Min-entropy Rate Research Articles

An energy and area efficient, all digital entropy source compatible with modern standards based on jitter pipelining

This paper proposes an energy and area efficient entropy source, suitable for true random number generation, accompanied with a stochastic model in a 28nm CMOS technology. The design uses a jitter pipelining architecture together with an increased timing resolution to achieve a maximal throughput of 298 Mbit/s and a best energy efficiency of 1.46 pJ/bit at a supply of 0.8V. The generated random bits pass the NIST SP 800-90B IID tests with a min entropy rate of 0.933 bit/bit, which is more than required by the AIS-31 standard. The all digital design allows for effortless transfer to other technology nodes, taking advantage of all benefits related to further technology scaling.

TROT: A Three-Edge Ring Oscillator Based True Random Number Generator With Time-to-Digital Conversion

This paper introduces a new true random number generator (TRNG) based on a three-edge ring oscillator. Our design uses a new technique with a time-to-digital converter to effectively acquire jitter accumulated independently by each edge. As a part of the security evaluation, we present the stochastic model of the TRNG’s digital noise source and estimate a lower bound of the min-entropy per random bit. Starting from the obtained entropy bound, we propose a procedure for selecting and implementing an area-efficient and throughput-optimal post-processing function based on the best known linear codes that will increase the output min-entropy rate to more than 0.999. The proposed TRNG exquisitely balances low design effort and resource consumption with high throughput and a high min-entropy rate, making it more suitable for randomness-demanding and resource-constrained platforms than the state-of-the-art. The complete implementation of the TRNG digital noise source and the post-processing occupies 33 slices and achieves a throughput of 12.5 Mbps on Xilinx Zynq-7000 FPGAs. The min-entropy of the generated random bits is assessed by NIST SP 800-90B entropy estimators, and the tested sequences pass the AIS-31 test suit.

Reusable Fuzzy Extractors for Low-Entropy Distributions

Fuzzy extractors (Dodis et al., in Advances in cryptology—EUROCRYPT 2014, Springer, Berlin, 2014, pp 93–110) convert repeated noisy readings of a secret into the same uniformly distributed key. To eliminate noise, they require an initial enrollment phase that takes the first noisy reading of the secret and produces a nonsecret helper string to be used in subsequent readings. Reusable fuzzy extractors (Boyen, in Proceedings of the 11th ACM conference on computer and communications security, CCS, ACM, New York, 2004, pp 82–91) remain secure even when this initial enrollment phase is repeated multiple times with noisy versions of the same secret, producing multiple helper strings (for example, when a single person’s biometric is enrolled with multiple unrelated organizations). We construct the first reusable fuzzy extractor that makes no assumptions about how multiple readings of the source are correlated. The extractor works for binary strings with Hamming noise; it achieves computational security under the existence of digital lockers (Canetti and Dakdouk, in Advances in cryptology—EUROCRYPT 2008, Springer, Berlin, 2008, pp 489–508). It is simple and tolerates near-linear error rates. Our reusable extractor is secure for source distributions of linear min-entropy rate. The construction is also secure for sources with much lower entropy rates—lower than those supported by prior (nonreusable) constructions—assuming that the distribution has some additional structure, namely, that random subsequences of the source have sufficient minentropy. Structure beyond entropy is necessary to support distributions with low entropy rates. We then explore further how different structural properties of a noisy source can be used to construct fuzzy extractors when the error rates are high, building a computationally secure and an information-theoretically secure construction for large-alphabet sources.

Santha-Vazirani sources, deterministic condensers and very strong extractors

The notion of semi-random sources, also known as Santha-Vazirani (SV) sources, stands for a sequence of n bits, where the dependence of the i’th bit on the previousi − 1 bits is limited for every i ∈ [n]. If the dependence of the i’th bit on the remainingn − 1 bits is limited, then this is a strongSV-source. Even the strong SV -sources are known not to admit (universal) deterministic extractors, but they have seeded extractors, as their min-entropy is Ω n. It is intuitively obvious that strong SV -sources are more than just high-min-entropy sources, and this work explores the intuition. Deterministic condensers are known not to exist for general high-min-entropy sources, and we construct for any constants e, δ ∈ (0,1) a deterministic condenser that maps n bits coming from a strong SV -source with bias at most δ to Ω n bits of min-entropy rate at least 1 − e. In conclusion we observe that deterministic condensers are closely related to very strong extractors – a proposed strengthening of the notion of strong (seeded) extractors: in particular, our constructions can be viewed as very strong extractors for the family of strong Santha-Vazirani distributions. The notion of very strong extractors requires that the output remains unpredictable even to someone who knows not only the seed value (as in the case of strong extractors), but also the extractor’s outputs corresponding to the same input value with each of the preceding seed values (say, under the lexicographic ordering). Very strong extractors closely resemble the original notion of SV -sources, except that the bits must satisfy the unpredictability requirement only on average.

