1 / 40

Derandomized Constructions of k -Wise (Almost) Independent Permutations

Derandomized Constructions of k -Wise (Almost) Independent Permutations. Tel-Aviv University. Weizmann Institute of Science. Eyal Kaplan Moni Naor Omer Reingold. k- wise independent functions. a family of functions G = {g| g: {0,1} n → {0,1} n }

rowena
Download Presentation

Derandomized Constructions of k -Wise (Almost) Independent Permutations

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Derandomized Constructions of k-Wise (Almost) Independent Permutations Tel-Aviv University Weizmann Institute of Science Eyal Kaplan Moni Naor Omer Reingold

  2. k-wise independent functions a family of functions G = {g| g: {0,1}n → {0,1}n } is called k-wise independent if: g 2R G is indistinguishable from a random functionf for any process that receives g(x)on at most k points 8x1, x1, … xk 2 {0,1}n, 8A: {0,1}nk →{0,1} Probg 2 G[A(g(x1), …, g(xk)) =‘1’] = Probf[A(f(x1), … f(xk)) =‘1’] A great success story

  3. k-wise independent functions Simple construction: • Let a G be the family of polynomials over GF(2n)of degree at most k-1 Then • G is k-wise independent: 8x1, x2, … xk, 8y1, y2, … yk, there is a uniqueg 2 G such that g(xi)= yi • The description of g 2 G is k¢n bits long • This is tight • Cannot hope to get a shorter description

  4. What about k-wise independent permutations? Suppose that G = {g| g: {0,1}n → {0,1}n } • Should be a family of permutations • 1-1 and length preserving • g 2R G is indistinguishable from a random permutationf for any process that receives g(x)on at most k points

  5. Pair-wise independent permutations Simple construction: G = {ga,b(x) = a∙x + b | a, b  GF(2n), a ≠0} • for all • x1, x2 {0,1}nand y1, y2 {0,1}nwhere x1 ≠x2 and y1 ≠y2 there is a uniquega,b2 G such that • ga,b(x1) = ax1+b = y1 and • ga,b(x2) = ax2+b= y2 What about larger k? • For k=3 there is a similar algebraic construction • For k>3 no known construction of non-trivial size

  6. Relaxation: k-wise almost independent permutations Suppose that G = {g| g: {0,1}n → {0,1}n } • Should be a family of permutations • 1-1 and length preserving • g 2R G is at most-distinguishable from a random permutationf for any process that receives g(x)on at most k points: the advantage of distinguishing g 2R G from a truly random permutation is at most 8x1, x1, … xk, the variation distance of • g(x1), …, g(xk) for g 2R G and • y1, y2, … yk a random k-tuple with no repetitions is at most  For =0 we have k-wise independence Should we allow inverses? Should we allow adaptive queries?

  7. Main Result • For anyn, k and : There is an explicit construction of a family G = {g| g: {0,1}n → {0,1}n } of k-wise -dependent permutations where the description of each g 2 G is O(kn + log 1/) bits long Can sample from the family and evaluate a permutation in time poly(k, n, log 1/) Optimal up to the log 1/

  8. Good for small k and moderate  Summary of Previous Work and Results

  9. Techniques and Ideas • Let F = {f| f: {0,1}n → {0,1}n } be a family of permutations • Each f 2 F described by w bits • Denote by Ftthe family of permutations obtained by composing f1, f2, … ft2R F • Suppose that Ftis k-wise -dependent • The description of f 2 Ft is w¢t bits We will show a technique to derandomize such constructions and look at a much smaller subset G of the t-tuples of F • The description of g 2 G would be roughly O(w+t) bits Many known constructions can be described as such

  10. Pseudo-randomness fooling bounded space machines • A function h:{0,1}* {0,1}* such that • on random input the output is indistinguishable from a string chosen uniformly at random • to any process using s bits of memory • Branching program • Expands the input Is called a pseudo-random generator for spaces machines h b2 … bℓ b1 s … 2s 0 1 b1 b2 bℓ

  11. First Idea: apply pseudo-random generators for fooling bounded space algorithm The possible assignments to the input of h define the collection G h is a generator that fools branching programs of width kn+w input h … f2 ft f1 w bits

  12. Where is the bounded space coming from? • Suppose that G ½Ft is notk-wise -dependent • Then there are x1, x2, …, xk which witness it • How much space does the algorithm for evaluating g=f1◦f2◦ … ◦ft2 Gon these points require? • Scanning f1, f2, … ftfrom left to right and gradually evaluating g on all x1, x2, … xk simultaneously • need only kn + w bits - As a branching program • Therefore: if the w¢t bits describing them are generated by a process that fools all kn + w bit branching programs • Then the distribution of g(x1), g(x2), …, g(xk) for g 2R G is similar to • The distribution of f(x1), f(x2), …, f(xk) for f=f1◦f2◦ … ◦ftfor independent fi Conclusion: G is k-wise -dependent

