Lecture 7: Hard-core Predicate and PRG

Transcription

1 CS 290G (Fall 2014) Introduction to Cryptography Oct 28th, 2014 Instructor: Rachel Lin 1 Recap Lecture 7: Hard-core Predicate and PRG 1.1 Computational Indistiguishability Scribe: Leonardo Bohac Last time, we came up with the concept of Computational Indistinguishability, which applies to distributions, let s say {X n } and {Y n }, that appear the same to computational bounded tests. Formal Definition: Two distributions are said to be computational indistinguishable {X n } {Y n } if n.u.ppt distinguisher D and n > n 0 : Properties: AdvD(X n, Y n ) = P r[x X n : D(x) = 1] P r[y Y n : D(y) = 1] ɛ(n) Closure under efficient operation: {X n } {Y n } pptm, {M(X n )} {M(Y n )} Transitivity (Hybrid Lemma): {X 1n } {X mn } {X in } {X (i+1)n }, i = 1, 2...(m 1) 1.2 Pseudo-random Generator A pseudo-random generator G is a function that operates over strings and has these properties: G is easy to evaluate G(x) < x {x (0, 1) n ; G(x)} is pseudo-random ( {U l(n) }) Our aim in this class is to construct a PRG. In order to do so, we need to approach an Accurate version of the Hybrid Lemma and define the Hard-core Predicate. 7-1

2 2 Accurate Hybrid Lemma 2.1 Lemma Say D distinguishes X and Y with probability u, Adv D (X, Y ) > u Say D distinguishes {X n } and {Y n } with probability u(.), Adv D (X n, Y n ) > u(n) Let X 1...X m be a sequence of distributions. Lemma: If D distinguishes X 1, X m with probability ε, then i such that D distinguishes X i, X i+1 with probability ε/m 2.2 Proof g i = P r[x X i : D(x) = 1] By premise, g 1 g m > ε (g 1 g 2 ) + (g 2 g 3 )...(g m 1 g m ) g i g i+1 g i g i+1 > ε Finally, i such that g i g i+1 > ε/m This lead us to a new corollary 2.3 Hybrid Lemma Corollary Corollary: constant m, {X 1n }...{X mn }, if {X 1n } {X (i+1)n } then {X 1n } {X mn }. fixed m N, look at X 1n...X mn, 7-2

3 if D that distinguishes X 1n, X mn with probability 1/p (by lemma) i such that D distinguishes X in, X (i+1)n with probability 1/pm. 3 PRG Construction - Part bit expansion (part 1) The first step we will take is to construct a PRG G that expands 1 bit: G(x) = x + 1 In order to do so, let s assume we have an One-Way-Permutation function such that: permutation π, {π(u n )} U n We want a predicate h, such that: {x U n : π(x) h(x)} U n+1 Minimum Properties of h: h(x) should be a pseudo random distribution for 1 bit π need to be OW at least h(x) should be hard to predict given π(x) This leads us to the concept of Hard-core predicate. 4 Hard-core predicate 4.1 Definition h is hard-core predicate for a function f if n.u.ppt predictor P, negligible ɛ such that: and h(x) is easy to evaluate Pr[x U n : P (f(x)) = h(x)] ɛ(n) mod N, h(x) = LSB(x) = x 1 (least significa- Example: RSA function f N,e (x) = x e tive bit of x 7-3

4 Given x e for x Z N, it s hard to predict x 1 Theorem: RSA assumption LSB is hard-core predicate for RSA functions. 5 PRG Construction - Part bit expansion (part 2) Given the OWP f and its associated hard-core predicate h, let us construct G that expands 1 bit this way: G(x) = f(x) h(x) Theorem: G is a PRG Proof: 1. G is easy to evaluate? Yes! Because f and h are. 2. G(x) = x + 1? Yes. 3. {G(U n )} {U n+1 }? Let s see why: Prove of (3) by contraposition: If {G(U n )} is not PRG h is not hard-core predicate Assume D and p(n) such that D distinguishes {G(U n )} from {U n+1 } with probability 1 p(n). Then and q(n) such that: P r[x U n : E(f(x)) = h(x)] 1 q(n) Let P 1 = P r[x U n : D(f(x) h(x)) = 1], P 2 = P r[x U n ; b U n : D(f(x) b) = 1] by premise P 1 P 2 1 p(n), but let s assume for convinience P 1 P 2, so we can take out the absolute value and have P 1 P 2 1 p(n) 7-4

5 Let s define P 3 = P r[x U n : D(f(x) h(x)) = 1], where h(x) = 1 h(x) obs: P 2 = 1 2 (P 1 + P 3 ) Since P (P 1 + P 3 ) 1 (p(n), that means (P 1 P 3 ) 2 p(n) D tends to output 1 when it receives f(x) h(x), and 0 when it receives f(x) h(x) Now let s construct E using D: Suppose E receives r = f(x) as a parameter. //E(r) Then g D(r v), where v U 1 Let us consider the following algorithm computed by E: If g = 1, E outputs v. If g = 0, E outputs v. What we want to conclude our proof by contraposition is to compute the probability that E wins. So let s consider the following experiment: x U n ; r = f(x); E(r) O P r[e wins] =? case 1: v = h(x) = P r[case 1 ] = 1 2 P r[e wins case 1 ] = P r[(r v) = 1 case 1 ] = P r[(f(x) h(x)) = 1] = P 1 case 2: v = h(x) = P r[case 2 ] = 1 2 Finally, P r[e wins case 2 ] = P r[(r v) = 0 case 2 ] = P r[d(f(x) h(x)) = 0] = 1 P 3 P r[e wins] = P r[case 1 ] P r[e wins case 1 ] + P r[case 2 ] P r[e wins case 2 ] = 1 (P P 3 ) 1 q(n) 7-5

6 5.2 2-bit expansion The idea behind constructing a PRG that expands 2 bits it s quite intuitive. We just need to apply the function that expands 1 bit twice. This construction is well-explained on the slides presented on class. 7-6