Revisiting structure graphs: Applications to CBC-MAC and EMAC

Brief history on CBC and EMAC.

The notion of authentication in cryptographic protocols was first introduced by Diffie and Hellman in their seminal paper [8] of 1976. In symmetric key settings, this need is fulfilled by message authentication codes, better known as MACs. CBC-MAC is a block cipher based MAC construction which is based on the CBC mode of operation invented by Ehrsam et al. [12]. The CBC-MAC was an international standard [16] which was proven to be secure for fixed length messages [1, 3] or prefix-free message spaces [30, 15]. The fixed length constraint is not desired in practice. One way to circumvent this is to use the length of message as the first block in CBC computation. This requires prior knowledge of the message length. A more reasonable and popular approach is to encrypt the CBC output with an independent keyed permutation. This later approach is called the EMAC which has been proved to be secure without any restrictions on the message [30]. We refer readers to Section 2 for a brief overview of literature related to CBC-MAC.

CBC and EMAC functions.

Throughout the paper, we fix a positive integer n and let ℬ:={0,1}n. Elements of these sets are called blocks. Let Perm:=Perm⁢(n) be the set of all permutations over ℬ. The CBC (cipher block chaining) function with key π∈Perm, denoted by CBCπ, takes as input a message M=(M⁢[1],…,M⁢[m])∈ℬm and outputs a block outπ⁢(M)⁢[m] which is inductively computed as outπ⁢(M)⁢[0]=0n and

For 0<i<m, inπ⁢(M)⁢[i]:=outπ⁢(M)⁢[i-1]⊕Mi and outπ⁢(M)⁢[i] are said to be the intermediate input and output, respectively. Figure 3 in Section 3.6 provides an illustration of CBC computation and intermediate values.

Security definitions.

In this paper, we consider two types of attacks for an adversary which makes queries of at most ℓ blocks: 𝖺𝗍𝗄=𝗉𝖿 and 𝖺𝗍𝗄=𝖺𝗇𝗒 mean no query is a prefix of another and the queries are arbitrary distinct strings, respectively. Let 𝐀𝐝𝐯F𝖺𝗍𝗄⁢(q,ℓ,σ) denote the maximum advantage attainable by any adversary making q queries and the total number of blocks in all q queries is at most σ, mounting an 𝖺𝗍𝗄 attack, in distinguishing whether its oracle is F or a random function that outputs n bits.^[1] To analyze the security of CBC and EMAC for the random permutation Π, the collision probability and full collision probability,

were introduced for distinct messages M1 and M2 with lengths m1 and m2, respectively. Moreover, let 𝐂𝐏2,ℓ𝖺𝗍𝗄 and 𝐅𝐂𝐏2,ℓ𝖺𝗍𝗄 denote the maximum collision and full collision probabilities, respectively, where the maximum is taken over all distinct messages M,M′ having at most ℓ blocks and satisfies 𝖺𝗍𝗄. In [2], the following results were shown:

As EMAC encrypts output of CBC-MAC under an independent key, as long as there is no collision in the output of CBC-MAC, the final output behaves randomly. This is essentially the same as the Carter–Wegman construction [33]. The CBC-MAC function can be similarly viewed as a (dependent) nested construction in which the final encryption is computed under the same key as the internal computation. This is why we need an extended definition of collision which is appropriately captured by the full collision event. Thus, bounding PRF advantages are reduced to bounding (full) collision probabilities. These are again reduced to bounding the number of structure graphs as described in the following paragraph.

Structure graph.

A block-vertex structure (BS) graph𝐆 with vertex set V⊆{0,1}n associated to a message M and a permutation π is the directed edge-labeled graph induced by the edge set E consisting of all edges

The label for ei is ℒ⁢(ei)=M⁢[i]. Note that a BS graph can be simply viewed as an M-walk. Informally, an M-walk is nothing but the walk generated by the message M starting at 0n. In this paper we often use this equivalent representation of BS graphs. A structure graph𝐆* over a vertex set V*⊆ℐ (an index set) is an isomorphic graph of the BS graph G mapping 0n to 0. The labeled walk of G is preserved in G* (in isomorphism sense) due to the isomorphism between G and G*. So we can have a similar representation of a structure graph in terms of walks. We refer readers to Definition 1 for a more formal definition of a structure graph. The (block-vertex) structure graph is also similarly defined for a tuple (or sometimes pair) of messages ℳ=(M1,…,Mq).

