Computational Entropy Salil Vadhan Harvard University on sabbatical
Computational Entropy Salil Vadhan Harvard University (on sabbatical at Microsoft Research SVC and Stanford) Joint works with Iftach Haitner (Tel Aviv), Thomas Holenstein (ETH Zurich), Omer Reingold (MSR-SVC), Hoeteck Wee (George Washington U. ), and Colin Jia Zheng (Harvard)
Complexity-Based Cryptography § Shannon `49: Information-theoretic security is infeasible. – |Key| ¸ |All Encrypted Data| – On a standard, insecure communication channel. § Diffie & Hellman `76: Complexity-based cryptography – Assume adversary has limited computational resources – Base cryptography on hard computational problems – Enables public-key crypto, digital signatures, …
![One-Way Functions [DH 76] easy x hard f(x) § Candidate: f(x, y) = x¢y](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-3.jpg "One-Way Functions [DH 76] easy x hard f(x) § Candidate: f(x, y) = x¢y")
One-Way Functions [DH 76] easy x hard f(x) § Candidate: f(x, y) = x¢y Formally, a OWF is f : {0, 1}n ! {0, 1}n s. t. § f poly-time computable § 8 poly-time A Pr[A(f(X))2 f-1(f(X))] = 1/n!(1) for XÃ{0, 1}n
OWFs & Cryptography secure protocols & applications private-key encryption MACs zero-knowledge proofs digital signatures statistical ZK arguments [GMW 86] pseudorandom functions [GGM 86] statistically binding commitments [NY 89] [BCC 86] [N 89] pseudorandom generators [HILL 90] target-collision-resistant hash functions (UOWHFs) [R 90] one-way functions statistically hiding commitments [HNORV 07]
OWFs & Cryptography secure protocols & applications private-key encryption MACs zero-knowledge proofs digital signatures statistical ZK arguments [GMW 86] pseudorandom functions [GGM 86] statistically binding commitments [NY 89] [BCC 86] [N 89] pseudorandom generators [HILL 90] target-collision-resistant hash functions (UOWHFs) [R 90] one-way functions statistically hiding commitments [HNORV 07]
![Computational Entropy [Y 82, HILL 90, BSW 03] Question: How can we use the](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-6.jpg "Computational Entropy [Y 82, HILL 90, BSW 03] Question: How can we use the")
Computational Entropy [Y 82, HILL 90, BSW 03] Question: How can we use the “raw hardness” of a OWF to build useful crypto primitives? Answer (today’s talk): § Every crypto primitive amounts to some form of “computational entropy”. § One-way functions already have a little bit of “computational entropy”.
![Entropy Def: The Shannon entropy of r. v. X is H(X) = ExÃX[log(1/Pr[X=x)] §](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-7.jpg "Entropy Def: The Shannon entropy of r. v. X is H(X) = ExÃX[log(1/Pr[X=x)] §")
Entropy Def: The Shannon entropy of r. v. X is H(X) = ExÃX[log(1/Pr[X=x)] § H(X) = “Bits of randomness in X (on avg)” § 0 · H(X) · log |Supp(X)| X concentrated on single point X uniform on Supp(X) § Conditional Entropy: H(X|Y) = EyÃY[H(X|Y=y)]
![Worst-Case Entropy Measures § Min-Entropy: H 1(X) = minx log(1/Pr[X=x]) § Max-Entropy: H 0(X)](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-8.jpg "Worst-Case Entropy Measures § Min-Entropy: H 1(X) = minx log(1/Pr[X=x]) § Max-Entropy: H 0(X)")
Worst-Case Entropy Measures § Min-Entropy: H 1(X) = minx log(1/Pr[X=x]) § Max-Entropy: H 0(X) = log |Supp(X)| H 1(X) · H 0(X)
Computational Entropy A poly-time algorithm may “perceive” the entropy of X to be very different from H(X). § Example: a pseudorandom generator [BM 82, Y 82] G: {0, 1}m!{0, 1}n – G(Um) “computationally indistinguishable” from Un – But H(G(Um))·m. Def [GM 82]: X ´c Y iff 8 poly-time T N), …) e. g. G(N, x) = (lsb(x), lsb(x 2 mod N), lsb(x 4 mod Pr[T(Y)=1] for N=pq, x 2 ZN* is a PRG if Pr[T(X)=1] factoring is¼hard [BBS 82, ACGS 82].
