OWF by encrypting a constant? This question is a generalization of this old, unanswered question.



Suppose we're given a strong PRP $E:\mathcal K\times\mathcal M\to\mathcal C,(K,M)\mapsto C=E(K,M)$. Suppose further we pick a constant parameter $S\in\mathcal M$.

Is $F_S:\mathcal K\to \mathcal C, X\mapsto E(X,S)$ a secure one-way-function?
If the above is not answerable: Is $F_S$ at least a secure OWF for practical purposes?

As example instances one can imagine $S=0^{128},E=\operatorname{AES}$ or $E$ being a fixed-key AES instance within an Even-Mansour construction.
Since $E$ is a secure PRP, instead of giving $C=E(X, S)$ to the adversary, you can give a uniform random $C\gets\mathcal{C}$.  To 'invert' this, adversary has to find a key $X'$ such that $E(X', S)=C$.

So, the construction being one-way function is equivalent to the property that, given a uniform random $C$, it should be hard to find $X$ such that $E(X, S)=C$.  I don't think that this necessarily follows from $E$ being secure, strong PRP.  For example, when the block cipher has polynomial-sized small domain (rather unusual case, I know), then this would not hold.  On the other hand, most reasonable block cipher constructions would have this property, I guess.  So, I think it could be considered as a secure OWF for practical purposes, in reasonable settings.