Efficiency Improvements in Constructing Pseudorandom Generators from One-Way Functions

Haitner, Iftach; Reingold, Omer; Vadhan, Salil

doi:10.1137/100814421

Cited by 49 publications

(74 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In addition to simplicity, our technique can also be used to refine and tighten the proof given in [7] (see Section 3.2 and Remark 3.2 for details). We mention that our proofs sketched above are not implied by the recent work of [13,23]. In particular, the construction of [13] applies a dedicated universal hash function h of description length O(n 2 ) to f (X) such that the first k output bits are statistically random and the next O(log n) bits are computationally random, and this holds even if k is unknown (which is desired for a general OWF f whose preimage size may vary for different images).…”

Section: Summary Of Contributionsmentioning

confidence: 95%

“…We mention that our proofs sketched above are not implied by the recent work of [13,23]. In particular, the construction of [13] applies a dedicated universal hash function h of description length O(n 2 ) to f (X) such that the first k output bits are statistically random and the next O(log n) bits are computationally random, and this holds even if k is unknown (which is desired for a general OWF f whose preimage size may vary for different images). However, in our context k is known and it is crucial that the description length of the hash functions is linear, for which we do two extractions from f (X) using h 2 and h c respectively.…”

Section: Summary Of Contributionsmentioning

confidence: 95%

“…While the construction was already known in literature (explicit in [7] and implicit in HILL-style generators [14,13,23]), its full proof was only seen in [7] and we further simplify the analysis via the use of unpredictability pseudo-entropy. In addition to simplicity, our technique can also be used to refine and tighten the proof given in [7] (see Section 3.2 and Remark 3.2 for details).…”

Section: Summary Of Contributionsmentioning

confidence: 99%

“…Nevertheless, a major drawback of [14] is that the construction is quite involved and too inefficient to be of any practical use, namely, to obtain a PRG with comparable security to the underlying OWF on security parameter n, one needs a seed of length O(n 8 ) 1 . Research efforts (see [15,13,23], just to name a few) have been followed up towards simplifying and improving the constructions, and the current state-ofthe-art construction [23] requires seed length O(n 3 ). Let us mention all aforementioned approaches are characterized by a parallel construction, namely, they run sufficiently many independent copies of the underlying OWFs (rather than running a single trail and feeding its output back to the input iteratively) and there seems an inherent lower bound on the number of copies needed.…”

Section: Introductionmentioning

confidence: 99%

“…The construction was also implicit in many HILL-style constructions (e.g. [15,13]). Haitner, Harnik and Reingold [12] refined the technique used in [9] (which they called the randomized iterate) and adapted the construction to unknown regular OWFs with reduced seed length O(n · log n).…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Pseudorandom generators from regular one-way functions: New constructions with improved parameters

Weng

2015

Theoretical Computer Science

View full text Add to dashboard Cite

We revisit the problem of basing pseudorandom generators on regular one-way functions, and present the following constructions:• For any known-regular one-way function (on n-bit inputs) that is known to be ε-hard to invert, we give a neat (and tighter) proof for the folklore construction of pseudorandom generator of seed length Θ(n) by making a single call to the underlying one-way function.• For any unknown-regular one-way function with known ε-hardness, we give a new construction with seed length Θ(n) and O(n/ log (1/ε)) calls. Here the number of calls is also optimal by matching the lower bounds of Holenstein and Sinha (FOCS 2012).Both constructions require the knowledge about ε, but the dependency can be removed while keeping nearly the same parameters. In the latter case, we get a construction of pseudo-random generator from any unknown-regular one-way function using seed lengthÕ(n) andÕ(n/ log n) calls, whereÕ omits a factor that can be made arbitrarily close to constant (e.g. log log log n or even less). This improves the randomized iterate approach by Haitner, Harnik and Reingold (CRYPTO 2006) which requires seed length O(n·logn) and O(n/ log n) calls.

show abstract

Section: Summary Of Contributionsmentioning

confidence: 95%

Section: Summary Of Contributionsmentioning

confidence: 95%

Section: Summary Of Contributionsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Pseudorandom generators from regular one-way functions: New constructions with improved parameters

