improving the exact security of digital signature schemes

36
10/5/2020 Sublinear Algorithms LECTURE 5 Last time β€’ Limitations of sublinear-time algorithms β€’ Yao’s Minimax Principle β€’ Examples: testing 0 βˆ— and sortedness Today β€’ Limitations of sublinear-time algorithms β€’ Yao’s Minimax Principle β€’ Communication complexity Sofya Raskhodnikova;Boston University

Upload: others

Post on 02-Feb-2022

4 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Improving the Exact Security of Digital Signature Schemes

10/5/2020

Sublinear Algorithms

LECTURE 5Last timeβ€’ Limitations of sublinear-time algorithms

β€’ Yao’s Minimax Principle

β€’ Examples: testing 0βˆ— and sortedness

Todayβ€’ Limitations of sublinear-time algorithms

β€’ Yao’s Minimax Principle

β€’ Communication complexity

Sofya Raskhodnikova;Boston University

Page 2: Improving the Exact Security of Digital Signature Schemes

Recall: Yao’s Minimax Principle

2

β€’ Need for lower bounds

Yao’s Minimax Principle (easy direction): Statement 2 β‡’ Statement 1.

NOTE: Also applies to restricted algorithms

β€’ 1-sided error tests

β€’ nonadaptive tests

Statement 1

For any probabilistic algorithm A of complexity q there exists an input x s.t.

Prπ‘π‘œπ‘–π‘› π‘‘π‘œπ‘ π‘ π‘’π‘  π‘œπ‘“ 𝐴

[A(x) is wrong] > 1/3.

Statement 2

There is a distribution D on the inputs, s.t. for every deterministic algorithm of complexity q,

Prπ‘₯←𝐷

[A(x) is wrong] > 1/3.

Page 3: Improving the Exact Security of Digital Signature Schemes

Yao’s Minimax Principle as a game

3

Players: Evil algorithms designer Al and poor lower bound prover Lola.

Game1

Move 1. Al selects a q-query randomized algorithm A for the problem.

Move 2. Lola selects an input on which A errs with largest probability.

Game2

Move 1. Lola selects a distribution on inputs.

Move 2. Al selects a q-query deterministic algorithm with as large probability of success on Lola’s distribution as possible.

Page 4: Improving the Exact Security of Digital Signature Schemes

Testing Monotonicity of functions on HypercubeNon-adaptive 1-sided error

Lower Bound

Page 5: Improving the Exact Security of Digital Signature Schemes

5

f(000)

f(111) f(011)

f(100)

f(101)

f(110)f(010)

f(001)

Boolean Functions 𝒇 ∢ 𝟎, 𝟏 𝒏 β†’ {𝟎, 𝟏}

Graph representation:

𝑛-dimensional hypercube

β€’ 2𝑛 vertices: bit strings of length 𝑛

β€’ 2π‘›βˆ’1𝑛 edges: (π‘₯, 𝑦) is an edge if 𝑦 can be obtained from π‘₯ by increasing one bit from 0 to 1

β€’ each vertex π‘₯ is labeled with 𝑓(π‘₯)

001001

011001

π‘₯𝑦

Page 6: Improving the Exact Security of Digital Signature Schemes

6

Boolean Functions 𝒇 ∢ 𝟎, 𝟏 𝒏 β†’ {𝟎, 𝟏}

Graph representation:

𝑛-dimensional hypercube

β€’ 2𝑛 vertices: bit strings of length 𝑛

β€’ 2π‘›βˆ’1𝑛 edges: (π‘₯, 𝑦) is an edge if 𝑦 can be obtained from π‘₯ by increasing one bit from 0 to 1

β€’ each vertex π‘₯ is labeled with 𝑓(π‘₯)

001001

011001

π‘₯𝑦

𝑓(00β‹―00)

𝑓(11β‹―11)

Vertices: increasing weight

Page 7: Improving the Exact Security of Digital Signature Schemes

Monotonicity of Functions

7

[Goldreich Goldwasser Lehman Ron Samorodnitsky,

Dodis Goldreich Lehman Raskhodnikova Ron Samorodnitsky

Fischer Lehman Newman Raskhodnikova Rubinfeld Samorodnitsky]

β€’ A function 𝑓 ∢ 0,1 𝑛 β†’ {0,1} is monotone

if increasing a bit of π‘₯ does not decrease 𝑓(π‘₯).

