Foundation of Cryptography (0368-4162-01), Lecture 4 Pseudorandom - PowerPoint PPT Presentation

Function Families PRF from OWF PRP from PRF Applications Foundation of Cryptography (0368-4162-01), Lecture 4 Pseudorandom Functions Iftach Haitner, Tel Aviv University November 29, 2011

Function Families PRF from OWF PRP from PRF Applications Section 1 Function Families

Function Families PRF from OWF PRP from PRF Applications function families function families F = { F n } n ∈ N , where F n = { f : { 0 , 1 } m ( n ) �→ { 0 , 1 } ℓ ( n ) } 1 We write F = { F n : { 0 , 1 } m ( n ) �→ { 0 , 1 } ℓ ( n ) } 2 If m ( n ) = ℓ ( n ) = n , we omit it from the notation 3 We identify function with their description 4 The rv F n is uniformly distributed over F n 5

Function Families PRF from OWF PRP from PRF Applications efficient function families efficient function families Definition 1 (efficient function family) An ensemble of function families F = {F n } n ∈ N is efficient, if the following hold: Samplable. F is samplable in polynomial-time: there exists a PPT that given 1 n , outputs (the description of) a uniform element in F n . Efficient. There exists a polynomial-time algorithm that given x ∈ { 0 , 1 } n and (a description of) f ∈ F n , outputs f ( x ) .

Function Families PRF from OWF PRP from PRF Applications random functions random functions Definition 2 (random functions) For m , ℓ ∈ N , we let Π m ,ℓ consist of all functions from { 0 , 1 } m to { 0 , 1 } ℓ .

Function Families PRF from OWF PRP from PRF Applications random functions random functions Definition 2 (random functions) For m , ℓ ∈ N , we let Π m ,ℓ consist of all functions from { 0 , 1 } m to { 0 , 1 } ℓ . It takes 2 m · ℓ bits to describe an element inside Π m ,ℓ .

Function Families PRF from OWF PRP from PRF Applications random functions random functions Definition 2 (random functions) For m , ℓ ∈ N , we let Π m ,ℓ consist of all functions from { 0 , 1 } m to { 0 , 1 } ℓ . It takes 2 m · ℓ bits to describe an element inside Π m ,ℓ . We sometimes think of π ∈ Π m ,ℓ as a random string of length 2 m · ℓ .

Function Families PRF from OWF PRP from PRF Applications random functions random functions Definition 2 (random functions) For m , ℓ ∈ N , we let Π m ,ℓ consist of all functions from { 0 , 1 } m to { 0 , 1 } ℓ . It takes 2 m · ℓ bits to describe an element inside Π m ,ℓ . We sometimes think of π ∈ Π m ,ℓ as a random string of length 2 m · ℓ . Π n = Π n , n

Function Families PRF from OWF PRP from PRF Applications pseudorandom functions pseudorandom functions Definition 3 (pseudorandom functions) A function family ensemble F = { F n : { 0 , 1 } m ( n ) �→ { 0 , 1 } ℓ ( n ) } is pseudorandom, if � � � � � Pr [ D F n ( 1 n ) = 1 ] − Pr [ D Π m ( n ) ,ℓ ( n ) ( 1 n ) = 1 � = neg ( n ) , for any oracle-aided PPT D.

Function Families PRF from OWF PRP from PRF Applications pseudorandom functions pseudorandom functions Definition 3 (pseudorandom functions) A function family ensemble F = { F n : { 0 , 1 } m ( n ) �→ { 0 , 1 } ℓ ( n ) } is pseudorandom, if � � � � � Pr [ D F n ( 1 n ) = 1 ] − Pr [ D Π m ( n ) ,ℓ ( n ) ( 1 n ) = 1 � = neg ( n ) , for any oracle-aided PPT D. Suffices to consider ℓ ( n ) = n 1

Function Families PRF from OWF PRP from PRF Applications pseudorandom functions pseudorandom functions Definition 3 (pseudorandom functions) A function family ensemble F = { F n : { 0 , 1 } m ( n ) �→ { 0 , 1 } ℓ ( n ) } is pseudorandom, if � � � � � Pr [ D F n ( 1 n ) = 1 ] − Pr [ D Π m ( n ) ,ℓ ( n ) ( 1 n ) = 1 � = neg ( n ) , for any oracle-aided PPT D. Suffices to consider ℓ ( n ) = n 1 Easy to construct (with no assumption) for m ( n ) = log n 2 and ℓ ∈ poly

Function Families PRF from OWF PRP from PRF Applications pseudorandom functions pseudorandom functions Definition 3 (pseudorandom functions) A function family ensemble F = { F n : { 0 , 1 } m ( n ) �→ { 0 , 1 } ℓ ( n ) } is pseudorandom, if � � � � � Pr [ D F n ( 1 n ) = 1 ] − Pr [ D Π m ( n ) ,ℓ ( n ) ( 1 n ) = 1 � = neg ( n ) , for any oracle-aided PPT D. Suffices to consider ℓ ( n ) = n 1 Easy to construct (with no assumption) for m ( n ) = log n 2 and ℓ ∈ poly PRF easily imply a PRG 3

Function Families PRF from OWF PRP from PRF Applications pseudorandom functions pseudorandom functions Definition 3 (pseudorandom functions) A function family ensemble F = { F n : { 0 , 1 } m ( n ) �→ { 0 , 1 } ℓ ( n ) } is pseudorandom, if � � � � � Pr [ D F n ( 1 n ) = 1 ] − Pr [ D Π m ( n ) ,ℓ ( n ) ( 1 n ) = 1 � = neg ( n ) , for any oracle-aided PPT D. Suffices to consider ℓ ( n ) = n 1 Easy to construct (with no assumption) for m ( n ) = log n 2 and ℓ ∈ poly PRF easily imply a PRG 3 Pseudorandom permutations (PRPs) 4

