ALGORITHMS FOR SOLVING LINEAR AND POLYNOMIAL ...

theorem that random functions and random permutations cannot be distinguished inpolynomial time [GGM86]. This is a perfect simulation in either case, and thereforeAlgorithm A will be correct with probability δ and therefore Algorithm B will becorrect with probability δ. Thus h and a random permutation are computationalydistinguishable.We have now proven that h ′being computationaly distinguishable from arandom function implies that h is computationaly distinguishable from a randompermutation. The inverse proceeds along very similar lines. []Lemma 3 If h : GF(2) n→ GF(2) n is a random permutation, then the limit asn → ∞ of the probability that h has p fixed points is 1/(p!e)Proof: If h ′ (x) = h(x) ⊕ x, and if h(y) = y then h ′ (y) = 0. Thus the set offixed points of h is merely the preimage of 0 under h ′ . By Lemma 2, h ′ behaves asa random function. Thus the value of h ′ (y) for any particular y is an independentlyand identically distributed uniform random variable. The “Bernoulli trials” modeltherefore applies. If |h ′−1 (0)| is the size of the preimage of 0 under h ′ thenlim Pr { |h ′−1 (0)| = p }n→∞( ) 2n (2=) −n p ( ) 1 − 2−n 2 n −pp( ) 2n (2=) −n p ( ) 1 − 2−n 2 n ( 1 − 2 −n) −pp≈ (2n )(2 n − 1)(2 n − 2)(2 n − 3) · · · (2 n − p + 1)(2 −n ) p (e −1 )(1)p!≈(1)(1 − 1 · 2−n )(1 − 2 · 2 −n )(1 − 3 · 2 −n ) · · · (1 − (p − 1) · 2 −n )e −1p!≈1/p!e28