Foundation of Cryptography (0368-4162-01), Lecture 3 Hardcore - PowerPoint PPT Presentation

The Information Theoretic Case The Computational Case Foundation of Cryptography (0368-4162-01), Lecture 3 Hardcore Predicates for Any One-way Function Iftach Haitner, Tel Aviv University November 22, 2011

The Information Theoretic Case The Computational Case Definition 1 (hardcore predicates) An efficiently computable function b : { 0 , 1 } n �→ { 0 , 1 } is an hardcore predicate of f : { 0 , 1 } n �→ { 0 , 1 } n , if Pr [ P ( f ( U n )) = b ( U n )] ≤ 1 2 + neg ( n ) , for any PPT P .

The Information Theoretic Case The Computational Case Definition 1 (hardcore predicates) An efficiently computable function b : { 0 , 1 } n �→ { 0 , 1 } is an hardcore predicate of f : { 0 , 1 } n �→ { 0 , 1 } n , if Pr [ P ( f ( U n )) = b ( U n )] ≤ 1 2 + neg ( n ) , for any PPT P . Theorem 2 (Goldreich-Levin) Let f : { 0 , 1 } n �→ { 0 , 1 } n be a OWF, and define g : { 0 , 1 } n × { 0 , 1 } n �→ { 0 , 1 } n × { 0 , 1 } n as g ( x , r ) = f ( x ) , r. Then b ( x , r ) = � x , r � 2 , is an hardcore predicate of g. Note that if f is one-to-one, then so is g .

The Information Theoretic Case The Computational Case Section 1 The Information Theoretic Case

The Information Theoretic Case The Computational Case Definition 3 (min-entropy) The min entropy of a random variable X , is defined 1 H ∞ ( X ) := y ∈ Supp ( X ) log min Pr X [ y ] .

The Information Theoretic Case The Computational Case Definition 3 (min-entropy) The min entropy of a random variable X , is defined 1 H ∞ ( X ) := y ∈ Supp ( X ) log min Pr X [ y ] . Examples X is uniform over a set of size 2 k

The Information Theoretic Case The Computational Case Definition 3 (min-entropy) The min entropy of a random variable X , is defined 1 H ∞ ( X ) := y ∈ Supp ( X ) log min Pr X [ y ] . Examples X is uniform over a set of size 2 k ( X | f ( X ) = y ) , where f : { 0 , 1 } n �→ { 0 , 1 } n is 2 k to 1 and X is uniform over { 0 , 1 } n

The Information Theoretic Case The Computational Case Pairwise independent hashing Pairwise independent hashing Definition 4 (pairwise independent hash functions) A function family H from { 0 , 1 } n to { 0 , 1 } m is pairwise independent, if for every x � = x ′ ∈ { 0 , 1 } n and y , y ′ ∈ { 0 , 1 } m , it holds that Pr h ←H [ h ( x ) = y ∧ h ( x ′ ) = y ′ )] = 2 − 2 m .

The Information Theoretic Case The Computational Case Pairwise independent hashing Pairwise independent hashing Definition 4 (pairwise independent hash functions) A function family H from { 0 , 1 } n to { 0 , 1 } m is pairwise independent, if for every x � = x ′ ∈ { 0 , 1 } n and y , y ′ ∈ { 0 , 1 } m , it holds that Pr h ←H [ h ( x ) = y ∧ h ( x ′ ) = y ′ )] = 2 − 2 m . Lemma 5 (leftover hash lemma) Let X be a random variable over { 0 , 1 } n with H ∞ ( X ) ≥ k and let H be a family of pairwise independent hash functions from { 0 , 1 } n to { 0 , 1 } m , then SD (( h , h ( x )) h ←H , x ← X , ( h , y ) h ←H , y ←{ 0 , 1 } m ) ≤ 2 ( m − k − 2 )) / 2 .

The Information Theoretic Case The Computational Case Pairwise independent hashing Pairwise independent hashing Definition 4 (pairwise independent hash functions) A function family H from { 0 , 1 } n to { 0 , 1 } m is pairwise independent, if for every x � = x ′ ∈ { 0 , 1 } n and y , y ′ ∈ { 0 , 1 } m , it holds that Pr h ←H [ h ( x ) = y ∧ h ( x ′ ) = y ′ )] = 2 − 2 m . Lemma 5 (leftover hash lemma) Let X be a random variable over { 0 , 1 } n with H ∞ ( X ) ≥ k and let H be a family of pairwise independent hash functions from { 0 , 1 } n to { 0 , 1 } m , then SD (( h , h ( x )) h ←H , x ← X , ( h , y ) h ←H , y ←{ 0 , 1 } m ) ≤ 2 ( m − k − 2 )) / 2 . * We typically simply write SD (( H , H ( X )) , ( H , U m )) , where H is uniformly distributed over H .

The Information Theoretic Case The Computational Case efficient function families efficient function families Definition 6 (efficient function family) An ensemble of function families F = {F n } n ∈ N is efficient, if the following hold: Samplable. F is samplable in polynomial-time: there exists a PPT that given 1 n , outputs (the description of) a uniform element in F n . Efficient. There exists a polynomial-time algorithm that given x ∈ { 0 , 1 } n and (a description of) f ∈ F n , outputs f ( x ) .

