Take the 2-minute tour ×  Define a commutative block cipher with
keyspace the finite set $K$, and data space the finite set $S$,
to be an application $$\begin{align} E:K\times S&\mapsto S\\
(k,x)&\mapsto E(k,x)\text{ also noted }E_k(x)\\ \text{such that
}&\forall k\in K,\forall x\in S, \forall y\in S,\text{ if
}E(k,x)=E(k,y)\text{ then }x=y\\ \text{and }&\forall k\in
K,\forall k'\in K, \forall x\in S,E(k',E(k,x))=E(k,E(k',x))\\
\end{align}$$ Note: the first property states that the
application $E_k$ from $S$ to $S$ is injective, implying that it
is a permutation of $S$ given this is a finite set, and that's
standard for a cipher; the second property is what makes the
cipher commutative.  Question: what commutative block cipher do
we have that is    • conjectured computationally
indistinguishable with effort polynomial in $\log(|K|)$ from a
random permutation for unknown random fixed key $k$, assuming
the attacker can obtain ciphertext for iteratively chosen
plaintext;   • efficiently computable, at least in t