Condense to Conduct and Conduct to Condense

Extracted source text · arXiv 2508.21602

\documentclass[11pt,a4paper]{article}

\usepackage[OT4,plmath]{polski}
\usepackage[utf8]{inputenc}
\usepackage[english]{babel}
\usepackage{amsfonts,amsmath,amsthm,amssymb,color}
\usepackage{graphicx}
\usepackage{enumerate}
\usepackage[a4paper, margin=3.2cm]{geometry}
\usepackage[bookmarks=false]{hyperref}

\newcommand\condd{\textrm{CondDeg}_\alpha}
\newcommand\cond{\textrm{Cond}_q}
\newtheorem{thm}{Theorem}
\newtheorem{dfn}{Definition}
\newtheorem{lem}{Lemma}
\newtheorem{claim}{Claim}

\title{Condense to Conduct and Conduct to Condense}
\author{Tomasz Kazana \\ 
	University of Warsaw\\
	\texttt{tkazana@mimuw.edu.pl}}

\date{}

\begin{document}
\maketitle

\begin{abstract}
In this paper, we present the first explicit examples of low-conductance permutations. The notion of conductance of permutations was introduced by Dodis et al. in ``Indifferentiability of Confusion-Diffusion Networks'', where the search for low-conductance permutations was first initiated and motivated. As part of our contribution, we not only provide these examples, but also offer a general characterization of the problem: we show that low-conductance permutations are equivalent to permutations possessing the information-theoretic properties of Multi-Source-Somewhere-Condensers, a specific variant of somewhere condensers.
\end{abstract}

\section{Introduction}

\subsection{Background}

The starting point of this paper is the concept of \textit{permutation conductance}, introduced by
Yevgeniy Dodis, Martijn Stam, John Steinberger, and Tianren Liu in their seminal paper
\textit{Indifferentiability of confusion-diffusion networks}
\cite{dod}.
%https://eprint.iacr.org/2015/680.pdf

Their work focuses on the theoretical analysis of the indifferentiability security of confusion-diffusion networks, investigating how many rounds of certain block cipher and hash function constructions suffice to ensure adequate security. A central primitive in their analysis is a particular permutation, for which the parameter they introduced, known as conductance, is expected to be small. The results of this paper (e.g. Theorem \ref{thm-main}) have a direct impact on these applications, as outlined in Section \ref{imp-crypto}. For a detailed discussion of the motivation and the direct connections between permutations with suitable conductance and the security of confusion-diffusion based ciphers, we refer to \cite{dod}. In this work, however, the conductance of a permutation is primarily treated as a combinatorial concept, situated within the broader framework of the combinatorics of data structures.

From a formal perspective, each permutation of the type $\pi: \{ 0,1\}^{nw} \to \{ 0,1\}^{nw}$ has a certain \textit{degree of conductance}, depending additionally on a parameter $\alpha \in (0, 1)$. This degree (denoted $\condd(\pi)$) is always a real number between $1$ and $w$ and serves as a measure of how random $\pi$ is (the more random the permutation, the closer $\condd$ is to $1$; in particular, a constant permutation has $\condd$ equal to $w$). It turns out that permutations with low $\condd$ (``more random'') are useful in the applications described in \cite{dod}. Fortunately, the authors of \cite{dod} showed (Theorem 3, App. B, probabilistic method) that almost every random permutation has (for parameters $\alpha < \frac{1}{2}-\frac{1}{nw}$, which is sufficient for their applications) $\condd$ very close to $1$ (more precisely: it is no larger than $1 + \frac{\log(3nw)}{\alpha n}$). On the other hand, no explicit constructions have been shown demonstrating how such permutations could be constructed in practice.

In this paper we provide, for the first time, explicit examples of permutations with conductance degree less than $w$ (see Theorem \ref{thm-main}). Our constructions are based on what we call Multi-Source-Somewhere-Condenser permutations (see Definition \ref{dfn-sc}), a variant of classical somewhere condensers, such as those defined for example in Definition 1.11 of \cite{raz}.
%https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=2874bc666af9a1ed67d2c4b7fcbc917c8f4994f6

Moreover, we establish a rather surprising converse result: every permutation with sufficiently low conductance degree must satisfy the Multi-Source-Somewhere-Condenser assumptions. In other words, this work provides an almost complete characterization of the problem, which is successful for nearly the entire range of parameters (see Section \ref{open2} for details).

\subsubsection{Relations to the State-of-the-Art and Previous Results}

In the literature on information theory and its applications in computer science, numerous constructions have been developed to simulate or enhance randomness. These include extractors \cite{raz2005extractors, vadhan2012pseudorandomness}, condensers \cite{ta-Shma2017condenser, doron2016nearly}, expanders \cite{goudarzi2020expander, mihail2017list}, list-decodable and list-recoverable codes \cite{mihail2017list, stinson2006cryptography, doron2016nearly}, samplers \cite{goldreich1993samplers}, and pairwise independent hash functions \cite{bellare1996foundations, shaltiel2011pseudorandomness}. Many of these primitives are closely related or, in a certain sense, formally equivalent (see  \cite{impagliazzo1999hardness, dod, shaltiel2011recent, impagliazzo1989recycle, dodis2009nonmalleable}), and they play a key role in managing randomness in computation.
Within this framework, these constructions have numerous applications in cryptography, including universal hashing, key derivation functions, and randomness extractors for secure computation.

In this work, we show that the notion of a low-conductance permutation, as introduced in \cite{dod}, can be viewed as essentially equivalent to condensers, and thus as another member of this family. Therefore, while combinatorially interesting on its own, it turns out to be equivalent to well-studied primitives. This equivalence is valuable as it enables transferring insights and parameter bounds from classical constructions to low-conductance permutations. At the same time, determining explicit parameters and limitations remains challenging, as problems in this family are inherently difficult. Overall, this perspective establishes a conceptual bridge between the combinatorial properties of permutations and information-theoretic tools, highlighting potential avenues for designing new cryptographic primitives with provable security guarantees.

\subsubsection{Concrete Implications for Cryptography}\label{imp-crypto}

A natural question is whether our results have direct implications for block cipher design. The detailed analysis of the connections between low-conductance permutations and block cipher security is thoroughly discussed in \cite{dod}. Here, we highlight the two main insights.

First, the bounds we obtain are non-trivial (see Theorem \ref{thm-main}), though still far from the ideal case of random permutations (in the probabilistic sense), for which conductance is close to $1$. In contrast, the analysis in \cite{dod} relies on access to such nearly optimal bounds. As a result, formal guarantees can only be established for relatively stringent conductance thresholds. Unfortunately, due to the equivalence with condensers, constructing explicit examples that achieve such bounds remains a major challenge.

Second, it turns out that simple linear permutations (as originally hypothesized in \cite{dod}) are unfortunately insufficient for achieving low conductance. These functions inherently fall short of the required conductance levels because they lack the necessary condenser properties, emphasizing the need for more sophisticated constructions to approach the theoretical optimum.

Overall, while immediate implications for provably secure cipher design are limited, this work provides a rigorous combinatorial and information-theoretic foundation, clarifying the limits and potential strategies for constructing robust block ciphers.

\subsubsection{Final Remarks}

To conclude the introduction, we highlight how this problem exemplifies the non-obvious interconnections between several fields in theoretical computer science and mathematics. The problem originally arises in the theoretical analysis of symmetric ciphers -- a relatively rare research area (see, e.g., \cite{biba1,biba2,biba3,biba4}). From this context, a notable combinatorial problem was extracted \cite{dod}. Its analysis draws heavily on techniques from information theory, particularly the theory of min-entropy extraction, and can thus also be seen as a contribution to that field (see, e.g., \cite{avi, bibb2, bibb3, bibb4, bibb5, bibb6, raz, bibb8, bibb9}).

