Condense to Conduct and Conduct to Condense

TL;DR

This paper introduces the first explicit examples of low-conductance permutations and characterizes them as permutations with properties similar to Multi-Source-Somewhere-Condensers, advancing understanding in this area.

Contribution

It provides explicit examples of low-conductance permutations and a general characterization linking them to Multi-Source-Somewhere-Condensers, a novel theoretical insight.

Findings

First explicit examples of low-conductance permutations

Low-conductance permutations are equivalent to permutations with properties of Multi-Source-Somewhere-Condensers

Provides a theoretical framework connecting conductance and information-theoretic properties

Abstract

In this paper, we present the first explicit examples of low-conductance permutations. The notion of conductance of permutations was introduced by Dodis et al. in "Indifferentiability of Confusion-Diffusion Networks", where the search for low-conductance permutations was first initiated and motivated. As part of our contribution, we not only provide these examples, but also offer a general characterization of the problem: we show that low-conductance permutations are equivalent to permutations possessing the information-theoretic properties of Multi-Source-Somewhere-Condensers, a specific variant of somewhere condensers.

Equations

$$\underset{\begin{array}{c}U=U_1\times \dots \times U_w\subset (\{0,1{\}}^n{)}^w\\ V=V_1\times \dots \times V_w\subset (\{0,1{\}}^n{)}^w\\ |U_1|=\dots =|V_w|=2^{\alpha n}\end{array}}{\max }|\left\{(x,y)\in (U,V):y=\pi (x)\right\}|=(2^{\alpha n}{)}^d.$$

$$X=X_1\times \dots \times X_w,$$

$$\underset{U,V}{\max }(|\pi (U)\cap V|)=q^{{\text{CondDeg}}_{\alpha }}.$$

$${\text{CondDeg}}_{\alpha }(\pi )\le w-\lfloor \frac{w}{3}\rfloor c,$$

$$H_{\infty }(X)=-\log (\underset{x\in X}{\max }(1/P[X=x])).$$

$$\pi (X_1,\dots ,X_w)=\sum _{i=1}^w{\gamma }_i{C}_i+\gamma R$$

$${\text{CondDeg}}_{\alpha }(\pi )\le 3-c\text{ (for some }c>0\text{),}$$

$$|{\sigma }_1(U)\cap V|=P_{u\leftarrow U}({\sigma }_1(u)\in V)\cdot (2^{\alpha n}{)}^3.$$

$$\gamma \le 2^{-\delta \alpha n}$$

$$P_{v\leftarrow C_3}(v\in \{0,1{\}}^n\times \{0,1{\}}^n\times \{x\})\le 2^{-(1+\delta )\alpha n}.$$

$$\begin{array}{rl}{P}_{u\leftarrow U}({\sigma }_1(u)\in V)& ={\gamma }_3{P}_{v\leftarrow C_3}(v\in V)+\gamma P_{v\leftarrow R}(v\in V)\le \\ & \le {\gamma }_3\sum _{i=1}^{2^{\alpha n}}{P}_{v\leftarrow C_3}(v\in \{0,1{\}}^n\times \{0,1{\}}^n\times x_i)+\gamma \stackrel{\text{eqref}eq2,\text{eqref}eq1}{\le }\\ & \le {\gamma }_3\cdot 2^{\alpha n}\cdot 2^{-(1+\delta )\alpha n}+2^{-\delta \alpha n}\le \\ & \le 2^{-\delta \alpha n}+2^{-\delta \alpha n}=2\cdot 2^{-\delta \alpha n}=\\ & =(2^{\alpha n}{)}^{-\delta +\frac{1}{\alpha n}}.\end{array}$$

$$\begin{array}{rl}|{\sigma }_1(U)\cap V|& \stackrel{\text{eqref}eq0}{=}{P}_{u\leftarrow U}({\sigma }_1(u)\in V)\cdot (2^{\alpha n}{)}^3\le \\ & \le (2^{\alpha n}{)}^{-\delta +\frac{1}{\alpha n}}\cdot (2^{\alpha n}{)}^3=(2^{\alpha n}{)}^{3-\delta +\frac{1}{\alpha n}}.\end{array}$$

$${\sigma }_3(a,b,c)=\{\begin{array}{ll}(a,b,c+ab)& \text{for }a\text{ even},\\ (a,b+ac,c)& \text{for }a\text{ odd},\end{array}$$

$$P_{u\leftarrow U}(\pi (u)\in V)\le 2^{-{ϵ}_1\alpha n}+{ϵ}_2.$$

$$\pi (U)=\sum _{i=1}^w{\gamma }_i{C}_i+\gamma R,$$

$$P_{v\leftarrow C_i}(v\in \{0,1{\}}^n\times \dots \times \underset{i\text{th-position}}{\{x\}}\times \dots \times \{0,1{\}}^n)\le 2^{-(1+{ϵ}_1)\alpha n}.$$

$$\begin{array}{rl}{P}_{v\leftarrow C_i}(v\in V)& \le \sum _{j=1}^{2^{\alpha n}}{P}_{v\leftarrow C_i}(v\in \{0,1{\}}^n\times \dots \times \underset{i\text{th-position}}{\{x_j\}}\times \dots \times \{0,1{\}}^n)\le \\ & \le 2^{\alpha n}\cdot 2^{-(1+{ϵ}_1)\alpha n}=2^{-{ϵ}_1\alpha n}.\end{array}$$

