Ronen Shaltiel

Simple extractors for all min-entropies and a new pseudorandom generator

A “randomness extractor” is an algorithm that given a sample from a distribution with sufficiently high min-entropy and a short random seed produces an output that is statistically indistinguishable from uniform. (Min-entropy is a measure of the amount of randomness in a distribution.) We present a simple, self-contained extractor construction that produces good extractors for all min-entropies. Our construction is algebraic and builds on a new polynomial-based approach introduced by Ta-Shma et al. [2001b]. Using our improvements, we obtain, for example, an extractor with output length m = k/(log n)O(1/α) and seed length (1 + α)log n for an arbitrary 0 < α ≤ 1, where n is the input length, and k is the min-entropy of the input distribution.A “pseudorandom generator” is an algorithm that given a short random seed produces a long output that is computationally indistinguishable from uniform. Our technique also gives a new way to construct pseudorandom generators from functions that require large circuits. Our pseudorandom generator construction is not based on the Nisan-Wigderson generator [Nisan and Wigderson 1994], and turns worst-case hardness directly into pseudorandomness. The parameters of our generator match those in Impagliazzo and Wigderson [1997] and Sudan et al. [2001] and in particular are strong enough to obtain a new proof that P = BPP if E requires exponential size circuits.Our construction also gives the following improvements over previous work:---We construct an optimal “hitting set generator” that stretches O(log n) random bits into sΩ(1) pseudorandom bits when given a function on log n bits that requires circuits of size s. This yields a quantitatively optimal hardness versus randomness tradeoff for both RP and BPP and solves an open problem raised in Impagliazzo et al. [1999].---We give the first construction of pseudorandom generators that fool nondeterministic circuits when given a function that requires large nondeterministic circuits. This technique also give a quantitatively optimal hardness versus randomness tradeoff for AM and the first hardness amplification result for nondeterministic circuits.

Simulating independence: new constructions of condensers, ramsey graphs, dispersers, and extractors

A distribution <i>X</i> over binary strings of length <i>n</i> has min-entropy <i>k</i> if every string has probability at most 2^-<i>k</i> in <i>X</i>. We say that <i>X</i> is a δ-source if its rate <i>k</i>⁄<i>n</i> is at least δ.We give the following new explicit instructions (namely, poly(n)- time computable functions) of <i>deterministic</i>extractors, dispersers and related objects. All work for any fixed rate δ>0. No previous explicit construction was known for either of these, for any δ‹1⁄2. The first two constitute major progress to very long-standing open problems. <ol><li><b>Bipartite Ramsey</b> <i>f</i><inf>1</inf>: (0,1)ⁿ)² →0,1, such that for any two independent δ-sources <i>X</i><inf>1</inf>, <i>X</i><inf>2</inf> we have <i>f</i><inf>1</inf>(<i>X</i><inf>1</inf>,<i>X</i><inf>2</inf>) = 0,1 This implies a new explicit construction of <i>2N</i>-vertex bipartite graphs where no induced <i>N</i>^δ by <i>N</i>^δ subgraph is complete or empty.</li> <li><b>Multiple source extraction</b> <i>f</i><inf>2</inf>: (0,1<i>n</i>)³→0,1 such that for any three independent δ-sources <i>X</i><inf>1</inf>,<i>X</i><inf>2</inf>,<i>X</i><inf>3</inf> we have that <i>f</i><inf>2</inf>(<i>X</i><inf>1</inf>,<i>X</i><inf>2</inf>,<i>X</i><inf>3</inf>) is (<i>o</i>(1)-close to being) an unbiased random bit.</li> <li><b>Constant seed condenser</b>² <i>f</i><inf>3</inf>: <i>ⁿ</i> →(0,1^<i>m</i>)^<i>c</i>, such that for any δ-source <i>X</i>, one of the <i>c</i> output distributions <i>f</i><inf>3</inf>(<i>X</i>)<inf><i>i</i></inf>, is a 0.9-source over 0,1<i>^m</i>. Here <i>c</i> is a constant depending only on δ.</li><li><b>Subspace Ramsey</b> <i>f</i>4: 0,1<i>ⁿ</i>→0,1 such that for any <i>affine</i>-δ-source³ <i>X</i> we have <i>f</i><inf>4</inf>(<i>X</i>)= 0,1.</li></ol>The constructions are quite involved and use as building blocks other new and known gadgets. But we can point out two important themes which recur in these constructions. One is that gadgets which were designed to work with independent inputs, sometimes perform well enough with correlated, high entropy inputs. The second is using the input to (introspectively) find high entropy regions within itself.

Computational Analogues of Entropy

Min-entropy is a statistical measure of the amount of randomness that a particular distribution contains. In this paper we investigate the notion of computational min-entropy which is the computational analog of statistical min-entropy. We consider three possible definitions for this notion, and show equivalence and separation results for these definitions in various computational models.

True random number generators secure in a changing environment

A true random number generator (TRNG) usually consists of two components: an “unpredictable” source with high entropy, and a randomness extractor — a function which, when applied to the source, produces a result that is statistically close to the uniform distribution. When the output of a TRNG is used for cryptographic needs, it is prudent to assume that an adversary may have some (limited) influence on the distribution of the high-entropy source. In this work:

Simple extractors for all min-entropies and a new pseudo-random generator

We present a simple, self-contained extractor construction that produces good extractors for all min-entropies (min-entropy measures the amount of randomness contained in a weak random source). Our construction is algebraic and builds on a new polynomial-based approach introduced by A. Ta-Shma et al. (2001). Using our improvements, we obtain, for example, an extractor with output length m=k/sup 1-/spl delta// and seed length O(log n). This matches the parameters of L. Trevisans (1999) breakthrough result and additionally achieves those parameters for small min-entropies k. Our construction gives a much simpler and more direct solution to this problem. Applying similar ideas to the problem of building pseudo-random generators, we obtain a new pseudo-random generator construction that is not based on the NW generator (N. Nisan and A. Widgerson, 1994), and turns worst-case hardness directly into pseudo-randomness. The parameters of this generator are strong enough to obtain a new proof that P=BPP if E requires exponential size circuits. Essentially, the same construction yields a hitting set generator with optimal seed length that outputs s/sup /spl Omega/(1)/ bits when given a function that requires circuits of size s (for any s). This implies a hardness versus randomness trade off for RP and BPP that is optimal (up to polynomial factors), solving an open problem raised by R. Impagliazzo et al. (1999). Our generators can also be used to derandomize AM.

Deterministic Extractors for Bit-Fixing Sources by Obtaining an Independent Seed

An

Extractors and pseudo-random generators with optimal seed length

(n,k)

Constant-Round Oblivious Transfer in the Bounded Storage Model

-bit-fixing source is a distribution

Near-optimal conversion of hardness into pseudo-randomness

X

Hardness Amplification Proofs Require Majority

over