Introduction to Cryptography

Transcription

1 B504 / I538: Introduction to Cryptography Spring 2017 Lecture 3

2 Assignment 0 is due today; Assignment 1 is out and is due in 2 weeks! 1

3 Review: Asymptotic notation

4 Oh and Omega, Oh my! Defⁿ: Let f:n R and g:n R be two functions. We say f Ο (g) iff c>0 and n c N, such that n>n c, f(n) c g(n). English: f is [in] big-o of g Intuitively: f(n) grows no faster than g(n) as n 2

5 Oh and Omega, Oh my! Defⁿ: Let f:n R and g:n R be two functions. We say f Ω(g) iff c>0 and n c N, such that n>n c, g(n) c f(n). English: f is [in] big-omega of g Intuitively: f(n) grows no slower than g(n) as n Equivalently: f Ω(g) iff g Ο(f) 3

6 Oh and Omega, Oh my! Defⁿ: Let f:n R and g:n R be two functions. We say f ο(g) iff c>0 and n c N, such that n>n c, f(n) <c g(n). English: f is [in] little-o of g Intuitively: f(n) grows much slower than g(n) as n 4

7 Oh and Omega, Oh my! Defⁿ: Let f:n R and g:n R be two functions. We say f ω(g) iff c>0 and n c N, such that n>n c, g(n) <c f(n). English: f is [in] little-omega of g Intuitively: f(n) grows much faster than g(n) as n Equivalently: f ω(g) iff g ο(f) 5

8 Oh and Omega, Oh my! Defⁿ: Let f:n R and g:n R be two functions. We say f Θ(g) iff c 1,c 2 >0 and n 0 N, such that n>n 0, c 1 g(n) f(n) c 2 g(n). English: f is [in] big-theta of g Intuitively: f(n) grows about as fast as g(n) as n Equivalently: f Θ(g) iff f Ο(g) and g Ο(f) 6

9 Oh and Omega, Oh my! Each of Ο(g), ο(g), Θ(g), Ω(g), and ω(g) is an infinite set of real-valued functions Ο & Θ impose a total order on real-valued functions: f ο(g) f<g Reflexive: f Ο(f) f Ο(g) f g Transitive: f Ο(g) g Ο(h) f Ο(h) f Θ(g) f=g Antisymmetric: f Ο(g) g Ο(f) f Θ(g) f Ω(g) f g Total: f Ο(g) g Ο(f) f ω(g) f>g 7 Common abuse of notation: f=ο(g) or f=ω(g) or f=θ(g), etc. Just keep in mind that = means not equals!

10 Polynomial functions Defⁿ: A function p:n R+ is polynomial in n if c N such that p Ο(n c ). 8 Defⁿ: p is superpolynomial in n if it is not polynomial in n Defⁿ: The set of all functions polynomial in n is poly(n) Common abuse of notation: p=poly(n) means p poly(n) p can be polynomial in n and not be a polynomial! Eg.: if f(n) is a polynomial, then p(n) f(n) log n is polynomial in n

11 Inverse polynomial functions Defⁿ: A function p:n R+ is inverse polynomial in n if p -1 poly(n). Alt. defⁿ: p:n R+ is inverse polynomial if its reciprocal is polynomial Eg.: p(n) 1/(n 100 log n) is inverse polynomial since p 1 (n) Ο(n 101 ) 9 Eg.: q(n) 1/n! is not inverse polynomial since n! poly(n)

12 Probabilistic polynomial time (PPT) algorithms

13 Turing Machines (TMs) A simple, well-defined model of computation Definition is out of scope Church-Turing Thesis: TMs are universal: anything you can compute in theory, you can compute on a TM! (try Wikipedia ) Measure running time by number of steps before TM halts Measure robust in that all other reasonable models of computation require polynomially related number of steps 10

14 Turing Machines (TMs) All inputs and outputs to a TM are assumed to be finite strings from {0,1} * If x {0,1} *, then x denotes the length of (number of bits in) x Defⁿ: A sequence of TMs {TM n } n N implements an algorithm A if, x {0,1}ⁿ, on input x, TM n executes each step of A with input x. 11

15 Turing Machines (TMs) We use the terms algorithm and (sequence of) TM(s) interchangeably An algorithm is equivalent to the most efficient sequence of TMs that implements it Defⁿ: If A is an algorithm (sequence of TMs), then A(x) denotes the random variable describing the output of A on input x {0,1} * 11

16 Turing Machines (TMs) Defⁿ: Let t:n N. An algorithm A runs in time t if x {0,1} *,A halts after at most t( x ) steps on input x. Note: running time is proportionate to length of input If input is an integer, say n N (expressed in binary), then running time depends on log n rather than on n itself! 12

17 Turing Machines (TMs) Defⁿ: An algorithm A computes f:{0,1} * {0,1} * if there exists a function t:n N such that A runs in time t and x {0,1} *,A(x)=f(x). Requirement that A runs in time t is just to ensure that A eventually halts; otherwise, an algorithm that never halts would compute every function! 13

18 Polynomial time algorithms Defⁿ: An algorithm A runs in polynomial time if p poly(n) such that A runs in time p. Refer to such an algorithm as a polynomial-time algorithm 14

19 Probabilistic algorithms Defⁿ: An algorithm A is probabilistic if x {0,1} * such that A(x) induces a distribution that is not a point distribution. Intuitively, a probabilistic algorithm makes random choices during its execution Probabilistic algorithms can do everything nonprobabilistic algorithms can do and possibly more 15