  13. Parameters of space bounded generators • For an ideal generator: this method takes O(kn + log 1/ + w +log t) bits • No such explicit generator is known • No known good enough generator all introduce extra polylog factors • Indyk, Sivakumar: previous proposals for using space generators for combinatorial constructions • When space is not an explicit issue

  14. Second idea: use pseudo-random generators for random walks Generate f1, f2, … ft2 F via a pseudo random generator for random walks Ones which are indistinguishable from random for any consistently labeled graph Such walk generators exist • Implicitly: Reingold’s SL=L • Explicitly: Reingold, Trevisan and Vadhan • Show how to apply them in the context of k-wise independent permutations • Using previous constructions to define the graph

  15. Pseudo-random generators for walks • Call a labeled graph H=(V,E) an (m,d,)-graph if • |V| = m • Each node has d outgoing edges • The labeling is consistent – all incoming labels are distinct • the second eigenvalue in absolute value (H) · A pseudo-random generator for random walks on H=(V,E) is a mapping G:{0,1}*[d]ℓ where for any starting node v 2 V the distributions of a walk starting from v • chosen from G via a random input and • truly random walk are  close For long enough walks and for graphs with large spectral gaps a random walk ends in a random node 1 3 2 Defines a walk of length ℓ

  16. The RTV Generator • For any m, d,  and  there is a pseudo-random generator for all (m,d,1-)-graphs PRGm,d, ,:{0,1}r [d]ℓ With the following parameters: • Seed lengthr 2 O(log (m ¢ d / ¢ )) • Walk length ℓ 2 O(poly(1/) log (m ¢ d /  )) • Computable in space O( log (m ¢ d / ¢ )) and time poly(1/, log (m ¢ d /  )) Such that • for any starting point v 2 V • a walk generated by PRGm,d, , walk yields an end point that is  close to uniform • For graphs with • large enough spectral gap (1/polylog m) • arbitrary degree • need only log m random bits to get to a random location • in polylog m steps

  17. k-Companion graph Let • N = 2n • [N]k be set of all k-tuples of distinctn-bit strings • Let F be a family of permutations. Then GF,k = (V,E) is the k-companion graph of F, where: • V =[N]k • E = {(z,(z)) | z 2 [N]k , 2 F)} • Each edge (z,(z)) 2 E is labeled by  z1, z2, … zk  (z1), (z2), … (zk)

  18. Properties of the Companion Graph • Let F be a family of permutations. If F • is closed under inverses and • contains the identity permutation. Then HF,k, the k-companion graph of F, is: • An undirected |F|-regular graph • With self-loops • Consistently labeled z1, z2, … zk  • The analysis of k-wise independence is via showing a spectral gap of HF,k (z1), (z2), … (zk)

  19. k-wise independence and random walks • If Ftyields a family of permutations that is k-wise -dependent, then in the companion graph HF,k • for any node z2 [N]ka random walk from z is -close to uniform Otherwise this zis a witness to the non k-wise -dependence

  20. The construction Generate f1, f2, … ft2 F via a pseudo random generator for random walks on HF,k , the k-companion graph of F • f1, f2, … ftare the labels of the walk. • The resulting permutation is g=f1◦f2◦ … ◦ft • Use PRGm,d, ,:{0,1}r [d]ℓfor • m = |[N]k| • d = |F| • r 2 O(log (2nk¢ |F| / ¢ ))  comes from the analysis of the original construction Ft gap(HF,k) ¸  is how close we want to be to a k-wise independent permutation

  21. The resulting parameters The resulting family G of permutations is: • A family of k-wise -dependent permutations • The description of each g 2 G is O(nk + log |F| + log(1/ ) ) bits • If the time to evaluate f(x) for f 2 F is (n,k), then the time complexity of evaluating g 2 G is poly(1/, n, k, log (|F| /  ))(n,k) • Need to ``open up” the description of f1, f2, … ft

  22. Summary of Previous Work and Results • Proposed and analyzed by • Gowers • Hoory, Magen, MyersandRackoff • BrodskyandHoory

  23. Resulting Parameters with Simple 3-bit Permutation Theorem [BH] There is a family of simple permutationsF2 s.t. for all 2 · k · 2n-2 there is a t 2 O(n2 k(nk+log 1/)) where: • F2t is k-wise -dependent • gap(HF2,k) is (1/n2 k) • Description of f 2F2is O(log(n3)) bits Therefore: description of each g 2 G is O(nk + log(n3) + log(n2 k / )) bits

  24. Open Problems • Get rid of the dependency on  • Come up with exactk-wise independent permutations of reasonable size or • Show a reason why it is difficult to construct them How about using permutation polynomials • Over fields – hard problem • Rivest: Simple characterization for mod 2n • Is it useful?