$$\begin{array}{rl}{P}_{u\leftarrow U}(\pi (u)\in V)& =\sum _{i=1}^w{\gamma }_i{P}_{v\leftarrow C_i}(v\in V)+\gamma P_{v\leftarrow R}(v\in V)\stackrel{\text{eqref}eq3}{\le }\\ & \le \sum _{i=1}^w{\gamma }_i{2}^{-{ϵ}_1\alpha n}+\gamma =\\ & =(1-\gamma )2^{-{ϵ}_1\alpha n}+\gamma \le \\ & \le 2^{-{ϵ}_1\alpha n}+{ϵ}_2,\end{array}$$

$$|C_i\cap \{0,1{\}}^n\times \dots \times \underset{i\text{th-position}}{\{y\}}\times \dots \times \{0,1{\}}^n|\le 2^{-(1+{ϵ}_1)\alpha n}\cdot |C_i|.$$

$$|\pi (U)\cap V|<2^{\alpha nw(1-{ϵ}_1-{ϵ}_2-{ϵ}_3-\frac{1}{\alpha n})}.$$

$$B=X\cap \{0,1{\}}^n\times \dots \times \underset{i\text{th-position}}{\{y\}}\times \dots \times \{0,1{\}}^n,$$

$$\begin{array}{rl}\tilde{R}& :=\tilde{R}\setminus B;\\ \widetilde{C_i}& :=\widetilde{C_i}\cup B.\end{array}$$

$$|C_i|>2^{\alpha n(w-{ϵ}_2)}.$$

$$|C_i\cap \{0,1{\}}^n\times \dots \times \underset{i\text{th-position}}{\{y\}}\times \dots \times \{0,1{\}}^n|<2^{\alpha n(w-1-{ϵ}_1-{ϵ}_2)},$$

$$\begin{array}{rl}|C_i\cap \{0,1{\}}^n\times \dots \times \underset{i\text{th-position}}{\{y\}}\times \dots \times \{0,1{\}}^n|& <2^{\alpha n(w-1-{ϵ}_1-{ϵ}_2)}=\\ & =2^{\alpha n(-1-{ϵ}_1)}\cdot 2^{\alpha n(w-{ϵ}_2)}<\\ & <2^{-(1+{ϵ}_1)\alpha n}\cdot |C_i|,\end{array}$$

$$|R|\le w{2}^{(w-{ϵ}_2)\alpha n}+2^{(1-{ϵ}_3)\alpha nw}.$$

$$\begin{array}{rl}|R_1|& \le w\cdot 2^{(w-{ϵ}_2)\alpha n},\\ |R_0|& \le 2^{(1-{ϵ}_3)\alpha nw}.\end{array}$$

$$|R_0\cap V|<2^{\alpha nw(1-{ϵ}_1-{ϵ}_2-{ϵ}_3-\frac{1}{\alpha n})}$$

$$|R_0|\le 2^{(1-{ϵ}_3)\alpha nw}.$$

$$\frac{2^{\alpha nw}}{2^{(w-1-{ϵ}_1-{ϵ}_2)\alpha n}}=2^{(1+{ϵ}_1+{ϵ}_2)\alpha n}$$

Full text

1 Introduction

1.1 Background

The starting point of this paper is the concept of permutation conductance, introduced by Yevgeniy Dodis, Martijn Stam, John Steinberger, and Tianren Liu in their seminal paper Indifferentiability of confusion-diffusion networks [dod].

Their work focuses on the theoretical analysis of the indifferentiability security of confusion-diffusion networks, investigating how many rounds of certain block cipher and hash function constructions suffice to ensure adequate security. A central primitive in their analysis is a particular permutation, for which the parameter they introduced, known as conductance, is expected to be small. The results of this paper (e.g. Theorem 1.3) have a direct impact on these applications, as outlined in Section 1.1.2. For a detailed discussion of the motivation and the direct connections between permutations with suitable conductance and the security of confusion-diffusion based ciphers, we refer to [dod]. In this work, however, the conductance of a permutation is primarily treated as a combinatorial concept, situated within the broader framework of the combinatorics of data structures.

From a formal perspective, each permutation of the type $\pi:\{0,1\}^{nw}\to\{0,1\}^{nw}$ has a certain degree of conductance, depending additionally on a parameter $\alpha\in(0,1)$. This degree (denoted $\textrm{CondDeg}_{\alpha}(\pi)$) is always a real number between $1$ and $w$ and serves as a measure of how random $\pi$ is (the more random the permutation, the closer $\textrm{CondDeg}_{\alpha}$ is to $1$; in particular, an identity permutation has $\textrm{CondDeg}_{\alpha}$ equal to $w$). It turns out that permutations with low $\textrm{CondDeg}_{\alpha}$ (“more random”) are useful in the applications described in [dod]. Fortunately, the authors of [dod] showed (Theorem 3, App. B, probabilistic method) that almost every random permutation has (for parameters $\alpha<\frac{1}{2}-\frac{1}{nw}$, which is sufficient for their applications) $\textrm{CondDeg}_{\alpha}$ very close to $1$ (more precisely: it is no larger than $1+\frac{\log(3nw)}{\alpha n}$). On the other hand, no explicit constructions have been shown demonstrating how such permutations could be constructed in practice.

In this paper we provide, for the first time, explicit examples of permutations with conductance degree less than $w$ (see Theorem 1.3). Our constructions are based on what we call Multi-Source-Somewhere-Condenser permutations (see Definition 1.7), a variant of classical somewhere condensers, such as those defined for example in Definition 1.11 of [raz].

