Algebraic Attacks against Random Local Functions and Their Countermeasures

Abstract

Suppose that you have n truly random bits x = (x 1 , . . . , x n ) and you wish to use them to generate m n pseudorandom bits y = (y 1 , . . . , y m ) using a local mapping, i.e., each y i should depend on at most d = O(1) bits of x. In the polynomial regime of m = n s , s > 1, the only known solution, originates from (Goldreich, ECCC 2000), is based on Random Local Functions: Compute y i by applying some fixed (public) d-ary predicate P to a random (public) tuple of distinct inputs (x i1 , . . . , x i d ). Our goal in this paper is to understand, for any value of s, how the pseudorandomness of the resulting sequence depends on the choice of the underlying predicate. We derive the following results:(1) We show that pseudorandomness against F 2 -linear adversaries (i.e., the distribution y has low-bias) is achieved if the predicate is (a) k = Ω(s)-resilient, i.e., uncorrelated with any ksubset of its inputs, and (b) has algebraic degree of Ω(s) even after fixing Ω(s) of its inputs. We also show that these requirements are necessary, and so they form a tight characterization (up to constants) of security against linear attacks. Our positive result shows that a d-local low-bias generator can have output length of n Ω(d) , answering an open question of Mossel, Shpilka and Trevisan (FOCS, 2003). Our negative result shows that a candidate for pseudorandom generator proposed by the first author (computational complexity, 2015) and by O'Donnell and Witmer (CCC 2014) is insecure. We use similar techniques to refute a conjecture of Feldman, Perkins and Vempala (STOC 2015) regarding the hardness of planted constraint satisfaction problems.(2) Motivated by the cryptanalysis literature, we consider security against algebraic attacks. We provide the first theoretical treatment of such attacks by formalizing a general notion of algebraic inversion and distinguishing attacks based on the Polynomial Calculus proof system. We show that algebraic attacks succeed if and only if there exist a degree e = O(s) non-zero polynomial Q whose roots cover the roots of P or cover the roots of P 's complement. As a corollary, we obtain the first example of a predicate P for which the generated sequence y passes all linear tests but fails to pass some polynomial-time computable test, answering an open question posed by the first author (Question 4.9, computational complexity 2015). * Tel-Aviv University, bennyap@post.tau.ac.il.

Correlated Pseudorandom Functions from Variable-Density LPN

“…Algebraic attacks have been introduced in [Pat95] and were later extended and abstracted in [Cou01,CM03,Cou03]. More recently, [AL18] formalized the notion of algebraic attacks in the study of random local functions.…”

On the Concrete Security of Goldreich’s Pseudorandom Generator

“…The existence of PRGs in NC 0 was first considered by Cryan and Miltersen in [CM01]. Remarkably, it was shown by Applebaum,Ishai,and Kushilevitz [AIK04,AIK08] that cryptographically secure pseudorandom generators (with linear stretch m = O(n)) exist in a complexity class as low as NC 0 4 (the class of constant depth, polysize circuits where each output bit depends on at most 4 input bits), under widely believed standard assumption for the case of PRG with sublinear stretch (such as factorization, or discrete logarithm), and under a specific intractability assumption related to the hardness of decoding "sparsely generated" linear codes, for the case of PRG with linear stretch. While this essentially settled the question of the existence of linear stretch PRGs in NC 0 , an intriguing open question remained: could PRGs in NC 0 have polynomial stretch, m = poly(n)?…”

“…In addition to the above (non-exhaustive) overview, we note that the existence of poly-stretch local pseudorandom generators also enjoys interesting complexity-theoretic implications. For example, they have been shown in [AIK08] to imply strong (tight) bounds on the average-case inapproximability of constraints satisfactions problems such as Max3SAT.…”

Limits on the Locality of Pseudorandom Generators and Applications to Indistinguishability Obfuscation

“…This is a remarkable development: until recently, we had IO candidates based on constant degree (most recently, degree 5) multilinear maps and constant locality (most recently, locality 5) PRGs. We did not have any candidates for the degree 5 multilinear maps that satisfied the required assumptions (namely, a version of the decisional Diffie-Hellman assumption); however, we did have candidates for locality 5 PRGs that are known to resist a large class of attacks [OW14,AL16]. The Lin-Tessaro result dramatically changed the landscape by shifting the burden of existence from degree 5 multilinear maps to pseudorandom generators with (so-called) blockwise locality 2 and polynomial stretch.…”