Foundation of Cryptography (0368-4162-01), Lecture 2 Pseudorandom - PowerPoint PPT Presentation

Foundation of Cryptography (0368-4162-01), Lecture 2 Pseudorandom Generators Iftach Haitner, Tel Aviv University Tel Aviv University. February 25, 2014 Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 1 / 26

Part I Statistical Vs. Computational distance Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 2 / 26

Section 1 Distributions and Statistical Distance Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 3 / 26

Distributions and Statistical Distance Let P and Q be two distributions over a finite set U . Their statistical distance (also known as, variation distance) is defined as SD ( P , Q ) := 1 � | P ( x ) − Q ( x ) | = max S⊆U ( P ( S ) − Q ( S )) 2 x ∈U We will only consider finite distributions. Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 4 / 26

Distributions and Statistical Distance Let P and Q be two distributions over a finite set U . Their statistical distance (also known as, variation distance) is defined as SD ( P , Q ) := 1 � | P ( x ) − Q ( x ) | = max S⊆U ( P ( S ) − Q ( S )) 2 x ∈U We will only consider finite distributions. Claim 1 For any pair of (finite) distribution P and Q , it holds that SD ( P , Q ) = max D { Pr x ← P [ D ( x ) = 1 ] − Pr x ← Q [ D ( x ) = 1 ] } , where D is any algorithm. Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 4 / 26

Some useful facts Let P , Q , R be finite distributions, then Triangle inequality: SD ( P , R ) ≤ SD ( P , Q ) + SD ( Q , R ) Repeated sampling: SD (( P , P ) , ( Q , Q )) ≤ 2 · SD ( P , Q ) Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 5 / 26

Distribution ensembles and statistical indistinguishability Definition 2 (distribution ensembles) P = { P n } n ∈ N is a distribution ensemble, if P n is a (finite) distribution for any n ∈ N . P is efficiently samplable (or just efficient), if ∃ PPT Samp with Sam ( 1 n ) ≡ P n . Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 6 / 26

Distribution ensembles and statistical indistinguishability Definition 2 (distribution ensembles) P = { P n } n ∈ N is a distribution ensemble, if P n is a (finite) distribution for any n ∈ N . P is efficiently samplable (or just efficient), if ∃ PPT Samp with Sam ( 1 n ) ≡ P n . Definition 3 (statistical indistinguishability) Two distribution ensembles P and Q are statistically indistinguishable, if SD ( P n , Q n ) = neg ( n ) . Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 6 / 26

Distribution ensembles and statistical indistinguishability Definition 2 (distribution ensembles) P = { P n } n ∈ N is a distribution ensemble, if P n is a (finite) distribution for any n ∈ N . P is efficiently samplable (or just efficient), if ∃ PPT Samp with Sam ( 1 n ) ≡ P n . Definition 3 (statistical indistinguishability) Two distribution ensembles P and Q are statistically indistinguishable, if SD ( P n , Q n ) = neg ( n ) . � � � ∆ D Alternatively, if ( P , Q ) ( n ) � = neg ( n ) , for any algorithm D, where � � ∆ D x ← P n [ D ( 1 n , x ) = 1 ] − Pr x ← Q n [ D ( 1 n , x ) = 1 ] ( P , Q ) ( n ) := Pr (1) Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 6 / 26

Section 2 Computational Indistinguishability Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 7 / 26

Computational Indistinguishability Definition 4 (computational indistinguishability) Two distribution ensembles P and Q are computationally � � � ∆ D indistinguishable, if ( P , Q ) ( n ) � = neg ( n ) , for any PPT D. � � Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 8 / 26

Computational Indistinguishability Definition 4 (computational indistinguishability) Two distribution ensembles P and Q are computationally � � � ∆ D indistinguishable, if ( P , Q ) ( n ) � = neg ( n ) , for any PPT D. � � Can it be different from the statistical case? Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 8 / 26

Computational Indistinguishability Definition 4 (computational indistinguishability) Two distribution ensembles P and Q are computationally � � � ∆ D indistinguishable, if ( P , Q ) ( n ) � = neg ( n ) , for any PPT D. � � Can it be different from the statistical case? Non uniform variant Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 8 / 26

Computational Indistinguishability Definition 4 (computational indistinguishability) Two distribution ensembles P and Q are computationally � � � ∆ D indistinguishable, if ( P , Q ) ( n ) � = neg ( n ) , for any PPT D. � � Can it be different from the statistical case? Non uniform variant Sometime behaves differently then expected! Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 8 / 26

Repeated sampling Question 5 Assume that P and Q are computationally indistinguishable, is it always true that P 2 = ( P , P ) and Q 2 = ( Q , Q ) are? Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 9 / 26

Repeated sampling Question 5 Assume that P and Q are computationally indistinguishable, is it always true that P 2 = ( P , P ) and Q 2 = ( Q , Q ) are? � � � ∆ D Let D be an algorithm and let δ ( n ) = ( P 2 , Q 2 ) ( n ) � � � Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 9 / 26

