Transcript scws3 6719

On Pseudorandom Generators
with Linear Stretch in NC0
Benny Applebaum
Yuval Ishai
Eyal Kushilevitz
Technion
Foundations of secure multi-party computation and zero-knowledge and its applications
Pseudorandom Generator (PRG)
stretch
Uin
G
G(Uin)
Rand
Src.
Uout
Pseudorandom
or Random?
Poly-time machine
PRG - Parallelism vs. Stretch
complexity
stretch
poly-time
super linear
NC
linear
log-space
Motivation
1
NC
parallel implementation
of crypto tasks
AC0
(e.g., Stream Cipher, Naor Commitment)
NC0
NC0ℓ
ℓ
sub linear
Previous Work
• Negative
Positive results
results
0
– No
Super-Linear
PRGs in NC
PRG
[Goldreich00,
PRG
Cryan [Goldreich
Miltersen01]
Micali 84]
2 from any
0 , factoring
0
– No
Super-Linear
Super-Linear
PRG
PRG
in NC
in 1NC
from
[CM01,
[Naor Reingold
MosselShpilkaTrevisan03]
Rosen02, NR97]
3 NC 4
BB Linear
–– Sub-Linear
PRG sum
[Viola
05]
Sub-LinearPRG
PRG in
AC0 from subset
[Impagliazzo
Naor 89]
AC0
– Heuristic Super-Linear PRG in NC05
[Mossel Shpilka Trevisan 03]
– Sub-Linear PRG in NC04 from any PRG in NC1
[AIK 04]
– Sub-Linear PRG in NC03 from decoding random linear code
[AIK]
– Linear PRG in NC04 from Linear PRG in NC0
[AIK 04]
P
factoring
subset sum/
rand linear code
impossible
NC1
AC0
NC0 NC04 NC03 NC02
sub
linear
linear
Open
super
linear
PRG
Main Results
• Algebraic assumption of [Alekhnovich 03]  LPRG in NC0
• LPRG in NC0  Inapporximability of MAX 3SAT.
Conclusion:
Already proven directly
Algebraic assumption
of [Alekhnovich 03] 
by [Alekhnovich 03]
Inapporximability of MAX 3SAT.
P
NC1
AC0
NC0 NC04 NC03 NC02
sub
linear
linear
Open
super
linear
PRG
Talk Outline
• LPRG in NC0  Inapproximability of MAX 3SAT
• Construction of LPRG in NC0
- Take 1: Good stretch Bad locality
- Take 2: Bad stretch Good locality
- Regaining the stretch via –biased generators
- A uniform version of the construction
• Conclusions and open questions
Cryptography and Inapproximability
• Hardness of refuting random 3SAT 
New inapproximability results [Feige 02]
• Hardness of determining number of satisfiable equations
in a random linear system 
Feige’s assumption + new results [Alekhnovich 03]
Do not rely on
standard crypto
primitive
• Approx algorithm for MAX 2LIN 
Upper bound the stretch of PRG in NC04 [MosselShpilkaTrevisan03]
NC0 Crypto and Inapproximability
k-Constraint Satisfaction Problem
– X1 +X3  X5 =0
– X2 X3  X4 =1
.
.
.
- X2 +X3 + X4 =1
• List of constraints over n variables x1,…,xn
• Each constraint involves k variables
• Q. how many of the constraints can be satisfied together?
Corollary of PCP [ALMSS,AS 92] :
If: PNP
Then: Cannot distinguish
– Satisfiable 3-CSP
– - unsatisfiable 3-CSP
Current work:
If: Lin-Stretch PRG in NC0
Then: Cannot distinguish
– Satisfiable 3-CSP
– - unsatisfiable 3-CSP
LPRG in NC0  Inapproximability
Thm. If G:{0,1}n {0,1}s is a PRG in NC0k and s-n=(n)
Then,   s.t satisfiable k-CSP and -unsat k-CSP are indistinguishable
Proof: k-CSP distinguisher  distinguisher for PRG
• If y R G(Un) 
y is satisfiable (since  x s.t G(x)=y)
•If y R Us
y is - unsat
 (w.h.p.)
G1(x) =y1
y R
G(Un)
y
Us
B
G2(x) =y2
.....
Gs(x) =ys
yes
satisfiable
k-CSP
-unsat
A
no
LPRG in NC0  Inapproximability 
Claim: If y R Us
y is - unsat
 (w.h.p.)
Proof:
• Assume y is not - unsat, then  x s.t H(y,G(x))< 
• Hence, Pr[y is not - unsat] = Pr[H(y, Image(G))< ]
 (|Image(G)|Vol(s, s))/ 2s
 2n+H()s – s= neg(n)
s=n+(n)
{0,1}s
-sphere
G1(x) =y1
y R
G(Un)
y
Us
B
G2(x) =y2
.....
Gs(x) =ys
yes
satisfiable
k-CSP
G(x)
ε-unsat
A
no
LPRG in NC0  Inapproximability 
Q: So what?
A: It explains why it is hard to construct LPRGs in NC0
We have an excuse…
Talk Outline
• LPRG in NC0  Inapproximability of MAX 3SAT
• Construction of LPRG in NC0
- Take 1: Good stretch Bad locality
- Take 2: Bad stretch Good locality
- Regaining the stretch via –biased generators
- A uniform version of the construction
• Conclusions and open questions
LPRG Construction – Take 1
fixed binary
ℓ-sparse matrix
Distribution C(M,)
random error vector
n
whose weight is ·m
n
x
m=kn
M
Distribution
C(M,+1/m)
Uniform
Distribution
+
e
c
x
m
M
U
+
e
ℓ ones