β€’ Is 𝑓 monotone or πœ€-far from monotone(𝑓 has to change on many points to become monontone)?

– Edge π‘₯𝑦 is violated by 𝑓 if 𝑓 (π‘₯) > 𝑓 (𝑦).

Time:

– 𝑂(𝑛/πœ€), logarithmic in the size of the input, 2𝑛

– Ξ©( 𝑛/πœ€) for 1-sided error, nonadaptive tests

– Advanced techniques: Θ( 𝑛/πœ€2) for nonadaptive tests, Ξ© 3 𝑛

[Khot Minzer Safra 15, Chen De Servidio Tang 15, Chen Waingarten Xie 17]

0

0 0

01

1

1

1

1

1 0

00

0

1

1

monotone

1

2-far from monotone

Page 8: Improving the Exact Security of Digital Signature Schemes

Hypercube 1-sided Error Lower Bound

8

β€’ 1-sided error test must accept if no violated pair is uncovered.

Violated pair:

– A distribution on far from monotone functions suffices.

LemmaEvery 1-sided error nonadaptive test for monotonicity of functions 𝑓 ∢

0,1 𝑛 β†’ {0,1} requires Ξ© 𝑛 queries.

01

[Fischer Lehman Newman Raskhodnikova Rubinfeld Samorodnitsky]

Page 9: Improving the Exact Security of Digital Signature Schemes

Hypercube 1-sided Error Lower Bound

9

β€’ Hard distribution: pick coordinate 𝑖 at random and output 𝑓𝑖.

𝑛

2Β± 𝑛 1 βˆ’ coordinate 𝑖

1

0

𝑓𝑖 ∢

𝑓𝑖(π‘₯) =

1 if π‘₯ >𝑛

2+ 𝑛

1 βˆ’ π‘₯𝑖 if π‘₯ =𝑛

2Β± 𝑛

0 if π‘₯ <𝑛

2βˆ’ 𝑛

Page 10: Improving the Exact Security of Digital Signature Schemes

Hypercube 1-sided Error Lower Bound

10

β€’ Hard distribution: pick coordinate 𝑖 at random and output 𝑓𝑖.

β€’ A ``truncation’’ of an antidicator

𝑛

2Β± 𝑛 1 βˆ’ coordinate 𝑖

1

0

𝑓𝑖 ∢

𝑓𝑖(π‘₯) =

1 if π‘₯ >𝑛

2+ 𝑛

1 βˆ’ π‘₯𝑖 if π‘₯ =𝑛

2Β± 𝑛

0 if π‘₯ <𝑛

2βˆ’ 𝑛

1

10

00

0

1

1

antidictator

Page 11: Improving the Exact Security of Digital Signature Schemes

The Fraction of Nodes in Middle Layers

E[Y]=

πœ€ =

11

Let Y1, … , Ys be independently distributed random variables in [0,1].

Let Y =1

𝑠⋅ βˆ‘

𝑠

𝑖=1Yi (called sample mean). Then Pr Y βˆ’ E Y β‰₯ πœ€ ≀ 2eβˆ’2π‘ πœ€

2.

Hoeffding Bound

𝑛

2Β± 𝑛 1 βˆ’ coordinate 𝑖

1

0

𝑓𝑖 ∢

Page 12: Improving the Exact Security of Digital Signature Schemes

Hard Functions are Far

12

β€’ Hard distribution: pick coordinate 𝑖 at random and output 𝑓𝑖.

Analysis

2 𝑛 1 βˆ’ coordinate 𝑖

1

0

𝑓𝑖 ∢

β€’ The middle contains a constant fraction of vertices.β€’ Edges from (π‘₯1, … , π‘₯π‘–βˆ’1, 0, π‘₯𝑖+1, … , π‘₯𝑛) to (π‘₯1, … , π‘₯π‘–βˆ’1, 1, π‘₯𝑖+1, … , π‘₯𝑛) are

violated if both endpoints are in the middle.β€’ All 𝑛 functions are πœ€-far from monotone for some constant πœ€.

