Sebery J.Cryptography.An introduction to computer security.1989

5 PSEUDORANDOMNESS

Most physical processes expose some random behaviour. A good example of such random behaviour is a noise in telecommunication channels. A great irony is that when there is a need for a source of random bits or numbers, then the ever-present randomness is in a short supply. Generation of a large volume of random bits is usually very expensive and requires special hardware. Also the parameters of truly random generators can uctuate, so they need to be calibrated and tested from time to time. The major drawback of truly random generators is the lack of reproducibility of yielded bits and numbers. The reproducibility is crucial in simulations where there is a need to repeat the same experiments many times. It is also necessary in some cryptographic applications when, for instance, two communicating parties want to generate identical sequences from a shared secret (and short) key. From a cryptographic point of view, we are interested in deterministic algorithms that eÆciently generate strings of bits and that cannot be distinguished from truly random ones. Readers interested in the subject are referred to Goldreich [206].

5.1 Number Generators

Knuth [283] devotes the whole of Chapter 3 on generation of \random" numbers. Let us review some of the classical solutions for number generation. The most popular solution applies the linear congruential method which generates a sequence of integers x1; x2; : : : according to the congruence

needs the so-called seed x0 which provides a starting point. Note that the sequence of integers is periodic. The choice of the modulus N and the multiplier a forces the length of the period. The maximum length of the period is N.

222 5 PSEUDORANDOMNESS

Consider an instance of the linear congruential generator for N = 7, a = 3, and c = 4. If the starting point is x0 = 2, then we get the following sequence of integers x1 = 3, x2 = 6, x3 = 1, x4 = 0, x5 = 4, and x6 = 2.

The quadratic congruential method is a generalization of the linear one and can be described by

The maximum length of the period of the sequence is N.

There is a class of number generators based on linear feedback shift registers [110, 217]. These generators can be seen as a far fetched generalization of congruential generators. They o er an eÆcient method of number generation, which can be a very attractive alternative for some applications. Unfortunately, numerous examples show that generators based on linear feedback shift registers are inherently insecure [213, 345].

Observe that the randomness of the sequences obtained is measured by statistical tests. We say that a number generator passes a statistical test if it behaves in the same way as a truly random generator. On the other hand, if a number generator fails a statistical test, the test can be used to distinguish the sequence generated from a truly random one. From a cryptographic point of view, the security of number generators could be determined by the computational eÆciency of an algorithm that enables an opponent, Oscar, to nd out the seed and other secret parameters from an observed output sequence. There is an intimate relation between the existence of an eÆcient statistical test (which can be used to distinguishes a generator from a truly random one) and the existence of a cryptographic attack that breaks the generator. Informally we can formulate the following proposition:

If a generator G is polynomially indistinguishable from a truly random generator, then there is no eÆcient algorithm that breaks the generator.

A generator is polynomially indistinguishable if there is no eÆcient statistical test which can be used to tell apart G from a truly random generator. The proposition can be justi ed using the contradiction. Assume that there is an eÆcient algorithm that breaks the generator. Now we can construct a simple test to distinguish the generator from a truly random one. To do that we take a long enough output sequence of the tested generator and feed it to our algorithm. The algorithm returns the parameters of the generator. We take the computed

224 5 PSEUDORANDOMNESS

ENSEMBLE ENSEMBLE

Which is it ?

Fig. 5.1. Illustration of the distinguishability problem

Consider Figure 5.2 with two ensembles. Assume that we would like to identify which ensemble is currently used. We can observe the output of the ensemble. A witness algorithm can be used to identify the ensemble. Clearly, the witness algorithm can process only a polynomial samples of output elements as it has to make its decision in polynomial time. Also its decisions may not always be correct but if it is run for a long enough 2 Sn`, there is a signi cant (larger than ") di erence between the probabilities j PDn (E1) PDn (E2) j. If this di erence persists for in nite sequence of n, we say that the witness algorithm distinguishes the two ensembles.