It is important to note that leveraging extractor-theoretic results to tackle combinatorial problems is not entirely new; similar phenomena have been observed in various contexts (see, e.g., \cite{bibc1, bibc2, bibc3, bibc4, bibc5, bibc6}). Together, these observations illustrate why the problem under consideration is both compelling and surprisingly non-trivial, requiring insights from multiple domains.

\subsection{Main Results}

\subsubsection{Main Notion}

Before we present the main result of the paper, let us first quote (from \cite{dod}) the formal definition of the notion of conductance of a permutation:
\begin{dfn}\label{dfn-cond}
Consider the permutation $\pi: \{ 0,1\}^{nw} \to \{ 0,1\}^{nw}$ and the parameter $\alpha\in (0,1)$. Then $\condd(\pi)$ is equal to $d$ if:
\[ \max_{\substack{U = U_1\times\ldots\times U_w \subset (\{0,1\}^n)^w \\
V = V_1\times\ldots\times V_w \subset (\{0,1\}^n)^w \\ |U_1|=\ldots=|V_w|=2^{\alpha n}}}
| \left\{ (x,y) \in (U,V) : y = \pi(x) \right\} |
= (2^{\alpha n})^ d. \]
\end{dfn}
Since the above notion is exceptionally essential for this work, to increase its readability we add an additional, intuitive understanding of this notion below preceded by one more important definition:
\begin{dfn}\label{dfn-box}
A set $X \subset (\{0,1\}^n)^w$ will be called a \emph{discrete $q$-box of dimension $w$} if
\[ X = X_1\times\ldots\times X_w,\]
for some $X_1,\ldots, X_w \subset \{0,1\}^n$ such that $|X_1|=\ldots= |X_w|=q$.

Remark: In the above definition, if the dimension is obvious from the context, we will sometimes just write that $X$ is a discrete $q$-box (omitting the phrase \emph{of dimension $w$}).
\end{dfn}
\paragraph{Intuition of Definition \ref{dfn-cond}:}
In simple terms, $\condd(\pi)$ determines how much a given permutation $\pi$ distorts all discrete $q$-boxes of dimension $w$ for $q = 2^{\alpha n}$. More specifically, for each such $q$-box $U$ we look at its image $\pi(U)$ and search for another $q$-box $V$  such that the intersection $U \cap V$ is as large as possible. The maximum we can obtain in this way is given by $\condd$ in the form of the following relation: \[\max_{U,V}(|\pi(U)\cap V|) = q^{\condd}.\]

In the ``worst'' (least random) case we will find such $U$ that $\pi(U)$ is just another $q$-box $V$ and then $|\pi(U)\cap V| = q^w$, which gives $\condd = w$.

On the other hand, ``more random'' permutations should intuitively behave in such a way that regardless of the choice of $U$ and $V$, the cardinality of the set $\pi(U)\cap V$ will always be much smaller than $q^w$. At the same time, it can be observed that it is always possible to choose $V$ such that $|\pi(U)\cap V|$ is at least $q$. In particular, this means that we definitely have $\condd(\pi) \geq 1$.

Finally, combining these intuitions and observations, we see that $\condd(\pi)$ is a specific way of estimating the randomness of the permutation $\pi$, which is always a number in the range between $1$ and $w$. The more random (in the given sense) the permutation is, the smaller this factor is.

\paragraph{Notation.}
For clarity, let us add a technical note that the original work of \cite{dod} uses a slightly different notation. Specifically, instead of the parameter $\alpha$, the parameter $q$ is used, which is simply equal to $2^{\alpha n}$ in the language of our work. Consequently, instead of $\condd$, \cite{dod} refers to $\cond$, with the relation $\cond(\pi) = q^{\condd(\pi) }$. Then $\cond(\pi)$ is a number between $q$ and $q^w$, not between $1$ and $w$, as is the case for $\condd(\pi)$.

The above changes are dictated by a different center of gravity of our focus. The work of \cite{dod} concerns more specific applications, so the parameter $q$ (referring to the number of queries present in security analyses) is natural there. Our work clearly takes a turn towards information theory and for us the primary notion is rather the min-entropy of the source, to which $\alpha$ refers.

\paragraph{Results in original notation.}

For consistency with the notation from the paper \cite{dod}, in Appendix \ref{old} we present the main results of our paper reformulated in the language of the paper \cite{dod}.
Similarly, the result from \cite{dod} quoted above (Theorem 3, App. B) is originally expressed
in a different language. Appendix \ref{old} also contains a proof of the equivalence of both versions.

\subsubsection{Main result}

In this paper we present the first example of a permutation with nontrivial conductance degree:

\begin{thm}\label{thm-main}

If $n > n_0$ is prime and $\epsilon\leq\alpha\leq 0.8$,
then there exists an efficiently computable permutation $\pi: \{ 0,1\}^{wn} \to \{ 0,1\}^{wn}$ such that
\[\condd(\pi)\leq w - \left\lfloor\frac{w}{3}\right\rfloor c,\]
where $n_0 = \Theta \left(\frac{1}{\epsilon^2} \right),
c = \Theta(\epsilon).$
\end{thm}
The reasoning that leads to the construction of this permutation (the final proof is in Section \ref{thm-main-proof}) requires the introduction of several lemmas (all proofs are in Section \ref{proofs}) and definitions, which we present below:
\begin{dfn}\label{dfn-ent}
The min-entropy of a source $X$ is defined as
\[H_\infty (X) = -\log(\max_{x\in X} (1/P [ X = x ])).\]
\end{dfn}
\begin{dfn}\label{dfn-flat}
A distribution $D$ over domain $X$ is a flat distribution  if it is uniformly random over a set $S \subset X$. In other words: if it is uniform on its support.
\end{dfn}
We have the following well known fact on these notions:
\begin{lem}\label{lem-flat}
A source $X$ with min-entropy at least $k$ is always a convex combination of flat distributions supported on sets of size $2^k$.
\end{lem}
\begin{dfn}\label{dfn-sc}
The permutation $\pi: \{ 0,1\}^{wn} \to \{ 0,1\}^{wn}$ will be called a ($\alpha, \epsilon_1, \epsilon_2$)-Multi-Source-Somewhere-Condenser if
for any independent random variables $X_1, X_2,\ldots X_w \in \{ 0,1 \}^n$ with min-entropy at least $\alpha n$,
the distribution $\pi(X_1, \ldots, X_w)$ can be expressed as a convex combination of the distributions ($\sum_{1\leq i \leq w} \gamma_i C_i + \gamma R$),
such that
$\gamma \leq \epsilon_2$
and
$[C_i ]_i$ (i.e. the $i$-th coordinate of $C_i$) has min-entropy at least $(1+\epsilon_1)\alpha n$.
\end{dfn}
Remark: the definition above is based on Definition 1.11 from \cite{raz}. However we consider several sources of the input and we limit ourselves to the study of permutations.
%https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=2874bc666af9a1ed67d2c4b7fcbc917c8f4994f6
Nevertheless, its intuitive meaning remains the same: we define a transformation, which from several sources with smaller min-entropy, leads to a convex combination of distributions, each of which (except for one component of size $\gamma$) has min-entropy on some coordinate by a factor $(1+ \epsilon_1)$ larger.

