A Unifying Approach for Proving Hardcore Predicates Using List Decoding

1. A Unifying Approach for Proving Hardcore PredicatesUsing List Decoding Adi AkaviaShafi Goldwasser Muli Safra

2. f(z) f(x) P(z) w.p ½ + x Hard Core Predicate • One-way function: easy to compute, but hard to invert • P is hard coreof f if predicting P implies inverting f • Proving P hardcore of f by reduction: Guessing P(x), when given f(x) for non-neg fraction of x’s Inversion Algorithm Magic Box

3. Examples • “One-Way” Functions: • RSA(x) = xe mod N • Exp(x) = gx mod p • Predicates: • halfN(x) = 1 iff x<N/2 • Least significant bit:lsb(x) = 1 iff x is even • [BM,ACGS, GL,N,HN,FS,VV,Kali…] N 0 N 0

4. j f(z).r Hadx(j) w.p ½ + ’ GL(x.r) w.p ½ + Goldreich-Levin Predicate GL(x.r) = i xiri • Thm[GL]: OWF f, GL is a hard core predicate of f’(x.r)=f(x).r. • “Proof”: • Hadamard codeHadx(j)=GL(x,j). • Code Accessgiven f(x), and a magic-box predicting GL, access a w close to Hadx Code Access f(x) Magic Box

5. j f(z).r f(x) w(closeto Hadx) Hadx(j) w.p ½ + ’ GL(x.r) w.p ½ + x Code Access f(x) Magic Box Goldreich-Levin Predicate GL(x.r) = i xiri • Thm[GL]: OWF f, GL is a hard core predicate of f’(x.r)=f(x).r. • “Proof”: • Hadamard codeHadx(j)=GL(x,j). • Code Accessgiven f(x), and a magic-box predicting GL, access a w close to Hadx • List Decodinggiven a word close to Hadx, find x Inversion Algorithm Code Access List Decoding

6. f(x) w x Inversion Algorithm List Decoding Code Access List Decoding Approach [GL,Im,Su] • Thm: If there exists a code C={Cx} with • Code Access (with respect to f,P): Given f(x), and a magic-box that predicts P, we can access w which is close to Cx • An efficient List Decoding algorithm for C(with few random queries) Then P is hard core of f • Proof:

7. List Decoding Approach for Natural OWFs • List decoding approach is elegant, but is it usefull ? • Can it be utilized to prove hardcore predicates for natural OWFs? • YES! We use the list-decoding approach to show hardcore predicates for the natural OWFs: • Exp - half and others • RSA - half,lsb, and others • ECL - half and others

8. (and not {0,1}n) 2 1 3 4 0 5 7 6 Main Tool – Fourier Analysis over ZN • Identifying functions and vectors • (a1,a2,…,aN-1)  g(i)=ai • g  (g(0), g(1),…, g(N-1)) • Standard basis: ex = (0,…,1,…,0) • Characters basis: • Let be a primitive Nth root of unity. • Then the characters basis is where

9. Concentrated Functions • Fourier representationwhere is the Fourier coefficient, and its weight is • Def: the restriction of g to  is • Def: f is a concentrated functions if >0,  of poly(log(N)/) size s.t.

10. + weight + + 2 1 3 - 4 0 + 5 7 - - 6 characters - …-5 -3 -1 1 3 5… Concentrated Functions - Examples Not Boolean! • Any character  is concentrated. • half is concentrated. Note, half is imaginary sign of 1 :

11. Legend: Concentrated highly agrees Agreement and Concentration • Notation: -Heavy(g)={characters of weight for g}. • Prop: Let P be concentrated, and let B s.t. (P,B)≤½-, then for =poly(log N/)-Heavy(P)  -Heavy(B)  • Proof: weight Fourier coefficients

12. New Algorithm for Learning Heavy Fourier Coefficients of functions over ZN • Learning Heavy coefficients: • Input: query access to g, threshold  • Output: -Heavy(g) • Kushilevitz & Mansour: g is over {0,1}n • Our work: g is over ZN • Other Applications: Approximating concentrated functions

13. Codes & Fourier • We think of a code C={Cx}  {1,-1}Nas a collection of functions Cx:ZN{1,-1}(where Cx(j) is the jth entry of Cx)and consider their Fourier representation…

14. Weights of Hadx characters x Concentrated Codes • Def: C is a concentrated code if every Cxis a concentrated functions • Example: Binary Hadamard CodeHadamard = {Hadx = (-1)<x,j>}x • Prop: Hadamard is concentrated • Proof: Hadx =x • List Decoding:Input: wOutput: 2-Heavy(w)

15. Main Theorem • Main Thm: Let f be a function, and let CP={Cx} be a code which is • Concentrated, • Recoverable, namely, given a character , and a threshold , one can efficiently find all x s.t. -Heavy(Cx), • with code access with respect to f and P. Then P is hard core of f. • Proof: (1)+(2) imply that C is list decodable.

