Constructions Of Extractors Research Articles

Extractors for Small Zero-Fixing Sources

Let V ⊆ [n] be a k-element subset of [n]. The uniform distribution on the 2k strings from {0, 1}n that are set to zero outside of V is called an (n, k)-zero-fixing source. An ϵ-extractor for (n, k)-zero-fixing sources is a mapping F: {0, 1}n → {0, 1}m, for some m, such that F(X) is ϵ-close in statistical distance to the uniform distribution on {0, 1}m for every (n, k)-zero-fixing source X. Zero-fixing sources were introduced by Cohen and Shinkar in [7] in connection with the previously studied extractors for bit-fixing sources. They constructed, for every μ > 0, an efficiently computable extractor that extracts a positive fraction of entropy, i.e., Ω(k) bits, from (n, k)-zero-fixing sources where k ≥ (log log n)2+μ.In this paper we present two different constructions of extractors for zero-fixing sources that are able to extract a positive fraction of entropy for k substantially smaller than log log n. The first extractor works for k ≥ C log log log n, for some constant C. The second extractor extracts a positive fraction of entropy for k ≥ log(i)n for any fixed i ∈ ℕ, where log(i) denotes i-times iterated logarithm. The fraction of extracted entropy decreases with i. The first extractor is a function computable in polynomial time in n; the second one is computable in polynomial time in n when k ≤ α log log n/log log log n, where α is a positive constant.Our results can also be viewed as lower bounds on some Ramsey-type properties. The main difference between the problems about extractors studied here and the standard Ramsey theory is that we study colorings of all subsets of size up to k while in Ramsey theory the sizes are fixed to k. However it is easy to derive results also for coloring of subsets of sizes equal to k. In Corollary 3.1 of Theorem 5.1 we show that for every l ∈ ℕ there exists β < 1 such that for every k and n, n ≤ expl (k), there exists a 2-coloring of k-tuples of elements of [n], \(\psi :\left({\matrix{{[n]} \cr k \cr}} \right) \to \left\{{- 1,1} \right\}\) such that for every V ⊆ [n], |V| = 2k, we have \(\left| {\sum\nolimits_{X \subseteq V,\left| X \right| = k} {\psi (X)}} \right| \le {\beta ^k}\left({\matrix{{2k} \cr k \cr}} \right)\) (Corollary 3.1 is more general — the number of colors may be more than 2).

Analysis and Adequacy Methodology for Voltage Violations in Distribution Power Grid

This paper proposes a computational process development capable of filling the electric power sector shortage regarding voltage non-conformities identification in electric distribution power grid accounting for loads dynamic behavior at medium and low voltages. Actual distribution power grid data are used, with georeferencing to signal voltage transgressions locations, generate a report with voltage transgression indices and financial reimbursement values provided by legislation. The methodology compares regulatory requirements and makes available in software some possible actions in an attempt to adjust voltage levels, avoiding inconvenience and penalties for energy utilities providers. The method involves a data extractor construction for electricity provider company’s databases, computer simulations and comparison of obtained results with values established in electricity quality control standards. Thus, finding non-conformity locations and determining network adjustments to correct tension indexes in permanent regulation. The proposal features a reduction in electricity utilities operating costs, increasing efficiency in operation and energy quality available to consumers.

Rejection Sampling Schemes for Extracting Uniform Distribution from Biased PUFs

This paper presents an efficient fuzzy extractor (FE) construction for secure cryptographic key generation from physically unclonable functions (PUFs). The proposed FE, named acceptance-or-rejection (AR)-based FE, utilizes a new debiasing scheme to extract a uniform distribution from a biased PUF response. The proposed debiasing scheme employs the principle of rejection sampling, and can extract a longer debiased bit string compared to those of conventional debiasing schemes. In addition, the proposed AR-based FE is extended to ternary PUF responses (i.e., ternary encoding of a PUF response). These responses can be derived according to cell-wise reliability of the PUF and are promising for extraction of stable and high-entropy responses from common PUFs. The performance of the AR-based Fes is evaluated through an experimental simulation of PUF-based key generation and compared with conventional FEs. We confirm that the proposed AR-based FE can achieve the highest efficiency in terms of PUF and nonvolatile memory (NVM) sizes for various PUF conditions among the conventional counterparts. More precisely, the AR-based FE can realize a 128-bit key generation with up-to 55% smaller PUF size or up-to 72% smaller NVM size than other conventional FEs. In addition, the ternary AR-based FE is up to 55% more efficient than the binary version, and can also achieve up-to 63% higher efficiency than conventional counterparts. Furthermore, we show that the AR-based FE can be applied to PUFs with local biases (e.g., biases depending on cell location in SRAM PUFs), unlike all the conventional schemes, for which only global (or identical) biases are assumed.