𝑓𝑖(π‘₯) =

1 if π‘₯ >𝑛

2+ 𝑛

1 βˆ’ π‘₯𝑖 if π‘₯ =𝑛

2Β± 𝑛

0 if π‘₯ <𝑛

2βˆ’ 𝑛

Page 13: Improving the Exact Security of Digital Signature Schemes

Hypercube 1-sided Error Lower Bound

13

β€’ How many functions does a set of π‘ž queries expose?

# functions that a query pair (π‘₯, 𝑦) exposes≀ # coordinates on which π‘₯ and 𝑦 differ

≀ 2 𝑛

111011

001001

π‘₯𝑦

𝑖 𝑗 π‘˜

Pair (π‘₯, 𝑦)can expose only

functions 𝑓𝑖 , 𝑓𝑗 and π‘“π‘˜

queries

2 𝑛

1

0

𝑓

π‘₯

𝑦

Only pairs of queries in the Green Band can be violated β‡’ disagreements ≀ 2 𝑛

Naive Analysis

# functions exposed by π‘ž queries≀ π‘ž2 β‹… 2 𝑛

Page 14: Improving the Exact Security of Digital Signature Schemes

Hypercube 1-sided Error Lower Bound

14

β€’ How many functions does a set of π‘ž queries expose?

# functions that a query pair (π‘₯, 𝑦) exposes≀ # coordinates on which π‘₯ and 𝑦 differ

≀ 2 𝑛

111011

001001

π‘₯𝑦

𝑖 𝑗 π‘˜

Pair (π‘₯, 𝑦)can expose only

functions 𝑓𝑖 , 𝑓𝑗 and π‘“π‘˜

queries

2 𝑛

1

0

𝑓

π‘₯

𝑦

Only pairs of queries in the Green Band can be violated β‡’ disagreements ≀ 2 𝑛

Claim# functions exposed by π‘ž queries

≀ (π‘ž βˆ’ 1) β‹… 2 𝑛

Page 15: Improving the Exact Security of Digital Signature Schemes

Hypercube 1-sided Error Lower Bound

15

β€’ How many functions does a set of π‘ž queries expose?

Let 𝑄 be the set of queries made.The tester catches a violation

⇕Q contains comparable π‘₯, 𝑦that differ in coordinate 𝑖

2 𝑛

1

0

𝑓

π‘₯

𝑦

Claim# functions exposed by π‘ž queries

≀ (π‘ž βˆ’ 1) β‹… 2 𝑛

Consider its spanning forest.

sufficient to consider adjacent vertices in a minimum spanning forest

on the query set

Draw an undirected graph 𝑄, 𝐸by connected comparable queries

π‘₯, 𝑦 exist⇕

there are adjacent vertices on the pathfrom π‘₯ to 𝑦 that differ in coordinate 𝑖

Page 16: Improving the Exact Security of Digital Signature Schemes

Hypercube 1-sided Error Lower Bound

16

β€’ How many functions does a set of π‘ž queries expose?

queries

2 𝑛

1

0

𝑓

π‘₯

𝑦

Claim# functions exposed by π‘ž queries

≀ (π‘ž βˆ’ 1) β‹… 2 𝑛

⇓

ClaimEvery deterministic test that makes a set 𝑄 of π‘ž queries (in the middle)

succeeds with probability π‘‚π‘ž

𝑛on our distribution. ⨳

Page 17: Improving the Exact Security of Digital Signature Schemes

Communication Complexity

A Method for Proving Lower Bounds [Blais Brody Matulef 11]

Use known lower bounds

for other models of computation

Partially based on slides by Eric Blais

Page 18: Improving the Exact Security of Digital Signature Schemes

(Randomized) Communication Complexity

20

Compute 𝐢 π‘₯, 𝑦

0100

11

001

β‹―

0011

BobAlice

𝐼𝑛𝑝𝑒𝑑: π‘₯ Input: 𝑦

1101000101110101110101010110…

π‘†β„Žπ‘Žπ‘Ÿπ‘’π‘‘ π‘Ÿπ‘Žπ‘›π‘‘π‘œπ‘š π‘ π‘‘π‘Ÿπ‘–π‘›π‘”

Goal: minimize the number of bits exchanged.