Armed with the above definitions, we are ready to formulate the following technical lemma, the proof of which can be found in Section \ref{lem-main-proof}:

\begin{lem}\label{lem-main}
If the permutation $\pi : \{ 0,1\}^{wn} \to \{ 0,1\}^{wn}$ is a ($\alpha, \epsilon_1, \epsilon_2$)-Multi-Source-Somewhere-Condenser,
then $\condd(\pi)$ is no larger than \[\log_q(q^{w-\epsilon_1} + \epsilon_2 q^w),\] for $q=2^{\alpha n}$.
\end{lem}
The formula in the above lemma means that if $\epsilon_2$ is negligible, then we will achieve $\condd \approx w - \epsilon_1$.

So, to effectively use Lemma \ref{lem-main}, we need a Multi-Source-Somewhere-Condenser with suitably strong parameters, which fortunately exists and may be found for example in the paper \cite{avi}.
% https://www.math.ias.edu/~avi/PUBLICATIONS/MYPAPERS/BIW04/biw.pdf
Specifically, it holds (in \cite{avi} this result and its proof are described as Lemma 3.14):

\begin{lem}\label{lem-avi}
Consider the permutation: $\pi: \{0,1\}^{3n} \to \{0,1\}^{3n}$ (i.e. $w=3$) defined by the formula $\pi(a, b, c) \to (a, b, c + ab)$, where $a,b,c\in \{0,1\}^n$ are treated as elements of the field $GF(2^n)$.
Then for each $\epsilon$, there exists $\delta = \Theta(\epsilon)$ such that:

If $\epsilon\leq\alpha\leq 0.8$ and $n$ is prime, then the permutation $\pi$ defined above is
($\alpha, \delta, 2^{-\delta \alpha n}$)-Multi-Source-Somewhere-Condenser.
\end{lem}
Note: the original lemma from \cite{avi} is even stronger than the formulation of Lemma \ref{lem-avi} presented above. In fact, it is always the third coordinate (except for some set of measure $2^{-\delta \alpha n}$) that has the appropriate min-entropy, not some coordinate for different fragments of the permutation.

The corollary of Lemmas \ref{lem-main} and \ref{lem-avi} is as follows:

\begin{lem}\label{lem-w3}
If $\epsilon\leq\alpha\leq 0.8$, then there exists a permutation $\pi: \{0,1\}^{3n} \to \{0,1\}^{3n}$ such that
\[\condd(\pi) \leq 3 - c \text{ (for some } c>0 \text{),}\]
as long as
$n$ is prime and $ n > n_0$
for some
$ n_0 = \Theta\left(\frac{1}{\epsilon^2}\right),
c = \Theta(\epsilon).$
\end{lem}
The formal proof of the above lemma can be found in Section \ref{lem-w3-proof}. The generalization of this lemma to higher dimensions (i.e. arbitrary $w$), which is simply the content of our main Theorem \ref{thm-main} -- can be found in Section \ref{thm-main-proof}).

\subsubsection{Converse Theorem}

It turns out that the theorem also holds in the opposite direction, i.e. showing that every permutation with a suitable $\condd$ is also a nontrivial Multi-Source-Somewhere-Condenser:

\begin{thm}\label{thm-rev}

Let $\pi : \{ 0,1\}^{wn} \to \{ 0,1\}^{wn}$ be a permutation such that its conductance degree $\condd(\pi)$ is less than $w(1-\epsilon_1-\epsilon_2-\epsilon_3 - \frac{1}{\alpha n})$, for some $\epsilon_1, \epsilon_2, \epsilon_3 > 0$ and $0 < \alpha < 1$. Then $\pi$ is a ($\alpha, \epsilon_1, r$)-Multi-Source-Somewhere-Condenser, for
$r = w 2^{- \alpha n \epsilon_2} + 2^{-\alpha n w \epsilon_3}$.

\end{thm}
The proof is given in Section \ref{thm-rev-proof}. It is also the most technically demanding part of the paper.

\subsection{Intuition and Toy Examples}\label{toy}

Consider the function $\pi_1 (a, b, c) = (a, b, c + ab)$, where $a,b,c\in GF(2^n)$ and $n$ is a prime number. This is of course a permutation, since for any value of $(x,y,z)$, its unique preimage is $(x,y,z - xy)$. We want to justify why such defined $\pi_1: \{ 0,1\}^{3n} \to \{ 0,1\}^{3n}$ has conductance degree $\condd(\pi_1)$ (for some fixed parameter $\alpha$) strictly less than $3$.

For this purpose, we consider two arbitrary $(2^{\alpha n})$-boxes $U = U_1 \times U_2 \times U_3$ and $V = V_1 \times V_2 \times V_3$ (i.e. $|U_1| = |U_2| = |U_3| = |V_1| = |V_2| = |V_3| = 2^{\alpha n}$).
Now we want (according to the Definition \ref{dfn-cond}) to estimate an upper bound on $|\pi_1(U)\cap V|$.

This is a purely combinatorial problem, but we will look at it from the probabilistic perspective. Specifically: we will assume a uniform distribution on $U$ and then we will show some upper bound on $P_{u\leftarrow U} (\pi_1(u)\in V)$. This will allow us to achieve the main result, since of course we have:
\begin{equation}\label{eq0}
 |\pi_1(U)\cap V| =  P_{u\leftarrow U} (\pi_1(u)\in V) \cdot (2^{\alpha n})^3.
\end{equation}

To achieve our goal, we will use the fact that $\pi_1$ is a Multi-Source-Somewhere-Condenser (thus Lemma \ref{lem-avi}), and even a stronger fact (which is formulated in this way in \cite{avi}), i.e. that it is always the third (not \textit{some}) coordinate of $\pi_1(a,b,c)$ that is the condenser, except for some negligible part of the domain. More specifically, thanks to this version of Lemma \ref{lem-avi} we know that -- since we are considering a uniform distribution on $U$ -- and thus we have that $U_1, U_2$ and $U_3$ are independent and have min-entropy $\alpha n$, there exists such $\delta = \Theta(\alpha)$ that $\pi_1(U)$ can be written as a convex combination of two distributions $C_3$ and $R$ (that is, $\pi(U) = \gamma_3 C_3 + \gamma R$ for some $\gamma_3, \gamma\geq 0, \gamma_3 + \gamma = 1$) with the following properties:
\begin{equation}\label{eq1}
 \gamma \leq 2^{-\delta \alpha n} 
 \end{equation}
and $[ C_3 ]_3$ (i.e. the third coordinate of $C_3$) has min-entropy at least $(1+\delta)\alpha n$. This last fact can also be formally written as follows: for any $x\in \{ 0,1\}^n$, it holds
\begin{equation}\label{eq2}
 P_{v\leftarrow C_3} ( v \in  \{ 0,1\}^n \times \{ 0,1\}^n \times \{x\}) 
\leq 2^{-(1+\delta)\alpha n}.
\end{equation}

