# Information Security and Cryptography Research Group

## A Hardcore Lemma for Computational Indistinguishability: Security Amplification for Arbitrarily Weak PRGs with Optimal Stretch

### Ueli Maurer and Stefano Tessaro

Theory of Cryptography — TCC 2010, Lecture Notes in Computer Science, Springer-Verlag, vol. 5978, pp. 237–254, Feb 2010.

It is well known that two random variables $X$ and $Y$ with the same range can be viewed as being equal (in a well-defined sense) with probability $1-d(X,Y)$, where $d(X,Y)$ is their statistical distance, which in turn is equal to the best distinguishing advantage for $X$ and $Y$. In other words, if the best distinguishing advantage for $X$ and $Y$ is $\epsilon$, then with probability $1-\epsilon$ they are completely indistinguishable. This statement, which can be seen as an information-theoretic version of a hardcore lemma, is for example very useful for proving indistinguishability amplification results.

In this paper we prove the computational version of such a hardcore lemma, thereby extending the concept of hardcore sets from the context of hard computational problems (like inverting a one-way function) to the context of computational indistinguishability. This paradigm promises to have many applications in cryptography and complexity theory. It is proven both in a non-uniform and a uniform setting. For example, for a weak pseudorandom generator (PRG) for which the (computational) distinguishing advantage is known to be bounded by $\epsilon$ (e.g. $\epsilon=\frac{1}{2}$), one can define an event on the seed of the PRG which has probability at least $1-\epsilon$ and such that, conditioned on the event, the output of the PRG is essentially indistinguishable from a string with almost maximal min-entropy, namely $\log(1/(1-\epsilon))$ less than its length. As an application, we show an optimally efficient construction for converting a weak PRG for any $\epsilon < 1$ into a strong PRG by proving that the intuitive construction of applying an extractor to an appropriate number of independent weak PRG outputs yields a strong PRG. This improves strongly over the best previous construction for security amplification of PRGs (the XOR of several weak PRG outputs) which does not work for $\epsilon \geq \frac{1}{2}$ and also requires the seed of the constructed strong PRG to be very long.

## BibTeX Citation

@inproceedings{MauTes10,
author       = {Ueli Maurer and Stefano Tessaro},
title        = {A Hardcore Lemma for Computational   Indistinguishability: Security Amplification for Arbitrarily Weak PRGs with Optimal Stretch},
editor       = {Daniele Micciancio},
booktitle    = {Theory of Cryptography --- TCC 2010},
pages        = {237--254},
series       = {Lecture Notes in Computer Science},
volume       = {5978},
year         = {2010},
month        = {2},
publisher    = {Springer-Verlag},
}