β€’ Communication complexity of a protocol is the maximum number of bits exchanged by the protocol.

β€’ Communication complexity of a function 𝐢, denoted 𝑅(𝐢), is the communication complexity of the best protocol for computing C.

Page 19: Improving the Exact Security of Digital Signature Schemes

Example: Set Disjointness π·πΌπ‘†π½π’Œ

21

Theorem [Kalyanasundaram Schmitger 92, Razborov 92]

𝑅 DISJπ‘˜ β‰₯ Ξ© π‘˜ for all π‘˜ ≀𝑛

2.

Compute π·πΌπ‘†π½π‘˜ 𝑆, 𝑇

= α‰Šπ’‚π’„π’„π’†π’‘π’• if 𝑆 ∩ 𝑇 = βˆ…π’“π’†π’‹π’†π’„π’• otherwise

BobAlice

𝐼𝑛𝑝𝑒𝑑: 𝑆 βŠ† [𝑛], 𝑆 = π‘˜. Input: 𝑇 βŠ† [𝑛], 𝑇 = π‘˜

1101000101110101110101010110…

Page 20: Improving the Exact Security of Digital Signature Schemes

A lower bound using CC method

Testing if a Boolean function is a k-parity

Page 21: Improving the Exact Security of Digital Signature Schemes

Linear Functions Over Finite Field 𝔽2

23

A Boolean function 𝑓: 0,1 𝑛 β†’ {0,1} is linear (also called parity) if

𝑓 π‘₯1, … , π‘₯𝑛 = π‘Ž1π‘₯1 +β‹―+ π‘Žπ‘›π‘₯𝑛 for some π‘Ž1, … , π‘Žπ‘› ∈ {0,1}

β€’ Work in finite field 𝔽2– Other accepted notation for 𝔽2: 𝐺𝐹2 and β„€2– Addition and multiplication is mod 2

– 𝒙= π‘₯1, … , π‘₯𝑛 , π’š= 𝑦1, … , 𝑦𝑛 , that is, 𝒙, π’š ∈ 0,1 𝑛

𝒙 + π’š= π‘₯1 + 𝑦1, … , π‘₯𝑛 + 𝑦𝑛

no free term

001001

011001

010000

+

example

Page 22: Improving the Exact Security of Digital Signature Schemes

Linear Functions Over Finite Field 𝔽2

24

A Boolean function 𝑓: 0,1 𝑛 β†’ {0,1} is linear (also called parity) if

𝑓 π‘₯1, … , π‘₯𝑛 = π‘Ž1π‘₯1 +β‹―+ π‘Žπ‘›π‘₯𝑛 for some π‘Ž1, … , π‘Žπ‘› ∈ {0,1}

⇕

𝑓 π‘₯1, … , π‘₯𝑛 = βˆ‘π‘–βˆˆS π‘₯𝑖 for some 𝑆 βŠ† 𝑛 .

Notation: πœ’π‘† π‘₯ = βˆ‘π‘–βˆˆπ‘† π‘₯𝑖.

[𝑛] is a shorthand for {1, …𝑛}

Page 23: Improving the Exact Security of Digital Signature Schemes

Testing if a Boolean function is Linear

25

Input: Boolean function 𝑓: 0,1 𝑛 β†’ {0,1}

Question:

Is the function linear or πœ€-far from linear

(β‰₯ πœ€2𝑛 values need to be changed to make it linear)?

Later in the course:

Famous BLR (Blum Lubi Rubinfeld 90) test runs in 𝑂1

πœ€time

Page 24: Improving the Exact Security of Digital Signature Schemes

k-Parity Functions

26

π‘˜-Parity Functions

A function 𝑓 ∢ 0,1 𝑛 β†’ {0,1} is a π‘˜-parity if

𝑓 π‘₯ = πœ’π‘† π‘₯ = βˆ‘π‘–βˆˆπ‘† π‘₯𝑖for some set 𝑆 βŠ† 𝑛 of size 𝑆 = π‘˜.

Page 25: Improving the Exact Security of Digital Signature Schemes

Testing if a Boolean Function is a k-Parity

27

Input: Boolean function 𝑓: 0,1 𝑛 β†’ {0,1} and an integer π‘˜

Question: Is the function a π‘˜-parity or πœ€-far from a π‘˜-parity

(β‰₯ πœ€2𝑛 values need to be changed to make it a π‘˜-parity)?