Moreover, we establish a rather surprising converse result: every permutation with sufficiently low conductance degree must satisfy the Multi-Source-Somewhere-Condenser assumptions. In other words, this work provides an almost complete characterization of the problem, which is successful for nearly the entire range of parameters (see Section • ‣ 3 for details).

1.1.1 Relations to the State-of-the-Art and Previous Results

In the literature on information theory and its applications in computer science, numerous constructions have been developed to simulate or enhance randomness. These include extractors [raz2005extractors, vadhan2012pseudorandomness], condensers [ta-Shma2017condenser, doron2016nearly], expanders [goudarzi2020expander, mihail2017list], list-decodable and list-recoverable codes [mihail2017list, stinson2006cryptography, doron2016nearly], samplers [goldreich1993samplers], and pairwise independent hash functions [bellare1996foundations, shaltiel2011pseudorandomness]. Many of these primitives are closely related or, in a certain sense, formally equivalent (see [impagliazzo1999hardness, dod, shaltiel2011recent, impagliazzo1989recycle, dodis2009nonmalleable]), and they play a key role in managing randomness in computation. Within this framework, these constructions have numerous applications in cryptography, including universal hashing, key derivation functions, and randomness extractors for secure computation.

In this work, we show that the notion of a low-conductance permutation, as introduced in [dod], can be viewed as essentially equivalent to condensers, and thus as another member of this family. Therefore, while combinatorially interesting on its own, it turns out to be equivalent to well-studied primitives. This equivalence is valuable as it enables transferring insights and parameter bounds from classical constructions to low-conductance permutations. At the same time, determining explicit parameters and limitations remains challenging, as problems in this family are inherently difficult. Overall, this perspective establishes a conceptual bridge between the combinatorial properties of permutations and information-theoretic tools, highlighting potential avenues for designing new cryptographic primitives with provable security guarantees.

1.1.2 Concrete Implications for Cryptography

A natural question is whether our results have direct implications for block cipher design. The detailed analysis of the connections between low-conductance permutations and block cipher security is thoroughly discussed in [dod]. Here, we highlight the two main insights.

First, the bounds we obtain are non-trivial (see Theorem 1.3), though still far from the ideal case of random permutations (in the probabilistic sense), for which conductance is close to $1$. In contrast, the analysis in [dod] relies on access to such nearly optimal bounds. As a result, formal guarantees can only be established for relatively stringent conductance thresholds. Unfortunately, due to the equivalence with condensers, constructing explicit examples that achieve such bounds remains a major challenge.

Second, it turns out that simple linear permutations (as originally hypothesized in [dod]) are unfortunately insufficient for achieving low conductance. These functions inherently fall short of the required conductance levels because they lack the necessary condenser properties, emphasizing the need for more sophisticated constructions to approach the theoretical optimum.

Overall, while immediate implications for provably secure cipher design are limited, this work provides a rigorous combinatorial and information-theoretic foundation, clarifying the limits and potential strategies for constructing robust block ciphers.

1.1.3 Final Remarks

To conclude the introduction, we highlight how this problem exemplifies the non-obvious interconnections between several fields in theoretical computer science and mathematics. The problem originally arises in the theoretical analysis of symmetric ciphers – a relatively rare research area (see, e.g., [biba1, biba2, biba3, biba4]). From this context, a notable combinatorial problem was extracted [dod]. Its analysis draws heavily on techniques from information theory, particularly the theory of min-entropy extraction, and can thus also be seen as a contribution to that field (see, e.g., [avi, bibb2, bibb3, bibb4, bibb5, bibb6, raz, bibb8, bibb9]).

It is important to note that leveraging extractor-theoretic results to tackle combinatorial problems is not entirely new; similar phenomena have been observed in various contexts (see, e.g., [bibc1, bibc2, bibc3, bibc4, bibc5, bibc6]). Together, these observations illustrate why the problem under consideration is both compelling and surprisingly non-trivial, requiring insights from multiple domains.

1.2 Main Results

1.2.1 Main Notion

Before we present the main result of the paper, let us first quote (from [dod]) the formal definition of the notion of conductance of a permutation:

Definition 1.1**.**

Consider the permutation $\pi:\{0,1\}^{nw}\to\{0,1\}^{nw}$ and the parameter $\alpha\in(0,1)$. Then $\textrm{CondDeg}_{\alpha}(\pi)$ is equal to $d$ if:

[TABLE]

Since the above notion is exceptionally essential for this work, to increase its readability we add an additional, intuitive understanding of this notion below preceded by one more important definition:

Definition 1.2**.**

A set $X\subset(\{0,1\}^{n})^{w}$ will be called a discrete $q$-box of dimension $w$ if

[TABLE]

for some $X_{1},\ldots,X_{w}\subset\{0,1\}^{n}$ such that $|X_{1}|=\ldots=|X_{w}|=q$.

{remark*}

In the above definition, if the dimension is obvious from the context, we will sometimes just write that $X$ is a discrete $q$-box (omitting the phrase of dimension $w$).

Intuition for Definition 1.1:

In simple terms, $\textrm{CondDeg}_{\alpha}(\pi)$ determines how much a given permutation $\pi$ distorts all discrete $q$-boxes of dimension $w$ for $q=2^{\alpha n}$. More specifically, for each such $q$-box $U$ we look at its image $\pi(U)$ and search for another $q$-box $V$ such that the intersection $U\cap V$ is as large as possible. The maximum we can obtain in this way is given by $\textrm{CondDeg}_{\alpha}$ in the form of the following relation:

[TABLE]

In the “worst” (least random) case we will find such $U$ that $\pi(U)$ is just another $q$-box $V$ and then $|\pi(U)\cap V|=q^{w}$, which gives $\textrm{CondDeg}_{\alpha}=w$.

