High-entropy High-entropy random selection random selection

protocolsprotocolsMichalMichal Koucký Koucký

(Institute of Mathematics, Prague)(Institute of Mathematics, Prague)

Harry Buhrman, Matthias Christandl, Harry Buhrman, Matthias Christandl, Zvi Lotker, Boaz Patt-Shamir, Zvi Lotker, Boaz Patt-Shamir,

KoliaVereshchaginKoliaVereshchagin

2

Random string selection:Random string selection:

Alice Alice BobBob

Goal: Goal: Alice and Bob want to agree on a Alice and Bob want to agree on a random random string string rr..

3

Goal: Goal: Alice and Bob want to agree on a Alice and Bob want to agree on a random random string string rr..

→→ Measure of randomness:Measure of randomness: Shannon Shannon entropyentropy

H( H( RR ) = - ) = - rr Pr[ Pr[RR = = rr ] ∙ log Pr[ ] ∙ log Pr[ RR = = rr ] ]

4

Example:Example:

random random rr11rr22 … … rrnn/2/2

Alice Alice

random random rrnn/2+1/2+1 … … rrnn

BobBob

→→ output output rr = = rr11rr22 … … rrnn

H( H( R R ) = ) = nn if Alice and Bob follow the if Alice and Bob follow the protocol.protocol.

H( H( R R ) ) nn/2/2 if one of them if one of them cheatscheats..

5

Main results:Main results: Random selection protocol that Random selection protocol that

guaranteesguarantees H( H( RR ) ) nn – O(1)– O(1) even if even if one of the parties cheats. This protocol one of the parties cheats. This protocol runs in log* runs in log* n n rounds and communicates rounds and communicates O( O( n n 2 2 ).).

Three-round protocol that guarantees Three-round protocol that guarantees H( H( R R ) ) ¾ ¾ n n and communicates O( and communicates O( n n ) ) bits.bits.

6

Previous work:Previous work: Different variantsDifferent variants

random selection protocol [GGL’95, SV’05, random selection protocol [GGL’95, SV’05, GVZ’06]GVZ’06]

collective coin flipping [B’82, Y’86, B-OL’89, collective coin flipping [B’82, Y’86, B-OL’89, AN’90, …]AN’90, …]

leader selection [AN’90,…]leader selection [AN’90,…] fault-tolerantfault-tolerant computation [GGL’95] computation [GGL’95] multiple-parties protocols [AN’90,…]multiple-parties protocols [AN’90,…] quantum protocols [ABDR’04]quantum protocols [ABDR’04]

different measuresdifferent measures statistical distance from uniform distributionstatistical distance from uniform distribution entropyentropy

7

H( H( RR ) ) nn – O(1) – O(1) ((, log, log-1-1 1/ 1/)-resilience.)-resilience.O( log* O( log* nn )-rounds, O( )-rounds, O( n n 2 2 )-communication.)-communication.

[GGL] [GGL] ((, , )-resilience, )-resilience, O( O( n n 2 2 )-rounds, O( )-rounds, O( n n 2 2 )-communication.)-communication.

[SV] [SV] ((, , ++)-resilience, )-resilience, O( log* O( log* nn )-rounds, O( )-rounds, O( n n 2 2 )-communication.)-communication.

[GVZ] [GVZ] ((, , )-resilience)-resilienceO( log* O( log* nn )-rounds, O( )-rounds, O( n n )-communication.)-communication.

BB

{0,1{0,1}}nn

((,,)-resilience:)-resilience:

BB; |; |BB|| 22nn

Pr[Pr[rr BB] ]

8

Our basic protocol:Our basic protocol:

random random xx11, …, , …, xxnn {0,1{0,1}}nn

Alice Alice random random yy {0,1 {0,1}}nn

BobBobrandom random ii {1, …, {1, …, nn}}

→→ output output xxi i yy

H( H( R R ) = ) = nn if Alice and Bob follow the if Alice and Bob follow the protocol.protocol.