Time:

O π‘˜ log π‘˜ [Chakraborty Garciaβˆ’Soriano Matsliah]

W min(π‘˜, 𝑛 βˆ’ π‘˜ ) [Blais Brody Matulef 11]

β€’ Today: Ξ©(π‘˜) for π‘˜ ≀ 𝑛/2

β€’ Today’s bound implies W min(π‘˜, 𝑛 βˆ’ π‘˜ )

Page 26: Improving the Exact Security of Digital Signature Schemes

Important Fact About Linear Functions

β€’ Consider functions πœ’π‘† and πœ’π‘‡ where 𝑆 β‰  𝑇.

– Let 𝑖 be an element on which 𝑆 and 𝑇 differ

(w.l.o.g. 𝑖 ∈ 𝑆 βˆ– 𝑇)

– Pair up all 𝑛-bit strings: (𝒙, 𝒙 𝑖 )

where 𝒙 𝑖 is 𝒙 with the 𝑖th bit flipped.

– For each such pair, πœ’π‘†(𝒙) β‰  πœ’π‘†(𝒙𝑖 )

but πœ’π‘‡(𝒙) = πœ’π‘‡(𝒙𝑖 )

So, πœ’π‘† and πœ’π‘‡ differ on exactly one of 𝒙, 𝒙 𝑖 .

– Since all 𝒙’s are paired up,

πœ’π‘† and πœ’π‘‡ differ on half of the values.

28

𝒙

𝒙 𝑖

πœ’π‘†(x) πœ’π‘‡(x)

011π‘Ž0β‹…β‹…β‹…

1 βˆ’ π‘Ž010

010𝑏1⋅⋅⋅𝑏001

Two different linear functions disagree on half of the values.Fact.

A π‘˜β€²βˆ’parity function, where π‘˜β€² β‰  π‘˜, is Β½-far from any k-parity.Corollary.

Page 27: Improving the Exact Security of Digital Signature Schemes

Reduction from π·πΌπ‘†π½π’Œ/𝟐 to Testing k-Parity

β€’ Let 𝑇 be the best tester for the π‘˜-parity property for πœ€ = 1/2– query complexity of T is π‘ž testing π‘˜βˆ’parity .

β€’ We will construct a communication protocol for π·πΌπ‘†π½π’Œ/𝟐 that runs

𝑇 and has communication complexity 2 β‹… π‘ž(testing π‘˜βˆ’parity).

β€’ Then 2 β‹… π‘ž(testing π‘˜βˆ’parity) β‰₯ 𝑅 DISJπ‘˜/2 β‰₯ Ξ© π‘˜/2 for π‘˜ ≀ 𝑛/2

⇓

π‘ž(testing π‘˜-parity) β‰₯ Ξ© π‘˜ for π‘˜ ≀ 𝑛/2

29

holds for CC of every

protocol for π·πΌπ‘†π½π’Œ [Kalyanasundaram Schnitger 92]

Page 28: Improving the Exact Security of Digital Signature Schemes

Reduction from π·πΌπ‘†π½π’Œ/𝟐 to Testing k-Parity

30

BobAlice

𝐼𝑛𝑝𝑒𝑑: 𝑆 βŠ† [𝑛], 𝑆 = π‘˜/2.

Compute: 𝑓 = πœ’π‘†

Input: 𝑇 βŠ† [𝑛], 𝑇 = π‘˜/2Compute: 𝑔 = πœ’π‘‡

1101000101110101110101010110…

Output T’s answer

T

β„Ž = 𝑓 + 𝑔 (π‘šπ‘œπ‘‘ 2)

𝒂𝒄𝒄𝒆𝒑𝒕/𝒓𝒆𝒋𝒆𝒄𝒕

β„Ž π‘₯ ? 𝑓 π‘₯ + 𝑔 π‘₯ π‘šπ‘œπ‘‘ 2

𝑓(π‘₯)𝑔(π‘₯)

β€’ 𝑇 receives its random bits from the shared random string.