AN EXPLICIT TWO‐SOURCE EXTRACTOR WITH MIN‐ENTROPY RATE NEAR

In 2005 Bourgain gave the first explicit construction of a two-source extractor family with min-entropy rate less than $1/2$. His approach combined Fourier analysis with innovative but inefficient tools from arithmetic combinatorics and yielded an unspecified min-entropy rate which was greater than $.499$. This remained essentially the state of the art until a 2015 breakthrough of Chattopadhyay and Zuckerman in which they gave an alternative approach which produced extractors with arbitrarily small min-entropy rate. In the current work, we revisit the Fourier analytic approach. We give an improved analysis of one of Bourgain's extractors which shows that it in fact extracts from sources with min-entropy rate near $\frac{21}{44} =.477\ldots$, moreover we construct a variant of this extractor which we show extracts from sources with min-entropy rate near $4/9 $ = $.444\ldots$. While this min-entropy rate is inferior to Chattopadhyay and Zuckerman's construction, our extractors have the advantage of exponential small error which is important in some applications. The key ingredient in these arguments is recent progress connected to the restriction theory of the finite field paraboloid by Rudnev and Shkredov. This in turn relies on a Rudnev's point-plane incidence estimate, which in turn relies on Koll\'ar's generalization of the Guth-Katz incidence theorem.

From Affine to Two-Source Extractors via Approximate Duality

We establish a new connection between affine and two-source extractors by presenting black-box constructions of two-source extractors for min-entropy rate below half from any affine extractor for min-entropy rate below half. Two such constructions are presented, and one of our constructions can reach arbitrarily small min-entropy rate assuming that the affine extractor has sufficiently good parameters. The first part of our analysis shows that our constructions are two-source dispersers which are weak (but nontrivial) kinds of two-source extractors, also known as “bipartite Ramsey graphs.” To strengthen this result and obtain two-source extractors we introduce the approximate duality conjecture (ADC) and initiate its study. The ADC leads to a rather general result that can be used to convert a natural class of two-source dispersers---``low-rank dispersers''---into two-source extractors. More specifically, we first prove a special case of ADC that implies that the constructions mentioned above are two-source extractors with large (but nontrivial) constant error. In an attempt to reduce the error in our constructions we show that the polynomial Freiman--Ruzsa conjecture (PFR) in additive combinatorics implies a stronger “approximate duality” statement (and that this stronger statement also implies a weak but as-of-yet-unknown version of PFR). This stronger statement implies in turn that our constructions are two-source extractors with exponentially small error.

Nonmalleable Extractors with Short Seeds and Applications to Privacy Amplification

Motivated by the classical problem of privacy amplification, Dodis and Wichs [in Proceedings of the 41st Annual ACM Symposium on Theory of Computing, 2009, pp. 601--610] introduced the notion of a nonmalleable extractor, significantly strengthening the notion of a strong extractor. A nonmalleable extractor is a function $\mathsf{nmExt}:\{0,1\}^n\times\{0,1\}^d\to\{0,1\}^m$ that takes two inputs---a weak source $W$ and a uniform (independent) seed $S$---and outputs a string $\mathsf{nmExt}(W,S)$ that is nearly uniform given the seed $S$ as well as the value $\mathsf{nmExt}(W,S')$ for any seed $S'\neq S$ that may be determined as an arbitrary function of $S$. The first explicit construction of a nonmalleable extractor was recently provided by Dodis et al. [Privacy Amplification and Non-malleable Extractors via Character Sums, preprint, arXiv:1102.5415 [cs.CR], 2011]. Their extractor works for any weak source with min-entropy rate $1/2+\delta$, where $\delta>0$ is an arbitrary constant and outputs up to a linear number of bits but suffers from two drawbacks. First, the length of its seed is linear in the length of the weak source (which leads to privacy amplification protocols with high communication complexity). Second, the construction is conditional: when outputting more than a logarithmic number of bits (as required for privacy amplification protocols), its efficiency relies on a longstanding conjecture on the distribution of prime numbers. In this paper we present an unconditional construction of a nonmalleable extractor with short seeds. For any integers $n$ and $d$ such that $2.01\cdot\log n\leq d\leq n$, we present an explicit construction of a nonmalleable extractor $\mathsf{nmExt}\colon\{0,1\}^n\times\{0,1\}^d\to\{0,1\}^m$, with $m=\Omega(d)$ and error exponentially small in $m$. The extractor works for any weak source with min-entropy rate $1/2+\delta$, where $\delta>0$ is an arbitrary constant. Moreover, our extractor in fact satisfies an even more general notion of nonmalleability: its output $\mathsf{nmExt}(W,S)$ is nearly uniform given the seed $S$ as well as the values $\mathsf{nmExt}(W,S_1),\dots,\mathsf{nmExt}(W,S_t)$ for several seeds $S_1,\dots,S_t$ that may be determined as an arbitrary function of $S$, as long as $S\notin\{S_1,\dots,S_t\}$. By instantiating the framework of Dodis and Wichs with our nonmalleable extractor, we obtain the first 2-round privacy amplification protocol for min-entropy rate $1/2+\delta$ with asymptotically optimal entropy loss and polylogarithmic communication complexity. This improves the previously known 2-round privacy amplification protocols: the protocol of Dodis and Wichs, whose entropy loss is not asymptotically optimal, and the protocol of Dodis et al., whose communication complexity is linear.

