G Cryptographby and Imperfect Randomness February 21, Lecture 6

Size: px

Start display at page:

Download "G Cryptographby and Imperfect Randomness February 21, Lecture 6"

Gilbert Wade
7 years ago
Views:

1 G Cryptographby ad Imperfect Radomess February 2, 2006 Lecturer: Yevgeiy Dodis Lecture 6 Scribe: Esther Iserovich ad Daa Glaser We bega by fiishig the discussio of multi-roud coi flippig ad the Bato Passig ad Lightest Bi protocols, ad saw how multi-roud coi flippig is equivalet to leader electio. We discussed adaptive coi-flippig ad the bias of various fuctios. We cojectured that majority is optimal. We also discussed Satha Vazarii sources ad foud lower bouds for the bias i this case. The we moved o to Mixed Sources ad discussed strog impossibility results. Multi-roud coi flippig Remember from the last lecture that we showed that -roud coi flippig caot tolerate Ω( ) bad players [KKL]. We will o show that the above is ot true for multi-roud coi flippig. We will start agai with the example of Bato Passig. Bato Passig [Saks89, AL93]: P holds the bato ad passes it to a radom player P i, elimiatig himself. P i does the same, ad so o, ad the last player left is the leader ad flips a coi. Clearly, bad guys will elimiate good guys, ad good guys will elimiate radom guys, so the bias is proportioal to Pr(bad guy is a leader). Let F(s, t) = Pr(bad guy is a leader whe s good guys ad t bad guys ad good guys starts). The, f(s, t) = s t s+t f(s, t) + s+t f(s, t ) because either the good guys will choose aother good guy, elimiatig him ad leavig the bad guys, or the good guy will choose a bad guy who will elimiate a good guy, so both bad ad good guys will go dow. t log t+ [Saks 89] showed that f(s, t) s+ by doig a iductio. Therefore, if t < ǫs log s this implies that f(s, t) < ǫ. Sice t + s =, the t < ǫ implies that f(s, t) = O(ǫ). [AL93]: The exact solutio is f(s, t) 9t k kxk where x = < s+t 2t log s s+t If t < (2+δ) x < k kxk = O() f(s, t) = O( t s+t ) < O( already breaks the KKL lower boud. 2t. I geeral, it is easy to see by iductio that you ca t tolerate more tha 2 [Feige 99]: ) = o(). This bad guys.. If there are 2 ( + δ) good guys, the there is a protoceol where the fairess, which is mi(pr(coi= 0), Pr(coi= )) is Ω(δ c ) where c Fairess must be O(δ ǫ ), ǫ > You ca achieve the boud i the first part with oly log rouds (essetially, O()). Lightest Bi Protocol [Feige 99]: This is the idea for eedig rouds. Each player chooses a radom bi 0 or. Players i the lightest bi recurse. At the begiig, L6-

2 sice the majority is good guys ad they will be radom so they will split basically evely, the bad guys will also eed to split almost evely i half i order to keep playig. There is, however, some small subtlety i defiig half whe is ot a power of 2. I this case we defie: Half(, c) where is umber of players i the roud ad c is committee size as Half(, c) = c mod(c + ). So whe c =, as before, at each roud, if the size of bi 0 Half(, c), bi 0 recurses. Otherwise, bi recurses. More geerally, this exteds to selectig a commitee of c people with at least oe hoest perso o the commitee. (Our target is the to get c = ). Theorem I geeral, for a committee of size c where umber of good players Pr(elected committe has at least good player) = δ O(log δ ) For the proof, see Lemmas 7 ad 8 ad Theorem 9 i [Feige 99]. c+, Corollary 2 If s > 2 costat. ad you elect a committee of size 2, Pr(good) = Ω() ad δ = Corollary 3 Up to a costat coi-flippig is equivalet to leader electio. Proof:. Leader Electio Coi-Flippig: Elect a leader ad let the leader flip a coi. 2. Coi-Flippig Leader Electio: Use the Lightest Bi Protocol to elect a committee of size 2. The use Coi-Flippig to select oe of the 2 members of the committee. Feige describes a clever mootoe circuit game that ca be used by the elected committee of size 2 to choose a leader from the origial players. For fairess of Ω() we ca see that Feige is best. For fairess of 2 o() we kow we ca tolerate oly t = o() ad there exist previous protocols i [AN 93] with bias = O( t ), but we wo t cover them. 2 Adaptive coi flippig Before: b out of players are bad ad they are chose at the begiig. This is called static corruptio. Adaptive Corruptios: starts hoest Attacker A corrupts b players durig executio It turs out that most existig static protocols are isecure because they are based o leader electio. Therefore, eve for b =, just corrupt the leader. How may people, b ca you tolerate? Startig poit: assume i each roud, (fixed) perso seds bit (radom) ad we igore efficiecy. This is called a LLS-source. L6-2

