1. Foundations of Cryptography Lecture 10 Lecturer: Moni Naor

2. Recap of Lecture 9 Hardcore predicates with public randomness The inner product bit: Goldreich-Levin Theorem Applications

3. Pseudo-random generators Definition : a function g:{0,1} * → {0,1}* is said to be a (cryptographic) pseudo-random generator if It is polynomial time computable It stretches the input |g(x)|>|x| – denote by ℓ(n) the length of the output on inputs of length n If the input (seed) is random, then the output is indistinguishable from random For any probabilistic polynomial time adversary A that receives input y of length ℓ(n) and tries to decide whether y= g(x) or is a random string from {0,1} ℓ(n) for any polynomial p(n) and sufficiently large n |Prob[A=`rand’| y=g(x)] - Prob[A=`rand’| y  R {0,1} ℓ(n) ] | < 1/p(n) Want to use the output a pseudo-random generator whenever long random strings are used Especially encryption – have not defined the desired properties yet. Anyone who considers arithmetical methods of producing random numbers is, of course, in a state of sin. J. von Neumann

4. Computational Indistinguishability Definition : two sequences of distributions {D n } and {D’ n } on {0,1} n are computationally indistinguishable if for every polynomial p(n) and sufficiently large n for every probabilistic polynomial time adversary A that receives input y  {0,1} n and tries to decide whether y was generated by D n or D’ n |Prob[A=‘0’ | D n ] - Prob[A=‘0’ | D’ n ] | < 1/p(n) Without restriction on probabilistic polynomial tests: equivalent to variation distance being negligible ∑ β  {0,1} n |Prob[ D n = β] - Prob[ D’ n = β]| < 1/p(n)

5. Hardcore Predicate With Public Information Definition : let f:{0,1} * → {0,1}* be a function. We say that h:{0,1} * x {0,1} * → {0,1} is a hardcore predicate for f if h(x,r) is polynomial time computable For any probabilistic polynomial time adversary A that receives input y=f(x) and public randomness r and tries to compute h(x,r) for any polynomial p(n) and sufficiently large n |Prob[A(y,r)=h(x,r)] -1/2| < 1/p(n) where the probability is over the choice y of r and the random coins of A Alternative view : can think of the public randomness as modifying the one-way function f: f’(x,r)=f(x),r.

6. Inner Product Hardcore bit The inner product bit: choose r  R {0,1} n let h(x,r) = r ∙x = ∑ x i r i mod 2 Theorem [Goldreich-Levin]: for any one-way function the inner product is a hardcore predicate Proof structure: There are many x ’s for which A returns a correct answer on ½+ε of the r ’s take an algorithm A that guesses h(x,r) correctly with probability ½+ε over the r ‘s and output a list of candidates for x –No use of the y info Choose from the list the/an x such that f(x)=y The main step!

7. Application: if subset is one-way, then it is a pseudo-random generator Subset sum problem: given –n numbers 0 ≤ a 1, a 2,…, a n ≤ 2 m –Target sum y –Find subset S ⊆ {1,...,n} ∑ i  S a i,=y Subset sum one-way function f:{0,1} mn+n → {0,1} m f(a 1, a 2,…, a n, x 1, x 2,…, x n ) = (a 1, a 2,…, a n, ∑ i=1 n x i a i mod 2 m ) If m<n then we get out less bits then we put in. Theorem : if for m<n subset sum is a one-way function, then it is also a family of UOWHF (was homework) If m>n then we get out more bits then we put in. Theorem : if for m>n subset sum is a one-way function, then it is also a pseudo-random generator

8. Subset Sum Generator Idea of proof: use the distinguisher A to compute r ∙x For simplicity: do the computation mod P for large prime P Given r  {0,1} n and (a 1, a 2,…, a n,y) Generate new problem (a’ 1, a’ 2,…, a’ n,y’) : Choose c  R Z P Let a’ i = a i if r i = 0 and a i =a i +c mod P if r i = 1 Guess k  R {o,…,n} - the value of ∑ x i r i –the number of locations where x and r are 1 Let y’ = y+c k mod P Run the distinguisher A on (a’ 1, a’ 2,…, a’ n,y’) –output what A says Xored with parity(k) Claim : if k is correct, then (a’ 1, a’ 2,…, a’ n,y’) is  R pseudo-random Claim : for any incorrect k, (a’ 1, a’ 2,…, a’ n,y’) is  R random y’= z + (k-h)c mod P where z = ∑ i=1 n x i a’ i mod P and h=∑ x i r i Therefore: probability to guess correctly r ∙x is 1/n∙(½+ε) + (n-1)/n (½)= ½+ε/n random pseudo- random Prob[A=‘0’|pseudo]= ½+ε Prob[A=‘0’|random]= ½ correct k incorrect k

9. Interpretations of the Goldreich-Levin Theorem A tool for constructing pseudo-random generators The main part of the proof: A mechanism for translating `general confusion’ into randomness –Diffie-Hellman example List decoding of Hadamard Codes –works in the other direction as well (for any code with good list decoding) –List decoding, as opposed to unique decoding, allows getting much closer to distance `Explains’ unique decoding when prediction was 3/4+ε Finding all linear functions agreeing with a function given in a black- box –Learning all Fourier coefficients larger than ε If the Fourier coefficients are concentrated on a small set – can find them –True for AC0 circuits –Decision Trees