Given a structure graph G*=(V*,E*), suppose we reconstruct the graph by defining edges one by one along the M-walk. Now there are three possibilities at any point of time: (1) we add a new edge heading to a new vertex (not obtained so far), (2) we get an old edge which is already defined, and (3) we add a new edge heading to an already existing vertex. True collisions correspond to the last case. The number of such true collision can be equivalently defined as the following sum:

Let us assign a variable Yv, meant for the intermediate output, for each node v∈V*. Let δ:=(u,v;z) be a triple such that u→z, v→z and u≠v. We call such triple input-collision (also called collision). Given any such input-collision the following linear equation, denoted by Lδ, must hold whenever Y-variables are actually assigned as intermediate outputs:

When 0 has no in-degree, the accident of a structure graph G*, denoted by 𝐀𝐜𝐜⁢(G), is the rank of all linear equations Lδ over all collisions of the graph. When 0 has positive in-degree, we add one to the rank to define the accident. In Section 5, we provide a more detailed study on the structure graph.

A flaw in [2, Lemma 10].

Lemma 10 of [2] states that for any structure graph G* realized by a pair of messages 𝐀𝐜𝐜⁢(G*)=1 implies 𝐓𝐂⁢(G*)=1. This result has been used to bound 𝐅𝐂𝐏n (in [2]) as well as 𝐂𝐏n (in [2, 31]). Unfortunately, the claim is incorrect as illustrated in Figure 1 where we have two structure graphs with true collision 2 and accident 1. Surprisingly, this flaw remained unobserved till now, although it has been applied for other results.

Figure 1

Counter-example for [2, Lemma 10]. The walks corresponding to the two messages start at v1, and end at v3. Here M2⁢[1]:=M1⁢[1]⊕M1⁢[2]⊕M1⁢[3] and * can be any number of blocks. In particular, when * has no block, the figures in (a) and (b) are identical. In (a) we have two input-collisions δ1:=(v1,v2;v2′) and δ2:=(v1,v2;v3). The two linear equations Lδ1 and Lδ2 corresponding to the two input-collisions are the same as Yv1⊕Yv2=M1⁢[1]⊕M1⁢[2] and so the rank of all collisions (which is also the accident) is one. However, true collision is two (at v2′ and v3), which contradicts [2, Lemma 10]. A similar argument can be given for (b).

1.1 Our contributions

The flaw in [2, Lemma 10] is an important observation that affects several results [2, 14, 35, 31] based on it. Naturally, the next course of action should be to study the impact of this flaw to those results in addition to [2], where it has been applied. This work serves this purpose. To our best knowledge, it has been applied in [31] and probably in [9, Lemma 3] (no proof of this claim is publicly available though). The bound on 𝐅𝐂𝐏2,ℓ𝗉𝖿 (see [2]) is also used in the PRF analysis of truncated CBC [14]. Any revision in the 𝐅𝐂𝐏2,ℓ𝗉𝖿 bound [2] will also necessitate revision of bound in [14].

Analysis of CBC-MAC.

First concrete results on CBC-MAC were given by Bellare, Kilian and Rogaway [1]. They showed a bound of 2⁢ℓ2⁢q2/2n for fixed length queries, which was further improved to ℓ2⁢q2/2n by Maurer [22]. Later Bernstein [3] simplified the proof for fixed-length CBC-MAC. Petrank and Rackoff [30] extended the proof in [1] to prefix-free queries, and a similar extension on Bernstein’s proof was done by Rackoff and Gorbunov [15]. Both bounds are about ℓ2⁢q2/2n. The most recent bound on CBC-MAC is by Bellare, Pietrzak and Rogaway [2] who improved (in terms of ℓ) the bound to 12⁢ℓ⁢q2/2n+64⁢ℓ4⁢q2/22⁢n. Another way of improving the bound is to show the PRF bound of the form q⁢σ/2n (see [26]).

