Key Derivation without Entropy Waste

Abstract

Abstract. We revisit the classical problem of converting an imperfect source of randomness into a usable cryptographic key. Assume that we have some cryptographic application P that expects a uniformly random m-bit key R and ensures that the best attack (in some complexity class) against P (R) has success probability at most δ. Our goal is to design a key-derivation function (KDF) h that converts any random source X of min-entropy k into a sufficiently "good" key h(X), guaranteeing that P (h(X)) has comparable security δ which is 'close' to δ.Seeded randomness extractors provide a generic way to solve this problem for all applications P , with resulting security δ = O(δ), provided that we start with entropy k ≥ m+2 log (1/δ)−O(1). By a result of Radhakrishnan and Ta-Shma, this bound on k (called the "RT-bound") is also known to be tight in general. Unfortunately, in many situations the loss of 2 log (1/δ) bits of entropy is unacceptable. This motivates the study KDFs with less entropy waste by placing some restrictions on the source X or the application P .In this work we obtain the following new positive and negative results in this regard:-Efficient samplability of the source X does not help beat the RTbound for general applications. This resolves the SRT (samplable RT) conjecture of Dachman-Soled et al.[DGKM12] in the affirmative, and also shows that the existence of computationally-secure extractors beating the RT-bound implies the existence of one-way functions. -We continue in the line of work initiated by Barak et al. [BDK + 11] and construct new information-theoretic KDFs which beat the RTbound for large but restricted classes of applications. Specifically, we design efficient KDFs that work for all unpredictability applications P (e.g., signatures, MACs, one-way functions, etc.) and can either:(1) extract all of the entropy k = m with a very modest security loss δ = O(δ · log (1/δ)), or alternatively, (2) achieve essentially optimal security δ = O(δ) with a very modest entropy loss k ≥ m + loglog (1/δ). In comparison, the best prior results from [BDK -The weaker bounds of [BDK + 11] hold for a larger class of so-called "square-friendly" applications (which includes all unpredictability, but also some important indistinguishability, applications). Unfortunately, we show that these weaker bounds are tight for the larger class of applications.-We abstract out a clean, information-theoretic notion of (k, δ, δ )-unpredictability extractors, which guarantee "induced" security δ for any δ-secure unpredictability application P , and characterize the parameters achievable for such unpredictability extractors. Of independent interest, we also relate this notion to the previously-known notion of (min-entropy) condensers, and improve the state-of-the-art parameters for such condensers.

The Randomized Iterate, Revisited - Almost Linear Seed Length PRGs from a Broader Class of One-Way Functions

“…Analogous observations were made in similar settings [1,5,4], where either the game is two-sided (e.g., indistinguishability applications) or the randomness is sampled from slightly defected min-entropy source. Plugging this lemma into [10] immediately yields a simpler proof for the key lemma of [10] (see Lemma 3.2), namely, "any k th iterate (instantiated with a regular OWF) is hard-to-invert".…”

“…See Remark 2.1 for some discussions. 4 The Rényi entropy deficiency of a random variable W over set W refers to the difference between entropies of UW and W , i.e., log |W| − H2(W ), where UW denotes the uniform distribution over W and H2(W ) is the Rényi entropy of W . 5 We should not confuse "weakly-regular" with "weakly-one-way", where the former "weakly" describes regularity (i.e., regular on a noticeable fraction as in Definition 2.4) and the latter is used for one-way-ness (i.e., hard-to-invert on a noticeable fraction [19]).…”

Reusable Fuzzy Extractors for Low-Entropy Distributions

“…A condenser is like a randomness extractor but the output is allowed to be slightly entropy deficient. Efficient condensers are known with smaller entropy loss than possible for randomness extractors (for example k-wise independent hashes [DPW14]). We now argue that there exists a distribution Y whereH ∞ (Y |seed) ≥α(n−β) and (V, seed 1 , ..., seed n ) ≈ (Y, seed 1 , .., seed n ).…”

Condensed Unpredictability

“…H Cond denotes a (log + 1) wise independent hash function, which is shown to be a good condenser (as stated in the table) for min-entropy in [DPW14]. The bounds for HILL entropy follow directly from the bound for min-entropy.…”