Randomness extractor

Formal definition of extractors

The min-entropy of a distribution X (denoted H ∞ ( X ) ), is the largest real number k such that Pr [ X = x ] ≤ 2 − k for every x in the range of X . In essence, this measures how likely X is to take its most likely value, giving a worst-case bound on how random X appears. Letting U ℓ denote the uniform distribution over { 0 , 1 } ℓ , clearly H ∞ ( U ℓ ) = ℓ .

For an n-bit distribution X with min-entropy k, we say that X is an ( n , k ) distribution.

Definition (Extractor): (k, ε)-extractor

Let Ext : { 0 , 1 } n × { 0 , 1 } d → { 0 , 1 } m be a function that takes as input a sample from an ( n , k ) distribution X and a d-bit seed from U d , and outputs an m-bit string. Ext is a (k, ε)-extractor, if for all ( n , k ) distributions X , the output distribution of Ext is ε-close to U m .

In the above definition, ε-close refers to statistical distance.

Intuitively, an extractor takes a weakly random n-bit input and a short, uniformly random seed and produces an m-bit output that looks uniformly random. The aim is to have a low d (i.e. to use as little uniform randomness as possible) and as high an m as possible (i.e. to get out as many close-to-random bits of output as we can).

Strong extractors

An extractor is strong if concatenating the seed with the extractor's output yields a distribution that is still close to uniform.

Definition (Strong Extractor): A ( k , ϵ ) -strong extractor is a function

such that for every ( n , k ) distribution X the distribution U d ∘ Ext ( X , U d ) (the two copies of U d denote the same random variable) is ϵ -close to the uniform distribution on { 0 , 1 } m + d .

Explicit extractors

Using the probabilistic method, it can be shown that there exists a (k, ε)-extractor, i.e. that the construction is possible. However, it is usually not enough merely to show that an extractor exists. An explicit construction is needed, which is given as follows:

Definition (Explicit Extractor): For functions k(n), ε(n), d(n), m(n) a family Ext = {Ext_n} of functions

is an explicit (k, ε)-extractor, if Ext(x, y) can be computed in polynomial time (in its input length) and for every n, Ext_n is a (k(n), ε(n))-extractor.

By the probabilistic method, it can be shown that there exists a (k, ε)-extractor with seed length

and output length

Dispersers

A variant of the randomness extractor with weaker properties is the disperser.

Randomness extractors in cryptography

One of the most important aspects of cryptography is random key generation. It is often necessary to generate secret and random keys from sources that are semi-secret or which may be compromised to some degree. By taking a single, short (and secret) random key as a source, an extractor can be used to generate a longer pseudo-random key, which then can be used for public key encryption. More specifically, when a strong extractor is used its output will appear be uniformly random, even to someone who sees part (but not all) of the source. For example, if the source is known but the seed is not known (or vice versa). This property of extractors is particularly useful in what is commonly called Exposure-Resilient cryptography in which the desired extractor is used as an Exposure-Resilient Function (ERF). Exposure-Resilient cryptography takes into account that the fact that it is difficult to keep secret the initial exchange of data which often takes place during the initialization of an encryption application e.g., the sender of encrypted information has to provide the receivers with information which is required for decryption.

The following paragraphs define and establish an important relationship between two kinds of ERF--k-ERF and k-APRF--which are useful in Exposure-Resilient cryptography.

Definition (k-ERF): An adaptive k-ERF is a function f where, for a random input r , when a computationally unbounded adversary A can adaptively read all of r except for k bits, | Pr { A r ( f ( r ) ) = 1 } − Pr { A r ( R ) = 1 } | ≤ ϵ ( n ) for some negligible function ϵ ( n ) (defined below).

The goal is to construct an adaptive ERF whose output is highly random and uniformly distributed. But a stronger condition is often needed in which every output occurs with almost uniform probability. For this purpose Almost-Perfect Resilient Functions (APRF) are used. The definition of an APRF is as follows:

Definition (k-APRF): A k = k ( n ) APRF is a function f where, for any setting of n − k bits of the input r to any fixed values, the probability vector p of the output f ( r ) over the random choices for the k remaining bits satisfies | p i − 2 − m | < 2 − m ϵ ( n ) for all i and for some negligible function ϵ ( n ) .