Consider two ensembles over the space Sn = f1; 2; : : : ; 2ng:

1

E1 = fSn; fp1(x) = 2n j xx2 Sng j n 2 Ng

E2 = fSn; fp2(x) = 2n 1(2n + 1) j x 2 Sng j n 2 Ng

Given a polynomial size sequence generated by one of the two ensembles (either E1 or E2). Assume that we have a probabilistic polynomial time algorithm D that can be used to identify the ensemble used to generate . Consider the following two probabilities:

PDn (E1) = X

2Sn`

PDn (E2) = X p2( )p(Dn( ) = 1)

2Sn`

Assuming that i 2 Sn are independent we can compute the probabilities p1( ) = p1( 1) p1( `) and p2( ) = p2( 1) p2( `) where = ( 1; : : : ; `). Their di erence is

j PDn (E1) PDn (E2) j=

X j p1( 1) p1( `) p2( 1 ) p2( `) j p(Dn( ) = 1):

2Sn`

Note that the di erence

Note that goes through all possible sequences of the set Sn` (there are exponentially many such sequences). As the witness algorithm D is polynomially bounded, it means that for any n it can investigate a polynomial sample of the whole space Sn` . Denote the sample by S (n) where the polynomial (n) indicates the size of the sample for a given n. Therefore Inequality (5.5) becomes

The ratio 2(n`n) can be made as small as required by the selection of a big enough n (see our discussion in Section 2.3.2). So the two ensembles are polynomially indistinguishable as Inequality (5.6) holds for any witness algorithm D. This kind of indistinguishability is also called statistical as it does not depend upon any number theoretic assumptions. In fact, two ensembles are statistically indistinguishable if their probability distributions converge. The statistical indistinguishability implies the polynomial indistinguishability but not vice versa.

De nition 7. Two ensembles are said to be polynomially indistinguishable if there exists no distinguisher for them.

To denote that two ensembles E1 , E2 are polynomially indistinguishable, we simply write E1 E2. It is easy to verify that the polynomial indistinguishability is an equivalence relation, i.e. it is re exive, symmetric and transitive. The relation is re exive E E as there is no witness algorithm that distinguishes two identical ensembles. It is symmetric as E1 E2 ) E2 E1. To show that

226 5 PSEUDORANDOMNESS

the relation is transitive, assume that we have three ensembles E1, E2, E3 and

(1) E1 E2 and (2) E2 E3. Now we have to prove that E1 E3. From the rst two assumptions, we know that for any probabilistic polynomial time algorithm

D

jPDn (E1) PDn (E2) j "1

and

jPDn (E2) PDn (E3) j "2;

respectively. Take

jPDn (E1) PDn (E3) j = j PDn (E1 ) PDn (E2) + PDn (E2) PDn (E3) j

j PDn (E1 ) PDn (E2) j + j PDn (E2) PDn (E3) j

"1 + "2 = ":

This proves our claim.

De nition 8. The ensemble E = f n; Pn j n 2 Ng which generates binary strings of length n (the set of all n-bit strings is n) with the uniform probability distributions Pn is said to be the reference ensemble or truly random generator

GR.

There is a class of ensembles that are polynomially indistinguishable from the truly random generator GR. As a matter of fact, any member of this class can be used as a reference ensemble.

5.3 Pseudorandom Bit Generators

Bit generators are often de ned as deterministic algorithms which produce long bit sequences from random and short seeds [46, 541].

De nition 9. Given an ensemble E = f n; Pn j n 2 Ng. A bit generator BG over E is a deterministic polynomial time function g that, upon receiving an n-bit input as a seed from E, extends the seed into a sequence of n` bits where ` 2 N . The seed is selected randomly and uniformly from n.

A bit generator consists of two layers. The probabilistic one is given by the uniform ensemble E = f n; Pn j n 2 Ng used to produce the seed. The deterministic one de ned by the function g which extends an n-bit seed to n`-bit output string. The generator induces a new ensemble

Eg = f n` ; Pg j n 2 Ng;

which re ects both the probabilistic and deterministic nature of the bit generator. We simplify the notation of an ensemble to Eg if the set and the probability distribution can be derived from the de nition of the generator.

De nition 10. A bit generator g over E is pseudorandom if for a large enough n and for any probabilistic polynomial time (witness) algorithm D

for any polynomial (n) and for any suÆciently large n.

Pseudorandom bit generators (PBG) cannot be distinguished from a truly random generator GR by any polynomially bounded attacker. They can be used as a secure substitute of a truly random generator whenever there is a need. But how can PBGs be constructed?

The natural candidates for implementation of PBGs are problems from complexity classes higher than P. The con rmation of this came when Levin [303] proved the following important result.

Theorem 19. A pseudorandom bit generator exists if and only if there exists a one-way function.

The problem of the PBG construction has been converted into the problem ofnding a one-way function. Informally, a one-way function is \easy" (in polynomial time) to compute but \hard" to invert. Now we are going to describe some constructions for PBG. Evidently, the generators are pseudorandom under the assumption that the underlying function is one-way. That is why all the constructions are conditionally secure.