Let us additionally denote $V_3 = \{ x_1, \ldots, x_{2^{\alpha n}} \}$ and we can finally complete the main estimation:
\begin{equation*}
\begin{split}
P_{u\leftarrow U} (\pi_1(u)\in V) &=  \gamma_3 P_{v\leftarrow C_3} (v\in V) + \gamma P_{v\leftarrow R}(v\in V) \leq \\
&\leq  \gamma_3 \sum_{i=1}^{2^{\alpha n}} P_{v\leftarrow C_3} (v\in \{ 0,1\}^n \times \{ 0,1\}^n \times {x_i}) + \gamma  \overset{\eqref{eq2},\eqref{eq1}}{\leq} \\
 &\leq  \gamma_3 \cdot 2^{\alpha n} \cdot 2^{-(1+\delta)\alpha n} + 2^{-\delta \alpha n} \leq \\
&\leq  2^{-\delta\alpha n} +  2^{-\delta \alpha n} = 2 \cdot 2^{-\delta \alpha n} = \\
&= (2^{\alpha n})^{-\delta + \frac{1}{\alpha n}}. 
\end{split}
\end{equation*}
Hence:
\begin{equation*}
\begin{split}
|\pi_1(U)\cap V| &\overset{\eqref{eq0}}{=}  P_{u\leftarrow U} (\pi_1(u)\in V) \cdot (2^{\alpha n})^3 \leq \\
&\leq (2^{\alpha n})^{-\delta + \frac{1}{\alpha n}} \cdot (2^{\alpha n})^3 = (2^{\alpha n})^{3-\delta+\frac{1}{\alpha n}}.
\end{split}
\end{equation*}
This of course means that $\condd \leq 3 - \delta + \frac{1}{\alpha n}$, which is strictly smaller than $3$ for sufficiently large $n$, so $\pi_1$ really has nontrivial conductance.

A completely analogous reasoning can be carried out for the permutation
$\pi_2(a, b, c) = (a, b + ac, c)$, establishing that and $\pi_2$ is also a permutation with nontrivial conductance.

Going even further, let us now consider the following permutation:
\[\pi_3(a, b, c) = \begin{cases}
(a, b, c + ab) & \text{for } a \text{ even},\\
(a, b + ac, c) &\text{for } a \text{ odd},
\end{cases}\]
which, as we can see, is a kind of mix of the permutations $\pi_1$ and $\pi_2$, so it is certainly -- as can be checked from the definition --
a Multi-Source-Somewhere-Condenser.
Reasoning that is only slightly more complicated than the one given above (and thus similar to the proof of Lemma \ref{lem-main}) allows us to prove that $\pi_3$ is also a permutation with nontrivial conductance.

Interestingly and importantly, in this work we managed to show that specifying more complex constructions is not possible at all.
That is: every permutation with nontrivial conductance cannot be constructed in any essentially more complicated or fundamentally different way than  $\pi_3$ -- so it always must be a ``mix'' of different concrete condensers on different coordinates (i.e. it must be a somewhere condenser). This fact is described in detail in Theorem \ref{thm-rev}.

\section{Technical Part: Formal Proofs}\label{proofs}
\subsection{Proof of Lemma \ref{lem-main}}\label{lem-main-proof}

(This proof is essentially a direct generalization of the reasoning presented in Section \ref{toy}.)

To prove the statement, we need to consider two arbitrary $(2^{\alpha n})$-boxes $U = U_1\times\ldots\times U_w, V = V_1\times\ldots\times V_w$ (i.e. $|U_1|=\ldots=|U_w|=|V_1|=\ldots=|V_w| = 2^{\alpha n}$) and show that $|\pi(U) \cap V| \leq (2^{\alpha n})^{w-\epsilon_1} + \epsilon_2 (2^{\alpha n})^w$. Equivalently, we will consider the uniform distribution on $U$ and prove that 
 \[ P_{u\leftarrow U}(\pi(u) \in V) \leq 2^{-\epsilon_1 \alpha n} + \epsilon_2.\]
 
Since $U_1,\ldots,U_w$ are independent and have min-entropy $\alpha n$, we can use the fact that $\pi$ is a $(\alpha, \epsilon_1, \epsilon_2)$-Multi-Source-Somewhere-Condenser. We then get that
\[\pi(U) = \sum_{i=1}^w \gamma_i C_i + \gamma R,\]
where $\gamma\leq\epsilon_2$ and $[C_i]_i$ (the $i$-th coordinate of $C_i$) has min-entropy of at least $(1+\epsilon_1)\alpha n$.

This last fact can be more conveniently rewritten as follows: for any $x\in \{ 0,1\}^n$, it holds
\[ P_{v\leftarrow C_i} ( v \in  \{ 0,1\}^n \times\ldots\times \underset{i\text{th-position}}{\{ x \}} \times\ldots\times \{ 0,1\}^n) \leq 2^{-(1+\epsilon_1)\alpha n}. \]
If we additionally denote $V_i = \{ x_1, \ldots, x_{2^{\alpha n} } \}$, then from the above we also have:
\begin{equation}\label{eq3}
\begin{split}
P_{v\leftarrow C_i} (v \in V) &\leq \sum_{j=1}^{2^{\alpha n}} P_{v\leftarrow C_i}( v\in \{ 0,1\}^n \times\ldots\times \underset{i\text{th-position}}{\{ x_j \}} \times\ldots\times \{ 0,1\}^n) \leq \\
&\leq 2^{\alpha n}  \cdot 2^{-(1+\epsilon_1)\alpha n} = 2^{- \epsilon_1 \alpha n}.
\end{split}
\end{equation}
Given the above, we can proceed to the main estimation:
\begin{equation*}
\begin{split}
P_{u\leftarrow U}(\pi(u) \in V)  &= \sum_{i=1}^w \gamma_i P_{v\leftarrow C_i}(v \in V) + \gamma P_{v\leftarrow R}(v\in V) \overset{\eqref{eq3}}{\leq} \\
&\leq \sum_{i=1}^w \gamma_i 2^{- \epsilon_1 \alpha n} + \gamma = \\
&= (1-\gamma) 2^{- \epsilon_1 \alpha n} + \gamma \leq \\
&\leq 2^{- \epsilon_1 \alpha n} + \epsilon_2,
\end{split}
\end{equation*}
which completes the proof.

\subsection{Proof of Theorem \ref{thm-rev}}\label{thm-rev-proof}

We are to show that $\pi$ is a $(\alpha, \epsilon_1, r)$-Multi-Source-Somewhere-Condenser. By definition, we should consider some independent random variables $U_1, \ldots, U_w$ such that their min-entropy is at least $\alpha n$ and show that the distribution $\pi(U_1,\ldots, U_w)$ has the appropriate properties. However, without loss of generality (using Lemma \ref{lem-flat}), we can assume that the distribution of $U = U_1\times\ldots\times U_w$ is flat, that is, it is really just a uniformly distributed discrete $(2^{\alpha n})$-box $U$ (as defined in Definition \ref{dfn-box}). Then, after translating to the discrete interpretation, our original statement becomes:

