Limits on Indifferentiable Single-Call Blockcipher-based Compression Functions

Recent requirements in applied cryptography have renewed interest in random-function-like constructions based on blockciphers. This paper studies the limitations of single-call constructions under statistical indifferentiability. We identify four conditions under which such constructions are not indifferentiable and prove corresponding positive results when the conditions are negated. As a consequence, no PGV-like compression function using a single ideal-cipher call is statistically indifferentiable. We also improve a previous attack on truncated random permutations and analyze fixed-input constructions in reset and quantum indifferentiability settings.