When Are Fuzzy Extractors Possible?

Fuzzy extractors (Dodis et al., SIAM J. Computing 2008) convert repeated noisy readings of a high-entropy secret into the same uniformly distributed key. A minimum condition for the security of the key is the hardness of guessing a value that is similar to the secret, because the fuzzy extractor converts such a guess to the key. We quantify this property in a new notion called fuzzy min-entropy . We ask: is fuzzy min-entropy sufficient to build fuzzy extractors? We provide two answers for different settings. 1) If the construction is provided a description of the probability distribution $W$ that defines the noisy source then fuzzy min-entropy is a sufficient condition for information-theoretic key extraction from $W$ . 2) A more ambitious goal is to design a single extractor that works for all possible sources. This more ambitious goal is impossible: there is a family of sources with high fuzzy min-entropy for which no single fuzzy extractor is secure. This is true in three settings: a) for standard fuzzy extractors, b) for fuzzy extractors that are allowed to sometimes be wrong, c) and for secure sketches, which are the main ingredient of most fuzzy extractor constructions.

Robust Fuzzy Extractors and Helper Data Manipulation Attacks Revisited: Theory versus Practice

Fuzzy extractors have been proposed in 2004 by Dodis et al. as a secure way to generate cryptographic keys from noisy sources. In recent years, fuzzy extractors have become an important building block in hardware security due to their use in secure key generation based on Physical Unclonable Functions (PUFs). Fuzzy extractors are provably secure against passive attackers. A year later Boyen et al. introduced robust fuzzy extractors which are also provably secure against active attackers, i.e., attackers that can manipulate the helper data. In this paper we show that the original provable secure robust fuzzy extractor construction by Boyen et al. actually does not fulfill the error-correction requirements for practical PUF applications. The fuzzy extractors proposed for PUF-based key generation on the other hand that fulfill the error-correction requirements cannot be extended to such robust fuzzy extractors, due to a strict bound $t$t on the number of correctable errors. While it is therefore tempting to simply ignore this strict bound, we present novel helper data manipulation attacks on fuzzy extractors that also work if a “robust fuzzy extractor-like” construction without this strict bound is used. Hence, this paper can be seen as a call for action to revisit this seemingly solved problem of building robust fuzzy extractors. The new focus should be on building more efficient solutions in terms of error-correction capability, even if this might come at the costs of a proof in a weaker security model.

Quantum-Proof Randomness Extractors via Operator Space Theory

Quantum-proof randomness extractors are an important building block for classical and quantum cryptography as well as device independent randomness amplification and expansion. Furthermore they are also a useful tool in quantum Shannon theory. It is known that some extractor constructions are quantum-proof whereas others are provably not [Gavinsky et al., STOC'07]. We argue that the theory of operator spaces offers a natural framework for studying to what extent extractors are secure against quantum adversaries: we first phrase the definition of extractors as a bounded norm condition between normed spaces, and then show that the presence of quantum adversaries corresponds to a completely bounded norm condition between operator spaces. From this we show that very high min-entropy extractors as well as extractors with small output are always (approximately) quantum-proof. We also study a generalization of extractors called randomness condensers. We phrase the definition of condensers as a bounded norm condition and the definition of quantum-proof condensers as a completely bounded norm condition. Seeing condensers as bipartite graphs, we then find that the bounded norm condition corresponds to an instance of a well studied combinatorial problem, called bipartite densest subgraph. Furthermore, using the characterization in terms of operator spaces, we can associate to any condenser a Bell inequality (two-player game) such that classical and quantum strategies are in one-to-one correspondence with classical and quantum attacks on the condenser. Hence, we get for every quantum-proof condenser (which includes in particular quantum-proof extractors) a Bell inequality that can not be violated by quantum mechanics.