Weng

2015

Theoretical Computer Science

View full text Add to dashboard Cite

show abstract

Unifying Computational Entropies via Kullback–Leibler Divergence

Agrawal

Chen

Horel

et al. 2019

Advances in Cryptology – CRYPTO 2019

Self Cite

View full text Add to dashboard Cite

We introduce hardness in relative entropy, a new notion of hardness for search problems which on the one hand is satisfied by all one-way functions and on the other hand implies both next-block pseudoentropy and inaccessible entropy, two forms of computational entropy used in recent constructions of pseudorandom generators and statistically hiding commitment schemes, respectively. Thus, hardness in relative entropy unifies the latter two notions of computational entropy and sheds light on the apparent "duality" between them. Additionally, it yields a more modular and illuminating proof that one-way functions imply next-block inaccessible entropy, similar in structure to the proof that one-way functions imply next-block pseudoentropy (Vadhan and Zheng, STOC '12).2. An "entropy equalization" step that converts G into a similar generator where the real entropy in each block conditioned on the prefix before it is known. This step is exactly the same in both constructions. 3.A "flattening" step that converts the (real and computational) Shannon entropy guarantees of the generator into ones on (smoothed) min-entropy and max-entropy. This step is again exactly the same in both constructions. 4. A "hashing" step where high (real or computational) min-entropy is converted to uniform (pseudo)randomness and low (real or computational) max-entropy is converted to a small-support or disjointness property. For PRGs, this step only requires randomness extractors [HILL99, NZ96], while for SHCs it requires (information-theoretic) interactive hashing [NOVY98, DHRS04]. (Constructing full-fledged SHCs in this step also utilizes UOWHFs, which can be constructed from one-way functions [Rom90]. Without UOWHFs, we obtain a weaker binding property, which nevertheless suffices for constructing statistical zero-knowledge arguments for all of NP.)

show abstract

Channels of Small Log-Ratio Leakage and Characterization of Two-Party Differentially Private Computation

Haitner

Mazor

Shaltiel

et al. 2019

Theory of Cryptography

Self Cite

View full text Add to dashboard Cite

Consider a ppt two-party protocol Π = (A, B) in which the parties get no private inputs and obtain outputs O A , O B ∈ {0, 1}, and let V A and V B denote the parties' individual views.The leakage of Π is the amount of information a party obtains about the event O A = O B ; that is, the leakage ǫ is the maximum, over P ∈ {A, B}, of the distance betweenTypically, this distance is measured in statistical distance, or, in the computational setting, in computational indistinguishability. For this choice, Wullschleger [TCC '09] showed that if ǫ ≪ α then the protocol can be transformed into an OT protocol.We consider measuring the protocol leakage by the log-ratio distance (which was popularized by its use in the differential privacy framework). The log-ratio distance between X, Y over domain Ω is the minimal ǫ ≥ 0 for which, for every v ∈ Ω, log Pr[X=v] PrIn the computational setting, we use computational indistinguishability from having log-ratio distance ǫ. We show that a protocol with (noticeable) accuracy α ∈ Ω(ǫ 2 ) can be transformed into an OT protocol (note that this allows ǫ ≫ α). We complete the picture, in this respect, showing that a protocol with α ∈ o(ǫ 2 ) does not necessarily imply OT. Our results hold for both the information theoretic and the computational settings, and can be viewed as a "fine grained" approach to "weak OT amplification".We then use the above result to fully characterize the complexity of differentially private twoparty computation for the XOR function, answering the open question put by Goyal, Khurana, Mironov, Pandey, and Sahai [ICALP '16] and Haitner, Nissim, Omri, Shaltiel, and Silbak [FOCS '18]. Specifically, we show that for any (noticeable) α ∈ Ω(ǫ 2 ), a two-party protocol that computes the XOR function with α-accuracy and ǫ-differential privacy can be transformed into an OT protocol. This improves upon Goyal et al. that only handle α ∈ Ω(ǫ), and upon Haitner et al. who showed that such a protocol implies (infinitely-often) key agreement (and not OT). Our characterization is tight since OT does not follow from protocols in which α ∈ o(ǫ 2 ), and extends to functions (over many bits) that "contain" an "embedded copy" of the XOR function.

show abstract

Efficiency Improvements in Constructing Pseudorandom Generators from One-Way Functions

Cited by 49 publications

References 25 publications

Pseudorandom generators from regular one-way functions: New constructions with improved parameters

Pseudorandom generators from regular one-way functions: New constructions with improved parameters

Unifying Computational Entropies via Kullback–Leibler Divergence

Channels of Small Log-Ratio Leakage and Characterization of Two-Party Differentially Private Computation

Contact Info

Product

Resources

About