Witness Maps and Applications

Chakraborty, Suvradip; Prabhakaran, Manoj; Wichs, Daniel

doi:10.1007/978-3-030-45374-9_8

Cited by 11 publications

(19 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Then, we extend it to a notion of cumulatively all-lossy-but-one (CALBO) functions and show how to construct CALBOs from LFs. The notion of CALBOs with a trapdoor was also explored in a recent work of [CPW19], where they gave a construction using DDH and indistinguishability obfuscation (iO). In contrast, our notion of CALBOs without a trapdoor appears to be significantly easier to achieve and we do not rely on iO.…”

Section: Construction Via Lossy Functionsmentioning

confidence: 99%

Extracting Randomness from Extractor-Dependent Sources

Dodis

Vaikuntanathan

Wichs

2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

We revisit the well-studied problem of extracting nearly uniform randomness from an arbitrary source of sufficient min-entropy. Strong seeded extractors solve this problem by relying on a public random seed, which is unknown to the source. Here, we consider a setting where the seed is reused over time and the source may depend on prior calls to the extractor with the same seed. Can we still extract nearly uniform randomness?In more detail, we assume the seed is chosen randomly, but the source can make arbitrary oracle queries to the extractor with the given seed before outputting a sample. We require that the sample has entropy and differs from any of the previously queried values. The extracted output should look uniform even to a distinguisher that gets the seed. We consider two variants of the problem, depending on whether the source only outputs the sample, or whether it can also output some correlated public auxiliary information that preserves the sample's entropy. Our results are: Without Auxiliary Information: We show that every pseudo-random function (PRF) with a sufficiently high security level is a good extractor in this setting, even if the distinguisher is computationally unbounded. We further show that the source necessarily needs to be computationally bounded and that such extractors imply one-way functions. With Auxiliary Information:We construct secure extractors in this setting, as long as both the source and the distinguisher are computationally bounded. We give several constructions based on different intermediate primitives, yielding instantiations based on the DDH, DLIN, LWE or DCR assumptions. On the negative side, we show that one cannot prove security against computationally unbounded distinguishers in this setting under any standard assumption via a black-box reduction. Furthermore, even when restricting to computationally bounded distinguishers, we show that there exist PRFs that are insecure as extractors in this setting and that a large class of constructions cannot be proven secure via a black-box reduction from standard assumptions. setting where a seed S is chosen uniformly at random. A source S EDExt(•,S) gets oracle access to the extractor with the seed S and outputs a sample X along with some public auxiliary information AUX. We say that such a source S is a legal extractor-dependent source of entropy α if two conditions hold: (1) the (conditional min-entropy) of X given S, AUX is at least α, and (2) the source never queries the oracle on the value X that it outputs. An α-ED-Extractor needs to ensure that for all legal extractor-dependent sources of entropy α, the output EDExt(X, S) is indistinguishable from uniform, even given the seed S and the auxiliary information AUX.Discussion on the Legality Conditions. We motivate the reason behind the two legality conditions imposed by the definition.Firstly, just like for standard (seeded) extractors, we need to assume that X has a sufficient level of entropy even conditioned on AUX in order to extract randomness from it. In our case, ...

show abstract

Section: Construction Via Lossy Functionsmentioning

confidence: 99%

Extracting Randomness from Extractor-Dependent Sources

Dodis

Vaikuntanathan

Wichs

2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…The strongest requirement would be that the prover cannot find two accepting proofs for the same formula, even if the formula has multiple satisfying assignments. This notion, however, is only known under very strong assumptions [SW14,CPW20]. A natural relaxation is to ask for unambiguous proofs only for formulas where the satisfying assignment is unique, or where finding multiple satisfying assignments is intractable.…”