True Randomness from Big Data.

Generating random bits is a difficult task, which is important for physical systems simulation, cryptography, and many applications that rely on high-quality random bits. Our contribution is to show how to generate provably random bits from uncertain events whose outcomes are routinely recorded in the form of massive data sets. These include scientific data sets, such as in astronomics, genomics, as well as data produced by individuals, such as internet search logs, sensor networks, and social network feeds. We view the generation of such data as the sampling process from a big source, which is a random variable of size at least a few gigabytes. Our view initiates the study of big sources in the randomness extraction literature. Previous approaches for big sources rely on statistical assumptions about the samples. We introduce a general method that provably extracts almost-uniform random bits from big sources and extensively validate it empirically on real data sets. The experimental findings indicate that our method is efficient enough to handle large enough sources, while previous extractor constructions are not efficient enough to be practical. Quality-wise, our method at least matches quantum randomness expanders and classical world empirical extractors as measured by standardized tests.

From Affine to Two-Source Extractors via Approximate Duality

We establish a new connection between affine and two-source extractors by presenting black-box constructions of two-source extractors for min-entropy rate below half from any affine extractor for min-entropy rate below half. Two such constructions are presented, and one of our constructions can reach arbitrarily small min-entropy rate assuming that the affine extractor has sufficiently good parameters. The first part of our analysis shows that our constructions are two-source dispersers which are weak (but nontrivial) kinds of two-source extractors, also known as “bipartite Ramsey graphs.” To strengthen this result and obtain two-source extractors we introduce the approximate duality conjecture (ADC) and initiate its study. The ADC leads to a rather general result that can be used to convert a natural class of two-source dispersers---``low-rank dispersers''---into two-source extractors. More specifically, we first prove a special case of ADC that implies that the constructions mentioned above are two-source extractors with large (but nontrivial) constant error. In an attempt to reduce the error in our constructions we show that the polynomial Freiman--Ruzsa conjecture (PFR) in additive combinatorics implies a stronger “approximate duality” statement (and that this stronger statement also implies a weak but as-of-yet-unknown version of PFR). This stronger statement implies in turn that our constructions are two-source extractors with exponentially small error.

From Low-Distortion Norm Embeddings to Explicit Uncertainty Relations and Efficient Information Locking

The existence of quantum uncertainty relations is the essential reason that some classically unrealizable cryptographic primitives become realizable when quantum communication is allowed. One operational manifestation of these uncertainty relations is a purely quantum effect referred to as information locking [DiVincenzo et al. 2004]. A locking scheme can be viewed as a cryptographic protocol in which a uniformly random n -bit message is encoded in a quantum system using a classical key of size much smaller than n . Without the key, no measurement of this quantum state can extract more than a negligible amount of information about the message, in which case the message is said to be “locked”. Furthermore, knowing the key, it is possible to recover, that is “unlock”, the message. In this article, we make the following contributions by exploiting a connection between uncertainty relations and low-distortion embeddings of Euclidean spaces into slightly larger spaces endowed with the ℓ 1 norm. We introduce the notion of a metric uncertainty relation and connect it to low-distortion embeddings of ℓ 2 into ℓ 1 . A metric uncertainty relation also implies an entropic uncertainty relation. We prove that random bases satisfy uncertainty relations with a stronger definition and better parameters than previously known. Our proof is also considerably simpler than earlier proofs. We then apply this result to show the existence of locking schemes with key size independent of the message length. Moreover, we give efficient constructions of bases satisfying metric uncertainty relations. The bases defining these metric uncertainty relations are computable by quantum circuits of almost linear size. This leads to the first explicit construction of a strong information locking scheme. These constructions are obtained by adapting an explicit norm embedding due to Indyk [2007] and an extractor construction of Guruswami et al. [2009]. We apply our metric uncertainty relations to exhibit communication protocols that perform equality testing of n -qubit states. We prove that this task can be performed by a single message protocol using O (log 2 n ) qubits and n bits of communication, where the computation of the sender is efficient.