\begin{claim}\label{main-claim}
The set $\pi(U)$ can be partitioned into disjoint sets $\{ C_i \}_{i=1}^w$ and $R$ such that:
\begin{itemize}
\item $|R| \leq r \cdot 2^{\alpha n w}$, where $r = w2^{-\alpha n \epsilon_2} + 2^{-\alpha n w \epsilon_3}$;
\item for each $C_i$ and for each $y\in\{0,1\}^n$ we have:
\[ |C_i \cap \{ 0,1\}^n \times\ldots\times \underset{i\text{th-position}}{\{ y \}} \times\ldots\times \{ 0,1\}^n|
\leq 2^{-(1+\epsilon_1)\alpha n} \cdot |C_i|. \]
\end{itemize}
Notational note: in the above statement $R$ and $C_i$ simply denote subsets of $\{0,1\}^{wn}$, while in the original Definition \ref{dfn-sc} the same letters would denote uniform distributions on these sets.
\end{claim}
Besides, let us remind that we know that the set $\pi(U)$ has cardinality $2^{\alpha n w}$ and (thanks to the assumption that $\pi$ has the appropriate degree of conductance) that for any other $(2^{\alpha n})$-box $V$ the following always holds:
\begin{equation}\label{ass-cond}
|\pi(U)\cap V| < 2^{\alpha n w (1 - \epsilon_1 - \epsilon_2 - \epsilon_3 - \frac{1}{\alpha n})}.
\end{equation}
Before we proceed to the direct proof of Claim \ref{main-claim} (that is, giving the appropriate way of partitioning $\pi(U)$), we need one more auxiliary definition:
\begin{dfn}
We say that the set $X$ has at point $y\in \{0,1\}^n$, an $i$-Bottleneck-Slice
\[ B = X \cap \{ 0,1\}^n \times\ldots\times \underset{i\text{th-position}}{\{ y\}} \times\ldots\times \{ 0,1\}^n\]
, if it holds
\[0 < |B| < 2^{\alpha n (w - 1 - \epsilon_1-\epsilon_2)}.\]
Intuitively: $i$-Bottleneck-Slice at point $y$ means that the projection of $X$ onto the $i$-coordinate at point $y$ is nonempty, but suitably thin.

\noindent Remark: 
We will sometimes also say that $X$ contains a Bottleneck-Slice (without specifying the coordinate $i$). This of course means that $X$ contains an $i$-Bottleneck-Slice for some $i$.
\end{dfn}

Now the procedure for partitioning the set $\pi(U)$ is as follows.

\paragraph{Procedure for partitioning $\pi(U)$:}
\begin{enumerate}[\bf Step 1:]
\item First, we initialize the auxiliary variables: for each $i$, let $\tilde{C_i}$ be the empty set and let $\tilde{R} := \pi(U)$. \item \label{cut} If $\tilde{R}$ contains any (for any $i$ and at any point $y$) $i$-Bottleneck-Slice $B$, perform the assignments:
\begin{equation*}
\begin{split}
\tilde{R} &:= \tilde{R} \setminus B;\\
\tilde{C_i} &:= \tilde{C_i} \cup B.
\end{split}
\end{equation*}
\item Loop Step \ref{cut} until $\tilde{R}$ no longer contains any Bottleneck-Slice.
\item Assign $R_0 := \tilde{R}$ and $R_1 := \emptyset$.
\item For each $i$, if $|\tilde{C_i}| > 2^{\alpha n (w-\epsilon_2)}$, then assign $C_i := \tilde{C_i}$, otherwise: assign
$C_i := \emptyset$ and $R_1 := R_1 \cup \tilde{C_i}$.
\item Assign $R := R_0 \cup R_1$.
\end{enumerate}
\textit{Intuitively: from the set $\pi(U)$ we cut off all Bottleneck-Slices one by one until we are left with $R_0$, which no longer contains sets of this type. Then all cut off $i$-Bottleneck-Slices concerning the $i$-th coordinate together form $C_i$, unless their measure is sufficiently small, in which case $C_i$ is empty and these Bottleneck-Slices go to $R_1$. The final $R$ is the sum of $R_0$ and $R_1$.}
\\ \\
It remains to analyze that the partitioning constructed in this way actually satisfies the requirements of Claim \ref{main-claim}. So we have both necessary analyses in turn:

\paragraph{Analysis of $C_i$.}
If $C_i$ is empty, then the statement trivially holds. Otherwise, it must be
\[|C_i| > 2^{\alpha n (w-\epsilon_2)}.\]
Additionally, for any $y$, it holds
\[|C_i \cap \{ 0,1\}^n \times\ldots\times \underset{i\text{th-position}}{\{ y\}} \times\ldots\times \{ 0,1\}^n|
< 2^{\alpha n (w - 1 - \epsilon_1-\epsilon_2)},\]
since every such set as above on the left is either empty or (as follows from the construction) equal to exactly one $i$-Bottleneck-Slice cut off from $\tilde{R}$.
 
Combining these facts, we can conclude that:
 \begin{equation*}
 \begin{split}
 |C_i \cap \{ 0,1\}^n \times\ldots\times \underset{i\text{th-position}}{\{ y\}} \times\ldots\times \{ 0,1\}^n|
 &< 2^{\alpha n (w - 1 - \epsilon_1-\epsilon_2)} = \\
 &= {2^{\alpha n (-1-\epsilon_1)}} \cdot {2^{\alpha n (w-\epsilon_2)}} < \\
 &< {2^{-(1+\epsilon_1)\alpha n }} \cdot |C_i|,
 \end{split}
 \end{equation*}
what was needed to be shown.

\paragraph{Analysis of $R$.}

We have to show $|R| \leq r \cdot 2^{\alpha n w}\text{, where } r = w2^{-\alpha n \epsilon_2} + 2^{-\alpha n w \epsilon_3},$ that is,
\[ |R| \leq w2^{(w-\epsilon_2)\alpha n } + 2^{(1-\epsilon_3) \alpha n w}.\]
Additionally, we know that $ R = R_0 \cup R_1$. So it is enough to show two inequalities:
 \begin{equation*}
 \begin{split}
|R_1| &\leq w\cdot 2^{(w-\epsilon_2)\alpha n },\\
|R_0| &\leq 2^{(1-\epsilon_3) \alpha n w}.
 \end{split}
 \end{equation*}
The first one is a trivial consequence of the partitioning procedure: $R_1$ in the worst case could have had $w$ times added the set $\tilde{C_i}$ of cardinality at most $2^{\alpha n (w-\epsilon_2)}$, which is exactly the postulated bound.

The last inequality follows directly from the fact that $R_0$ does not contain any Bottleneck-Slice, the bound
$|R_0| \leq |\pi(U)| = 2^{\alpha n w}$
and the property \eqref{ass-cond} (this property holds for $\pi(U)$, so obviously also for $R_0 \subset \pi(U)$), which, however, requires a slightly deeper analysis, which (thus concluding the entire proof) we present below:

\begin{claim}
If the set $R_0$ does not contain any Bottleneck-Slice, $|R_0| \leq 2^{\alpha n w}$ and
\begin{equation}\label{last-check}
|R_0 \cap V| < 2^{\alpha n w (1 - \epsilon_1 - \epsilon_2 - \epsilon_3 - \frac{1}{\alpha n})}
\end{equation}
for any discrete $2^{\alpha n}$-box $V$ of dimension $w$, then
\[ |R_0| \leq 2^{(1-\epsilon_3) \alpha n w}. \]
Reminder: the formal definition of a discrete box is given in Definition \ref{dfn-box}.
\end{claim}
To prove the above statement, let us assume for the sake of contradiction that $|R_0| > 2^{(1-\epsilon_3)\alpha n w}$. Then:

First, let us note that $R_0$ is contained in a discrete $(2^{(1+\epsilon_1+\epsilon_2)\alpha n})$-box $V_{big}$.
This is actually the case because $|R_0| \leq 2^{\alpha n w}$ and $R_0$ does not contain any Bottleneck-Slice, so at each coordinate it takes at most: \[ \frac{2^{\alpha n w}}{2^{(w-1-\epsilon_1-\epsilon_2)\alpha n}} = 2^{(1+\epsilon_1+\epsilon_2)\alpha n} \]
different values.