Analysis of EMAC.

In [1], Bellare, Kilian and Rogaway also suggested some variants of CBC-MAC to handle variable length messages. In particular, they mentioned a construction where the output of CBC-MAC is further encrypted by an independent key. This construction known as EMAC was first developed during the RACE project [4]. Petrank and Rackoff [30] proved that DMAC (same as EMAC) is secure up to 2.5⁢ℓ2⁢q2/2n. Bellare, Pietrzak and Rogaway [2] improved the bound to q2⋅d′⁢(ℓ)/2n which was further improved by Pietrzak [31] to q2/2n for ℓ≤2n/8. However, the proof of the later result is invalid due to the flaw that we discussed earlier. A result on 𝐂𝐏2,ℓ𝖾𝗊 stated in [9] also gives a tight bound of O⁢(q2/2n) for equal length messages.

Analysis of variants of CBC-MAC and EMAC.

Although the EMAC construction is tolerant to variable length messages it has a domain limited to ℬ+. Black and Rogaway [6] introduced three refinements to EMAC, viz., ECBC, FCBC and XCBC to allow use of variable block length strings. They showed that ECBC and FCBC are secure up to 2.5⁢σ2/2n, and that the bound on XCBC is 3.75⁢σ2/2n. Jaulmes, Joux and Valette [19] gave a randomized version of EMAC which they called RMAC and proved that the construction resists birthday attacks. However the proof seems to be incorrect (as suggested in [2]). Other excellent variants of CBC-MAC are TMAC [21], OMAC [17] and GCBC [24]. A variant of OMAC, namely OMAC1 is equivalent to CMAC which became an NIST recommendation [11] in 2005. Another design approach is the PMAC construction proposed by Black and Rogaway [5] which is inherently parallel. In [23, 18, 27, 25], the improved bounds for XCBC, TMAC, PMAC and OMAC are shown in the form of O⁢(ℓ⁢q2/2n), O⁢(σ2/2n) and O⁢(σ⁢q/2n). Apart from these specific constructions Jutla [20] suggested a general class of DAG-based PRF constructions.

Beyond birthday bound (BBB) security.

Another direction of research is BBB security, where the aim is to achieve more than n/2-bits security in σ. Among the block cipher based BBB secure MACs, PMAC⁢_⁢Plus [36] and 3kf9 [37] are two efficient candidates. Both these candidates are three-key constructions. Recently, Dutta et al. [7] proposed a one-key candidate named 1kf9, which also offers beyond birthday security of 3kf9.

Structure graph analysis.

Structure graphs are the basic tool for analyzing sequential construction based on random permutation as evident from the work on CBC based MACs [2, 31, 14] and 1kf9 [7]. Although structure graphs have been mainly used in analysis of random permutation based constructions, they have also found application in random function based construction as evident from the analysis of NI MAC by Gaži, Pietrzak and Rybár [13] and the one key compression function based MAC by Dutta, Nandi and Paul [10]. From our observation these later works [13, 7, 10] are free from the flaw that we observed for [2, 31].

Basic notation.

Throughout the paper, we fix a positive integer n. Let Perm be the set of all permutations on ℬ:={0,1}n. Elements of ℬ are called blocks. For any two integers a≤b, we write [a..b] (or simply [b], when a=1) to denote the set {a,a+1,…,b}. Let ϕ be a property defined for the elements of S. We define the subset

The above set will appear in this paper many times for different choices of S and ϕ. Let

denote the k-permutations of m.