The Information Theoretic Case The Computational Case hardcore predicate for regular functions hardcore predicate for regular OWF Lemma 7 Let f : { 0 , 1 } n �→ { 0 , 1 } n be a d ( n ) ∈ 2 ω ( log n ) regular function and let H = {H n } be an efficient family of Boolean pairwise independent hash functions over { 0 , 1 } n . Define g : { 0 , 1 } n × H n �→ { 0 , 1 } n × H n as g ( x , h ) = ( f ( x ) , h ) , then b ( x , h ) = h ( x ) is an hardcore predicate of g.

The Information Theoretic Case The Computational Case hardcore predicate for regular functions hardcore predicate for regular OWF Lemma 7 Let f : { 0 , 1 } n �→ { 0 , 1 } n be a d ( n ) ∈ 2 ω ( log n ) regular function and let H = {H n } be an efficient family of Boolean pairwise independent hash functions over { 0 , 1 } n . Define g : { 0 , 1 } n × H n �→ { 0 , 1 } n × H n as g ( x , h ) = ( f ( x ) , h ) , then b ( x , h ) = h ( x ) is an hardcore predicate of g. How does it relate to the computational case?

The Information Theoretic Case The Computational Case hardcore predicate for regular functions hardcore predicate for regular OWF Lemma 7 Let f : { 0 , 1 } n �→ { 0 , 1 } n be a d ( n ) ∈ 2 ω ( log n ) regular function and let H = {H n } be an efficient family of Boolean pairwise independent hash functions over { 0 , 1 } n . Define g : { 0 , 1 } n × H n �→ { 0 , 1 } n × H n as g ( x , h ) = ( f ( x ) , h ) , then b ( x , h ) = h ( x ) is an hardcore predicate of g. How does it relate to the computational case? Proof : We prove the claim by showing that Claim 8 SD (( f ( U n ) , H , H ( U n )) , ( f ( U n ) , H , U 1 )) = neg ( n ) , where the rv H = H ( n ) is uniformly distributed over H n .

The Information Theoretic Case The Computational Case hardcore predicate for regular functions hardcore predicate for regular OWF Lemma 7 Let f : { 0 , 1 } n �→ { 0 , 1 } n be a d ( n ) ∈ 2 ω ( log n ) regular function and let H = {H n } be an efficient family of Boolean pairwise independent hash functions over { 0 , 1 } n . Define g : { 0 , 1 } n × H n �→ { 0 , 1 } n × H n as g ( x , h ) = ( f ( x ) , h ) , then b ( x , h ) = h ( x ) is an hardcore predicate of g. How does it relate to the computational case? Proof : We prove the claim by showing that Claim 8 SD (( f ( U n ) , H , H ( U n )) , ( f ( U n ) , H , U 1 )) = neg ( n ) , where the rv H = H ( n ) is uniformly distributed over H n . Does this conclude the proof?

The Information Theoretic Case The Computational Case hardcore predicate for regular functions Proving Claim 8 Proof : For y ∈ f ( { 0 , 1 } n ) := { f ( x ): x ∈ { 0 , 1 } n } , let the rv X y be uniformly distributed over f − 1 ( y ) := { x ∈ { 0 , 1 } n : f ( x ) = y } .

The Information Theoretic Case The Computational Case hardcore predicate for regular functions Proving Claim 8 Proof : For y ∈ f ( { 0 , 1 } n ) := { f ( x ): x ∈ { 0 , 1 } n } , let the rv X y be uniformly distributed over f − 1 ( y ) := { x ∈ { 0 , 1 } n : f ( x ) = y } . SD (( f ( U n ) , H , H ( U n )) , ( f ( U n ) , H , U 1 )) � � = Pr [ f ( U n ) = y ] · SD ( f ( U n ) , H , H ( U n ) | f ( U n ) = y ) y ∈ f ( { 0 , 1 } n ) � , ( f ( U n ) , H , U 1 | f ( U n ) = y )

The Information Theoretic Case The Computational Case hardcore predicate for regular functions Proving Claim 8 Proof : For y ∈ f ( { 0 , 1 } n ) := { f ( x ): x ∈ { 0 , 1 } n } , let the rv X y be uniformly distributed over f − 1 ( y ) := { x ∈ { 0 , 1 } n : f ( x ) = y } . SD (( f ( U n ) , H , H ( U n )) , ( f ( U n ) , H , U 1 )) � � = Pr [ f ( U n ) = y ] · SD ( f ( U n ) , H , H ( U n ) | f ( U n ) = y ) y ∈ f ( { 0 , 1 } n ) � , ( f ( U n ) , H , U 1 | f ( U n ) = y ) � = Pr [ f ( U n ) = y ] · SD (( y , H , H ( X y )) , ( y , H , U 1 )) y ∈ f ( { 0 , 1 } n )

The Information Theoretic Case The Computational Case hardcore predicate for regular functions Proving Claim 8 Proof : For y ∈ f ( { 0 , 1 } n ) := { f ( x ): x ∈ { 0 , 1 } n } , let the rv X y be uniformly distributed over f − 1 ( y ) := { x ∈ { 0 , 1 } n : f ( x ) = y } . SD (( f ( U n ) , H , H ( U n )) , ( f ( U n ) , H , U 1 )) � � = Pr [ f ( U n ) = y ] · SD ( f ( U n ) , H , H ( U n ) | f ( U n ) = y ) y ∈ f ( { 0 , 1 } n ) � , ( f ( U n ) , H , U 1 | f ( U n ) = y ) � = Pr [ f ( U n ) = y ] · SD (( y , H , H ( X y )) , ( y , H , U 1 )) y ∈ f ( { 0 , 1 } n ) ≤ y ∈ f ( { 0 , 1 } n ) SD (( y , H , H ( X y )) , ( y , H , U 1 )) max