This means that $V_{big}$ is a sum of at most
\[\left(\left\lceil \frac{2^{(1+\epsilon_1+\epsilon_2)\alpha n}}{2^{\alpha n}} \right\rceil\right)^w = (\lceil 2^{(\epsilon_1+\epsilon_2)\alpha n} \rceil)^w \leq
(2^{(\epsilon_1+\epsilon_2)\alpha n} + 1)^w \leq (2^{(\epsilon_1+\epsilon_2)\alpha n + 1})^w\]
discrete $(2^{\alpha n}$)-boxes.

Since $|R_0| > 2^{(1-\epsilon_3)\alpha n w}$, at least one of these boxes contains
\[\frac{2^{(1-\epsilon_3)\alpha n w}}{(2^{(\epsilon_1+\epsilon_2)\alpha n + 1} )^w}
= 2^{\alpha n w (1-\epsilon_3-\epsilon_1-\epsilon_2 - \frac{1}{\alpha n})} \]
points, which, however, contradicts the \eqref{last-check} property, and thus completes the proof.

\subsection{Proof of Lemma \ref{lem-w3}}\label{lem-w3-proof}

We simply apply Lemma \ref{lem-main} to the permutation from Lemma \ref{lem-avi}:

That is, first from Lemma \ref{lem-avi} we have that there exists a permutation $\pi: \{0,1\}^{3n} \to \{0,1\}^{3n}$, which
is a ($\epsilon, \delta, 2^{-\delta\alpha n}$)-Multi-Source-Somewhere-Condenser for some $\delta = \Theta(\epsilon)$.
Now, additionally denoting $q=2^{\alpha n}$, from Lemma \ref{lem-main} we have that this permutation has $\condd(\pi)$ such that:
\begin{equation*}
\begin{split}
\condd(\pi) &\leq \log_q(q^{3-\delta} + 2^{-\alpha \delta n} \cdot q^3 ) = \\
&= \log_q(q^{3-\delta} + q^{-\delta} \cdot q^3) = \log_q(2\cdot q^{3-\delta}) = \\
&= \log_q{q^{3-\delta + \frac{1}{\log q}}} = 3-\delta + \frac{1}{\log q} = \\
&= 3 - c,
\end{split}
\end{equation*}
for $c = \delta - \frac{1}{\log q} = \delta - \frac{1}{\alpha n}$.

Finally, to achieve the postulated result $c = \Theta(\alpha) = \Theta(\delta)$, it is enough to choose the parameters so that:
\[ \delta \geq c \geq \delta/2.\]
The left inequality follows trivially from the formula on $c$ obtained above. To obtain the right one, we want
\[ \frac{1}{ \alpha n} \leq \delta/2,\]
which means
\[n \geq \frac{2}{\delta\alpha} = O\left(\frac{1}{\epsilon^2}\right),\]
and is true by assumption so completes the proof.

\subsection{Final Proof of Theorem \ref{thm-main}}\label{thm-main-proof}

The final proof is a direct consequence of Lemma \ref{lem-w3}, since our final construction for dimension $w$ will be just a simple serial repetition of many copies of the dimension $3$ permutation $\pi$ from the aforementioned lemma.

To formalize this construction, let us first denote the permutation $\pi: \{0,1\}^{3n} \to \{0,1\}^{3n}$ (coming from Lemma \ref{lem-w3}) on successive coordinates as follows:
\[ \pi(x, y, z) = (\pi_1(x,y,z),\pi_2(x,y,z),\pi_3(x,y,z) )\text{, where } x,y,z\in\{0,1\}^n.\]
Now let $w\geq3$ and the permutation $\pi^{(w)}: \{0,1\}^{wn} \times \{0,1\}^{wn}$ be defined as follows (for now, assume that $w$ is a multiple of $3$):
\begin{equation*}
\begin{split}
\pi^{(w)}(x_1,\ldots,x_w)  = \Big( 
  & \pi_1(x_1,x_2,x_3),\pi_2(x_1,x_2,x_3),\pi_3(x_1,x_2,x_3),\\
  &\pi_1(x_4,x_5,x_6),\pi_2(x_4,x_5,x_6),\pi_3(x_4,x_5,x_6),\\
  &\ldots \\
  & \pi_1(x_{w-2},x_{w-1},x_w),\pi_2(x_{w-2},x_{w-1},x_w),\pi_3(x_{w-2},x_{w-1},x_w)
  \Big).
\end{split}
\end{equation*}
If $w$ leaves a remainder $1$ when divided by $3$, we define:
\[ \pi^{(3k+1)}(x_1,\ldots,x_{3k+1}) = (\pi^{(3k)}(x_1\ldots,x_{3k}), x_{3k+1}),\]
and similarly, when $w$ divided by $3$ leaves a remainder $2$:
\[ \pi^{(3k+2)}(x_1,\ldots,x_{3k+2}) = (\pi^{(3k)}(x_1\ldots,x_{3k}), x_{3k+1}, x_{3k+2}).\]
For example:
\begin{equation*}
\begin{split}
\pi^{(7)}(x_1,x_2,x_3,x_4,x_5,x_6,x_7) =  \Big(
&\pi_1(x_1,x_2,x_3),\pi_2(x_1,x_2,x_3),\pi_3(x_1,x_2,x_3),\\
&\pi_1(x_4,x_5,x_6),\pi_2(x_4,x_5,x_6),\pi_3(x_4,x_5,x_6),x_7
\Big).
\end{split}
\end{equation*}
From the very construction it is obvious that $\pi^{(w)}$ is a permutation, so it remains to estimate $\condd(\pi^{(w)})$ of the presented construction. For this purpose, we consider two arbitrary $(2^{\alpha n})$-boxes:
$U = U_1\times\ldots \times U_w$ and $V = V_1\times\ldots \times V_w$ (i.e.
$|U_1| = \ldots |U_w| = |V_1|=\ldots |V_w| = 2^{\alpha n}$) and we estimate $|\pi^{(w)}(U)\cap V| = (2^{\alpha n})^{\condd(\pi^{(w)})}$.

As in Sections \ref{toy} and \ref{lem-main-proof},
it will be more convenient to assume a uniform distribution on $U$
and use the probabilistic interpretation:
\[(2^{\alpha n})^{\condd(\pi^{(w)})} = |\pi^{(w)}(U)\cap V|  = P_{u\leftarrow U}(\pi^{(w)}(u) \in V) \cdot 2^{\alpha n w} .\]
Before we move on to the main estimation, let us just recall that for any $X, Y, Z, A, B, C \subset \{0,1\}^n$
such that
$|X|=|Y|=|Z|=|A|=|B|=|C|=2^{\alpha n}$
we have (from Lemma \ref{lem-w3} and again the probabilistic interpretation of the inequality $\condd(\pi) \leq 3-c$):
\begin{equation}\label{case3}
P_{(x,y,z)\leftarrow X\times Y\times Z}(\pi(x,y,z) \in (A,B,C)) \cdot (2^{\alpha n})^3 \leq (2^{\alpha n})^{3-c}.
\end{equation}
Armed with this fact, we can finally move on to the main estimation:
 \begin{equation}\label{last}
 \begin{split}
 &(2^{\alpha n})^{\condd(\pi^{(w)})} =\\
 &= 2^{\alpha n w} \cdot P_{u\leftarrow U}(\pi^{(w)}(u) \in V) \overset{(\star)}{=} \\
 &= 2^{\alpha n w} \cdot \prod_{i=1}^{\left\lfloor\frac{w}{3}\right\rfloor} P_{(x,y,z)\leftarrow 
U_{3i-2}\times U_{3i-1}\times U_{3i}}(\pi(x,y,z)\in V_{3i-2}\times V_{3i-1}\times V_{3i}) \overset{\eqref{case3}}{\leq} \\
 &\leq 2^{\alpha n w} \cdot ((2^{\alpha n})^{-c})^{\left\lfloor\frac{w}{3}\right\rfloor} 
 = (2^{\alpha n})^{w - \left\lfloor\frac{w}{3}\right\rfloor c},
\end{split}
\end{equation}
where $(\star)$ follows immediately from the structure of the construction of $\pi^{(w)}$ (primarily from the fact that successive triples in the construction are fully independent of each other).