3.1 Notation on sequences

Let ℐ and S be two sets. A S-sequence x over the index set ℐ is denoted as (x⁢[α])α∈ℐ where x⁢[α]∈S for all α∈ℐ. The length of the sequence is |ℐ|, the size of the index set. In this paper we mostly consider block sequences, i.e. S=ℬ. When the index set is [a..b], we also write the sequence as a tuple or vector x[a..b]:=(x[a],…,x[b]). Sometimes, by abusing notation, x also represents the set {x⁢[α]:α∈ℐ}. Similarly x[a..b] represents {x[α]:α∈[a..b]}. We write #⁢x to denote the number of distinct elements in the sequence x. We write S+ and S≤ℓ:=⋃i≤ℓSi to represent the set of all S sequences of positive and finite length, and of length at most ℓ, respectively. Now we define an equivalence relation that captures the equalities among the elements of the sequence x.

Let ρ:𝒟→ℛ. Let x and y be, respectively, 𝒟- and ℛ-sequences over an index set ℐ. We write x↦𝜌y to mean that ρ⁢(x⁢[α])=y⁢[α] for all α∈ℐ and we simply say that ρ multi-maps x to y. This is a property of function ρ. When 𝒟=ℛ, the subset Perm[x↦𝜋y] represents the set of all permutations π multi-mapping x to y. We say that (x,y) is permutation compatible if there exists a permutation π such that x↦𝜋y. It is easy to see that (x,y) is permutation compatible if and only if ∼x⁣=⁣∼y.

3.2 Notation on strings

We call ℬ an alphabet and its elements will be referred to as letters. A string over the alphabet ℬ is an element of ℬ*. We can also say that a string is a finite concatenation S:=a1∥a2∥…∥aℓ where ai∈ℬ. Note that the elements of ℬ are also strings. We can also view strings as ℬ-sequences over an index set ℐ. The length of a string S, denoted by |S|, is defined as the total number of letters in it. Note that for an empty string the length will be 0 as it does not have any letters in it. For a string S=X∥Y, X (respectively Y) is said to be a prefix (respectively suffix) of S. We write X<1S if X is a prefix of S. We write X<2S if X[1..x-1]<1S but X⁢[x]≠S⁢[s], where x=|X| and s=|S|. For two strings S1 and S2 of lengths s1 and s2, respectively, a non-negative integer p:=𝖫𝖢𝖯⁢(S1;S2) (respectively s:=𝖫𝖢𝖲⁢(S1;S2)) is called the index of the largest common prefix (respectively largest common suffix), if S1[1..p]=S2[1..p] and S1⁢[p+1]≠S2⁢[p+1] (or S1[s..s1]=S2[s..s2] and S1⁢[s-1]≠S2⁢[s-1]).

3.3 Basic definitions and notation of graph

Convention.

By abusing notation, E also denotes the set of unlabeled edges and the label a of the edge e:=(u,v) is expressed as ℒG⁢(e) (this notation makes sense as there is a unique choice of the label for an edge) or simply ℒ⁢(e) whenever the graph is understood.

For an edge e:=(u,v), vertex u is called a predecessor of v, and v a successor of u. An edge (u,v) is called a loop if u=v. We define two sets:

1. The predecessor set of a vertex v is 𝗇𝖻𝖽(*→v):={u:(u,v)∈E}.

2. The successor set of v is 𝗇𝖻𝖽(v→*):={u:(v,u)∈E}.

The sizes of the predecessor and successor sets of v are called in-degree and out-degree, respectively. We implicitly assume that no vertex has both in-degree and out-degree 0. So the vertex set and hence the graph without the edge labels is uniquely determined by the edge set.

Definition 2

A walk of length s is defined as a vertex sequence w:=(w⁢[0],…,w⁢[s]) such that w⁢[i-1]→w⁢[i] for all i∈[s]. We define the label of the walk as ℒ⁢(w):=(a1,…,as) where ai=ℒ⁢(w⁢[i-1],w⁢[i]), i∈[s].

Since a walk is a V-sequence over the index set {0,1,…,s}, we define a subwalk w[a..b]:=(w[a],…,w[b]) where 0≤a≤b≤s.

When all vertices of a walk sequence are distinct, we call it a path. When all vertices w⁢[0],…,w⁢[s-1] are distinct and w⁢[s]=w⁢[0], then we call it a cycle. Other special examples of walks, which will be studied later in the paper, are ρ walks and ρ′ walks.