![Pseudoentropy Def [HILL 90]: X has pseudoentropy ¸ k iff there exists a random](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-10.jpg "Pseudoentropy Def [HILL 90]: X has pseudoentropy ¸ k iff there exists a random")
Pseudoentropy Def [HILL 90]: X has pseudoentropy ¸ k iff there exists a random variable Y s. t. 1. Y ´c X 2. H(Y) ¸ k Interesting when k > H(X), i. e. Pseudoentropy > Real Entropy
OWFs & Cryptography secure protocols & applications private-key encryption MACs zero-knowledge proofs digital signatures statistical ZK arguments [GMW 86] pseudorandom functions statistically binding commitments [GGM 86] [BCC 86] [N 89] pseudorandom generators [HILL 90] [NY 89] target-collision-resistant hash functions (UOWHFs) pseudoentropy [R 90] one-way functions statistically hiding commitments [HNORV 07]
![Application of Pseudoentropy Thm [HILL 90]: 9 OWF ) 9 PRG Proof idea: OWF](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-12.jpg "Application of Pseudoentropy Thm [HILL 90]: 9 OWF ) 9 PRG Proof idea: OWF")
Application of Pseudoentropy Thm [HILL 90]: 9 OWF ) 9 PRG Proof idea: OWF to discuss X with pseudoentropy ¸ H(X)+1/poly(n) repetitions X with pseudo-min-entropy ¸ H 0(X)+poly(n) hashing PRG
Pseudoentropy from OWF: Intuition Computational Setting: For 1 -1 OWF f, XÃ{0, 1}n: Information Theory: For jointly distributed (X, Y): H(X|f(X))=0, but 8 poly-time A Pr[A(f(X))=X] · 1/n!(1) def [HLR 07] 8 function A Pr[A(Y)=X] · p def [DORS 04] X has “unpredictability entropy”¸ !(log n) given f(X) X has “average min-entropy” ¸ log(1/p) given Y X has pseudoentropy !(log n) given f(X) H(X|Y) ¸ log(1/p) ?
Pseudoentropy from OWF: Intuition Computational Setting: For 1 -1 OWF f, XÃ{0, 1}n: H(X|f(X))=0, but 8 poly-time A Pr[A(f(X))=X] · 1/n!(1) def [HLR 07] X has “unpredictability entropy”¸ !(log n) given f(X) X has pseudoentropy !(log n) given f(X) Challenges: § How to convert unpredictability into pseudoentropy? § When f not 1 -1, unpredictability can be trivial. FALSE! T(x, y) = [[f(x)=? y]] distinguishes (X, f(X)) from every (Z, f(X)) with H(Z|f(X))>0
![Pseudoentropy from OWF § Thm [HILL 90]: W=(f(X), H, H(X)1, …H(X)J) has pseudoentropy ¸](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-15.jpg "Pseudoentropy from OWF § Thm [HILL 90]: W=(f(X), H, H(X)1, …H(X)J) has pseudoentropy ¸")
Pseudoentropy from OWF § Thm [HILL 90]: W=(f(X), H, H(X)1, …H(X)J) has pseudoentropy ¸ H(W)+!(log n)/n – H : {0, 1}n ! {0, 1}n a certain kind of hash func. – XÃ{0, 1}n, JÃ{1, …, n}. § Thm [HRV 10, VZ 11]: (f(X), X 1, …, Xn) has “next-bit pseudoentropy” ¸n+!(log n). – No hashing! – Total amount of pseudoentropy known & > n. – Get full !(log n) bits of pseudoentropy.
![Next-bit Pseudoentropy § Thm [HRV 10, VZ 11]: (f(X), X 1, …, Xn) has](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-16.jpg "Next-bit Pseudoentropy § Thm [HRV 10, VZ 11]: (f(X), X 1, …, Xn) has")
Next-bit Pseudoentropy § Thm [HRV 10, VZ 11]: (f(X), X 1, …, Xn) has “next-bit pseudoentropy” ¸ n+!(log n). § Note: (f(X), X) easily distinguishable from every random variable of entropy > n. § Next-bit pseudoentropy: 9 (Y 1, …, Yn) s. t. – (f(X), X 1, …, Xi) ´c (f(X), X 1, …, Xi-1, Yi) – H(f(X))+ i H(Yi|f(X), X 1, …, Xi-1) = n+!(log n).
Consequences § Simpler and more efficient construction of pseudorandom generators from one-way functions. § [HILL 90, H 06]: OWF f of input length n ) PRG G of seed length O(n 8). § [HRV 10, VZ 11]: OWF f of input length n ) PRG G of seed length O~(n 3).
![Pseudoentropy , Unpredictability wrt KL Divergence § Thm [VZ 11]: Let (Y, Z) 2](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-18.jpg "Pseudoentropy , Unpredictability wrt KL Divergence § Thm [VZ 11]: Let (Y, Z) 2")
Pseudoentropy , Unpredictability wrt KL Divergence § Thm [VZ 11]: Let (Y, Z) 2 {0, 1}n £ {0, 1}O(log n). The pseudoentropy of Z given Y is ¸ H(Z|Y)+± m There is no probabilistic poly-time A s. t. D((Y, Z)||(Y, A(Y)) · ±. [D = Kullback-Liebler Divergence] § Special case: H(Z|Y)=0 – “Z has pseudoentropy ¸ ±” iff “hard to predict Z with divergence · ±” – Can’t take Z=f-1(Y) for 1 -1 OWF f since |f-1(Y)|=n.