Page 29: Improving the Exact Security of Digital Signature Schemes

Analysis of the Reduction

Queries: Alice and Bob exchange 2 bits for every bit queried by 𝑇

Correctness:

β€’ β„Ž = 𝑓 + 𝑔 π‘šπ‘œπ‘‘ 2 = πœ’π‘† + πœ’π‘‡ π‘šπ‘œπ‘‘ 2 = πœ’π‘†Ξ”π‘‡

β€’ 𝑆Δ𝑇 = 𝑆 + 𝑇 βˆ’ 2 𝑆 ∩ 𝑇

β€’ SΔ𝑇 = α‰Šπ‘˜ if S∩T = βˆ…

≀ π‘˜ βˆ’ 2 if S∩T β‰  βˆ…

β„Ž is α‰Šπ‘˜βˆ’parity if S∩T = βˆ…

π‘˜β€²βˆ’parity where π‘˜β€² β‰  π‘˜ if S∩T β‰  βˆ…

Summary: π‘ž(testing π‘˜-parity) β‰₯ Ξ© π‘˜ for π‘˜ ≀ 𝑛/2

31

1/2-far from every π‘˜-parity

Page 30: Improving the Exact Security of Digital Signature Schemes

Testing Lipschitz Property on Hypercube

Lower Bound

Page 31: Improving the Exact Security of Digital Signature Schemes

Lipschitz Property of Functions f: 0,1 𝑛→R

33

β€’ A function 𝑓 ∢ 0,1 𝑛 β†’ R is Lipschitz

if changing a bit of π‘₯ changes 𝑓(π‘₯) by at most 1.

β€’ Is 𝑓 Lipschitz or πœ€-far from Lipschitz(𝑓 has to change on many points to become Lipschitz)?

– Edge π‘₯ βˆ’ 𝑦 is violated by 𝑓 if 𝑓 π‘₯ βˆ’ 𝑓(𝑦) > 1.

Time:

– 𝑂(𝑛/πœ€), logarithmic in the size of the input, 2𝑛

[Chakrabarty Seshadhri]

– Ξ©(𝑛) [Jha Raskhodnikova]

0

0 1

12

1

2

1

2

2 0

00

0

2

2

Lipschitz

1

2-far from Lipschitz

Page 32: Improving the Exact Security of Digital Signature Schemes

Testing Lipschitz Property

34

Prove it.

Theorem

Testing Lipschitz property of functions f: 0,1 𝑛 β†’ {0,1,2}requires Ξ©(𝑛) queries.

Page 33: Improving the Exact Security of Digital Signature Schemes

Summary of Lower Bound Methods

β€’ Yao’s Principle

– testing membership in 1*, sortedness of a list and monotonicity of Boolean functions

β€’ Reductions from communication complexity problems

– testing if a Boolean function is a π‘˜-parity

35

Page 34: Improving the Exact Security of Digital Signature Schemes

Other Models of SublinearComputation

Page 35: Improving the Exact Security of Digital Signature Schemes

37

Tolerant Property Tester

𝜺𝟏-close to YES

𝜺𝟐-far from

YES

YES

Reject with probability 2/3

Don’t care

Accept with probability β‰₯ 𝟐/πŸ‘

Tolerant Property Tester [Rubinfeld Parnas Ron]

Randomized Algorithm

YES Accept with probability β‰₯ 𝟐/πŸ‘

Reject with probability 2/3

NO

Page 36: Improving the Exact Security of Digital Signature Schemes

Sublinear-Time β€œRestoration” Models

Local Decoding

Program Checking

Local Reconstruction

38

Input: Function 𝑓 nearly satisfying some property 𝑃Requirement: Reconstruct function 𝑓 to ensure that the reconstructed function 𝑔 satisfies 𝑃, changing 𝑓 only when necessary. For each input π‘₯, compute 𝑔(π‘₯) with a few queries to 𝑓.

𝑓

𝑃Input: A program 𝑃 computing 𝑓 correctly on most inputs.Requirement: Self-correct program 𝑃: for a given input π‘₯, compute 𝑓(π‘₯) by making a few calls to P.

Input: A slightly corrupted codewordRequirement: Recover individual bits of the closest codeword with a constant number of queries per recovered bit.

𝑓