A ρ walk is a walk w:=(w⁢[0],…,w⁢[s]) such that for some 0≤i<j≤s, w[0..j-1] is a path, w⁢[j]=w⁢[i] and for all j<k≤s, w⁢[k]=w⁢[i+r] where 0≤r<(j-i) and (k-r) is a multiple of (j-i). It is illustrated in Figure 2 (a). In words, a ρ walk comes back to one previous vertex (which makes a cycle) and afterwards it remains in the cycle.

A ρ′ walk is an extension of a ρ walk that leaves the cycle and does not come back. It is illustrated in Figure 2 (b). Note that the lengths of the subwalks labeled with * can be zero.

A directed edge-label graph G=(V,E) is called a function graph if for all v∈V, there do not exist two distinct successors v1 and v2 of v with ℒG⁢(v,v1)=ℒG⁢(v,v2). In other words, for every vertex v and any label a we can find at most one successor w for which the label of the edge (u,v) is a. This observation can be extended for a walk in a function graph G as follows:

w1⁢[0]=w2⁢[0],ℒ⁢(w1)=ℒ⁢(w2)⇒w1=w2.

So if there is a walk with label M, then it must be unique and we call such a walk M-walk.

Figure 2

The graphs corresponding to ρ and ρ′ walks. Note that the lengths of the parts labeled with * can be zero.

3.4 PRF advantage of a keyed function

If S is a finite set, then x←$S denotes the uniform random sampling of x from S. Let 𝒟⊆ℬ+ be a finite set. A random function from 𝒟 to ℬ is 𝖱𝖥⁢(𝒟)←$Func⁢(𝒟,ℬ), the set of all functions from 𝒟 to ℬ. When the domain 𝒟 is understood, we simply write the random function as 𝖱𝖥.

The maximum prf-advantage of F is defined as

where the maximum is taken over all adversaries A making at most q queries from the domain 𝒟, say M1,…,Mq with Mi∈ℬmi, such that ∑imi≤σ and maxi⁡mi≤ℓ. Note that 𝐚𝐭𝐤=𝐩𝐟 means none of the query is a prefix of another; 𝐚𝐭𝐤=𝐞𝐪 means the queries are of equal length; and 𝐚𝐭𝐤=𝐚𝐧𝐲 means all queries are arbitrary distinct strings. This is an information theoretic definition and we allow an unbounded time adversary. There is no loss to assume that A always makes exactly q distinct queries, represented by a sequence, say ℳ=(M1,…,Mq). In this case, for any T=(T1,…,Tq)∈ℬq, we have

3.5 Coefficient-H technique

Let A be an adversary which makes q distinct queries (possibly adaptive) to F. Let the queries be x1,…,xq and the corresponding F outputs y1,…,yq. Let view⁢(AF) denote the q-tuple of pairs ((x1,y1),…,(xq,yq)) where xi denotes the i-th query and yi is the corresponding response.

For any q-tuple of pairs τ=((x1,y1),…,(xq,yq)), the probability

is called the interpolation probability, where the probability is taken under the randomness of F’s key. Here we assume that F is stateless and so the above probability is independent of the order of the pairs.

This technique was first introduced by Patarin in his PhD thesis [28] (as mentioned in [32]). The proof of this theorem can be found in [29]. So we skip the proof. We use this theorem to bound the PRF advantage of CBC function defined in the next subsection.

3.6 CBC-MAC and EMAC functions based on permutations

CBC function.

The CBC (cipher block chaining) function (see Figure 3) with an oracle π∈Perm, viewed as a key of the construction, takes as input a message M=(M⁢[1],…,M⁢[m])∈ℬm with m blocks and outputs

CBCπ⁢(M):=𝗈𝗎𝗍π⁢(M)⁢[m].

This is inductively computed as follows: 𝗈𝗎𝗍π⁢(M)⁢[0]=0n and

𝗈𝗎𝗍π⁢(M)⁢[i]=π⁢(𝗂𝗇π⁢(M)⁢[i]),𝗂𝗇π⁢(M)⁢[i]=𝗈𝗎𝗍π⁢(M)⁢[i-1]⊕M⁢[i],i∈[m].