Unbalanced expanders and randomness extractors from Parvaresh--Vardy codes

We give an improved explicit construction of highly unbalanced bipartite expander graphs with expansion arbitrarily close to the degree (which is polylogarithmic in the number of vertices). Both the degree and the number of right-hand vertices are polynomially close to optimal, whereas the previous constructions of Ta-Shma et al. [2007] required at least one of these to be quasipolynomial in the optimal. Our expanders have a short and self-contained description and analysis, based on the ideas underlying the recent list-decodable error-correcting codes of Parvaresh and Vardy [2005]. Our expanders can be interpreted as near-optimal “randomness condensers,” that reduce the task of extracting randomness from sources of arbitrary min-entropy rate to extracting randomness from sources of min-entropy rate arbitrarily close to 1, which is a much easier task. Using this connection, we obtain a new, self-contained construction of randomness extractors that is optimal up to constant factors, while being much simpler than the previous construction of Lu et al. [2003] and improving upon it when the error parameter is small (e.g., 1/poly(n)).

An Improved Analysis of Linear Mergers

Mergers are procedures that, with the aid of a short random string, transform k (possibly dependent) random sources into a single random source, in a way that ensures that if one of the input sources has min-entropy rate ? then the output has min-entropy rate close to ?. Mergers were first introduced by Ta-Shma [28th STOC, pp. 276-285, 1996] and have proven to be a very useful tool in explicit constructions of extractors and condensers. In this work we present a new analysis of the merger construction of Lu et al [35th STOC, pp. 602-611, 2003]. We prove that the merger's output is close to a distribution with min-entropy rate of at least $$\frac{6}{11}\delta$$ . We show that the distance from this distribution is polynomially related to the number of additional random bits that were used by the merger (i.e., its seed). We are also able to prove a bound of $$\frac{4}{7}\delta$$ on the min-entropy rate at the cost of increasing the statistical error. Both results are improvements to the previous known lower bound of $$\frac{1}{2}\delta$$ (however, in the $$\frac{1}{2}\delta$$ result the error decreases exponentially in the length of the seed). To obtain our results we deviate from the usual linear algebra methods that were used by Lu et al and introduce techniques from additive number theory.

Constructing Locally Computable Extractors and Cryptosystems in the Bounded-Storage Model

We consider the problem of constructing randomness extractors that are locally computable; that is, read only a small number of bits from their input. As recently shown by Lu locally computable extractors directly yield secure private-key cryptosystems in Maurer’s bounded-storage model. We suggest a general “sample-then-extract” approach to constructing locally computable extractors: use essentially any randomness-efficient sampler to select bits from the input and then apply any extractor to the selected bits. Plugging in known sampler and extractor constructions, we obtain locally computable extractors, and hence cryptosystems in the bounded-storage model, whose parameters improve upon previous constructions. We also provide lower bounds showing that the parameters we achieve are nearly optimal. The correctness of the sample-then-extract approach follows from a fundamental lemma of Nisan and Zuckerman, which states that sampling bits from a weak random source roughly preserves the min-entropy rate. We also present a refinement of this lemma, showing that the min-entropy rate is preserved up to an arbitrarily small additive loss, whereas the original lemma loses a logarithmic factor.