Finally, from \eqref{last} we have that $\condd(\pi^{(w)}) \leq w - \left\lfloor\frac{w}{3}\right\rfloor c$, which completes the proof.
 
\section{Open Problems and Future Work}

In this section we list a number of issues that remain open and may be worth further investigation.

\subsection{Wider Range of Parameters}\label{open1}

The main result (Theorem \ref{thm-main}) largely relies on Lemma 3.14 of \cite{avi} (i.e. Lemma \ref{lem-avi} in this paper), which contains certain restrictions that we suspect can be avoided. First of all, we ask whether the same result can be obtained for $n$ that are not prime numbers, and also whether the parameters $n$ and $c$ must really depend on $\epsilon$ (the work of \cite{avi} even gives hope for removing these dependencies -- one would like to simply use Lemma 3.1 from that paper, but unfortunately in our solution it turned out that we were able only to  use Lemma 3.14, which is a version of Lemma 3.1 with weaker assumptions and a weaker thesis.).

Additionally, there remains an open question about low-conductance permutations for $w=2$.

\subsection{The Converse Theorem for Weak Conductance}\label{open2}
The Converse Theorem (Theorem \ref{thm-rev}) applies to almost all cases, except when
\[ w\left(1-\frac{1}{n}\right) < \condd < w.\]
It remains to be investigated.

\subsection{Always-Condenser should be better then Somewhere-Condenser}

Recall that our solution for the dimension $3$ is given by:
\[\pi_1(a, b, c) = (a, b, c+ab).\]
While we can easily believe that the third coordinate of $\pi_1$ really behaves very randomly, since it is a condenser, it seems intuitive that the following construction should have even lower conductance than $\pi_1$ (i.e. both the second and third coordinates are condensers):
\[\pi_2(a, b, c) = (a, ba+c, ca-b).\]
However, we cannot formally prove that $\pi_2$ is indeed better.

(For clarity: we can show that when $n$ is a prime such that $n \equiv 3 \mod 4$, then $\pi_2$ is indeed a permutation; in a more complicated way, we can improve this example by constructing a permutation where all three coordinates will simultaneously have the form of a condenser.)

The above question can naturally be generalized to higher dimensions. In other words: we hypothesize that if all coordinates (and not, for example, every third one like in our construction) of a permutation are condensers, then such a permutation has an even better conductance degree than the construction that derives from Lemma \ref{lem-main}. 

\bibliographystyle{plain} 
\bibliography{cond}

\appendix
\section{Original Language Formulations from \cite{dod}}\label{old}

\subsection{Theorem 3, Appendix B from \cite{dod}}
The result quoted in the introduction:
\[\condd \leq 1 + \frac{\log(3nw)}{\alpha n} \text{, provided }\alpha \leq \frac{1}{2} - \frac{1}{nw},\]
was originally formulated as follows:
\[ \cond \leq 2nqw + 1 \text{, provided } q^{2w} \leq 2^{nw}/4. \]
This is, of course, a consequence of the original result, because, on the one hand, we have (equivalence of assumptions):
\[q^{2w} \leq 2^{nw}/4 \iff 2^{2\alpha n w} \leq 2^{nw-2} \iff
2\alpha n w \leq nw-2 \iff \alpha \leq \frac{1}{2} - \frac{1}{nw},\]
and on the other hand we have:
\begin{equation*}
\begin{split}
\condd &= \log_q(\cond) \leq log_q(2nqw + 1) \leq log_q(3nqw) = \\
&= 1 + \log_q(3nw) = 1 + \frac{\log(3nw)}{\log(q)} = 1 + \frac{\log(3nw)}{\alpha n}.
\end{split}
\end{equation*}

\subsection{Main Results of the Paper in the Notation from \cite{dod}}

For the sake of clarity, we present the main results once again, this time rewritten in the original notation from the paper \cite{dod}:

\paragraph{Theorem \ref{thm-main}'.}

If $n > n_0$ is a prime number and $\epsilon\leq \frac{\log q}{n} \leq 0.8$,
then there exists a permutation $\pi: \{ 0,1\}^{wn} \to \{ 0,1\}^{wn}$ such that:
\[ \cond(\pi) \leq q^{w - \left\lfloor\frac{w}{3}\right\rfloor c},\]
where
\[ n_0 = \Theta \left(\frac{1}{\epsilon^2} \right),
 c = \Theta(\epsilon).\]

\paragraph{Theorem \ref{thm-rev}'.}

Let $\pi : \{ 0,1\}^{wn} \to \{ 0,1\}^{wn}$ be a permutation such that $\cond(\pi) < q^{w(1-\epsilon_1-\epsilon_2-\epsilon_3 - \frac{1}{\log q})}$, for some $\epsilon_1, \epsilon_2, \epsilon_3 > 0$. Then $\pi$ is a ($\frac{\log q}{n}, \epsilon_1, w q^{- \epsilon_2} + q^{-w \epsilon_3}$)-Multi-Source-Somewhere-Condenser.


\end{document}
\begin{thebibliography}{10}

\bibitem{bibc6}
Divesh Aggarwal, Ivan Damg{\aa}rd, Jesper~Buus Nielsen, Maciej Obremski, Erick
  Purwanto, Joao Ribeiro, and Mark Simkin.
\newblock Stronger leakage-resilient and non-malleable secret sharing schemes
  for general access structures.
\newblock In {\em Advances in Cryptology--CRYPTO 2019: 39th Annual
  International Cryptology Conference, Santa Barbara, CA, USA, August 18--22,
  2019, Proceedings, Part II}, pages 510--539. Springer, 2019.

\bibitem{bibc3}
Divesh Aggarwal, Yevgeniy Dodis, Tomasz Kazana, and Maciej Obremski.
\newblock Non-malleable reductions and applications.
\newblock In {\em Proceedings of the Forty-Seventh Annual ACM Symposium on
  Theory of Computing}, pages 459--468. Association for Computing Machinery,
  2015.

\bibitem{bibc4}
Divesh Aggarwal, Tomasz Kazana, and Maciej Obremski.
\newblock Inception makes non-malleable codes stronger.
\newblock In Yael Kalai and Leonid Reyzin, editors, {\em Theory of
  Cryptography}, pages 319--343. Springer International Publishing, 2017.

\bibitem{bibc5}
Divesh Aggarwal, Tomasz Kazana, and Maciej Obremski.
\newblock Leakage-resilient algebraic manipulation detection codes with optimal
  parameters.
\newblock In {\em 2018 IEEE International Symposium on Information Theory
  (ISIT)}, pages 1131--1135, 2018.

\bibitem{avi}
Boaz Barak, Russell Impagliazzo, and Avi Wigderson.
\newblock Extracting randomness using few independent sources.
\newblock {\em SIAM Journal on Computing}, 36(4):1095--1118, 2006.