3 3 LLS-Source A LLS-source ca be thought of as the followig process: Nature flips radom bits. Attacker is allowed b history-depedet itervetios. Meaig, the attacker observes the bits ad based o the first b 0...b i bits he ca decide whether or ot to corrupt the b i th bit. This is called a (, b)-lls source or (, b)-cotrollimited source. Let q f (b, ) be the fairess of f(x) : {0, } {0, }, with b itervetios. We wat to fid: q(b, ) = mi A max f (fairess of f(x)). Examples: f-parity: Clearly, b = q = 0 sice the attacker ca just wait for the last bit ad decide whether to sed 0 or. f-radom: We ca thik of f as a tree whose leaves are the output of f ad the path to the leaf is the iput. Sice f is radom, we expect the bottom subtrees to cotai both 0 s ad s as leaves. Therefore, the attacker ca wait util the ed ad the determie whether the output will be 0 or by choosig a path to 0 or. Therefore, b = ω() q = o(). f-majority: Clearly, the adversary will fix x, x 2,...x b =. However, sice the stadard deviatio is, up to guys do t matter. c, c 2 s/t b = c q = 2 o(), b > c 2 q = o() I fact, majority turs out to be optimal. Theorem 4 (LLS) : Majority is the optimal bit-extractor for (, b)-cotrol-limited source. Optimal b = θ( ). Theorem 5 (LLS) : Give f : {0, } {0, } let p = Pr x {0,} (f(x) = ). The with b = O( log( p )) ca force f(x) to with probability o(). I fact, E[ # of itervetios to force with pr = ] = O( log( p )) I fact, [LLS], for ay p, we ca achieve the above boud with the followig f. Defie f(x) = if x has i s ad i ( j=0 j) p = 2 Otherwise f(x) = 0. We ca visualize this fuctio usig a hypercube of dimesio. Positio the hypercube so that vertices with the least weight are o the top ad vertices with greatest weight are o the bottom. Startig from the bottom, we ca add layer after layer where f(x) =. After i j=0 ( j) vertices have bee passed, all the remaiig vertices fulfill f(x) = 0. This fuctio turs out to be optimal. Clearly, this fuctio correspods to majority for p = 2. L6-3

4 Cojecture 6 Returig to the geeral problem: Majority is optimal for geeral adaptive coi-flippig. Thus, we ca oly tolerate bad guys. 4 Satha-Vazarai Source Before (LLS): each bit was either completely perfect or completely bad. Now: x, x 2,...x, each x i is at most δ-biased. The bias, while δ, depeds o history. Defiitio 7 X = x...x is a δ-sv (δ-bias limited) source if Examples: i a...a i Pr(x i = x...x i = a...a i ) Parity: clearly, oly the last step matters. Therefore, q =. Radom: ot great, but ot bad. [, ] Theorem 8 (AR89) [BN93] δ > 0 c > 0 s/t with pr( 2 ) q f (δ) c Majority: Adversary will bias every bit to. By Cheroff boud pr(f(x) = ) = 2 Ω(). This is really bad! I fact, [AR89] Majority is the worst f. Note that so far we could ot get bias δ. Ufortuately, this must be the case, irrespective of! Theorem 9, f : {0, } {0, } q f (δ). This meas that parity or eve f(x) = x is optimal. The attacker ca always bias the result by at least δ. Therefore, whe δ = Ω() we ca t extract eve a sigle, almost ubiased bit. To prove above, defie 2 useful sources: Defiitio 0 Assume S {0, }, S = 2. Defie Z S (δ half-space source): pick b = with pr ad 0 otherwise. If b =, pick radom x from S. Else, x {0, } \S. Defiitio Strog δ-sv source: a...a i a i+...a = a i Pr(x i = x i = a i ) [, ] ad Pr(x i = x i = a i ) [, ]. Lemma 2 S, Z S is a strog δ-sv source. Proof: fix a i. It is eough to prove that: Pr(x i = a i) Pr(x i = 0 a i ) L6-4

5 by multiplyig by Pr(a i) Pr(a i ) we get: Pr(a i) Pr(0a i ) However, this is true by the defiitio of δ-half-space { sice a i ad 0a i are either i the same or differet partitio so clearly Pr(a i) Pr(0a i ) 2 δ. 2 +δ,, 2 +δ 2 δ } Now we ca prove that for SV sources, bias δ. Proof: Take f. WLOG, assume that f is balaced (hardest case). The {x f(x) = 0} = {x f(x) = } Let S = {x f(x) = 0}, S = 2. The we ca pick a δ-halfspace source Z S at S. This meas that Pr(f(Z S ) = ) =. But by the previous lemma, a δ-halfspace source is also a δ-sv source. 5 Mixed Sources Both previous sources were kid of restricted. Now we itroduce a source that combies both LLS ad SV. Defiitio 3 (δ, b, )-bias-cotrol-limited source. A has b itervetios, otherwise ca bias by at most δ. Here we have a much stroger impossibility result. Theorem 4 f q f (δ, b) 2 ( + 2δ) b = 2 Ω(δb) Thus, if bδ = ω() the extractors ca fail with pr ( o()). Like i SV, this is idepedet of. This gives a very egative message for determiistic radomess extractio. L6-5

5 Boolean Decision Trees (February 11)

5 Boolean Decision Trees (February 11) 5 Boolea Decisio Trees (February 11) 5.1 Graph Coectivity Suppose we are give a udirected graph G, represeted as a boolea adjacecy matrix = (a ij ), where a ij = 1 if ad oly if vertices i ad j are coected