Deterministic Extractor Research Articles

Homodyne detection in quantum optics: deterministic extractors and quantum random number generators on ‘vacuum fluctuations’

Quantum random number generators with a continuous variable are considered based on a primary randomness of the outcomes of homodyne measurements of a coherent state. A deterministic method of extraction of truly random 0 and 1 from the primary sequence of measurements of the quadrature of the field in homodyne detection is considered. The method, in the case of independence of successive measurement outcomes, in the asymptotic limit of long sequences, allows us to extract with a polynomial complexity all the true randomness contained in the primary sequence. The method does not require knowledge of the probability distribution function of the primary random sequence, and also does not require additional randomness in the extraction of random 0 and 1. The approach with deterministic randomness extractors, unlike other methods, contains fewer assumptions and conditions that need to be satisfied in the experimental implementation of such generators, and is significantly more effective and simple in experimental implementation. The fundamental limitations dictated by nature for achieving statistical independence of successive measurement outcomes are also considered. The statistical independence of the measurement outcomes is the equivalent of true randomness, in the sense that is possible in the case of the independence of the measurement outcomes, provably, with deterministic extractor, to extract a ‘truly random sequence of 0 and 1’. It is shown that in the asymptotic limit it is possible to extract all the true randomness contained in the outcomes of physical measurements.

Incompressible Functions, Relative-Error Extractors, and the Power of Nondeterministic Reductions

A circuit C compresses a function $${f : \{0,1\}^n\rightarrow \{0,1\}^m}$$f:{0,1}n?{0,1}m if given an input $${x\in \{0,1\}^n}$$x?{0,1}n, the circuit C can shrink x to a shorter l-bit string x? such that later, a computationally unbounded solver D will be able to compute f(x) based on x?. In this paper we study the existence of functions which are incompressible by circuits of some fixed polynomial size $${s=n^c}$$s=nc. Motivated by cryptographic applications, we focus on average-case $${(\ell,\epsilon)}$$(l,∈) incompressibility, which guarantees that on a random input $${x\in \{0,1\}^n}$$x?{0,1}n, for every size s circuit $${C:\{0,1\}^n\rightarrow \{0,1\}^{\ell}}$$C:{0,1}n?{0,1}l and any unbounded solver D, the success probability $${\Pr_x[D(C(x))=f(x)]}$$Prx[D(C(x))=f(x)] is upper-bounded by $${2^{-m}+\epsilon}$$2-m+∈. While this notion of incompressibility appeared in several works (e.g., Dubrov and Ishai, STOC 06), so far no explicit constructions of efficiently computable incompressible functions were known. In this work, we present the following results: (1)Assuming that E is hard for exponential size nondeterministic circuits, we construct a polynomial time computable boolean function $${f:\{0,1\}^n\rightarrow \{0,1\}}$$f:{0,1}n?{0,1} which is incompressible by size nc circuits with communication $${\ell=(1-o(1)) \cdot n}$$l=(1-o(1))·n and error $${\epsilon=n^{-c}}$$∈=n-c. Our technique generalizes to the case of PRGs against nonboolean circuits, improving and simplifying the previous construction of Shaltiel and Artemenko (STOC 14).(2)We show that it is possible to achieve negligible error parameter $${\epsilon=n^{-\omega(1)}}$$∈=n-?(1) for nonboolean functions. Specifically, assuming that E is hard for exponential size $${\Sigma_3}$$Σ3-circuits, we construct a nonboolean function $${f:\{0,1\}^n\rightarrow \{0,1\}^m}$$f:{0,1}n?{0,1}m which is incompressible by size nc circuits with $${\ell=\Omega(n)}$$l=Ω(n) and extremely small $${\epsilon=n^{-c} \cdot 2^{-m}}$$∈=n-c·2-m. Our construction combines the techniques of Trevisan and Vadhan (FOCS 00) with a new notion of relative error deterministic extractor which may be of independent interest.(3)We show that the task of constructing an incompressible boolean function $${f:\{0,1\}^n\rightarrow \{0,1\}}$$f:{0,1}n?{0,1} with negligible error parameter $${\epsilon}$$∈ cannot be achieved by "existing proof techniques". Namely, nondeterministic reductions (or even $${\Sigma_i}$$Σi reductions) cannot get $${\epsilon=n^{-\omega(1)}}$$∈=n-?(1) for boolean incompressible functions. Our results also apply to constructions of standard Nisan-Wigderson type PRGs and (standard) boolean functions that are hard on average, explaining, in retrospect, the limitations of existing constructions. Our impossibility result builds on an approach of Shaltiel and Viola (STOC 08).

