Indistinguishability Theory Ueli Maurer ETH Zurich FOSAD 2009, Bertinoro, Sept. 2009.
Distinguishing two objects:
Distinguishing two objects: left or right?
Distinguishing two types of numbers Set A: Set B: 2048-bit integers with exactly 2048-bit integers with exactly 2 prime factors, each with at 3 prime factors, each with at least 512 bits. least 512 bits.
Distinguishing two types of numbers Set A: Set B: 2048-bit integers with exactly 2048-bit integers with exactly 2 prime factors, each with at 3 prime factors, each with at least 512 bits. least 512 bits. 374095762974511873398056743981753957783254673845967825364509871 365295584882333644985766091852825640501638759879538762635485678 243091425765253648526374099125231764748985576600963327393947586 123498750533495862054987746524351089758393218367443278968764534 3127364987564354675092736565475849823142537584950243685261 left or right?
Random vs. pseudo-random bit generator RBG PRBG output output sequence sequence
Random vs. pseudo-random bit generator RBG PRBG output output sequence sequence 101100011101111001001110100010000011101100101110010111010001101 000011011010111101010001101011010100100101011110101000001101101 111000111011000101111010010101101001010110000101011010101101001 110011001001100010110100011100101010001011010100001111000101010 left or right?
Distinguisher’s advantage D’s task: Guess left/right 50% 50% View Distinguisher D left / right
� ✄ Distinguisher’s advantage D’s task: Guess left/right 50% 50% � /2 Prob(correct guess) = 0.5 + D ✁ I = I I I I I ✂ I I I I I I (D’s advantage) View Distinguisher D left / right
✞ ☎ ✞ Distinguisher’s advantage D’s task: Guess left/right 50% 50% Prob(correct guess) = 0.5 + ☎ /2 D ✆ I = I I I I I ✝ I I I I I I (D’s advantage) View ✆ I best D: I I I I I ✝ I I I I I I Distinguisher D left / right
Distinguishing a RV V from a uniform RV U P (v) V 1 (uniform) V v
✔ ✘ ✔ ✡ ✔ ✔ ✓ ✗ ✎ ✍ ✡ ✔ ✙ ✙ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ Distinguishing a RV V from a uniform RV U P (v) V 1 (uniform) V v Statistical distance: ✏✒✑ d ✟ V ✠ U ✔ PV (sum of red quantities) ☛✌☞ ✟✖✕
✜ ✩ ✩ ✜ ✫ ✬ ✭ ✭ ✩ ✩ ✩ ✩ ✩ ✩ ✩ ✣ ✩ ✩ ✩ ✥ ★ ✩ ✜ ✤ Distinguishing a RV V from a uniform RV U P (v) V 1 (uniform) V v Statistical distance: ✦✒✧ d ✚ V ✛ U ✩ PV (sum of red quantities) ✢✌✣ ✚✖✪ ✚ V ✛ U
✰ ✸ ✺ ✼ ✼ ✸ ✸ ✸ ✸ ✸ ✸ ✸ ✲ ✰ ✲ ✰ ✲ ✻ ✺ ✰ ✻ ✸ ✴ ✸ ✰ ✸ ✸ ✳ ✸ ✷ Distinguishing a RV V from a uniform RV U P (v) V 1 (uniform) V v Statistical distance: ✵✒✶ d ✮ V ✯ U ✸ PV (sum of red quantities) ✱✌✲ ✮✖✹ ✮ V ✯ U Possible interpretation: P ✮ V U d ✮ V ✯ U
Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S
Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ...
Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ... What kind of mathematical object is the behavior?
✽ Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ... What kind of mathematical object is the behavior? Only input-output behavior is relevant!
✾ ▼ ✾ ◆ Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ... What kind of mathematical object is the behavior? Only input-output behavior is relevant! ✿❁❀❃❂❅❄ ❆❈❇❉❇❊❇❋❄ ❀●✿❍❆■❇❊❇❊❇❏✿❑❀●▲ pS ❆ for ❖◗P❙❘ P❯❚❱❚❱❚ Characterized by:
❨ ❲ ❨ ❡ ❡ ❡ ❵ ❴ ❲ Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ... What kind of mathematical object is the behavior? Only input-output behavior is relevant! ❳❁❨❃❩❅❬ ❭❈❪❉❪❊❪❋❬ ❨●❳❍❭■❪❊❪❊❪❏❳❑❨●❫ pS ❭ for ❛◗❜❙❝ ❜❯❞❱❞❱❞ Characterized by: abstraction called random system [Mau02] This description is minimal! ❳❍❭■❪❊❪❊❪❢❳ ❩❅❬ ❭■❪❊❪❊❪❋❬ Redundant (better) description: pS