![Pseudoentropy , Unpredictability wrt KL Divergence § Thm [VZ 11]: Let (Y, Z) 2](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-19.jpg "Pseudoentropy , Unpredictability wrt KL Divergence § Thm [VZ 11]: Let (Y, Z) 2")
Pseudoentropy , Unpredictability wrt KL Divergence § Thm [VZ 11]: Let (Y, Z) 2 {0, 1}n £ {0, 1}O(log n). The pseudoentropy of Z given Y is ¸ H(Z|Y)+± m There is no probabilistic poly-time A s. t. D((Y, Z)||(Y, A(Y)) · ±. [D = Kullback-Liebler Divergence] § Analogue of Impagliazzo’s Hardcore Thm [I 95, N 95, H 05, BHK 09] for Shannon entropy rather than min-entropy.
Next-Bit Pseudoentropy from OWF: Proof Sketch f a one-way function Given f(X), hard to achieve divergence O(log n) from X Given (f(X), X 1, …, XJ), hard to achieve divergence O(log n)/n from XJ+1 thm Given (f(X), X 1, …, XJ), XJ+1 has pseudoentropy¸entropy+!(log n)/n (f(X), X 1, …, Xn) has next-bit pseudoentropy ¸ n+!(log n)
OWFs & Cryptography secure protocols & applications private-key encryption MACs zero-knowledge proofs digital signatures statistical ZK arguments [GMW 86] pseudorandom functions statistically binding commitments [GGM 86] [BCC 86] [N 89] pseudorandom generators [HRV 10, VZ 11] [NY 89] target-collision-resistant hash functions (UOWHFs) next-bit pseudoentropy [R 90] one-way functions statistically hiding commitments [HNORV 07]
![Application of Next-Bit Pseudoentropy Thm [HILL 90]: 9 OWF ) 9 PRG Proof outline](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-22.jpg "Application of Next-Bit Pseudoentropy Thm [HILL 90]: 9 OWF ) 9 PRG Proof outline")
Application of Next-Bit Pseudoentropy Thm [HILL 90]: 9 OWF ) 9 PRG Proof outline [HRV 10]: OWF done Z=(f(Un), Un) with next-bit pseudoentropy ¸ n+!(log n) repetitions Z’ with next-block pseudo-min-entropy ¸ |seed|+poly(n) hashing PRG
OWFs & Cryptography secure protocols & applications private-key encryption MACs zero-knowledge proofs digital signatures statistical ZK arguments [GMW 86] pseudorandom functions statistically binding commitments [GGM 86] [BCC 86] [N 89] pseudorandom generators [HRV 10, VZ 11] [NY 89] target-collision-resistant hash functions (UOWHFs) next-bit pseudoentropy [R 90] one-way functions statistically hiding commitments [HNORV 07]
OWFs & Cryptography secure protocols & applications private-key encryption MACs zero-knowledge proofs digital signatures statistical ZK arguments [GMW 86] pseudorandom functions statistically binding commitments [GGM 86] [BCC 86] [N 89] pseudorandom generators [HRV 10, VZ 11] [NY 89] target-collision-resistant hash functions (UOWHFs) next-bit pseudoentropy statistically hiding commitments inaccessible entropy one-way functions [HRVW 09, HHRVW 10]
![Inaccessible Entropy [HRVW 09, HHRVW 10] § Example: if h : {0, 1}n! {0,](http://slidetodoc.com/presentation_image_h/202ed97d59a4d346f6d30a37bea59667/image-25.jpg "Inaccessible Entropy [HRVW 09, HHRVW 10] § Example: if h : {0, 1}n! {0,")
Inaccessible Entropy [HRVW 09, HHRVW 10] § Example: if h : {0, 1}n! {0, 1}n-k is collisionresistant and XÃ {0, 1}n, then – H(X|h(X)) ¸ k, but – To an efficient algorithm, once it produces h(X), X is determined ) “accessible entropy” 0. – Accessible entropy ¿ Real Entropy! § Thm [HRVW 09]: f a OWF ) (f(X)1, …, f(X)n, X) has accessible entropy n-!(log n). – Cf. (f(X), X 1, …, Xn) has pseudoentropy n+!(log n).
Conclusion Complexity-based cryptography is possible because of gaps between real & computational entropy. “Secrecy” pseudoentropy > real entropy “Unforgeability” accessible entropy < real entropy
Research Directions § Formally unify inaccessible entropy and pseudoentropy. § OWF f : {0, 1}n! {0, 1}n ) Pseudorandom generators of seed length O(n)? § More applications of inaccessible entropy in crypto or complexity (or mathematics? )
- Slides: 27