On extractors and exposure‐resilient functions for sublogarithmic entropy

AbstractWe study resilient functions and exposure‐resilient functions in the low‐entropy regime. A resilient function (a.k.a. deterministic extractor for oblivious bit‐fixing sources) maps any distribution on n ‐bit strings in which k bits are uniformly random and the rest are fixed into an output distribution that is close to uniform. With exposure‐resilient functions, all the input bits are random, but we ask that the output be close to uniform conditioned on any subset of n ‐ k input bits. In this paper, we focus on the case that k is sublogarithmic in n.We simplify and improve an explicit construction of resilient functions for k sublogarithmic in n due to Kamp and Zuckerman (SICOMP 2006), achieving error exponentially small in k rather than polynomially small in k. Our main result is that when k is sublogarithmic in n, the short output length of this construction (O(log k) output bits) is optimal for extractors computable by a large class of space‐bounded streaming algorithms.Next, we show that a random function is a resilient function with high probability if and only if k is superlogarithmic in n, suggesting that our main result may apply more generally. In contrast, we show that a random function is a static (resp. adaptive) exposure‐resilient function with high probability even if k is as small as a constant (resp. loglog n). No explicit exposure‐resilient functions achieving these parameters are known. © 2012 Wiley Periodicals, Inc. Random Struct. Alg., 2013

Extractors and Lower Bounds for Locally Samplable Sources

We consider the problem of extracting randomness from sources that are efficiently samplable, in the sense that each output bit of the sampler only depends on some small numberdof the random input bits. As our main result, we construct a deterministic extractor that, given anyd-local source with min-entropykonnbits, extractsΩ(k2/nd) bits that are 2−nΩ(1)-close to uniform, providedd≤o(logn) andk≥n2/3+γ(for arbitrarily small constantsγ> 0).Using our result, we also improve a result of Viola [2010] who proved a 1/2 −O(1/logn) statistical distance lower bound foro(logn)-local samplers trying to sample input-output pairs of an explicit boolean function, assuming the samplers use at mostn+n1−δrandom bits for some constantδ> 0. Using a different function, we simultaneously improve the lower bound to 1/2 − 2−nΩ(1)and eliminate the restriction on the number of random bits.

Randomness extraction in elliptic curves and secret key derivation at the end of Diffie-Hellman protocol

A deterministic extractor for an elliptic curve, that converts a uniformly random point on the curve to a random bit-string with a uniform distribution, is an important tool in cryptography. Such extractors can be used for example in key derivation functions, in key exchange protocols and to design cryptographically secure pseudorandom number generator. In this paper, we present a simple and efficient deterministic extractor for an elliptic curve E defined over a non prime finite field. Our extractor, for a given random point P on the curve, outputs the k-first coefficients of the abscissa of the point P. This extractor confirms the two conjectures stated by Farashahi and Pellikaan (2007) and Farashahi et al. (2008), related to the extraction of bits from coordinates of a point of an elliptic curve. As applications of our extractor, we show under the decisional Diffie-Hellman problem on an elliptic curve defined over a finite field of characteristic two, that the k-first or the k-last bits of the abscissa of a random point on the curve are indistinguishable from a random bit-string of the same length.

Deterministic Extractors for Independent-Symbol Sources

In this paper, we consider the task of deterministically extracting randomness from sources consisting of a sequence of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> independent symbols from {0,1} <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i> . The only randomness guarantee on such a source is that the whole source has min-entropy <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> . We give an explicit deterministic extractor which extract Ω(log <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -loglog(1/ ε)) bits with error ε , for any <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> , <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i> , <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> ∈ \BBN and ε ∈ (0,1). For sources with a larger min-entropy, we can extract even more randomness. When <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> ≥ <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1/2+γ</sup> , for any constant γ ∈ (0,1/2), we can extract <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</i> = <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> - <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i> log(1/ ε)) bits with any error ε ≥ 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">-Ω(</sup> <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">γ</sup> ). When <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> ≥ log <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">cn</i> , for some constant <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">c</i> > 0, we can extract <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</i> = <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> -(1/ ε) <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> (1) bits with any error ε ≥ <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">-Ω(1)</sup> . Our results generalize those of Kamp and Zuckerman and Gabizon which only work for bit-fixing sources (with <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i> =1 and each bit of the source being either fixed or perfectly random). Moreover, we show the existence of a nonexplicit deterministic extractor which can extract <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</i> = <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> - <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">O</i> (log(1/ ε)) bits whenever <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> =ω( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i> +log( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</i> / ε)) . Finally, we show that even to extract from bit-fixing sources, any extractor, seeded or not, must suffer an entropy loss <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</i> - <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">m</i> =Ω(log(1/ ε)). This generalizes a lower bound of Radhakrishnan and Ta-Shma on extracting from general sources.