On the other hand, “more random” permutations should intuitively behave in such a way that regardless of the choice of $U$ and $V$, the cardinality of the set $\pi(U)\cap V$ will always be much smaller than $q^{w}$. At the same time, it can be observed that it is always possible to choose $V$ such that $|\pi(U)\cap V|$ is at least $q$. In particular, this means that we definitely have $\textrm{CondDeg}_{\alpha}(\pi)\geq 1$.

Finally, combining these intuitions and observations, we see that $\textrm{CondDeg}_{\alpha}(\pi)$ is a specific way of estimating the randomness of the permutation $\pi$, which is always a number in the range between $1$ and $w$. The more random (in the given sense) the permutation is, the smaller this factor is.

Notation

For clarity, let us add a technical note that the original work of [dod] uses a slightly different notation. Specifically, instead of the parameter $\alpha$, the parameter $q$ is used, which is simply equal to $2^{\alpha n}$ in the language of our work. Consequently, instead of $\textrm{CondDeg}_{\alpha}$, [dod] refers to $\textrm{Cond}_{q}$, with the relation $\textrm{Cond}_{q}(\pi)=q^{\textrm{CondDeg}_{\alpha}(\pi)}$. Then $\textrm{Cond}_{q}(\pi)$ is a number between $q$ and $q^{w}$, not between $1$ and $w$, as is the case for $\textrm{CondDeg}_{\alpha}(\pi)$.

The above changes are dictated by a different center of gravity of our focus. The work of [dod] concerns more specific applications, so the parameter $q$ (referring to the number of queries present in security analyses) is natural there. Our work clearly takes a turn towards information theory and for us the primary notion is rather the min-entropy of the source, to which $\alpha$ refers.

Results in the Original Notation

For consistency with the notation from the paper [dod], in Appendix A we present the main results of our paper reformulated in the language of the paper [dod]. Similarly, the result from [dod] quoted above (Theorem 3, App. B) is originally expressed in a different language. Appendix A also contains a proof of the equivalence of both versions.

1.2.2 Main Result

In this paper we present the first example of a permutation with nontrivial conductance degree:

Theorem 1.3**.**

If $n>n_{0}$ is prime and $\alpha\leq 0.8$, then there exists an efficiently computable permutation $\pi:\{0,1\}^{wn}\to\{0,1\}^{wn}$ such that

[TABLE]

where $n_{0}=\Theta\left(\frac{1}{\alpha^{2}}\right),c=\Theta(\alpha).$

The reasoning that leads to the construction of this permutation (the final proof is in Section 2.4) requires the introduction of several lemmas (all proofs are in Section 2) and definitions, which we present below:

Definition 1.4**.**

The min-entropy of a source $X$ is defined as

[TABLE]

Definition 1.5**.**

A distribution $D$ over domain $X$ is a flat distribution if it is uniformly random over a set $S\subset X$. In other words: if it is uniform on its support.

We have the following well known fact on these notions:

Lemma 1.6**.**

A source $X$ with min-entropy at least $k$ is always a convex combination of flat distributions supported on sets of size $2^{k}$.

Definition 1.7**.**

Let $w,n$ be positive integers, and let $\pi:\{0,1\}^{wn}\to\{0,1\}^{wn}$ be a permutation.

We say that $\pi$ is an $(\alpha,\epsilon_{1},\epsilon_{2})$-Multi-Source-Somewhere-Condenser if for any independent random variables $X_{1},\dots,X_{w}\in\{0,1\}^{n}$ with min-entropy at least $\alpha n$, the distribution of $\pi(X_{1},\dots,X_{w})$ can be written as

[TABLE]

such that for each $1\leq i\leq w$, the marginal $[C_{i}]_{i}$ has min-entropy at least $(1+\epsilon_{1})\alpha n$, where:

• •

$C_{1},\dots,C_{w},R$* are distributions over $\{0,1\}^{wn}$;*

• •

$\gamma_{1},\dots,\gamma_{w},\gamma\geq 0$* and $\sum_{i=1}^{w}\gamma_{i}+\gamma=1$;*

• •

$[C_{i}]_{i}$* denotes the marginal of $C_{i}$ on the $i$-th $n$-bit block, under the natural decomposition $\{0,1\}^{wn}=(\{0,1\}^{n})^{w}$;*

• •

$\gamma\leq\epsilon_{2}$.

Intuition: The permutation $\pi$ redistributes entropy from several independent weak sources so that, in almost all of the resulting mass (of total weight at least $1-\gamma$), there exists a block whose min-entropy is amplified by a factor of $(1+\epsilon_{1})$. In other words: in nearly all cases the output is “somewhere” more random. This definition is based on Definition 1.11 from [raz], adapted to the multi-source setting and restricted to permutations.

Armed with the above definitions, we are ready to formulate the following technical lemma, the proof of which can be found in Section 2.1:

Lemma 1.8**.**

If the permutation $\pi:\{0,1\}^{wn}\to\{0,1\}^{wn}$ is an $(\alpha,\epsilon_{1},\epsilon_{2})$-Multi-Source-Somewhere-Condenser, then $\textrm{CondDeg}_{\alpha}(\pi)$ is at most $\textstyle\log_{q}(q^{w-\epsilon_{1}}+\epsilon_{2}q^{w})$, for $q=2^{\alpha n}$.

