Bit Security as Computational Cost for Winning Games with High Probability

Bit Security as Cost to Demonstrate Advantage

“…That is, we measure the total work done by an adversary to allow an observer to distinguish it from a dummy adversary by observing wins and loses while repeating games. Our simple definition (i) captures both search and decision primitives in a single framework like Micciancio-Walter [MW18] and (ii) has a firm operational meaning like Watanabe-Yasunaga [WY21]. Indeed, our definition also resolves the peculiar cases introduced above, matching the intuitive expectations (Remark 10 and Thm.…”

“…• prove several security reductions with respect to our definition. Our proofs are arguably simpler and more intuitive than the previous proofs of [ MW18,WY21]. Namely, we prove:…”

“…Watanabe-Yasunaga [WY21] pointed out this weakness of Micciancio-Walter as a lack of operational meaning and provided another definition as cost for winning certain games with high probability -which also resolves the peculiar cases mentioned above and has an operational meaning by nature. However, they defined the games qualitatively differently for search and decision primitives, losing the generality that Micciancio-Walter sought.…”

“…the hybrid argument. Our proof is essentially the same as the conventional proof, whereas [MW18,WY21] had to develop new techniques. This is due to the structural similarity between the conventional bit security and ours.…”

“…In Section 4, we prove several security reductions concerning our bit security: a distribution approximation theorem (Section 4.1), the hybrid argument (Section 4.2), and decision-to-search reductions (Section 4.3). In Section 5, we review the previous definitions of bit security proposed by Micciancio-Walter [MW18] and Watanabe-Yasunaga [WY21]. Then, we compare their definitions with our new definition.…”