Repeated sampling Question 5 Assume that P and Q are computationally indistinguishable, is it always true that P 2 = ( P , P ) and Q 2 = ( Q , Q ) are? � � � ∆ D Let D be an algorithm and let δ ( n ) = ( P 2 , Q 2 ) ( n ) � � � δ ( n ) = | Pr [ D ( x ) = 1 ] − Pr [ D ( x ) = 1 ] | x ← P 2 x ← Q 2 n n � � � � ≤ � Pr [ D ( x ) = 1 ] − x ← ( P n , Q n ) [ D ( x ) = 1 ] Pr � � x ← P 2 � n � � � � + x ← ( P n , Q n ) [ D ( x ) = 1 ] − Pr Pr [ D ( x ) = 1 ] � � x ← Q 2 � � n Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 9 / 26

Repeated sampling Question 5 Assume that P and Q are computationally indistinguishable, is it always true that P 2 = ( P , P ) and Q 2 = ( Q , Q ) are? � � � ∆ D Let D be an algorithm and let δ ( n ) = ( P 2 , Q 2 ) ( n ) � � � δ ( n ) = | Pr [ D ( x ) = 1 ] − Pr [ D ( x ) = 1 ] | x ← P 2 x ← Q 2 n n � � � � ≤ � Pr [ D ( x ) = 1 ] − x ← ( P n , Q n ) [ D ( x ) = 1 ] Pr � � x ← P 2 � n � � � � + x ← ( P n , Q n ) [ D ( x ) = 1 ] − Pr Pr [ D ( x ) = 1 ] � � x ← Q 2 � � n � � � � � ∆ D � ∆ D = ( P 2 , ( P , Q ) ( n ) � + (( P , Q ) , Q 2 ) ( n ) � � � � � Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 9 / 26

Repeated sampling Question 5 Assume that P and Q are computationally indistinguishable, is it always true that P 2 = ( P , P ) and Q 2 = ( Q , Q ) are? � � � ∆ D Let D be an algorithm and let δ ( n ) = ( P 2 , Q 2 ) ( n ) � � � δ ( n ) = | Pr [ D ( x ) = 1 ] − Pr [ D ( x ) = 1 ] | x ← P 2 x ← Q 2 n n � � � � ≤ � Pr [ D ( x ) = 1 ] − x ← ( P n , Q n ) [ D ( x ) = 1 ] Pr � � x ← P 2 � n � � � � + x ← ( P n , Q n ) [ D ( x ) = 1 ] − Pr Pr [ D ( x ) = 1 ] � � x ← Q 2 � � n � � � � � ∆ D � ∆ D = ( P 2 , ( P , Q ) ( n ) � + (( P , Q ) , Q 2 ) ( n ) � � � � � So either | ∆ D ( P 2 , ( P , Q ) ( n ) | ≥ δ ( n ) / 2, or | ∆ D (( P , Q ) , Q 2 ) ( n ) | ≥ δ ( n ) / 2 Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 9 / 26

� � � ∆ D Assume D is a PPT and that ( P 2 , Q 2 ) ( n ) � ≥ 1 / p ( n ) for some � � p ∈ poly and infinitely many n ’s, and assume wlg. that � � � ∆ D P 2 , ( P , Q ) ( n ) � ≥ 1 / 2 p ( n ) for infinitely many n ’s. � � Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 10 / 26

� � � ∆ D Assume D is a PPT and that ( P 2 , Q 2 ) ( n ) � ≥ 1 / p ( n ) for some � � p ∈ poly and infinitely many n ’s, and assume wlg. that � � � ∆ D P 2 , ( P , Q ) ( n ) � ≥ 1 / 2 p ( n ) for infinitely many n ’s. � � Can we use D to contradict the fact that P and Q are computationally close? Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 10 / 26

� � � ∆ D Assume D is a PPT and that ( P 2 , Q 2 ) ( n ) � ≥ 1 / p ( n ) for some � � p ∈ poly and infinitely many n ’s, and assume wlg. that � � � ∆ D P 2 , ( P , Q ) ( n ) � ≥ 1 / 2 p ( n ) for infinitely many n ’s. � � Can we use D to contradict the fact that P and Q are computationally close? Assuming that P and Q are efficiently samplable Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 10 / 26

� � � ∆ D Assume D is a PPT and that ( P 2 , Q 2 ) ( n ) � ≥ 1 / p ( n ) for some � � p ∈ poly and infinitely many n ’s, and assume wlg. that � � � ∆ D P 2 , ( P , Q ) ( n ) � ≥ 1 / 2 p ( n ) for infinitely many n ’s. � � Can we use D to contradict the fact that P and Q are computationally close? Assuming that P and Q are efficiently samplable Non-uniform settings Iftach Haitner (TAU) Foundation of Cryptography February 25, 2014 10 / 26