16. Segment Predicates • Def: Let P be a balanced predicate. Then • P is a basic t-segment predicate if P(x+1)P(x) for at most tx's. • P is a t-segment predicate if P(x)=P'(x/a)for P' a basic t-segment predicate, and (a,N)=1. • When t=poly(log N), we say that P is a segment predicate. N 0

17. Examples • halfN(x) = 1 iff x<N/2this is a basic 2-segment predicate • Least significant bit:lsb(x) = 1 iff x is evenWhen N is odd, this is a 2-segment predicate, sincelsb(x) = halfN(x/2) N 0 N 0

18. Segment Predicate Theorem • Theorem (segment predicate):Let P be a segment predicate. Define a code: CP={Cx}, by Cx(j) = P(jx mod N)Then, if there is code access to CP with respect to f,P, then P is hard core of f. • Proof: By Main Theorem it suffice to show that CP is concentrated and recoverable.

19. Fourier coefficients of I I characters ZN CP is Concentrated • Claim 1: A basic t-segment predicate P is concentrated on low characters. • Proof: • P = i Ii (sum of t intervals) • Ii is concentrated on low characters. N 0

20. CP is Concentrated – Cont. • Claim 2: if g(y) = f(y/a) then • Since P is a segment predicate, there is a basic segment predicate P’ such that P(y)=P’(y/a) • Now, Cx(j) = P(jx) = P’(jx/a), so P’ concentrated implies Cx concentrated.

21. CP is Recoverable • By Claims 1,2:If  is a heavy character of Cx, then  = x /a, where  is a low character. • Therefore, the algorithm that returns all x such that  = x /a, where  is a low characteris a recovery algorithm.

22. CP is concentrates, recoverable, and with access algorithm, thus, any segment predicate P is hard core of f.

23. Hard Core Segment Predicate • Corollary: Every segment predicate is hard core of RSA, Exp and ECL. • Proof: It remains to show code access for CP w.r. to RSA,Exp,ECL. Since Cx(j)=P(jx), we return the answer of the magic box on “f(jx)”: • RSA(jx) = xe je mod N,. • Exp(jx) = (gx)j mod p, • ECL(jx) = j (xQ),

24. Comments on the Code Access Algorithms • RSA: magic box is defined only for jxZN*. Nonetheless, ZN\ZN* is negligible, thus we have good code-access. • Exp: When gx is a generator, the code-access algorithm succeeds with same probability as the magic box.

25. Comments on Segment Predicates • lsb is not a segment predicate of Exp, since Exp‘s domain is Zp-1 and p-1 is even. • A natural extension of halfN is: bj(x) = halfN(x/2j). This is a 2-segment predicate, when N is odd. • Non-balanced segment predicates: must be non negligibly far from any constant function.

26. Comments on Codes • list decoding other concentrated recoverable codes? • Example of concentrated code which is NOT recoverable: Reed-Solomon code.

27. END

28. Learning…

29. Learning Heavy Fourier Coefficients • Learning Heavy coefficients: • Input: query access to f, threshold  • Output: -Heavy(f) • Motivation: • Approximating concentrated functions • Application in list decoding and hard core predicates • Related Work: Kushilevitz & Mansour

30. Binary Search

31. Multi-Target Binary Search

32. First Try Fourier coefficient of f Parseval-identity ||f|low||22 Can’t query f|low , f|high … ||f|high||22

33. Convolution with Interval • Interval: • Convolution: • Convolution with Interval:

34. Convolution with Interval • Fact: • Therefore • High characters: • Let g = f -a, then • Use Avgg,I.

35. Computing Chernoff

36. Second Try Fourier coefficients of f ||Avgf,I||22 ||Avgf,I||22 is only APPROXIMATELY ||f|low||22 ||Avgg,I||22

37. BlindfoldedSearch ||Avgf,I||22 Fourier coefficients of f ? ? ? ||Avgg,I||22