Extractors And Rank Extractors For Polynomial Sources

In this paper we construct explicit deterministic extractors from polynomial sources, which are distributions sampled by low degree multivariate polynomials over finite fields. This naturally generalizes previous work on extraction from affine sources (which are degree 1 polynomials). A direct consequence is a deterministic extractor for distributions sampled by polynomial size arithmetic circuits over exponentially large fields. The steps in our extractor construction, and the tools (mainly from algebraic geometry) that we use for them, are of independent interest: The first step is a construction of rank extractors, which are polynomial mappings which ‘extract’ the algebraic rank from any system of low degree polynomials. More precisely, for any n polynomials, k of which are algebraically independent, a rank extractor outputs k algebraically independent polynomials of slightly higher degree. The rank extractors we construct are applicable not only over finite fields but also over fields of characteristic zero. The next step is relating algebraic independence to min-entropy. We use a theorem of Wooley to show that these parameters are tightly connected. This allows replacing the algebraic assumption on the source (above) by the natural information theoretic one. It also shows that a rank extractor is already a high quality condenser for polynomial sources over polynomially large fields. Finally, to turn the condensers into extractors, we employ a theorem of Bombieri, giving a character sum estimate for polynomials defined over curves. It allows extracting all the randomness (up to a multiplicative constant) from polynomial sources over exponentially large prime fields.

How to get more mileage from randomness extractors

AbstractLet 𝒞 be a class of distributions over Bn. A deterministic randomness extractor for 𝒞 is a function E : BnarBm such that for any X in 𝒞 the distribution E(X) is statistically close to the uniform distribution. A long line of research deals with explicit constructions of such extractors for various classes 𝒞 while trying to maximize m.In this paper we give a general transformation that transforms a deterministic extractor E which extracts “few” bits into an extractor E′ that extracts “almost all the bits present in the source distribution.” More precisely, we prove a general theorem saying that if E and 𝒞 satisfy certain properties, then we can transform E into an extractor E′.Our methods build on (and generalize) a technique of Gabizon et al. [FOCS (2004) 394–403] that presents such a transformation for the very restricted class 𝒞 of “oblivious bit‐fixing sources.” The high level idea is to find properties of E and 𝒞 which allow “recycling” the output of E so that it can be “reused” to operate on the source distribution. An obvious obstacle is that the output of E is correlated with the source distribution.Using our transformation we give an explicit construction of a two‐source extractor E : Bn × BnarBm such that for every two independent distributions X1 and X2 over Bn with min‐entropy at least k = (1/2 + δ)n and eps ≤ 2, E(X1,X2) is eps‐close to the uniform distribution on m = 2k ‐ Cδ log(1/eps) bits. This result is optimal except for the precise constant Cδ and improves previous results by Chor and Goldreich [SICOMP 17 (1988) 230–261], Vazirani [Combinatorica 7 (1987) 375–392], and Dodis et al. [RANDOM (2004) 334–344].We also give explicit constructions of extractors for samplable distributions that extract many bits even out of “low‐entropy” samplable distributions. These constructions rely on average case hardness assumptions and extend some previous results by Trevisan and Vadhan [FOCS (2000) 32–42] which give such extractors only for distributions with “high entropy.” © 2008 Wiley Periodicals, Inc. Random Struct. Alg., 2008

Extractors for binary elliptic curves

We propose a simple and efficient deterministic extractor for an ordinary elliptic curve E, defined over $$\mathbb{F}_{2^n}$$ , where n = 2? and ? is a positive integer. Our extractor, for a given point P on E, outputs the first $${\mathbb{F}}_{2^\ell}$$ -coefficient of the abscissa of the point P. We also propose a deterministic extractor for the main subgroup G of E, where E has minimal 2-torsion. We show that if a point P is chosen uniformly at random in G, the bits extracted from the point P are indistinguishable from a uniformly random bit-string of length ?.