Function Families PRF from OWF PRP from PRF Applications Section 2 PRF from OWF

Function Families PRF from OWF PRP from PRF Applications the construction the construction Construction 4 Let g : { 0 , 1 } n �→ { 0 , 1 } 2 n . Let g 0 ( s ) = g ( s ) 1 ,..., n and g 1 ( s ) = g ( s ) n + 1 ,..., 2 n . For s and x ∈ { 0 , 1 } ∗ , let f s be defined as f s ( x ) = g x n ( . . . ( g x 2 ( g x 1 ( s ))))

Function Families PRF from OWF PRP from PRF Applications the construction the construction Construction 4 Let g : { 0 , 1 } n �→ { 0 , 1 } 2 n . Let g 0 ( s ) = g ( s ) 1 ,..., n and g 1 ( s ) = g ( s ) n + 1 ,..., 2 n . For s and x ∈ { 0 , 1 } ∗ , let f s be defined as f s ( x ) = g x n ( . . . ( g x 2 ( g x 1 ( s )))) Let F n = { f s : s ∈ { 0 , 1 } n } and F = { F n } .

Function Families PRF from OWF PRP from PRF Applications the construction the construction Construction 4 Let g : { 0 , 1 } n �→ { 0 , 1 } 2 n . Let g 0 ( s ) = g ( s ) 1 ,..., n and g 1 ( s ) = g ( s ) n + 1 ,..., 2 n . For s and x ∈ { 0 , 1 } ∗ , let f s be defined as f s ( x ) = g x n ( . . . ( g x 2 ( g x 1 ( s )))) Let F n = { f s : s ∈ { 0 , 1 } n } and F = { F n } . g is efficient function implies that F is an efficient family.

Function Families PRF from OWF PRP from PRF Applications the construction the construction Construction 4 Let g : { 0 , 1 } n �→ { 0 , 1 } 2 n . Let g 0 ( s ) = g ( s ) 1 ,..., n and g 1 ( s ) = g ( s ) n + 1 ,..., 2 n . For s and x ∈ { 0 , 1 } ∗ , let f s be defined as f s ( x ) = g x n ( . . . ( g x 2 ( g x 1 ( s )))) Let F n = { f s : s ∈ { 0 , 1 } n } and F = { F n } . g is efficient function implies that F is an efficient family. Theorem 5 (Goldreich-Goldwasser-Micali) If g is a PRG then F is a PRF .

Function Families PRF from OWF PRP from PRF Applications the construction the construction Construction 4 Let g : { 0 , 1 } n �→ { 0 , 1 } 2 n . Let g 0 ( s ) = g ( s ) 1 ,..., n and g 1 ( s ) = g ( s ) n + 1 ,..., 2 n . For s and x ∈ { 0 , 1 } ∗ , let f s be defined as f s ( x ) = g x n ( . . . ( g x 2 ( g x 1 ( s )))) Let F n = { f s : s ∈ { 0 , 1 } n } and F = { F n } . g is efficient function implies that F is an efficient family. Theorem 5 (Goldreich-Goldwasser-Micali) If g is a PRG then F is a PRF . Corollary 6 OWFs imply PRFs.

Function Families PRF from OWF PRP from PRF Applications Proof Idea Proof Idea Easy to prove for input of length 2.

Function Families PRF from OWF PRP from PRF Applications Proof Idea Proof Idea Easy to prove for input of length 2. Observation: D = ( g ( g 0 ( U n )) , g ( g 1 ( U n ))) is pseudorandom:

Function Families PRF from OWF PRP from PRF Applications Proof Idea Proof Idea Easy to prove for input of length 2. Observation: D = ( g ( g 0 ( U n )) , g ( g 1 ( U n ))) is pseudorandom: Proof: D ′ = ( g ( U ( 0 ) n ) , g ( U 1 n )) ≈ c U 4 n and D ≈ c D ′ .

Function Families PRF from OWF PRP from PRF Applications Proof Idea Proof Idea Easy to prove for input of length 2. Observation: D = ( g ( g 0 ( U n )) , g ( g 1 ( U n ))) is pseudorandom: Proof: D ′ = ( g ( U ( 0 ) n ) , g ( U 1 n )) ≈ c U 4 n and D ≈ c D ′ . Hence we can handle input of length 2 Extend to longer inputs?

Function Families PRF from OWF PRP from PRF Applications Proof Idea Proof Idea Easy to prove for input of length 2. Observation: D = ( g ( g 0 ( U n )) , g ( g 1 ( U n ))) is pseudorandom: Proof: D ′ = ( g ( U ( 0 ) n ) , g ( U 1 n )) ≈ c U 4 n and D ≈ c D ′ . Hence we can handle input of length 2 Extend to longer inputs? We show that an efficient sample from the truth table of f ← F n , is computationally indistinguishable from that of π ← Π n , n .

Function Families PRF from OWF PRP from PRF Applications Actual proof Actual proof Assume ∃ PPT D, p ∈ poly and infinite set I ⊆ N with � � 1 � � � Pr [ D F n ( 1 n ) = 1 ] − Pr [ D Π n ( 1 n ) = 1 ] � ≥ p ( n ) , (1) for any n ∈ I and fix n ∈ N