5.3.1 RSA Pseudorandom Bit Generator

Alexi, Chor, Goldreich, and Schnorr [5] used the RSA exponentiation as a oneway function.

RSA generator { outputs pseudorandom bits.

Initialization: For an instance n, select at random an instance of exponentiation function g 2R EN;e where N is the product of two random primes p; q 2R

228 5 PSEUDORANDOMNESS

[2n=2 1; 2n=2] and e 2R [1; '(N)] such that gcd (e; '(N)) = 1. The seed x0 2R [1; N]. Recall that 2R S means that is selected randomly and uniformly from S.

Expansion: For an input sequence xi (i = 0; 1; : : : ; n`), generate xi+1 = g(xi) xei mod N:

Output: For i = 1; 2; : : :, extract `(n) least signi cant bits of xi, where `(n) is a polynomial in n. So the output is yi = xic`(n).

Theorem 20. (Alexi et al. [5]) If the RSA exponentiation is one-way and `(n) = O(log n), then the following ensembles are polynomially indistinguishable:

{ g; x; y = g(x)c`(n) where g 2R EN;e, x 2R [1; N]

{ (g; r; z) where g 2R EN;e, r 2R [1; N], and z 2R `(n)

Clearly, for a polynomially bounded attacker output bits yi are indistinguishable from truly random bits zi 2R `(n). The conclusion from this theorem can be formulated as follows:

Corollary 4. (Alexi et al, [5]) If the RSA exponentiation is one-way and `(n) = O(log n), then the sequence y1; : : : ; yn` is pseudorandom.

There are two interesting issues for the RSA generator. The rst one is: how to extract more bits per iteration and make the generator more eÆcient [184]? The second issue is: how to design an RSA generator so the extracted bits are not used in further generation? These issues were studied by Micali and Schnorr in [344].

Consider an instance of the RSA generator for a small n = 20. The two

If we decide to extract 4 least signi cant bits from each number xi (log2 20 > 4), then the rst 20 bits of the output is:

1001 0010 0000 1101 0111

5.3.2 BBS Pseudorandom Bit Generator

Blum, Blum, and Shub [44] studied two bit generators. One of them based on squaring is pseudorandom provided the quadratic residuosity problem is intractable. The generator is further referred as to the BBS generator.

BBS generator { outputs pseudorandom bits.

Initialization: For an instance n, select at random two primes p; q 2R [2n=2 1; 2n=2] such that p q 3 mod 4. The seed x0 2R [1; N] such that its Jacobi symbols xp0 = xq0 = 1 (so x0 is a quadratic residue).

Expansion: For an input sequence xi (i = 0; 1; : : : ; n`), generate xi+1 x2i mod N:

Output: For i = 1; 2; : : : ; n`, extract the least signi cant bit (the parity) of xi i.e.

yi = xi mod 2:

First we investigate some algebraic properties of Jacobi symbol and the BBS generator.

Lemma 11. Let N be a product of two primes p; q such that p q 3 mod 4. Then Na = Na .

Proof. From the de nition of the Jacobi symbol we have

Primes p; q can be represented as p = 4 + 3 and q = 4 + 3 for some integers

; so

230 5 PSEUDORANDOMNESS

Lemma 12. Let N be a product of two primes p; q such that p q 3 mod 4. Then each quadratic residue modulo N has exactly one square root which is a quadratic residue.

Proof. Squaring x2 mod N where N is a product of two primes, has four roots. To nd them, it is enough to nd roots of two congruences (x2 mod p) and (x2 mod q). Each congruence has two solutions. Let them be a and b for therst and the second congruence, respectively. The Chinese Remainder Theorem allows to combine them giving the four possible roots: r1 = (a mod p; b mod q),

of factors of N and a generated xi, allows to identify the unique predecessor xi 1 (which is also a quadratic residue). If the factorization of N is unknown, there are two possible roots, each of which generates a di erent output bit.

The set of quadratic residues is

ZNQ+ = fx 2 ZN j xp = xq = 1g

and the set

ZNQ = fx 2 ZN j xp = xq = 1g:

The set ZNQ = ZNQ+ [ZNQ is the set of all integers in ZN whose Jacobi symbols with respect to N are equal to 1. The cardinality of ZNQ is '(2N) . Both sets ZNQ+ and ZNQ are of the same size so their cardinality is '(4N) .