  25. Time complexity of the permutation • The RTV Generator increases the length of the walk • The general space generator does not increase it • Is it possible to get the best of both worlds?

  26. Efficiency of evaluating k-wise independent permutations and functions What about the time to evaluate g on a given point x • Want a representation where the evaluation does not involve reading the entire description of g • Even for functions: in the simple construction need to read all the bits • Siegel: Some lower and upper bounds for functions Question: given either • k-wise independent function or • k-wise independent permutation over larger range Come up with a good construction of k-wise independent permutation with a small evaluation time and black-box calls to the given function/permutation What if the domain size N is not a power of 2? Open only for small k Using good extractors

  27. The End

  28. L1 R1 f L2 R2 k-wise permutations over other domains • What if the domain size N is not a power of 2 • The card shuffling approach are hard to adapt • Can use Feistel network to get some results • Can reduce size by fixed fraction • Cycle walking • Need to take k’-wise for k’ 2 O(k+log 1/) Problem if k is small

  29. The credit card problem • Find a simple reduction from permutations on large blocks to small blocks • Preserving the properties of the original permutation • Time-wise • Security

  30. Motivating example: permuting credit card numbers To reduce fraud want to permute credit card numbers

  31. Motivating example: permuting credit card numbers To reduce fraud want to permute credit card numbers • Size of set: roughly 240 (ignoring the first 4 digits) • Only trusted servers will have access to the permutation • An adversary that sees only a limited number of permuted cc numbers should not be able to obtain information on any other card • For which it sees only the permuted value • Want a way to spread the permutation to the trusted servers Need a succinct representation No such construction known even based on cryptographic primitives

  32. Shared-key encryption schemes where: The encryption of every plaintext block is a ciphertext block of the same length. Important Examples: DES, AES How to go from block size 64 to block size 40? Complexity based concept modeling them: Pseudo-Random Permutations Plaintext Key BC Ciphertext Block-Ciphers: Block size: 64 bits

  33. Block-ciphers and k-wise independent permutations • The two notions are related • But some important differences • Example: dynamic vs. static attacks

  34. Pseudo-randomness fooling bounded space machines • A function h:{0,1}* {0,1}* such that • on random input the output is indistinguishable from a string chosen uniformly at random • to any process using s bits of memory • Branching program • Expands the input Is called a pseudo-random generator for spaces machines h b2 … bℓ b1 s … 2s 0 1 b1 b2 bℓ

  35. First Idea: apply pseudo-random generators for fooling bounded space algorithm The possible assignments to the input of h define G input h … f2 ft f1 w bits

  36. Where is the bounded space coming from? • Suppose that G ½Ft is notk-wise -dependent • Then there are x1, x2, …, xk which witness it • How much space does the algorithm for evaluating g=f1◦f2◦ … ◦ft2 Gon these points require? • Scanning f1, f2, … ftfrom left to right and gradually evaluating g on all x1, x2, … xk simultaneously • need only kn + w bits - As a branching program • Therefore: if the w¢t bits describing them are generated by a process that fools all kn + w bit branching programs • Then the distribution of g(x1), g(x2), …, g(xk) for g 2R G is similar to • The distribution of f(x1), f(x2), …, f(xk) for f=f1◦f2◦ … ◦ftfor independent fi Conclusion: G is k-wise -dependent

  37. Parameters of space bounded generators • For an ideal generator: this method takes O(kn + log 1/ + w +log t) bits • No such explicit generator is known • Best known ones introduce additional polylog factors • Indyk, Sivakumar: previous proposals for using space generators for combinatorial constructions • When space is not an explicit issue

  38. Simple 3 bit Permutations An approach for generating simple permutations by changing a fixed number of bits in each round Each permutation is defined by • A small subset of the indices • A permutation  that maps the subset of the bits to their new value Proposed and analyzed by • Gowers • Hoory, Magen, MyersandRackoff • BrodskyandHoory ( )

  39. Simple 3 bit Permutations For • Boolean function on c bits f:0,1c  0,1 • Subset S = {i0, i1, … ic} ½ [n] define a Permutation f,S:0,1n  0,1nwhere f,S(x1, x2, …, xn) = (x1, …, xi0-1, xi  f(xi1, …, xic), xi0+1, …, xn) Note that f,S is an involution: Inverse of itself Let F2 ={f,S | f:0,12  0,1, S ½ [n], |S|=3} Theorem [Brodsky-Hoory] For all 2 · k · 2n-2 there is a t 2 O(n2 k(nk+log 1/)) where: • F2t is k-wise -dependent • gap(HF2,k) is (1/n2 k)

  40. The End

More Related