New Constructions of WOM Codes Using the Wozencraft Ensemble

In this paper, we give several new constructions of write-once-memory (WOM) codes. The novelty in our constructions is the use of the so-called Wozencraft ensemble of linear codes. Specifically, we obtain the following results. We give an explicit construction of a two-write WOM code that approaches capacity, over the binary alphabet. More formally, for every ϵ > 0, 0 <; p <; 1, and n=(1/ϵ)O(1/pϵ), we give a construction of a two-write WOM code of length n and capacity H(p)+1-p-ϵ. Since the capacity of a two-write WOM code is maxp (H(p)+1-p), we get a code that is ϵ-close to capacity. Furthermore, encoding and decoding can be done in time O(n2 ·poly (logn)) and time O(n ·poly (logn)), respectively, and in logarithmic space. In addition, we exhibit an explicit randomized encoding scheme of a two-write capacity-achieving WOM code of block length polynomial in 1/ϵ (again, ϵ is the gap to capacity), with a polynomial time encoding and decoding. We obtain a new encoding scheme for three-write WOM codes over the binary alphabet. Our scheme achieves rate 1.809-ϵ, when the block length is exp(1/ϵ). This gives a better rate than what could be achieved using previous techniques. We highlight a connection to linear seeded extractors for bit-fixing sources. In particular, we show that obtaining such an extractor with seed length O(logn) can lead to improved parameters for two-write WOM codes. We then give an application of existing constructions of extractors to the problem of designing encoding schemes for memory with defects.

Quantum to Classical Randomness Extractors

The goal of randomness extraction is to distill (almost) perfect randomness from a weak source of randomness. When the source yields a classical string X, many extractor constructions are known. Yet, when considering a physical randomness source, X is itself ultimately the result of a measurement on an underlying quantum system. When characterizing the power of a source to supply randomness it is hence a natural question to ask, how much classical randomness we can extract from a quantum system. To tackle this question we here take on the study of quantum-to-classical randomness extractors (QC-extractors). We provide constructions of QC-extractors based on measurements in a full set of mutually unbiased bases (MUBs), and certain single qubit measurements. As the first application, we show that any QC-extractor gives rise to entropic uncertainty relations with respect to quantum side information. Such relations were previously only known for two measurements. As the second application, we resolve the central open question in the noisy-storage model [Wehner et al., PRL 100, 220502 (2008)] by linking security to the quantum capacity of the adversary's storage device.

Trevisan's Extractor in the Presence of Quantum Side Information

Randomness extraction involves the processing of purely classical information and is therefore usually studied in the framework of classical probability theory. However, such a classical treatment is generally too restrictive for applications, where side information about the values taken by classical random variables may be represented by the state of a quantum system. This is particularly relevant in the context of cryptography, where an adversary may make use of quantum devices. Here, we show that the well known construction paradigm for extractors proposed by Trevisan is sound in the presence of quantum side information. We exploit the modularity of this paradigm to give several concrete extractor constructions, which, e.g, extract all the conditional (smooth) min-entropy of the source using a seed of length poly-logarithmic in the input, or only require the seed to be weakly random.

Guest column

Additive combinatorics is the branch of combinatorics where the objects of study are subsets of the integers or of other abelian groups, and one is interested in properties and patterns that can be expressed in terms of linear equations. More generally, arithmetic combinatorics deals with properties and patterns that can be expressed via additions and multiplications. In the past ten years, additive and arithmetic combinatorics have been extremely successful areas of mathematics, featuring a convergence of techniques from graph theory, analysis and ergodic theory. They have helped prove long-standing open questions in additive number theory, and they offer much promise of future progress. Techniques from additive and arithmetic combinatorics have found several applications in computer science too, to property testing, pseudorandomness, PCP constructions, lower bounds, and extractor constructions. Typically, whenever a technique from additive or arithmetic combinatorics becomes understood by computer scientists, it finds some application. Considering that there is still a lot of additive and arithmetic combinatorics that computer scientists do not understand (and, the field being very active, even more will be developed in the near future), there seems to be much potential for future connections and applications.