+1/m
••Pros:
Assumption
1 [Alekhnovich
03]: For
any
const.
k,output:
ℓ, 0<<1
random
n-bit vector
High
(linear)
Stretch
input:
n+mH()
bits,
m bits
any family
ℓ-sparseinmatrices
Mn, if Mn is expanding
Mxofisknn
samplable
NC0
Then,How toC(M
n,) the
c C(M
n, +1/kn)
•Con:
sample
noise
vector in NC0?
• Lemma [Alek 03]: Assumption  C(Mn,) is pseudorandom
LPRG Construction – Take 2
Distribution D(M,)
iid noise vector: each bit
n
is 1 w/prob. 
n
x
m=kn
M
Distribution D(M,+1/m)
+
c
e
x
m
M
+

e
+1/m
• Assumption 2:  const. k, ℓ, 0<<1, family Mn of knn ℓ-sparse matrices,
if Mn is expanding

D(Mn,) c D(Mn, +1/kn)
• Assumption 1  Assumption 2
• Lemma: Assumption 2  D(Mn,) is pseudorandom
Sampling D(M,) in NC0
• For  =1/2t can smaple e in NC0t
• Problem: No expansion: mt+n inputs  m outputs
• Observation: y has large entropy even when e is given
• Sol: extract more random bits from y
m
• Need to extract
y
- almost all bits of y
- in NC0




t



e
+
- using less than m extra bits
• Sol: use NC0 ε-biased generator
D(M,)
Mx
ℓ
x
n
Regaining the stretch
• Let [y|e] be the distribution of y given e.
• Lem. 1 (High Entropy) Except w/prob exp(-(m/2t))
m
H([y|e]) mt(1-2-(t))
y
t
• Proof:

- ei=1  i-th block of y = 1t
- ei=0  i-th block of y R
{0,1}t
\




e
{1t}
- e has k zeroes  [y|e] is uniform over set of size> (2t-1)k
- By Chernoff: Pr[# 1’s in e>2 m/2t] <exp(-(m/2t))
- Hence, w/prob 1-exp(-(m/2t)),
# 0’s in e  m(1-1/2t-1)
m(1-2-t+1)
 [y|e] is uniform over a set of size (2t-1)