The formula in the above lemma means that if $\epsilon_{2}$ is negligible, then we will achieve $\textrm{CondDeg}_{\alpha}\approx w-\epsilon_{1}$.

So, to effectively use Lemma 1.8, we need a Multi-Source-Somewhere-Condenser with suitably strong parameters, which fortunately exists and may be found for example in the paper [avi]. Specifically, it holds (in [avi] this result and its proof are described as Lemma 3.14):

Lemma 1.9**.**

Consider the permutation: $\pi:\{0,1\}^{3n}\to\{0,1\}^{3n}$ (i.e. $w=3$) defined by the formula $\pi(a,b,c)\to(a,b,c+ab)$, where $a,b,c\in\{0,1\}^{n}$ are treated as elements of the field $GF(2^{n})$. Then for $\alpha\leq 0.8$ and a prime number $n$, the permutation $\pi$ defined above is ($\alpha,\delta,2^{-\delta\alpha n}$)-Multi-Source-Somewhere-Condenser for $\delta=\Theta(\alpha)$.

{remark*}

Note: the original lemma from [avi] is even stronger than the formulation of Lemma 1.9 presented above. In fact, it is always the third coordinate (except for some set of measure $2^{-\delta\alpha n}$) that has the appropriate min-entropy, not some coordinate for different fragments of the permutation.

The corollary of Lemmas 1.8 and 1.9 is as follows:

Lemma 1.10**.**

If $\alpha\leq 0.8$, then there exists an efficiently computable permutation $\pi:\{0,1\}^{3n}\to\{0,1\}^{3n}$ such that

[TABLE]

as long as $n$ is prime and $n>n_{0}$ for some $n_{0}=\Theta\left(\frac{1}{\alpha^{2}}\right),c=\Theta(\alpha).$

The formal proof of the above lemma can be found in Section 2.3. The generalization of this lemma to higher dimensions (i.e. arbitrary $w$), which is simply the content of our main Theorem 1.3 – can be found in Section 2.4).

1.2.3 Converse Theorem

It turns out that the theorem also holds in the opposite direction, i.e. showing that every permutation with a suitable $\textrm{CondDeg}_{\alpha}$ is also a nontrivial Multi-Source-Somewhere-Condenser:

Theorem 1.11**.**

Let $\pi:\{0,1\}^{wn}\to\{0,1\}^{wn}$ be a permutation such that its conductance degree $\textrm{CondDeg}_{\alpha}(\pi)$ is less than $w(1-\epsilon_{1}-\epsilon_{2}-\epsilon_{3}-\frac{1}{\alpha n})$, for some $\epsilon_{1},\epsilon_{2},\epsilon_{3}>0$ and $0<\alpha<1$. Then $\pi$ is a ($\alpha,\epsilon_{1},r$)-Multi-Source-Somewhere-Condenser, for $r=w2^{-\alpha n\epsilon_{2}}+2^{-\alpha nw\epsilon_{3}}$.

The proof is given in Section 2.2. It is also the most technically demanding part of the paper.

1.3 Intuition and Toy Examples

Consider the function $\sigma_{1}(a,b,c)=(a,b,c+ab)$, where $a,b,c\in GF(2^{n})$ and $n$ is a prime number. This is of course a permutation, since for any value of $(x,y,z)$, its unique preimage is $(x,y,z-xy)$. We want to justify why $\sigma_{1}:\{0,1\}^{3n}\to\{0,1\}^{3n}$ has conductance degree $\textrm{CondDeg}_{\alpha}(\sigma_{1})$ strictly less than $3$ (for some fixed parameter $\alpha$).

For this purpose, we consider two arbitrary $(2^{\alpha n})$-boxes $U=U_{1}\times U_{2}\times U_{3}$ and $V=V_{1}\times V_{2}\times V_{3}$ (i.e. $|U_{1}|=|U_{2}|=|U_{3}|=|V_{1}|=|V_{2}|=|V_{3}|=2^{\alpha n}$). Now we want (according to the Definition 1.1) to estimate an upper bound on $|\sigma_{1}(U)\cap V|$.

This is a purely combinatorial problem, but we will look at it from the probabilistic perspective. Specifically: we will assume a uniform distribution on $U$ and then we will show some upper bound on $P_{u\leftarrow U}(\sigma_{1}(u)\in V)$. This will allow us to achieve the main result, since of course we have:

[TABLE]

To achieve our goal, we will use the fact that $\sigma_{1}$ is a Multi-Source-Somewhere-Condenser (thus Lemma 1.9), and even a stronger fact (which is formulated in this way in [avi]), i.e. that it is always the third (not some) coordinate of $\sigma_{1}(a,b,c)$ that is the condenser, except for some negligible part of the domain. More specifically, thanks to this version of Lemma 1.9 we know that – since we are considering a uniform distribution on $U$ – and thus we have that $U_{1},U_{2}$ and $U_{3}$ are independent and have min-entropy $\alpha n$, there exists such $\delta=\Theta(\alpha)$ that $\sigma_{1}(U)$ can be written as a convex combination of two distributions $C_{3}$ and $R$ (that is, $\sigma_{1}(U)=\gamma_{3}C_{3}+\gamma R$ for some $\gamma_{3},\gamma\geq 0,\gamma_{3}+\gamma=1$) with the following properties:

[TABLE]

and $[C_{3}]_{3}$ (i.e. the third coordinate of $C_{3}$) has min-entropy at least $(1+\delta)\alpha n$. This last fact can also be formally written as follows: for any $x\in\{0,1\}^{n}$, it holds

[TABLE]

Let us additionally denote $V_{3}=\{x_{1},\ldots,x_{2^{\alpha n}}\}$ and we can finally complete the main estimation:

[TABLE]

Hence:

[TABLE]

This of course means that $\textrm{CondDeg}_{\alpha}\leq 3-\delta+\frac{1}{\alpha n}$, which is strictly smaller than $3$ for sufficiently large $n$, so $\sigma_{1}$ really has nontrivial conductance.

