Goldreich's PRG: Evidence for Near-Optimal Polynomial Stretch

O’Donnell, Ryan; Witmer, David

doi:10.1109/ccc.2014.9

Cited by 41 publications

(35 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Similar bounds were proven by Feldman, Perkins and Vempala [30] for a wide family of statistical algorithms [29,36]. Interestingly, the results of [39] and [30] are tight since algorithms from the corresponding classes can break pseudorandomness when the resiliency is smaller than 2s − 1.…”

Section: How To Choose a Hard Predicate?supporting

confidence: 69%

“…In light of this, it is natural to conjecture that high resiliency defeats all attacks except for Gaussian elimination. Indeed, such views were taken by several researchers [30,39] (see also [11] for a similar conjecture in a related context). In particular, it was suggested that s-pseudorandomness is achieved by any predicate with sufficiently large resiliency k = k(s) and sufficiently large algebraic degree = (s).…”

Section: How To Choose a Hard Predicate?mentioning

confidence: 80%

“…The above results cover a rich family of attacks including most standard algorithmic approaches for solving CSPs (see discussion in [30,39]), excluding one important technique: Gaussian Elimination. Indeed, a random local function instantiated with the d-ary parity, (whose resilience is d−1) resists all the above attacks, but can be easily broken even for m = n+1 by detecting a linear dependency in the outputs.…”

Section: How To Choose a Hard Predicate?mentioning

confidence: 92%

“…For example, the results of [6] imply that, for every constant s, a predicate with resiliency 2 is s-pseudorandom against constant-depth (AC 0 ) circuits with sub-exponential size (see [4,Proposition 4.10]). O'Donnell and Witmer [39] proved that resiliency larger than 2s − 1 yields s-pseudorandomness against attacks which are based on a large class of semidefinite programs. Similar bounds were proven by Feldman, Perkins and Vempala [30] for a wide family of statistical algorithms [29,36].…”

Section: How To Choose a Hard Predicate?mentioning

confidence: 99%

“…In the last fifteen years, the RLFH assumption was extensively studied (cf. [1,3,6,8,12,13,17,24,25,30,38,39]), and was used to derive important applications in cryptography and complexity. Notable examples include secure computation protocols with constant computational overhead [35], a new public-key encryption scheme and hardness results for learning juntas [5], and strong inapproximability results for combinatorial problems [3].…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Algebraic Attacks against Random Local Functions and Their Countermeasures

Applebaum¹,

Lovett²

2018

SIAM J. Comput.

View full text Add to dashboard Cite

Suppose that you have n truly random bits x = (x 1 , . . . , x n ) and you wish to use them to generate m n pseudorandom bits y = (y 1 , . . . , y m ) using a local mapping, i.e., each y i should depend on at most d = O(1) bits of x. In the polynomial regime of m = n s , s > 1, the only known solution, originates from (Goldreich, ECCC 2000), is based on Random Local Functions: Compute y i by applying some fixed (public) d-ary predicate P to a random (public) tuple of distinct inputs (x i1 , . . . , x i d ). Our goal in this paper is to understand, for any value of s, how the pseudorandomness of the resulting sequence depends on the choice of the underlying predicate. We derive the following results:(1) We show that pseudorandomness against F 2 -linear adversaries (i.e., the distribution y has low-bias) is achieved if the predicate is (a) k = Ω(s)-resilient, i.e., uncorrelated with any ksubset of its inputs, and (b) has algebraic degree of Ω(s) even after fixing Ω(s) of its inputs. We also show that these requirements are necessary, and so they form a tight characterization (up to constants) of security against linear attacks. Our positive result shows that a d-local low-bias generator can have output length of n Ω(d) , answering an open question of Mossel, Shpilka and Trevisan (FOCS, 2003). Our negative result shows that a candidate for pseudorandom generator proposed by the first author (computational complexity, 2015) and by O'Donnell and Witmer (CCC 2014) is insecure. We use similar techniques to refute a conjecture of Feldman, Perkins and Vempala (STOC 2015) regarding the hardness of planted constraint satisfaction problems.(2) Motivated by the cryptanalysis literature, we consider security against algebraic attacks. We provide the first theoretical treatment of such attacks by formalizing a general notion of algebraic inversion and distinguishing attacks based on the Polynomial Calculus proof system. We show that algebraic attacks succeed if and only if there exist a degree e = O(s) non-zero polynomial Q whose roots cover the roots of P or cover the roots of P 's complement. As a corollary, we obtain the first example of a predicate P for which the generated sequence y passes all linear tests but fails to pass some polynomial-time computable test, answering an open question posed by the first author (Question 4.9, computational complexity 2015). * Tel-Aviv University, bennyap@post.tau.ac.il.

show abstract

Section: How To Choose a Hard Predicate?supporting

confidence: 69%

Section: How To Choose a Hard Predicate?mentioning

confidence: 80%

Section: How To Choose a Hard Predicate?mentioning

confidence: 92%

Section: How To Choose a Hard Predicate?mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Algebraic Attacks against Random Local Functions and Their Countermeasures

Applebaum¹,

Lovett²

2018

SIAM J. Comput.

View full text Add to dashboard Cite

show abstract

On the Concrete Security of Goldreich’s Pseudorandom Generator

Couteau

Dupin

Méaux

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Local pseudorandom generators allow to expand a short random string into a long pseudorandom string, such that each output bit depends on a constant number d of input bits. Due to its extreme efficiency features, this intriguing primitive enjoys a wide variety of applications in cryptography and complexity. In the polynomial regime, where the seed is of size n and the output of size n s for s > 1, the only known solution, commonly known as Goldreich's PRG, proceeds by applying a simple d-ary predicate to public random sized subsets of the bits of the seed. While the security of Goldreich's PRG has been thoroughly investigated, with a variety of results deriving provable security guarantees against class of attacks in some parameter regimes and necessary criteria to be satisfied by the underlying predicate, little is known about its concrete security and efficiency. Motivated by its numerous theoretical applications and the hope of getting practical instantiations for some of them, we initiate a study of the concrete security of Goldreich's PRG, and evaluate its resistance to cryptanalytic attacks. Along the way, we develop a new guess-and-determine-style attack, and identify new criteria which refine existing criteria and capture the security guarantees of candidate local PRGs in a more fine-grained way.

show abstract