SIGACT news complexity theory column 63

Additive combinatorics is the branch of combinatorics where the objects of study are subsets of the integers or of other abelian groups, and one is interested in properties and patterns that can be expressed in terms of linear equations. More generally, arithmetic combinatorics deals with properties and patterns that can be expressed via additions and multiplications. In the past ten years, it has been an extremely successful area of mathematics, featuring a convergence of techniques from graph theory, analysis and ergodic theory. It has helped prove long-standing open questions in additive number theory, and it offers much promise of future progress. Arithmetic combinatorics has found several applications in computer science, to property testing, PCP constructions, lower bounds, and extractor constructions. Typically, whenever a technique from arithmetic combinatorics becomes understood by computer scientists, it finds some application. Considering that there is still a lot of additive and arithmetic combinatorics that computer scientists do not understand (and, the field being very active, even more will be developed in the near future), there seems to be much potential for future connections and applications.

Extractors And Rank Extractors For Polynomial Sources

In this paper we construct explicit deterministic extractors from polynomial sources, which are distributions sampled by low degree multivariate polynomials over finite fields. This naturally generalizes previous work on extraction from affine sources (which are degree 1 polynomials). A direct consequence is a deterministic extractor for distributions sampled by polynomial size arithmetic circuits over exponentially large fields. The steps in our extractor construction, and the tools (mainly from algebraic geometry) that we use for them, are of independent interest: The first step is a construction of rank extractors, which are polynomial mappings which ‘extract’ the algebraic rank from any system of low degree polynomials. More precisely, for any n polynomials, k of which are algebraically independent, a rank extractor outputs k algebraically independent polynomials of slightly higher degree. The rank extractors we construct are applicable not only over finite fields but also over fields of characteristic zero. The next step is relating algebraic independence to min-entropy. We use a theorem of Wooley to show that these parameters are tightly connected. This allows replacing the algebraic assumption on the source (above) by the natural information theoretic one. It also shows that a rank extractor is already a high quality condenser for polynomial sources over polynomially large fields. Finally, to turn the condensers into extractors, we employ a theorem of Bombieri, giving a character sum estimate for polynomials defined over curves. It allows extracting all the randomness (up to a multiplicative constant) from polynomial sources over exponentially large prime fields.

Extractors for a Constant Number of Polynomially Small Min-Entropy Independent Sources

We consider the problem of randomness extraction from independent sources. We construct an extractor that can extract from a constant number of independent sources of length n, each of which have min-entropy $n^\gamma$, for an arbitrarily small constant $\gamma>0$. Our extractor is obtained by composing seeded extractors in simple ways. We introduce a new technique to condense independent somewhere-random sources which looks like a useful way to manipulate independent sources. Our techniques are different from those used in recent work [B. Barak, R. Impagliazzo, and A. Wigderson, SIAM J. Comput., 36 (2006), pp. 1095–1118; B. Barak, G. Kindler, R. Shaltiel, B. Sudakov, and A. Wigderson, Simulating independence: New constructions of condensers, Ramsey graphs, dispersers, and extractors, in Proceedings of the 37th Annual ACM Symposium on Theory of Computing, ACM, New York, 2005, pp. 1–10; R. Raz, Extractors with weak random seeds, in Proceedings of the 37th Annual ACM Symposium on Theory of Computing, ACM, New York, 2005, pp. 11–20; J. Bourgain, Int. J. Number Theory, 1 (2005), pp. 1–32] for this problem in the sense that they do not rely on any results from arithmetic combinatorics. Using an extractor of Bourgain's [Int. J. Number Theory, 1 (2005), pp. 1–32] as a black box, we obtain a new extractor for two independent block sources with few blocks, even when the min-entropy is as small as $\operatorname{polylog}(n)$. We also show how to modify the 2 source disperser for linear min-entropy of Barak et al. [Simulating independence: New constructions of condensers, Ramsey graphs, dispersers, and extractors, in Proceedings of the 37th Annual ACM Symposium on Theory of Computing, ACM, New York, 2005, pp. 1–10] and the three source extractor of Raz [Extractors with weak random seeds, in Proceedings of the 37th Annual ACM Symposium on Theory of Computing, ACM, New York, 2005, pp. 11–20] to get dispersers/extractors with exponentially small error and linear output length where previously both were constant.