We call 𝗂𝗇π⁢(M) and 𝗈𝗎𝗍π⁢(M)intermediate input and output vectors, respectively, associated to π. Note that the intermediate input vector 𝗂𝗇π is uniquely determined by 𝗈𝗎𝗍π (and does not depend on the permutation π). We can write down this association generically as a function 𝗈𝗎𝗍𝟤𝗂𝗇M:ℬm→ℬm mapping any block vector y to a block vector x where x⁢[1]=M⁢[1] and x⁢[i]=y⁢[i-1]⊕M⁢[i] if 1<i≤m. So for all permutations π∈𝖯𝖾𝗋𝗆, we have 𝗈𝗎𝗍𝟤𝗂𝗇⁢(𝗈𝗎𝗍π)=𝗂𝗇π.

Figure 3

CBC function and its intermediate values.

4.1 PRF advantage of EMAC

Let M1 and M2 be two distinct tuples of blocks. Let 𝖼𝗈𝗅𝗅π⁢(M1;M2) denote the event that CBCπ⁢(M1)=CBCπ⁢(M2), we call it the collision event for a pair of messages M1 and M2. We similarly define the collision event for a tuple of q≥2 distinct messages ℳ=(M1,…,Mq) as

We define the collision probability as 𝐂𝐏n⁢(ℳ)=𝖯𝗋⁢[𝖼𝗈𝗅𝗅Π⁢(ℳ)].

Let 𝐂𝐏q,ℓ𝖺𝗍𝗄=maxℳ⁡𝐂𝐏n⁢(ℳ) where the maximum is taken over all q-tuples of distinct messages ℳ having at most ℓ blocks each and satisfy 𝖺𝗍𝗄 (i.e., when 𝖺𝗍𝗄=𝖾𝗊, messages must have equal length, similarly when 𝖺𝗍𝗄=𝗉𝖿 no message is prefix to others, and finally 𝖺𝗍𝗄=𝖺𝗇𝗒 means no restriction other than length restriction). Following [2], we view EMAC as an instance of the Carter–Wegman paradigm [33]. This enables us to reduce the problem of bounding the prf-advantage of EMAC to bounding the collision probability as

Note that 𝐂𝐏q,ℓ𝖺𝗇𝗒≤(q2)⁢𝐂𝐏2,ℓ𝖺𝗇𝗒 as the collision for q messages is the union of collision events for each of the (q2) pairs of messages. Bellare, Pietrzak and Rogaway [2] proved that

where d′⁢(ℓ)=maxℓ′≤ℓ⁡d⁢(ℓ′) and d⁢(ℓ′) is the number of divisors of ℓ′. In [34], Wigert showed that

Using this bound of collision probability for a pair of messages, we see that the prf-advantage of EMAC is about O⁢(d′⁢(ℓ)⁢q2/2n) for ℓ<2n/4. Later Pietrzak [31] provided an improved analysis of EMAC and proved that the PRF advantage of EMAC is about O⁢(q2/2n) for ℓ<min⁡{q1/2,2n/8}. We revisit this improved analysis later in Section 8. A related claim on 𝐂𝐏 is

(see [9]) which gives a tight bound for equal length messages.

4.2 PRF advantage of CBC

Now we revisit the security analysis of CBC-MAC construction. Let 𝖥𝖼𝗈𝗅𝗅π⁢(M1;M2), called full collision, denote the event that

In other words, if the full collision event does not hold, then the last intermediate input of π is “fresh” (not appeared before) while computing CBCπ⁢(M2). So when π is replaced by a random permutation and this event does not hold, then the CBC-output should behave “almost” randomly. We use this intuition while we provide a bound of prf-advantage of CBC.