Kamp and Zuckerman have proved a theorem stating that if a function f is a k-APRF, then f is also a k-ERF. More specifically, any extractor having sufficiently small error and taking as input an oblivious, bit-fixing source is also an APRF and therefore also a k-ERF. A more specific extractor is expressed in this lemma:

Lemma: Any 2 − m ϵ ( n ) -extractor f : { 0 , 1 } n → { 0 , 1 } m for the set of ( n , k ) oblivious bit-fixing sources, where ϵ ( n ) is negligible, is also a k-APRF.

This lemma is proved by Kamp and Zuckerman. The lemma is proved by examining the distance from uniform of the output, which in a 2 − m ϵ ( n ) -extractor obviously is at most 2 − m ϵ ( n ) , which satisfies the condition of the APRF.

The lemma leads to the following theorem, stating that there in fact exists a k-APRF function as described:

Theorem (existence): For any positive constant γ ≤ 1 2 , there exists an explicit k-APRF f : { 0 , 1 } n → { 0 , 1 } m , computable in a linear number of arithmetic operations on m -bit strings, with m = Ω ( n 2 γ ) and k = n 1 2 + γ .

Definition (negligible function): In the proof of this theorem, we need a definition of a negligible function. A function ϵ ( n ) is defined as being negligible if ϵ ( n ) = O ( 1 n c ) for all constants c .

Proof: Consider the following ϵ -extractor: The function f is an extractor for the set of ( n , δ n ) oblivious bit-fixing source: f : { 0 , 1 } n → { 0 , 1 } m . f has m = Ω ( δ 2 n ) , ϵ = 2 − c m and c > 1 .

The proof of this extractor's existence with δ ≤ 1 , as well as the fact that it is computable in linear computing time on the length of m can be found in the paper by Jesse Kamp and David Zuckerman (p. 1240).

That this extractor fulfills the criteria of the lemma is trivially true as ϵ = 2 − c m is a negligible function.

The size of m is:

Since we know δ ≤ 1 then the lower bound on m is dominated by n . In the last step we use the fact that γ ≤ 1 2 which means that the power of n is at most 1 . And since n is a positive integer we know that n 2 γ is at most n .

The value of k is calculated by using the definition of the extractor, where we know:

and by using the value of m we have:

Using this value of m we account for the worst case, where k is on its lower bound. Now by algebraic calculations we get:

Which inserted in the value of k gives

which proves that there exists an explicit k-APRF extractor with the given properties. ◻

Von Neumann extractor

Perhaps the earliest example is due to John von Neumann. His extractor took successive pairs of consecutive bits (non-overlapping) from the input stream. If the two bits matched, no output was generated. If the bits differed, the value of the first bit was output. The Von Neumann extractor can be shown to produce a uniform output even if the distribution of input bits is not uniform so long as each bit has the same probability of being one and there is no correlation between successive bits.

Thus, it takes as input a Bernoulli sequence with p not necessarily equal to 1/2, and outputs a Bernoulli sequence with p = 1 / 2. More generally, it applies to any exchangeable sequence – it only relies on the fact that for any pair, 01 and 10 are equally likely: for independent trials, these have probabilities p ⋅ q = q ⋅ p , while for an exchangeable sequence the probability may be more complicated, but both are equally likely.

Chaos machine

Another approach is to use the output of a chaos machine applied to the input stream. This approach generally relies on properties of chaotic systems. Input bits are pushed to the machine, evolving orbits and trajectories in multiple dynamical systems. Thus, small differences in the input produce very different outputs. Such a machine has a uniform output even if the distribution of input bits is not uniform or has serious flaws, and can therefore use weak entropy sources. Additionally, this scheme allows for increased complexity, quality, and security of the output stream, controlled by specifying three parameters: time cost, memory required, and secret key.

Cryptographic hash function

It is also possible to use a cryptographic hash function as a randomness extractor. However, not every hashing algorithm is suitable for this purpose.

Applications

Randomness extractors are used widely in cryptographic applications, whereby a cryptographic hash function is applied to a high-entropy, but non-uniform source, such as disk drive timing information or keyboard delays, to yield a uniformly random result.

Randomness extractors have played a part in recent developments in quantum cryptography, where photons are used by the randomness extractor to generate secure random bits.[1]

Randomness extraction is also used in some branches of computational complexity theory.

Random extraction is also used to convert data to a simple random sample, which is normally distributed, and independent, which is desired by statistics.