20 Probabilistic polynomial time Defⁿ: An algorithm A is probabilistic polynomialtime (PPT) if it is probabilistic and it runs in polynomial time. An algorithm is said to be efficient if it is PPT If the sequence of TMs {TM n } n N implementing A satisfies TM 1 =TM 2 = then A is uniform PPT; otherwise, it is non-uniform PPT (nuppt) 16

21 The negligible, the noticeable, and the overwhelming

22 Negligible functions Defⁿ: A function ε:n R+ is negligible if c>0,ε(n) Ο(n c ). Alt. defⁿ: A function ε:n R+ is negligible if it vanishes (to zero) faster than any inverse polynomial Alt. defⁿ: A function ε:n R+ is negligible if c>0, n c N such that ε(n)<n -c for all n>n c 18

23 Negligible functions Defⁿ: A function ε:n R+ is negligible if c>0,ε(n) Ο(n c ). Defⁿ: The set of all functions negligible in n is negl(n) Common abuse of notation: ε=negl(n) 18

24 Negligible functions Thm (negl+negl=negl): If ε 1 :N R+ and ε 2 :N R+ are both negligible, then ε 1 (n)+ε 2 (n) is negligible. Proof: Left as an exercise (see Assignment 1). 19

25 Negligible functions Corollary: If ε:n R+ is negligible and λ:n R+ is not negligible, then λ(n) ε(n) is not negligible. Proof: Define μ(n) λ(n) ε(n) and suppose (for a contradiction) that μ(n) is negligible. Then, by the preceding theorem, μ(n)+ε(n)=λ(n) would also be negligible. 20

26 Negligible functions Thm (poly negl=negl): If ε ℕ ℝ is negligible and p ℕ ℝ is polynomial, then p(n) ε(n) is negligible. Proof: Left as an exercise (see Assignment 1). 21

27 Negligible functions c Thm (negl =negl): If ε ℕ ℝ is negligible and c>0 c is a constant then (ε(n)) is negligible. Proof: Left as an exercise (see Assignment 1). 22

28 Proving a function is negligible Step 1: Assume c>0 is given do not fix a specific c keep c is an abstract quantity Step 2: Set n c =f(c), for some f this step requires all the ingenuity * Step 3: Prove that ε(n)<n -c for all n>n c 23 * Okay to assume that c is not too small

29 Proving a function is negligible Lemma: Let f:n R+ and fix c>0 and n c N such that f(n)<n c for all n>n c. Then for any d (0,c), we have f(n)<n d for all n>n c. Q: Why do we care? 24 A: To prove ε is negligible, it suffices to consider only "large" values of the constant c sometimes the argument for large c fails for small c

30 Proving a function is negligible Lemma: Let f:n R+ and fix c>0 and n c N such that f(n)<n c for all n>n c. Then for any d (0,c), we have f(n)<n d for all n>n c. Proof: n c n d iff n c /n d 1 (noting n 1) Rewrite n c /n d as n a, where a=c d Now, a>0 since c>d; thus, 1 n a (again noting n 1) It follows that,n c /n d =n a 1. 24

31 Proof: Example proof: 2 n is negligible Let c 2 be given. We must produce an n c N such that 2 n <n c for all n>n c. Taking logs, this is n< c logn n/ logn>c for all n>n c. 25 Set n c = c 4. Since c 2, we have log n c n c ¼ ; hence, for all n>n c, n / logn n / n ¼ =n ¼ >n ¼ c. But n c ¼ (c 4 ) ¼ =c, so we just showed - n/ log n>c, as desired.

32 Example proof: ε(n) is negligible Proof: Let c>0 be given. By defⁿ: m c N such that ε(n)<n (c+1) for all n>m c. Set n c =max{10 100,m c }. Then for all n>n c, ε(n)< n (c+1) =( /n) n c n c ; (n c ( /n) 1) 26 hence, we have shown that ε(n)<n c for all n>n c.

33 Overwhelming functions Defⁿ: A function κ:n R+ is overwhelming if ε(n) 1 κ(n) is negligible Alt. defⁿ: A function κ:n R+ is overwhelming if there exists a negligible function ε:n R+ such that κ(n)=1 ε(n) 27 (Like negligible functions), overwhelming functions typically describe probabilities

34 Noticeable functions Defⁿ: A function μ:n R+ is noticeable if c>0,μ(n) Ω(n c ). Alt. defⁿ: A function μ:n R+ is noticeable if some inverse polynomial vanishes to zero faster than it 27 Noticeable inverse polynomial; however, we typically reserve the label noticeable for inverse polynomials that (quickly) tend to 0 as n

35 If f is not negligible, does that mean it is noticeable? Q: NO! But why? (See assignment 1) 28

36 Distribution ensembles Defⁿ: An ensemble of probability distributions is an infinite sequence {X n } n N of random variables indexed by the natural numbers. Any PPT algorithm A induces an ensemble of distributons n N, set X n A(x) for the x {0,1}ⁿ 29

37 Indistinguishable ensembles Defⁿ: Two ensembles of distributions {X i } i N and {Y i } i N are statistically indistinguishable there exists a negligible function ε:n R+ such that i N, Pr[X i =x] Pr[Y i =x] ε(n) x V i where V i is the (combined) range of X i and Y i. 31

38 That s all for today, folks!