For a q-tuple of messages ℳ, the union of full collision events is similarly denoted by 𝖥𝖼𝗈𝗅𝗅π⁢(ℳ). The probability of this event, called full collision probability, is denoted by 𝐅𝐂𝐏n⁢(ℳ). The maximum full collision probability is denoted by 𝐅𝐂𝐏q,ℓ𝖺𝗍𝗄. Similar to inequality (1), the following result has been proved in [2]:

Note that we must restrict the adversary to make prefix-free queries, since otherwise it would be easy to distinguish CBC from a random function (using the classical length extension attack). Similarly, if M2 is a prefix of M1, it is easy to see that 𝐅𝐂𝐏n⁢(M1,M2)=1, so the above result becomes meaningless. As before, we also state an equivalent form of PRF advantage of CBC in terms of full collision probability among q messages. The above inequality (2) would be again a straightforward application of the following result.

Notation and conventions for this section.

Let us fix a tuple of messages ℳ=(M1,…,Mq) throughout this section where Mi∈ℬmi, and let m:=∑i=1qmi and maxi⁡mi=ℓ.

5.1 Intermediate inputs and outputs

5.2 Structure graphs and block-vertex structure graphs

A block-vertex structure graph is a graph theoretical representation of intermediate output 𝗈𝗎𝗍π. The block-vertex structure graph𝖡𝗌𝗍𝗋𝗎𝖼𝗍π for a permutation π is defined by the set of labeled edges

Clearly, G is a union of Mi-walks for all i∈[q], and vertex 0n∈V has positive out-degree. Let 𝖡𝗌𝗍𝗋𝗎𝖼𝗍⁢(ℳ) denote the set of all block structure graphs for the tuple of messages ℳ. Note that as explained below,

So, for every v∈V, all outward edges (similarly for inward edges) have distinct edge labels. Using this property, it is easy to see that the walks are unique and we denote them by wMi or simply wi whenever the message tuple is understood. See Figure 4 for a single message (i.e., q=1) in which the input and output vectors are stored in a directed graph.

While storing the intermediate sequences as a set of labeled edges, we may loose the order as well as the repetition of the elements. Interestingly, we see that we can uniquely reconstruct the intermediate sequences from such an edge-labeled graph by using uniqueness of Mi-walks. More precisely, 𝗈𝗎𝗍π⁢[r,i]=wr⁢[i].

Let G=(V,E) be a labeled directed graph and f:V→V* a bijective function. Then one can define a labeled directed graph G*=(V*,E*) isomorphic to G for which f is an isomorphism. More precisely, ((u,v);a)∈E if and only if ((f⁢(u),f⁢(v));a)∈E*. When f is an injective function, we can view the function where the range set is the image set of the function and this makes the function bijective. We call the graph obtained as described above a transformed G with respect to f.

Figure 4

Let M1=(1,0,0,0,0) and π⁢(1)=2, π⁢(2)=3, π⁢(3)=2. For any such π, we have 𝗈𝗎𝗍π=(2,3,2,3,2) and𝗂𝗇π=(1,2,3,2,3). However, the graph consists of three vertices {0,2,3} and edge set E={(0,2),(2,3),(3,2)}with labels 1, 0 and 0, respectively. We see that the intermediate input and output sequences actually can bereconstructed from this labeled structure graph. The walk corresponding to the message M1 will uniquely identifythe output vector as 𝗈𝗎𝗍π=(2,3,2,3,2), and the input vector 𝗂𝗇π=(1,2,3,2,3) can be constructed using therelation between input, output and message.

Figure 5

Structure graph corresponding to the labeled structure graph.

Let wr* denote the Mr-walk in G*. It is easy to see that a structure graph is again a union of Mr-walks wr* starting from 0.^[2] A structure graph is called a zero-output graph if 0 has positive in-degree, otherwise we call it non-zero output graph. To express it mathematically, we define a binary function Iszero such that for each zero-output graph G*, Iszero⁢(G*)=1, otherwise it maps to 0.

To reconstruct a block-vertex structure graph realizing G* we have to find labels from ℬ for all the vertices in a “consistent manner”, and we call such a labeling valid. Basically, we need to find an injective mapping α-1:V*→ℬ such that image set of α-1 is V and α:=(α-1)-1 is an isomorphism.