|
|
| Line 1: |
Line 1: |
| − | In cryptography, a pseudorandom generator (or PSG) is procedure that outputs a sequence computationally indistinguishable from truly random sequence with uniformly distributed random sequence. The prefix pseudo (from Greek ?????? "lying, false") is used to mark something as false, fraudulent, or pretending to be something it is not. Pseudo random generators find application in many fields besides cryptography such as applied mathematics, physics and simulations.
| |
| − | Simulations often require mechanisms producing sequences of random values. These procedures are certainly non-trivial and often require significant amounts of computational time.
| |
| | | | |
| − |
| |
| − | __TOC__
| |
| − |
| |
| − | == Definition ==
| |
| − | A pseudorandom generator (or PRG) is a (deterministic) map <math>{{G:\{0, 1\}^l \rightarrow \{0, 1\}^n}}</math>, where <math>{{n \geq l}}</math>. Here <math>{{l}}</math> is the 'seed length' and <math>{{n - l \geq 0}}</math> is the 'stretch'. We typically think that <math>{{n \gg l}}</math> and that <math>{{G}}</math> is effciently computable in some model. If <math>{{f:\{0, 1\}^n \rightarrow \{0, 1\}}}</math> is any 'statistical test', we say that G '<math>{{\epsilon}}</math>-fools' <math>{{f}}</math> is
| |
| − |
| |
| − |
| |
| − | <math>{{|Pr[f({U_n} = 1)] - Pr[f(G({U_l})) = 1)]| \leq \epsilon}}</math>
| |
| − |
| |
| − |
| |
| − | where <math>{U_m}</math> denotes a uniformly random string in <math>{{\{0, 1\}^m}}</math>. Here the string <math>{{U_l}}</math> is called the 'seed'. If <math>{{C}}</math> is a class of tests, we say that G '<math>{{\epsilon}}</math>-fools <math>{{C}}</math>' or is an '<math>{{\epsilon}}</math>-PRG against <math>{{C}}</math>' if <math>{{G}}</math> <math>{{\epsilon}}</math>-fools <math>{{f}}</math> for every <math>{{f \in C}}</math>.<ref name="cmu">[http://www.cs.cmu.edu/~odonnell/complexity/docs/lecture16.pdf Lecture 16: Nisan's PRG for small space, 15-855: Intensive Intro to Complexity Theory. Spring 2009, Carnegie Mellon University, USA.]: page 1</ref>
| |
| − |
| |
| − |
| |
| − | In other words we are thying to convince any outside party (let's call them an adversary) that sequences returned from PRG are being produced chosen at random. Adversary may use statistical test algorithms to check simultaneously outputs from PRG and uniformly random sequnces. PRGs ensure that to the adversary both outputs look the same.
| |
| − |
| |
| − | == Construction of simple PRG ==
| |
| − | There are many ways how to construct PRGs and one of the simpliest ones is to use pseudorandom functions and expand the key. A pseudorandom function (or PRF) is any function defined over <math>{{\textnormal(K, X, Y)}}</math> :
| |
| − |
| |
| − | <math>{{F:K \times X \rightarrow Y}}</math>
| |
| − |
| |
| − | where:
| |
| − |
| |
| − | # <math>{{K}}</math> is key space
| |
| − | # <math>{{X}}</math> is input space
| |
| − | # <math>{{Y}}</math> is output space
| |
| − |
| |
| − | such that exists efficient algorithm to evaluate <math>{{\textnormal F(k,x)}}</math>.<ref name=crypto>[https://class.coursera.org/crypto/class/index Boneh, D. (2012); Lecture 3 - Block ciphers, Introduction to Cryptography. Stanford, USA.]</ref>
| |
| − |
| |
| − |
| |
| − | On the other hand pseudorandom permutation is any function defined over <math>{{\textnormal(K, X)}}</math>:
| |
| − |
| |
| − | <math>{{E:K \times X \rightarrow X}}</math>
| |
| − |
| |
| − | such that<ref name=crypto/>:
| |
| − |
| |
| − | # Exists efficient deterministic algorithm to evaluate <math>{{\textnormal E(k,x)}}</math>
| |
| − | # The function <math>{{\textnormal F(k,\cdot)}}</math> is one-to-one
| |
| − | # Exists efficient inversion algorithm <math>{{\textnormal D(k,y)}}</math>
| |
| − |
| |
| − |
| |
| − | Any pseudorandom permutation (or PRP) is also pseudorandom function given
| |
| − | # <math>{{X=Y}}</math>
| |
| − | # Function is efficiently invertible
| |
| − |
| |
| − |
| |
| − | So let <math>{{F: K \times \{0, 1\}^n \rightarrow \{0, 1\}^n}}</math> be a PRF
| |
| − |
| |
| − |
| |
| − | <math>{{
| |
| − | \begin{cases}
| |
| − | Functions[X, Y]: \text{ all functions from X to Y}\\
| |
| − | S_F = {F(k, \cdot) st. k \in K} \subseteq Functions[X, Y]
| |
| − | \end{cases}
| |
| − | </math>
| |
| − |
| |
| − |
| |
| − | For PRF to be suitable for use in PRG it must be secure and therefore computationally indistinguishable from random function <math>{{f(\cdot)}}</math>. This situation is depicted below:
| |
| − |
| |
| − |
| |
| − | [[File:secure_prf.png|x125px]]
| |
| − |
| |
| − |
| |
| − | The adversary can not distinguish whether output came from <math>{{S_F}}</math> or some random <math>{{f(\cdot)}}</math>.
| |
| − |
| |
| − |
| |
| − | If <math>{{F}}</math> is secure PRF we can use key expantion to construct secure PRG defined as
| |
| − |
| |
| − |
| |
| − | <math>{{G: K \times \{0, 1\}^{nt}}}</math>
| |
| − | where:
| |
| − | # <math>{{n}}</math> number of bits in each block
| |
| − | # <math>{{t}}</math> number of generated blocks
| |
| − |
| |
| − |
| |
| − |
| |
| − | ==References==
| |
| − | <references />
| |
