SearcharxivSearch

arXiv subjects

Ronen Shaltiel

Publications and source records attributed to Ronen Shaltiel.

4 recordsLinked to original sources

Query complexity lower bounds for local list-decoding and hard-core predicates (even for small rate and huge lists)

A binary code Enc$:\{0,1\}^k \to \{0,1\}^n$ is $(0.5-\epsilon,L)$-list decodable if for all $w \in \{0,1\}^n$, the set List$(w)$ of all messages $m \in \{0,1\}^k$ such that the relative Hamming distance between Enc$(m)$ and $w$ is at most $0.5 -\epsilon$, has size at most $L$. Informally, a $q$-query local list-decoder for Enc is a randomized procedure Dec$:[k]\times [L] \to \{0,1\}$ that when given oracle access to a string $w$, makes at most $q$ oracle calls, and for every message $m \in \text{List}(w)$, with high probability, there exists $j \in [L]$ such that for every $i \in [k]$, with high probability, Dec$^w(i,j)=m_i$. We prove lower bounds on $q$, that apply even if $L$ is huge (say $L=2^{k^{0.9}}$) and the rate of Enc is small (meaning that $n \ge 2^{k}$): 1. For $\epsilon \geq 1/k^{\nu}$ for some universal constant $0< \nu < 1$, we prove a lower bound of $q=\Omega(\frac{\log(1/\delta)}{\epsilon^2})$, where $\delta$ is the error probability of the local list-decoder. This bound is tight as there is a matching upper bound by Goldreich and Levin (STOC 1989) of $q=O(\frac{\log(1/\delta)}{\epsilon^2})$ for the Hadamard code (which has $n=2^k$). This bound extends an earlier work of Grinberg, Shaltiel and Viola (FOCS 2018) which only works if $n \le 2^{k^{\gamma}}$ for some universal constant $0<\gamma <1$, and the number of coins tossed by Dec is small (and therefore does not apply to the Hadamard code, or other codes with low rate). 2. For smaller $\epsilon$, we prove a lower bound of roughly $q = \Omega(\frac{1}{\sqrt{\epsilon}})$. To the best of our knowledge, this is the first lower bound on the number of queries of local list-decoders that gives $q \ge k$ for small $\epsilon$. We also prove black-box limitations for improving some of the parameters of the Goldreich-Levin hard-core predicate construction.

cs.CC

On Hardness Assumptions Needed for "Extreme High-End'' PRGs and Fast Derandomization

The hardness vs.~randomness paradigm aims to explicitly construct pseudorandom generators $G:\{0,1\}^r \rightarrow \{0,1\}^m$ that fool circuits of size $m$, assuming the existence of explicit hard functions. A ``high-end PRG'' with seed length $r=O(\log m)$ (implying BPP=P) was achieved in a seminal work of Impagliazzo and Wigderson (STOC 1997), assuming the high-end hardness assumption: there exist constants $0<β< 1< B$, and functions computable in time $2^{B \cdot n}$ that cannot be computed by circuits of size $2^{β\cdot n}$. Recently, motivated by fast derandomization of randomized algorithms, Doron et al.~(FOCS 2020) and Chen and Tell (STOC 2021), construct ``extreme high-end PRGs'' with seed length $r=(1+o(1))\cdot \log m$, under qualitatively stronger assumptions. We study whether extreme high-end PRGs can be constructed from the following scaled version of the assumption which we call ``the extreme high-end hardness assumption'', and in which $β=1-o(1)$ and $B=1+o(1)$. We give a partial negative answer, showing that certain approaches cannot yield a black-box proof. (A longer abstract with more details appears in the PDF file)

cs.CC

Channels of Small Log-Ratio Leakage and Characterization of Two-Party Differentially Private Computation

Consider a PPT two-party protocol $π=(A,B)$ in which the parties get no private inputs and obtain outputs $O^A,O^B\in \{0,1\}$, and let $V^A$ and $V^B$ denote the parties' individual views. Protocol $π$ has $α$-agreement if $Pr[O^A=O^B]=1/2+α$. The leakage of $π$ is the amount of information a party obtains about the event $\{O^A=O^B\}$; that is, the leakage $ε$ is the maximum, over $P\in\{A,B\}$, of the distance between $V^P|OA=OB$ and $V^P|OA\neq OB$. Typically, this distance is measured in statistical distance, or, in the computational setting, in computational indistinguishability. For this choice, Wullschleger [TCC 09] showed that if $α>>ε$ then the protocol can be transformed into an OT protocol. We consider measuring the protocol leakage by the log-ratio distance (which was popularized by its use in the differential privacy framework). The log-ratio distance between X,Y over domain Ωis the minimal $ε>0$ for which, for every $v\inΩ$, $log(Pr[X=v]/Pr[Y=v])\in [-ε,ε]$. In the computational setting, we use computational indistinguishability from having log-ratio distance $ε$. We show that a protocol with (noticeable) accuracy $α\inΩ(ε^2)$ can be transformed into an OT protocol (note that this allows $ε>>α$). We complete the picture, in this respect, showing that a protocol with $α\in o(ε^2)$ does not necessarily imply OT. Our results hold for both the information theoretic and the computational settings, and can be viewed as a "fine grained" approach to "weak OT amplification". We then use the above result to fully characterize the complexity of differentially private two-party computation for the XOR function, answering the open question put by Goyal, Khurana, Mironov, Pandey, and Sahai [ICALP 16] and Haitner, Nissim, Omri, Shaltiel, and Silbak [FOCS 18].

cs.CC

Computational Two-Party Correlation: A Dichotomy for Key-Agreement Protocols

Let $π$ be an efficient two-party protocol that given security parameter $κ$, both parties output single bits $X_κ$ and $Y_κ$, respectively. We are interested in how $(X_κ,Y_κ)$ "appears" to an efficient adversary that only views the transcript $T_κ$. We make the following contributions: $\bullet$ We develop new tools to argue about this loose notion and show (modulo some caveats) that for every such protocol $π$, there exists an efficient simulator such that the following holds: on input $T_κ$, the simulator outputs a pair $(X'_κ,Y'_κ)$ such that $(X'_κ,Y'_κ,T_κ)$ is (somewhat) computationally indistinguishable from $(X_κ,Y_κ,T_κ)$. $\bullet$ We use these tools to prove the following dichotomy theorem: every such protocol $π$ is: - either uncorrelated -- it is (somewhat) indistinguishable from an efficient protocol whose parties interact to produce $T_κ$, but then choose their outputs independently from some product distribution (that is determined in poly-time from $T_κ$), - or, the protocol implies a key-agreement protocol (for infinitely many $κ$'s). Uncorrelated protocols are uninteresting from a cryptographic viewpoint, as the correlation between outputs is (computationally) trivial. Our dichotomy shows that every protocol is either completely uninteresting or implies key-agreement. $\bullet$ We use the above dichotomy to make progress on open problems on minimal cryptographic assumptions required for differentially private mechanisms for the XOR function. $\bullet$ A subsequent work of Haitner et al. uses the above dichotomy to makes progress on a longstanding open question regarding the complexity of fair two-party coin-flipping protocols.

cs.CR