\bibitem{bibb2}
Boaz Barak, Guy Kindler, Ronen Shaltiel, Benny Sudakov, and Avi Wigderson.
\newblock Simulating independence: New constructions of condensers, ramsey
  graphs, dispersers, and extractors.
\newblock {\em Journal of the ACM (JACM)}, 57(4):1--52, 2010.

\bibitem{bellare1996foundations}
Mihir Bellare and Phillip Rogaway.
\newblock {\em Foundations of Cryptography: Basic Applications}.
\newblock Cambridge University Press, 1996.

\bibitem{biba4}
Jean-S{\'e}bastien Coron, Yevgeniy Dodis, C{\'e}cile Malinaud, and Prashant
  Puniya.
\newblock Merkle-damg{\aa}rd revisited: How to construct a hash function.
\newblock In {\em Annual International Cryptology Conference}, pages 430--448.
  Springer, 2005.

\bibitem{bibb8}
Yevgeniy Dodis and Roberto Oliveira.
\newblock On extracting private randomness over a public channel.
\newblock In {\em International Workshop on Randomization and Approximation
  Techniques in Computer Science}, pages 252--263. Springer, 2003.

\bibitem{bibb9}
Yevgeniy Dodis and Joel Spencer.
\newblock On the (non) universality of the one-time pad.
\newblock In {\em The 43rd Annual IEEE Symposium on Foundations of Computer
  Science, 2002. Proceedings.}, pages 376--385. IEEE, 2002.

\bibitem{dod}
Yevgeniy Dodis, Martijn Stam, John Steinberger, and Tianren Liu.
\newblock Indifferentiability of confusion-diffusion networks.
\newblock In {\em Cryptology ePrint Archive, Report 2015/680}, 2015.

\bibitem{dodis2009nonmalleable}
Yevgeniy Dodis and Daniel Wichs.
\newblock Non-malleable extractors and symmetric key cryptography from weak
  secrets.
\newblock In {\em Proceedings of the 41st Annual ACM Symposium on Theory of
  Computing (STOC)}, pages 601--610. ACM, 2009.

\bibitem{doron2016nearly}
Dean Doron, Dana Moshkovitz, Justin Oh, and David Zuckerman.
\newblock Nearly optimal pseudorandomness from hardness.
\newblock {\em SIAM Journal on Computing}, 45(2):567--600, 2016.

\bibitem{biba3}
H{\"o}rst Feistel.
\newblock Cryptographic coding for data-bank privacy.
\newblock Technical report, IBM Thomas J. Watson Research Center, 1970.

\bibitem{goldreich1993samplers}
Oded Goldreich, Shafi Goldwasser, and David Micali.
\newblock How to construct random functions.
\newblock In {\em Journal of the ACM}, volume~42, pages 742--780. ACM, 1995.

\bibitem{goudarzi2020expander}
Mohammad Goudarzi and Igor Shinkar.
\newblock Expander graphs in computer science: Applications and constructions.
\newblock In {\em IEEE Symposium on Foundations of Computer Science (FOCS)},
  pages 45--58, 2020.

\bibitem{bibc1}
Ronald~L. Graham and Joel~H. Spencer.
\newblock A constructive solution to a tournament problem.
\newblock {\em Canadian Mathematical Bulletin}, 14(1):45--48, 1971.

\bibitem{impagliazzo1999hardness}
Russell Impagliazzo and Valentine Kabanets.
\newblock Constructing hard functions from weak one-way functions.
\newblock In {\em Proceedings of the 34th Annual Symposium on Foundations of
  Computer Science (FOCS)}, pages 66--75. IEEE, 1999.

\bibitem{impagliazzo1989recycle}
Russell Impagliazzo and David Zuckerman.
\newblock How to recycle random bits.
\newblock In {\em Proceedings of the 30th Annual Symposium on Foundations of
  Computer Science (FOCS)}, pages 248--253. IEEE, 1989.

\bibitem{bibb5}
Jesse Kamp and David Zuckerman.
\newblock Deterministic extractors for bit-fixing sources and
  exposure-resilient cryptography.
\newblock {\em SIAM Journal on Computing}, 36(5):1231--1247, 2007.

\bibitem{bibb4}
Chi-Jen Lu, Omer Reingold, Salil Vadhan, and Avi Wigderson.
\newblock Extractors: Optimal up to constant factors.
\newblock In {\em Proceedings of the thirty-fifth annual ACM symposium on
  Theory of computing}, pages 602--611, 2003.

\bibitem{biba2}
Ueli Maurer, Renato Renner, and Clemens Holenstein.
\newblock Indifferentiability, impossibility results on reductions, and
  applications to the random oracle methodology.
\newblock In Moni Naor, editor, {\em Theory of Cryptography}, pages 21--39.
  Springer Berlin Heidelberg, 2004.

\bibitem{mihail2017list}
Milena Mihail and Ravi Kumar.
\newblock List-decodable codes and their applications.
\newblock {\em IEEE Transactions on Information Theory}, 63(4):2153--2166,
  2017.

\bibitem{biba1}
Eric Miles and Emanuele Viola.
\newblock Substitution-permutation networks, pseudorandom functions, and
  natural proofs.
\newblock In Reihaneh Safavi-Naini and Ran Canetti, editors, {\em Advances in
  Cryptology -- CRYPTO 2012}. Springer Berlin Heidelberg, 2012.

\bibitem{raz}
Ran Raz.
\newblock Extractors with weak random seeds.
\newblock In {\em Proceedings of the Thirty-Seventh Annual ACM Symposium on
  Theory of Computing}, pages 11--20. ACM, 2005.

\bibitem{raz2005extractors}
Ran Raz and Shmuel Safra.
\newblock Extractors and condensers.
\newblock In {\em Proceedings of STOC}, pages 563--572, 2005.

\bibitem{shaltiel2011pseudorandomness}
Ronen Shaltiel.
\newblock Pseudorandomness.
\newblock In {\em Foundations and Trends in Theoretical Computer Science},
  volume~7, pages 1--336, 2011.

\bibitem{shaltiel2011recent}
Ronen Shaltiel.
\newblock Recent developments in explicit constructions of extractors.
\newblock {\em Bulletin of the EATCS}, 104:67--95, 2011.

\bibitem{stinson2006cryptography}
Douglas Stinson.
\newblock {\em Cryptography: Theory and Practice}.
\newblock CRC Press, 3rd edition, 2006.

\bibitem{ta-Shma2017condenser}
Amos Ta-Shma.
\newblock Explicit condensers with small seed length.
\newblock {\em SIAM Journal on Computing}, 46(3):1111--1133, 2017.

\bibitem{bibb3}
Luca Trevisan and Salil Vadhan.
\newblock Extracting randomness from samplable distributions.
\newblock In {\em Proceedings 41st Annual Symposium on Foundations of Computer
  Science}, pages 32--42. IEEE, 2000.

\bibitem{vadhan2012pseudorandomness}
Salil Vadhan.
\newblock {\em Pseudorandomness}, volume~7.
\newblock Foundations and Trends in Theoretical Computer Science, 2012.

\bibitem{bibc2}
Avi Wigderson and David Zuckerman.
\newblock Expanders that beat the eigenvalue bound: Explicit construction and
  applications.
\newblock {\em Combinatorica}, 19(1):125--138, 1999.

\bibitem{bibb6}
Aviad~Cohen Wigderson.
\newblock Dispersers, deterministic amplification, and weak random sources.
\newblock In {\em Foundations of Computer Science}, volume~30, page~14.
  Citeseer, 1989.

\end{thebibliography}