Dense Subsets of Pseudorandom Sets

Abstract

A theorem of Green, Tao, and Ziegler can be stated (roughly) as follows: if R is a pseudorandom set, and D is a dense subset of R, then D may be modeled by a set M that is dense in the entire domain such that D and M are indistinguishable. (The precise statement refers to"measures" or distributions rather than sets.) The proof of this theorem is very general, and it applies to notions of pseudorandomness and indistinguishability defined in terms of any family of distinguishers with some mild closure properties. The proof proceeds via iterative partitioning and an energy increment argument, in the spirit of the proof of the weak Szemerédi regularity lemma. The "reduction" involved in the proof has exponential complexity in the distinguishing probability.We present a new proof inspired by Nisan's proof of Impagliazzo's hardcore set theorem. The reduction in our proof has polynomial complexity in the distinguishing probability and provides a new characterization of the notion of "pseudoentropy" of a distribution.We also follow the connection between the two theorems and obtain a new proof of Impagliazzo's hardcore set theorem via iterative partitioning and energy increment. While our reduction has exponential complexity in some parameters, it has the advantage that the hardcore set is efficiently recognizable.

Overcoming Weak Expectations

“…This leads to a simple (computationally-secure) construction of such a KDF h using length-doubling PRGs, already mentioned at the end of Section 3.2. As an unexpected consequence, also mentioned in the Introduction, our new KDF will give us an interesting (and often more favorable) alternative to the dense model theorem [28,27,16,17].…”

“…the difference between m = length(R) and the amount of entropy it has), and the second is essentially the 'variance' of f under uniform distribution U m . Quite surprisingly, some 'unexpected' results follow as simple corollaries of this inequality, such as non-malleable extractors [14,10,7,21], leakage-resilient symmetric encryptions [24], alternative to the dense model theorem [28,27,16,17], seed-dependent condensers [12] and improved entropy loss for the Leftover Hash Lemma (LHL) [1]. We provide a unified proof for these diversified problems and in many cases significantly simply and/or improve known techniques for the same problems.…”

“…Unfortunately, a closer look shows that not only ε degrades by at least the (expected) factor 2 d as compared to ε prg , but also the time T is much less than T : the most recent variant due to [17] has T T 1/3 , while previous versions [16,27] had T = T · poly(ε). In contrast, by replacing any extractor h by a "special" extractor -a pairwise independent hash function h -and also swapping the roles of the key and the input, we can maintain nearly the same resources T ≈ T , but at the cost of potentially 9 increasing ε from roughly ε prg ·2 d +T −1/3 to ε prg · 2 d .…”

“…Prior to our work, the only alternative method of tolerating weak PRG seeds came from the "dense model theorem" [28,27,16,17], which roughly states that the 2m-bit output X = G(X) of a (T, ε prg )-secure PRG G is (T , ε )-computationally close to having the same entropy deficiency d m as X (despite being twice as long). This means, for example, that one can now apply an m-bit extractor (e.g., LHL) h to X to derive the final m-bit key R = h (G(X)).…”

Robust Pseudorandom Generators

“…What do these values together with C reveal about M ? The dense model theorem [48,46,23] assures us that if G is sufficiently strong, then M is indistinguishable from some source whose min-entropy is roughly m−k. However, even a single lost bit of entropy can correspond to global information about m. For instance, if an intermediate value reveals the parity of G(K), this information together with C reveals the parity of M .…”