Explicit constructions of extractors and expanders

We investigate 2-variable expanders and 3-source extractors in prime fields. We extend previous results of J. Bourgain.

The complexity of the matroid–greedoid partition problem

We show that the maximum matroid–greedoid partition problem is NP-hard to approximate to within 1 / 2 + ε for any ε > 0 , which matches the trivial factor 1/2 approximation algorithm. The main tool in our hardness of approximation result is an extractor code with polynomial rate, alphabet size and list size, together with an efficient algorithm for list-decoding. We show that the recent extractor construction of Guruswami, Umans and Vadhan [V. Guruswami, C. Umans, S.P. Vadhan, Unbalanced expanders and randomness extractors from Parvaresh-Vardy codes, in: IEEE Conference on Computational Complexity, IEEE Computer Society, 2007, pp. 96–108] can be used to obtain a code with these properties. We also show that the parameterized matroid–greedoid partition problem is fixed-parameter tractable.

How to get more mileage from randomness extractors

AbstractLet 𝒞 be a class of distributions over Bn. A deterministic randomness extractor for 𝒞 is a function E : BnarBm such that for any X in 𝒞 the distribution E(X) is statistically close to the uniform distribution. A long line of research deals with explicit constructions of such extractors for various classes 𝒞 while trying to maximize m.In this paper we give a general transformation that transforms a deterministic extractor E which extracts “few” bits into an extractor E′ that extracts “almost all the bits present in the source distribution.” More precisely, we prove a general theorem saying that if E and 𝒞 satisfy certain properties, then we can transform E into an extractor E′.Our methods build on (and generalize) a technique of Gabizon et al. [FOCS (2004) 394–403] that presents such a transformation for the very restricted class 𝒞 of “oblivious bit‐fixing sources.” The high level idea is to find properties of E and 𝒞 which allow “recycling” the output of E so that it can be “reused” to operate on the source distribution. An obvious obstacle is that the output of E is correlated with the source distribution.Using our transformation we give an explicit construction of a two‐source extractor E : Bn × BnarBm such that for every two independent distributions X1 and X2 over Bn with min‐entropy at least k = (1/2 + δ)n and eps ≤ 2, E(X1,X2) is eps‐close to the uniform distribution on m = 2k ‐ Cδ log(1/eps) bits. This result is optimal except for the precise constant Cδ and improves previous results by Chor and Goldreich [SICOMP 17 (1988) 230–261], Vazirani [Combinatorica 7 (1987) 375–392], and Dodis et al. [RANDOM (2004) 334–344].We also give explicit constructions of extractors for samplable distributions that extract many bits even out of “low‐entropy” samplable distributions. These constructions rely on average case hardness assumptions and extend some previous results by Trevisan and Vadhan [FOCS (2000) 32–42] which give such extractors only for distributions with “high entropy.” © 2008 Wiley Periodicals, Inc. Random Struct. Alg., 2008

Analyzing linear mergers

AbstractMergers are functions that transform k (possibly dependent) random sources (distributions) into a single random source, in a way that ensures that if one of the input sources has min‐entropy rate δ then the output has min‐entropy rate close to δ. Mergers have proven to be a very useful tool in explicit constructions of extractors and condensers, and are also interesting objects in their own right. In this work we give a refined analysis of the merger constructed by [Raz, STOC'05] (based on [Lu, Reingold, Vadhan, and Wigderson, STOC'03 pp. 602–611, 2003]). Our analysis uses min‐entropy instead of Shannon's entropy to derive tighter results than the ones obtained in [Raz STOC'05].We show that for every constant r and k it is possible to construct a merger that takes as input k strings of length n bits each, and outputs a string of length n/r bits, such that if one of the input sources has min‐entropy b, the output will be close to having min‐entropy b/(r + 1). This merger uses a constant number of additional uniform bits. One advantage of our analysis is that b (the min‐entropy of the “good” source) can be as small as a constant (this constant depends on r and k), while in the analysis given in [Raz STOC'05], b is required to be linear in n. © 2007 Wiley Periodicals, Inc. Random Struct. Alg., 2008