Section: Our Delegation Schemementioning

confidence: 99%

Delegation with Updatable Unambiguous Proofs and PPAD-Hardness

Kalai

Paneth

Yang

2020

Advances in Cryptology – CRYPTO 2020

View full text Add to dashboard Cite

In this work, we construct an updatable and unambiguous delegation scheme based on the decisional assumption on bilinear groups introduced by Kalai, Paneth and Yang [STOC 2019]. Using this delegation scheme, we show PPAD-hardness (and hence the hardness of computing Nash equilibria) based on the quasi-polynomial hardness of this bilinear group assumption and any hard language that is decidable in quasi-polynomial time and polynomial space.The delegation scheme is for super-polynomial time deterministic computations and is publicly verifiable and non-interactive in the common reference string (CRS) model. It is updatable meaning that given a proof for the statement that a Turing machine reaches some configuration C in T steps, it is efficient to update it into a proof for the statement that the machine reaches the next configuration C' in T+1 steps. It is unambiguous meaning that it is hard to produce two different proofs for the same statement.

show abstract

“…In a setting where multiple lossy evaluations are provided (e.g., for multiple lossy evaluation keys in the context of standard LTDFs or for multiple lossy tags in the context of tag-based LTDFs), one may want to guarantee that multiple lossy evaluations on the same input x do not reveal more information about x than a single evaluation. This additional property was termed cumulative lossiness in [19] where it was formalized by requiring the existence of a (possibly inefficient) algorithm that starts with some fixed, partial information about x and recovers the entire information provided by the multiple lossy evaluations. The fact that all these evaluations can be recovered (even inefficiently) from the same amount of partial information on x then guarantees that multiple lossy evaluations on the same input x preserve the entropy of x.…”

Section: Introductionmentioning

confidence: 99%

“…In this paper, we investigate the notion of cumulatively all-lossy-but-one trapdoor functions, suggested by Chakraborty, Prabharkaran and Wichs [19], which considers the case where all tags are lossy, except one. This notion has been used to obtain advanced constructions of randomness extractors [24] and signatures in the leakage and tampering model [19].…”

Section: Introductionmentioning

confidence: 99%

“…The design of CALBO-TDFs, for which a trapdoor is required in injective mode, is much harder. Indeed, the only known instantiation so far [19] relies on the existence of indistinguishability obfuscation [29] (iO) besides the DDH (or LWE) assumption. At a high level, the construction of [19] starts with cumulative LTDFs (C-LTDFs), which can be built from LWE or DDH, and combines it with iO and puncturable PRFs [13,41,15].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Cumulatively All-Lossy-But-One Trapdoor Functions from Standard Assumptions

Libert

Nguyen

Passelègue

2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Chakraborty, Prabhakaran, and Wichs (PKC'20) recently introduced a new tag-based variant of lossy trapdoor functions, termed cumulatively all-lossy-but-one trapdoor functions (CALBO-TDFs). Informally, CALBO-TDFs allow defining a public tag-based function with a (computationally hidden) special tag, such that the function is lossy for all tags except when the special secret tag is used. In the latter case, the function becomes injective and efficiently invertible using a secret trapdoor. This notion has been used to obtain advanced constructions of signatures with strong guarantees against leakage and tampering, and also by Dodis, Vaikunthanathan, and Wichs (EUROCRYPT'20) to obtain constructions of randomness extractors with extractor-dependent sources. While these applications are motivated by practical considerations, the only known instantiation of CALBO-TDFs so far relies on the existence of indistinguishability obfuscation. In this paper, we propose the first two instantiations of CALBO-TDFs based on standard assumptions. Our constructions are based on the LWE assumption with a sub-exponential approximation factor and on the DCR assumption, respectively, and circumvent the use of indistinguishability obfuscation by relying on lossy modes and trapdoor mechanisms enabled by these assumptions.

show abstract

Witness Maps and Applications

Cited by 11 publications

References 39 publications

Extracting Randomness from Extractor-Dependent Sources

Extracting Randomness from Extractor-Dependent Sources

Delegation with Updatable Unambiguous Proofs and PPAD-Hardness

Cumulatively All-Lossy-But-One Trapdoor Functions from Standard Assumptions

Contact Info

Product

Resources

About