Pseudorandomness Properties of Random Reversible Circuits

TL;DR

This work analyzes how simple, locally connected reversible circuits on $n$ wires can approximate random permutations with strong pseudorandom properties. By proving sharp spectral-gap bounds for both one-dimensional and two-dimensional brickwork architectures, the authors show that random reversible circuits of depth about $\tilde{O}(n^{1/2}k^3)$ (in 2D) or $\tilde{O}(nk^2)$ (in 1D) yield ${k}$-wise independence with error exponentially small in $\sqrt{n}$ or $n$, respectively. The core technique blends Markov-chain mixing, Fourier analysis, and a Nachtergaele-inspired reduction to analyze local gate dynamics and a row-column (2D) construction, culminating in a powerful 2D-to-1D reduction that generalizes to higher dimensions. These results improve prior bounds for random reversible circuits with structured, local gates and point toward practical, efficiently invertible pseudorandom permutations suitable for cryptographic designs and hardware implementations. The study thereby connects depth-efficient pseudorandomness to concrete block-cipher-like constructions and highlights the tradeoffs between dimension, locality, and permutation security.

Abstract

Motivated by practical concerns in cryptography, we study pseudorandomness properties of permutations on $\{0,1\}^n$ computed by random circuits made from reversible $3$-bit gates (permutations on $\{0,1\}^3$). Our main result is that a random circuit of depth $\sqrt{n} \cdot \tilde{O}(k^3)$, with each layer consisting of $Θ(n)$ random gates in a fixed two-dimensional nearest-neighbor architecture, yields approximate $k$-wise independent permutations. Our result can be seen as a particularly simple/practical block cipher construction that gives provable statistical security against attackers with access to $k$~input-output pairs within few rounds. The main technical component of our proof consists of two parts: 1. We show that the Markov chain on $k$-tuples of $n$-bit strings induced by a single random $3$-bit one-dimensional nearest-neighbor gate has spectral gap at least $1/n \cdot \tilde{O}(k)$. Then we infer that a random circuit with layers of random gates in a fixed one-dimensional gate architecture yields approximate $k$-wise independent permutations of $\{0,1\}^n$ in depth $n\cdot \tilde{O}(k^2)$ 2. We show that if the $n$ wires are layed out on a two-dimensional lattice of bits, then repeatedly alternating applications of approximate $k$-wise independent permutations of $\{0,1\}^{\sqrt n}$ to the rows and columns of the lattice yields an approximate $k$-wise independent permutation of $\{0,1\}^n$ in small depth. Our work improves on the original work of Gowers, who showed a gap of $1/\mathrm{poly}(n,k)$ for one random gate (with non-neighboring inputs); and, on subsequent work improving the gap to $Ω(1/n^2k)$ in the same setting.

Figures (3)

• Figure 1: Our two-dimensional brickwork circuit architecture. Each green bar represents a single random 3-bit gate. \ref{['thm:2D main']} states that with the stated number of layers of random gates, the permutation becomes $2^{-\sqrt{n}k}$-approximate $k$-wise independent.
• Figure 2: The first circuit is an example of a circuit with generic 3-bit gates. The second is an example of a circuit with 1D nearest-neighbor 3-bit gates. The third is an example of a 1D brickwork circuit with five layers.
• Figure 3: Step 1 applies parallel circuits from $\mathcal{B}$ to the rows, while Step 2 applies to the columns. Our circuit alternates between layers of the two.

Theorems & Definitions (149)

• Definition 1
• Theorem 2
• Theorem 3
• Theorem 4
• Theorem 5
• Theorem 6
• Theorem 7
• Theorem 8
• Theorem 9
• Theorem 10