A completely analogous reasoning can be carried out for the permutation $\sigma_{2}(a,b,c)=(a,b+ac,c)$, establishing that $\sigma_{2}$ is also a permutation with nontrivial conductance.

Going even further, let us now consider the following permutation:

[TABLE]

which, as we can see, is a kind of mix of the permutations $\sigma_{1}$ and $\sigma_{2}$, so it is certainly – as can be checked from the definition – a Multi-Source-Somewhere-Condenser. Reasoning that is only slightly more complicated than the one given above (and thus similar to the proof of Lemma 1.8) allows us to prove that $\sigma_{3}$ is also a permutation with nontrivial conductance.

Interestingly and importantly, we show that no fundamentally different constructions can yield nontrivial conductance. To be more concrete: every such permutation is essentially just a somewhere condenser. That is, it must be obtained as a “mix” of coordinate-wise condensers, in the same sense as in $\sigma_{3}$. This is made precise in Theorem 1.11.

2 Technical Part: Formal Proofs

2.1 Proof of Lemma 1.8

(This proof is essentially a direct generalization of the reasoning presented in Section 1.3.)

To prove the statement, we need to consider two arbitrary $(2^{\alpha n})$-boxes $U=U_{1}\times\ldots\times U_{w},V=V_{1}\times\ldots\times V_{w}$ (i.e. $|U_{1}|=\ldots=|U_{w}|=|V_{1}|=\ldots=|V_{w}|=2^{\alpha n}$) and show that $|\pi(U)\cap V|\leq(2^{\alpha n})^{w-\epsilon_{1}}+\epsilon_{2}(2^{\alpha n})^{w}$. Equivalently, we will consider the uniform distribution on $U$ and prove that

[TABLE]

Since $U_{1},\ldots,U_{w}$ are independent and have min-entropy $\alpha n$, we can use the fact that $\pi$ is a $(\alpha,\epsilon_{1},\epsilon_{2})$-Multi-Source-Somewhere-Condenser. We then get that

[TABLE]

where $\gamma\leq\epsilon_{2}$ and $[C_{i}]_{i}$ (the $i$-th coordinate of $C_{i}$) has min-entropy of at least $(1+\epsilon_{1})\alpha n$.

This last fact can be more conveniently rewritten as follows: for any $x\in\{0,1\}^{n}$, it holds

[TABLE]

If we additionally denote $V_{i}=\{x_{1},\ldots,x_{2^{\alpha n}}\}$, then from the above we also have:

[TABLE]

Given the above, we can proceed to the main estimation:

[TABLE]

which completes the proof.

2.2 Proof of Theorem 1.11

We are to show that $\pi$ is a $(\alpha,\epsilon_{1},r)$-Multi-Source-Somewhere-Condenser. By definition, we should consider some independent random variables $U_{1},\ldots,U_{w}$ such that their min-entropy is at least $\alpha n$ and show that the distribution $\pi(U_{1},\ldots,U_{w})$ has the appropriate properties. However, without loss of generality (using Lemma 1.6), we can assume that the distribution of $U=U_{1}\times\ldots\times U_{w}$ is flat, that is, it is really just a uniformly distributed discrete $(2^{\alpha n})$-box $U$ (as defined in Definition 1.2). Then, after translating to the discrete interpretation, our original statement becomes:

Claim 1**.**

The set $\pi(U)$ can be partitioned into disjoint sets $\{C_{i}\}_{i=1}^{w}$ and $R$ such that:

• •

$|R|\leq r\cdot 2^{\alpha nw}$, where $r=w2^{-\alpha n\epsilon_{2}}+2^{-\alpha nw\epsilon_{3}}$;

• •

for each $C_{i}$ and for each $y\in\{0,1\}^{n}$ we have:

[TABLE]

Notational note: in the above statement $R$ and $C_{i}$ simply denote subsets of $\{0,1\}^{wn}$, while in the original Definition 1.7 the same letters would denote uniform distributions on these sets.

Besides, let us remind that we know that the set $\pi(U)$ has cardinality $2^{\alpha nw}$ and (thanks to the assumption that $\pi$ has the appropriate degree of conductance) that for any other $(2^{\alpha n})$-box $V$ the following always holds:

[TABLE]

Before we proceed to the direct proof of Claim 1 (that is, giving the appropriate way of partitioning $\pi(U)$), we need one more auxiliary definition:

Definition 2.1**.**

We say that the set $X$ has at point $y\in\{0,1\}^{n}$, an $i$-Bottleneck-Slice

[TABLE]

if it holds $0<|B|<2^{\alpha n(w-1-\epsilon_{1}-\epsilon_{2})}$.

Intuitively: $i$-Bottleneck-Slice at point $y$ means that the projection of $X$ onto the $i$-coordinate at point $y$ is nonempty, but suitably thin.