-biased generators
stretch
Uin
g
G(Uin)
Rand
Src.
Uout
Pseudorandom
or Random?
Linear function
-bias generator [Naor Naor 90]:
 Linear distinguisher L, |Pr[L(g(Us))=1]-Pr[L(Us)=1]|
Extraction via -biased generators
• Lem 2. (Extraction) [Alon Roichman 94, Goldreich Wigderson 97]
- Let g:{0,1}n{0,1}s be  biased generator,
- Xs distributed over {0,1}s where s-H(Xs) .
- Then:
SD( g(Un)Xs , Us)  2(-1)/2
• Lem 3. ( biased in NC0) [Mossel Shpilka Trevisan 02]
 const. c,   biased gen g:{0,1}n{0,1}cn w/bias = 2-n/poly(c) in NC05.
Wrapping Up
1. Pry[H ([y|e]) mt(1-neg(t))] > 1-neg(m)
2.  c, we have g:{0,1}mt/c{0,1}mt w/bias 2-mt/poly(c) in NC05 [MST 03]
3. rUtm/c then (g(r)+[y|e]) is close to uniform up to
 neg(m)+2-mt/poly(c)+mtneg(t)=neg(m)
mt/c
[AlonRoichman94,
GoldreichWigderson97]
r
For proper consts t,c
g
g(r)
+
g(r)+y
m
y



e
s
Uniform
t



e
e
e
Wrapping Up
mt/c
r
g
g(r)
+
y



e
Uniform
g(r)+y
m
t


s

e
e
e
Our Generator
mt/c
r
g
g(r)
+
y



e
+
Mx
Uniform
g(r)+y
m
t


cs

e
e
D(,M)
e
uniform
D(,M)
Let m=kn
Input: n+tm+tm/c = n(1+ tk+ tk/c)
x
n
Output: m + tm = n(k+tk)
For const. k and good consts. c,t have linear stretch
LPRG in Uniform NC0
•
Non-Uniform advices:
1. Mn (family of unbalanced constant degree bipartite expanders)
2.  c, generator g:{0,1}n{0,1}cn w/bias = 2-n/poly(c) in non-uniform NC05.
[MST03]
•
Uniform implementation:
1. Mn= explicit family of unbalanced constant degree bipartite expanders
[Capalbo Reingold Vadhan Wigderson 02]
2.
Prove a uniform version of MST:
 c, generator g:{0,1}n{0,1}cn w/bias = 2-n/polylog(c) in uniform NC0polylog(c).
(Construction uses again [Capalbo Reingold Vadhan Wigderson 02] )
Talk Outline
• LPRG in NC0  Inapproximability of MAX 3SAT
• Construction of LPRG in NC0
- Take 1: Good stretch Bad locality
- Take 2: Bad stretch Good locality
- Regaining the stretch via –biased generators
- A uniform version of the construction
• Conclusions and open questions
Open Questions
Q: Can we compile a high stretch PRG in a “relatively high”
complexity class (e.g., NC1) into LPRG in NC0?
PRG
Open Questions
Q: Can we compile a high stretch PRG in a “relatively high”
complexity class (e.g., NC1) into LPRG in NC0?
A: Maybe, but compiler must be “combinatorially interesting”
LPRG
The Necessity of Expansion
•Let G:{0,1}n{0,1}s be an -strong PRG
• Claim:
any
of outputs
sizen),U
k<log(1/
) touch at least k inputs
i.e.,
forset
anyT eff.
A, advAof(G(U
s)< 
• Hence the graph is expanding.
• Proof: Otherwise,
• If G is not in NC0  graph has non-const. degree  Trivial !
0
yG(Un)
k,
• If G for
hassome
smallz{0,1}
stretch 
TrivialPr[y
! T=z]=
2-k>  yUs
• G in NC0 and has linear stretch  non-trivial expansion
• By dispersers LBs [Radhakrishnan, Ta-Shma] :
=2-k then,
locality  ( log(s/k) / log(n/k) )
• Corollary: No 2-(n) PRGs w/super-linear stretch in NC0
s outputs
…
n inputs
if
Open Questions
• PRG w/ super-linear stretch in NC0 or even in AC0?
• LPRG in NC03 ?
• LPRG in NC0 under standard assumptions?
• sub-linear PRG NC LPRG ?
- Easy: linear PRG NC1 super-linear PRG
P from
NC1 crypto
AC0 NC0
• More inapproximabilty
- Not
sub
hard linear
to extend
NC04 NC03 NC02
results to other primitives…
- Get inapprox results which are not followed fromOpen
PCP
linear
- Use
super
Open
morelinear
standard assumptions
PRG
Thank You !