♦ ❣ ✈ ✐ ✐ ✉ ✉ ✉ ♣ ❣ Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ... What kind of mathematical object is the behavior? Only input-output behavior is relevant! ❤❁✐❃❥❅❦ ❧❈♠❉♠❊♠❋❦ ✐●❤❍❧■♠❊♠❊♠❏❤❑✐●♥ pS ❧ for q◗r❙s r❯t❱t❱t Characterized by: abstraction called random system [Mau02] This description is minimal! ❤❍❧■♠❊♠❊♠❢❤ ❥❅❦ ❧■♠❊♠❊♠❋❦ Redundant (better) description: pS Equivalence of systems: S T if same behavior
➁ ⑧ ❹ ❻ ➀ ❽ ❿ ❾ ❽ ❻ ❺ ② ② ❹ ❹ ⑨ ❹ ✇ ✇ Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ... What kind of mathematical object is the behavior? Only input-output behavior is relevant! ①❁②❃③❅④ ⑤❈⑥❉⑥❊⑥❋④ ②●①❍⑤■⑥❊⑥❊⑥❏①❑②●⑦ pS ⑤ for ⑩◗❶❙❷ ❶❯❸❱❸❱❸ Characterized by: abstraction called random system [Mau02] This description is minimal! ①❍⑤■⑥❊⑥❊⑥❢① ③❅④ ⑤■⑥❊⑥❊⑥❋④ Redundant (better) description: pS Equivalence of systems: S T if same behavior ❼ S Realization of S from a RV (range ):
➒ ➐ ➐ ➐ ➐ ➐ ↕ ➄ ➒ ➊ ➄ ↔ ➔ ➑ ➣ → ➔ ➋ ➂ ➂ Discrete systems X , X , ... Y , Y , ... 1 2 1 2 S Description of S: pseudo-code, figures, text, ... What kind of mathematical object is the behavior? Only input-output behavior is relevant! ➃❁➄❃➅❅➆ ➇❈➈❉➈❊➈❋➆ ➄●➃❍➇■➈❊➈❊➈❏➃❑➄●➉ pS ➇ for ➌◗➍❙➎ ➍❯➏❱➏❱➏ Characterized by: abstraction called random system [Mau02] This description is minimal! ➃❍➇■➈❊➈❊➈❢➃ ➅❅➆ ➇■➈❊➈❊➈❋➆ Redundant (better) description: pS Equivalence of systems: S T if same behavior ➓ S Realization of S from a RV (range ): notion of independence
Distinguishers X , X , ... Y , Y , ... 1 2 1 2 S D
➩ ➟ ➙ ➜ ➭ ➭ ➜ ➥ ➙ ➭ ➤ ➞ ➞ ➭ ➛ ➙ ➙ ➺ ➜ ➡ ➛ ➥ ➙ ➙ ➛ ➥ Distinguishers X , X , ... Y , Y , ... 1 2 1 2 S D ➯ pD ➥➫➩ ➥➫➩ ➥➫➩ PDS pS ➠➢➡ ➧❢➙ ➛➝➜ ➜➦➥➨➧❢➙ ➯ pD pS ➛➵➧➸➜ ➛➲➧➳➙ ➭➼➻❱➽❯➽❱➽❱➻ ➥➚➾ notation:
➱ ➘ ➹ ❒ ❒ ➹ ➱ ➘ ➹ ➮ ➶ ➴ ➶ ❒ ➪ ➪ ➶ ❐ ❒ ➪ ➱ ➬ ❰ ➪ ➪ ➪ Distinguishers X , X , ... Y , Y , ... 1 2 1 2 S D W = 0/1 ❮ pD ➱➫❐ ➱➫❐ ➱➫❐ PDS pS ➷➢➬ ✃❢➪ ➶➝➹ ➹➦➱➨✃❢➪ ❮ pD pS ➶➵✃➸➹ ➶➲✃➳➪ ❒➼Ï❱Ð❯Ð❱Ð❱Ï ➱➚Ñ notation:
Ø Ø Ú × Ù Ø Ø Ø Ø × Û Ø Ø × Ø Ø × Õ Ú Ü Ý Ø Ø Ø Ø Ù Õ Ø Ø Ø Ò Ø Ø Õ Distinguishing advantage 2 equivalent views: S Z 0 S T 1 T D D D W = 0/1 W = 0/1 W = 0/1 PDS PDT D Ó S Ó W Ó W Ô T Ö✌× Õ✒Ø PDSTZ Ó W Z
á ä ä ä ä ä ä ã ã á å á æ ä ä ã ç ä ä é Þ ä ä ä ä ä è ä æ á ã ä ä ä Þ å Distinguishing advantage 2 equivalent views: S Z 0 S T 1 T D D D W = 0/1 W = 0/1 W = 0/1 PDS PDT D ß S ß W ß W à T â✌ã á✒ä PDSTZ ß W Z ß S best (adaptive) D: à T
í ï ð ð ð ð ð ó ñ ð í ò ï ð ï ñ ð ð í ð ð ê í ê ð ð ð ð õ ð ô ò í ï ð ê ð ð Distinguishing advantage 2 equivalent views: S Z 0 S T 1 T D D D W = 0/1 W = 0/1 W = 0/1 PDS PDT D ë S ë W ë W ì T î✌ï í✒ð PDSTZ ë W Z ë S best (adaptive) D: ì T ë S NA best non-adapt. D: ì T
Game-winning S X , X , ... Y , Y , ... 1 2 1 2
Game-winning monotone binary output (MBO) 1 0 i game won S X , X , ... Y , Y , ... 1 2 1 2
Game-winning monotone binary output (MBO) 1 0 i game won S X , X , ... Y , Y , ... 1 2 1 2 D
û ö ù ø Game-winning monotone binary output (MBO) 1 0 i game won S X , X , ... Y , Y , ... 1 2 1 2 D ÷ D D’s prob. of winning with queries: ú S
✁ ü ÿ þ ✁ ÿ þ ý ✁ ÿ þ Game-winning monotone binary output (MBO) 1 0 i game won S X , X , ... Y , Y , ... 1 2 1 2 D ý D D’s prob. of winning with queries: � S ✂☎✄ ý D Optimal (adaptive) D: � S maxD � S
Recommend
More recommend