{remark*}

We will sometimes also say that $X$ contains a Bottleneck-Slice (without specifying the coordinate $i$). This of course means that $X$ contains an $i$-Bottleneck-Slice for some $i$.

Now the procedure for partitioning the set $\pi(U)$ is as follows.

Procedure for Partitioning $\pi(U)$:

1. Step 1:

First, we initialize the auxiliary variables: for each $i$, let $\tilde{C_{i}}$ be the empty set and let $\tilde{R}:=\pi(U)$. 2. Step 2:

If $\tilde{R}$ contains any (for any $i$ and at any point $y$) $i$-Bottleneck-Slice $B$, perform the assignments:

[TABLE] 3. Step 3:

Loop Step 2 until $\tilde{R}$ no longer contains any Bottleneck-Slice. 4. Step 4:

Assign $R_{0}:=\tilde{R}$ and $R_{1}:=\emptyset$. 5. Step 5:

For each $i$, if $|\tilde{C_{i}}|>2^{\alpha n(w-\epsilon_{2})}$, then assign $C_{i}:=\tilde{C_{i}}$, otherwise: assign $C_{i}:=\emptyset$ and $R_{1}:=R_{1}\cup\tilde{C_{i}}$. 6. Step 6:

Assign $R:=R_{0}\cup R_{1}$.

Intuitively: from the set $\pi(U)$ we cut off all Bottleneck-Slices one by one until we are left with $R_{0}$, which no longer contains sets of this type. Then all cut off $i$-Bottleneck-Slices concerning the $i$-th coordinate together form $C_{i}$, unless their measure is sufficiently small, in which case $C_{i}$ is empty and these Bottleneck-Slices go to $R_{1}$. The final $R$ is the union of $R_{0}$ and $R_{1}$.

It remains to analyze that the partitioning constructed in this way actually satisfies the requirements of Claim 1. So we have both necessary analyses in turn:

Analysis of $C_{i}$:

If $C_{i}$ is empty, then the statement trivially holds. Otherwise, it must be

[TABLE]

Additionally, for any $y$, it holds

[TABLE]

since every such set as above on the left is either empty or (as follows from the construction) equal to exactly one $i$-Bottleneck-Slice cut off from $\tilde{R}$.

Combining these facts, we can conclude that:

[TABLE]

what was needed to be shown.

Analysis of $R$:

We have to show $|R|\leq r\cdot 2^{\alpha nw}\text{, where }r=w2^{-\alpha n\epsilon_{2}}+2^{-\alpha nw\epsilon_{3}},$ that is,

[TABLE]

Additionally, we know that $R=R_{0}\cup R_{1}$. So it is enough to show two inequalities:

[TABLE]

The first one is a trivial consequence of the partitioning procedure: $R_{1}$ in the worst case could have had $w$ times added the set $\tilde{C_{i}}$ of cardinality at most $2^{\alpha n(w-\epsilon_{2})}$, which is exactly the postulated bound.

The last inequality follows directly from the fact that $R_{0}$ does not contain any Bottleneck-Slice, the bound $|R_{0}|\leq|\pi(U)|=2^{\alpha nw}$ and the property (5) (this property holds for $\pi(U)$, so obviously also for $R_{0}\subset\pi(U)$), which, however, requires a slightly deeper analysis, which (thus concluding the entire proof) we present below:

Claim 2**.**

If the set $R_{0}$ does not contain any Bottleneck-Slice, $|R_{0}|\leq 2^{\alpha nw}$ and

[TABLE]

for any discrete $2^{\alpha n}$-box $V$ of dimension $w$, then

[TABLE]

Reminder: the formal definition of a discrete box is given in Definition 1.2.

To prove the above statement, let us assume for the sake of contradiction that $|R_{0}|>2^{(1-\epsilon_{3})\alpha nw}$. Then:

First, let us note that $R_{0}$ is contained in a discrete $(2^{(1+\epsilon_{1}+\epsilon_{2})\alpha n})$-box $V_{big}$. This is actually the case because $|R_{0}|\leq 2^{\alpha nw}$ and $R_{0}$ does not contain any Bottleneck-Slice, so at each coordinate it takes at most:

[TABLE]

different values.

This means that $V_{big}$ is a sum of at most

[TABLE]

discrete $(2^{\alpha n}$)-boxes.

Since $|R_{0}|>2^{(1-\epsilon_{3})\alpha nw}$, at least one of these boxes contains

[TABLE]

points, which, however, contradicts the (6) property, and thus completes the proof.

2.3 Proof of Lemma 1.10

We simply apply Lemma 1.8 to the permutation from Lemma 1.9:

That is, first from Lemma 1.9 we have that there exists a permutation $\pi:\{0,1\}^{3n}\to\{0,1\}^{3n}$ (explicitly $\pi(a,b,c)=(a,b,c+ab)$ over $GF(2^{n})$), which is a ($\epsilon,\delta,2^{-\delta\alpha n}$)-Multi-Source-Somewhere-Condenser for some $\delta=\Theta(\alpha)$. Now, additionally denoting $q=2^{\alpha n}$, from Lemma 1.8 we have that this permutation has $\textrm{CondDeg}_{\alpha}(\pi)$ such that:

[TABLE]

for $c=\delta-\frac{1}{\log q}=\delta-\frac{1}{\alpha n}$.

