## Encryption is reporting the value

*g*(*f*(*x*)) instead of*f*(*x*)*g*is 1-1 so it has an inverse (though the inverse may not be known)## g should be totally private; otherwise it can be compromised

## g is a

*derangement function*if it has no fixed point, i.e.,## Derangement alone is not enough

- Need to avoid short periods:
*g*(*g*(*x*)) =*x* - Also want
*g*to be computationally one-way.*g*(*x*) =*x*+1 is no good

- Need to avoid short periods:
## Whether

*g*has a fixed point is undecidable. Generalized SHA?## Question: when is

*g*(*f*(*x*)) totally private?## There exists a totally private derangement function

*g*and a totally private*f*such that*g*(*f*(*x*)) is determined everywhere