10. Composing PRGs Composition Let g 1 be a (ℓ 1, ℓ 2 )- pseudo-random generator g 2 be a (ℓ 2, ℓ 3 )- pseudo-random generator Consider g(x) = g 2 (g 1 (x)) Claim : g is a (ℓ 1, ℓ 3 )- pseudo-random generator Proof: consider three distributions on {0,1} ℓ 3 –D 1 : y uniform in {0,1} ℓ 3 –D 2 : y=g(x) for x uniform in {0,1} ℓ 1 –D 3 : y=g 2 (z) for z uniform in {0,1} ℓ 2 By assumption there is a distinguisher A between D 1 and D 2 A must either distinguish between D 1 and D 3 - can use A use to distinguish g 2 or distinguish between D 2 and D 3 - can use A use to distinguish g 1 ℓ2ℓ2 ℓ1ℓ1 ℓ3ℓ3 triangle inequality

11. Composing PRGs When composing a generator secure against advantage ε 1 and a a generator secure against advantage ε 2 we get security against advantage ε 1 +ε 2 When composing the single bit expansion generator time Loss in security ε/n Hybrid argument: to prove that two distributions D and D’ are indistinguishable: suggest a collection of distributions D= D 0, D 1,… D k =D’ such that If D and D’ can be distinguished, there is a pair D i and D i+1 that can be distinguished. Difference ε between D and D’ means ε/k between some D i and D i+1 Use such a distinguisher to derive a contradiction

12. Homework Let {D n } and {D’ n } be two distributions that are –Computationally indistinguishable –Polynomial time samplable Suppose that {y 1,… y m } are all sampled according to {D n } or all are sampled according to {D’ n } Prove: no probabilistic polynomial time machine can tell, given {y 1,… y m }, whether they were sampled from {D n } or {D’ n }

13. Next-bit Test Definition : a function g:{0,1} * → {0,1}* is said to pass the next bit test if It is polynomial time computable It stretches the input |g(x)|>|x| – denote by ℓ(n) the length of the output on inputs of length n If the input (seed) is random, then the output passes the next-bit test For any prefix 0≤ i< ℓ(n), for any probabilistic polynomial time adversary A that receives the first i bits of y= g(x) fand tries to guess the next bit, or any polynomial p(n) and sufficiently large n |Prob[A(y i,y 2,…, y i )= y i+1 ] – 1/2 | < 1/p(n) Theorem : a function g:{0,1} * → {0,1}* passes the next bit test if and only if it is a pseudo-random generator

14. Existence of PRGs What we have proved: Theorem : if pseudo-random generators stretching by a single bit exist, then pseudo-random generators stretching by any polynomial factor exist Theorem : if one-way permutations exist, then pseudo-random generators exist A harder theorem to prove Theorem [HILL] : if one-way functions exist, then pseudo- random generators exist Homework : show that if pseudo-random generators exist, then one-way functions exist

15. Pseudo-Random Generators concrete version G n :  0,1  m  0,1  n A cryptographically strong pseudo-random sequence generator - if passes all polynomial time statistical tests (t,  )-pseudo-random - no test T running in time t can distinguish with advantage 

16. Three Basic issues in cryptography Identification Authentication Encryption Solve in a shared key environment S S  

17. Identification - Remote login using pseudo-random sequence A and B share key S  0,1  k In order for A to identify itself to B Generate sequence G n (S) For each identification session - send next block of G n (S) G: G n (S) S

18. Problems... More than two parties Malicious adversaries - add noise Coordinating the location block number Better approach: Challenge-Response

19. Challenge-Response Protocol B selects a random location and sends to A A sends value at random location   What’s this?

20. Desired Properties Very long string - prevent repetitions Random access to the sequence Unpredictability - cannot guess the value at a random location –even after seeing values at many parts of the string to the adversary’s choice. –Pseudo-randomness implies unpredictability Not the other way around for blocks

21. Authenticating Messages A wants to send message M  0,1  n to B B should be confident that A is indeed the sender of M One-time application: S  a,b) - where a,b  R  0,1  n To authenticate M: supply aM  b Computation is done in GF[2 n ]

22. Problems and Solutions Problems - same as for identification If a very long random string available - –can use for one-time authentication –Works even if only random looking a,b   Use this!

23. Encryption of Messages A wants to send message M  0,1  n to B only B should be able to learn M One-time application: S  a  - where a  R  0,1  n To encrypt M send a  M

24. Encryption of Messages If a very long random looking string available - –can use as in one-time encryption   Use this!

25. Pseudo-random Functions Concrete Treatment: F  0,1  k  0,1  n  0,1  m key Domain Range Denote Y  F S (X) A family of functions  k  F S  S  0,1  k  is (t, , q)- pseudo-random if it is Efficiently computable - random access and...

26. (t, ,q)-pseudo-random The tester A that can choose adaptively –X 1 and get Y 1  F S (X 1 ) –X 2 and get Y 2  F S (X 2 )  … –X q and get Y q  F S (X q ) Then A has to decide whether – F S  R  k  or – F S  R R n  m  F  F  0,1  n  0,1  m 

27. (t, ,q)-pseudo-random For a function F chosen at random from (1) F k ={F S | S  0,1  k  (2) R n  m =  F | F :  0,1  n   0,1  m  For all t-time machines A that choose q locations and try to distinguish (1) from (2)  Prob  A  ‘1’  F  R F k  - Prob  A  ‘1’  F  R R n  m    

28. Equivalent/Non-Equivalent Definitions Instead of next bit test: for X  X 1,X 2, , X q  chosen by A, decide whether given Y is –Y= F S (X) or –Y  R  0,1  m Adaptive vs. Non-adaptive Unpredictability vs. pseudo-randomness A pseudo-random sequence generator g:  0,1  m  0,1  n –a pseudo-random function on small domain  0,1  log n  0,1  with key in  0,1  m