Finally, to achieve the postulated result $c=\Theta(\alpha)=\Theta(\delta)$, it is enough to choose the parameters so that:

[TABLE]

The left inequality follows trivially from the formula on $c$ obtained above. To obtain the right one, we want $\frac{1}{\alpha n}\leq\delta/2$, which means $n\geq\frac{2}{\delta\alpha}=O\left(\frac{1}{\alpha^{2}}\right)$, and is true by assumption so completes the proof.

2.4 Final Proof of Theorem 1.3

The final proof is a direct consequence of Lemma 1.10, since our final construction for dimension $w$ will be just a simple serial repetition of many copies of the dimension $3$ permutation $\pi$ from the aforementioned lemma.

To formalize this construction, let us first denote the permutation $\pi:\{0,1\}^{3n}\to\{0,1\}^{3n}$ (coming from Lemma 1.10) on successive coordinates as follows:

[TABLE]

(explicitly $\pi(a,b,c)=(a,b,c+ab)$ over $GF(2^{n})$, as defined in the proof of Lemma 1.10)

Now let $w\geq 3$ and the permutation $\pi^{(w)}:\{0,1\}^{wn}\times\{0,1\}^{wn}$ be defined as follows (for now, assume that $w$ is a multiple of $3$):

[TABLE]

If $w$ leaves a remainder $1$ when divided by $3$, we define:

[TABLE]

and similarly, when $w$ divided by $3$ leaves a remainder $2$:

[TABLE]

[TABLE]

From the very construction it is obvious that $\pi^{(w)}$ is a permutation, so it remains to estimate $\textrm{CondDeg}_{\alpha}(\pi^{(w)})$ of the presented construction. For this purpose, we consider two arbitrary $(2^{\alpha n})$-boxes: $U=U_{1}\times\ldots\times U_{w}$ and $V=V_{1}\times\ldots\times V_{w}$ (i.e. $|U_{1}|=\ldots|U_{w}|=|V_{1}|=\ldots|V_{w}|=2^{\alpha n}$) and we estimate $|\pi^{(w)}(U)\cap V|=(2^{\alpha n})^{\textrm{CondDeg}_{\alpha}(\pi^{(w)})}$.

As in Sections 1.3 and 2.1, it will be more convenient to assume a uniform distribution on $U$ and use the probabilistic interpretation:

[TABLE]

Before we move on to the main estimation, let us just recall that for any $X,Y,Z,A,B,C\subset\{0,1\}^{n}$ such that $|X|=|Y|=|Z|=|A|=|B|=|C|=2^{\alpha n}$ we have (from Lemma 1.10 and again the probabilistic interpretation of the inequality $\textrm{CondDeg}_{\alpha}(\pi)\leq 3-c$):

[TABLE]

Armed with this fact, we can finally move on to the main estimation:

[TABLE]

where $(\star)$ follows immediately from the structure of the construction of $\pi^{(w)}$ (primarily from the fact that successive triples in the construction are fully independent of each other).

Finally, from (8) we have that $\textrm{CondDeg}_{\alpha}(\pi^{(w)})\leq w-\left\lfloor\frac{w}{3}\right\rfloor c$, which completes the proof.

3 Open Problems and Future Work

This section lists issues that remain open and may be worth further investigation.

• •

Wider Range of Parameters

The main result (Theorem 1.3) largely relies on Lemma 3.14 of [avi] (i.e. Lemma 1.9 in this paper), which contains certain restrictions that we suspect can be avoided. First of all, we ask whether the same result can be obtained for $n$ that are not prime numbers, and also whether the parameters $n_{0}$ and $c$ must really depend on $\alpha$ (the work of [avi] even gives hope for removing these dependencies – one would like to simply use Lemma 3.1 from that paper, but unfortunately in our solution it turned out that we were able only to use Lemma 3.14, which is a version of Lemma 3.1 with weaker assumptions and a weaker thesis.).

Additionally, there remains an open question about low-conductance permutations for $w=2$.

• •

The Converse Theorem for Weak Conductance

The Converse Theorem (Theorem 1.11) applies to almost all cases, except when $w\left(1-\frac{1}{n}\right)<\textrm{CondDeg}_{\alpha}<w$. It remains to be investigated.

• •

Always-Condenser vs. Somewhere-Condenser

Recall that our solution for the dimension $3$ is given by: $\pi(a,b,c)=(a,b,c+ab).$ While we can easily believe that the third coordinate of $\pi$ really behaves very randomly, since it is a condenser, it seems intuitive that the following construction should have even lower conductance than $\pi$ (i.e. both the second and third coordinates are condensers): $\pi^{\prime}(a,b,c)=(a,ba+c,ca-b).$ However, we cannot formally prove that $\pi^{\prime}$ is indeed better.

(For clarity: we can show that when $n$ is a prime such that $n\equiv 3\mod 4$, then $\pi^{\prime}$ is indeed a permutation; in a more complicated way, we can improve this example by constructing a permutation where all three coordinates will simultaneously have the form of a condenser.)

The above question can naturally be generalized to higher dimensions. In other words: we hypothesize that if all coordinates (and not, for example, every third one like in our construction) of a permutation are condensers, then such a permutation has an even better conductance degree than the construction that derives from Lemma 1.8.

• •

Other Directions

In this work, we have established the equivalence between low-conductance permutations and condensers, but a more quantitative analysis of the tightness of this equivalence would be valuable.

Another direction is to construct permutations for larger width $w$ without relying on product-type constructions derived from smaller-width permutations. Strategies that replicate a width-$k$ permutation $w/k$ times are unlikely to achieve optimal conductance, which suggests that new, more global constructions may be required.