H( H( RR ) ) n n – log – log n n if Alice cheats.if Alice cheats.

H( H( RR ) ) n n – O(1)– O(1) if Bob cheats.if Bob cheats.

9

Alice cheats, Bob plays honestly:Alice cheats, Bob plays honestly:

Alice carefully selects Alice carefully selects xx11, …, , …, xxnn

Bob picks a random Bob picks a random yy

for all for all ii and and rr, Pr, Pry y [ [ rr = = xxii y y ] = 2 ] = 2 --nn..

for all for all rr, Pr, Pry y [ [ i i ; ; rr = = xxii y y ] ] nn 2 2 --nn..

H( H( R R ) ) nn – log – log nn . .

H( H( RR ) ) n n – O(1)– O(1) if Bob cheats.if Bob cheats.

10

Iterating our protocolIterating our protocol

xx11, …, , …, xxmm yy11, …, , …, yym’m’ AA B B

ii jjAA BB r’’ r’’ = … = …

r r = = xxii r’ r’ r’ r’ = = yyii r’’r’’

→→ log* log* nn iterationsiterations H( H( R R ) ) nn – 3 – 3 regardless of who regardless of who cheats.cheats.

11

Cost of our protocol:Cost of our protocol:

2 log* 2 log* nn roundsrounds

O( O( n n 2 2 ) bits communicated) bits communicated

Question: Question: How to reduce the amount How to reduce the amount of communication close to linear?of communication close to linear?

12

Generic protocol:Generic protocol:

random random x x {0,1 {0,1}}nn

Alice Alice random random yy {0,1 {0,1}}nn

BobBobrandom random ii {1, …, {1, …, nn}}

→→ output output f f ( ( xx ,, yy ,, ii ))

for some for some ff : {0,1} : {0,1}nn {0,1} {0,1}nn {1, …, {1, …, nn}} → → {0,1}{0,1}nn

W.h.p for a random function W.h.p for a random function f f

H( H( RR ) ) n n – O( log – O( log n n ) ) regardless of regardless of cheating.cheating.

13

Explicit candidate functions:Explicit candidate functions:

x x ii yy rotation of rotation of x ix i-times.-times.

ix ix + + yy xx,, yy FFkk i i FFF F = GF(2= GF(2log log nn ) ) kk = = nn / /

log log nn

ix ix + + yy xx,, y y FF i i H H FFF F = GF(2= GF(2nn ) |) |HH|=|=nn

14

Rotations:Rotations:

For any For any xx and and yy

( ( x x ii yy ) ) ( ( x x jj y y ) = ) = x x i i x x j j = = x Ax Aijij

where where AAijij has rank has rank n n – 1. – 1.

xx random random n n – 1 – 1 H( H( x Ax Aijij ) ) H( H( x x ii yy , , x x jj y y

))

H( H( R R ) ) nn – log – log nn when Alice cheatswhen Alice cheats

H( H( R R ) ) nn /2/2 when Bob cheatswhen Bob cheats

15

¾¾n-n-protocol:protocol:

1.1. Pick one half of the string by A-B-A Pick one half of the string by A-B-A “rotating” protocol and the other one “rotating” protocol and the other one by B-A-B “rotating” protocol, i.e., use by B-A-B “rotating” protocol, i.e., use the asymmetry in the cheating powers.the asymmetry in the cheating powers.

2.2. The “line” protocol The “line” protocol ix ix + + yy , where , where

xx,, yy [GF(2 [GF(2 nn/4/4 )] )]kk and and kk = 4 = 4

→→ analysis related to the problem of analysis related to the problem of KakeyaKakeya..

16

Kakeya Problem:Kakeya Problem:

PP

FFkk

Conj: Conj: PP contains a line in each direction contains a line in each direction ||PP||||FF||k k

( 1( 1– – cc /|/|FF|)|)

17

Open problems:Open problems:

Better analysis of our candidate Better analysis of our candidate functions.functions.

Other candidate functions?Other candidate functions? Multiple parties.Multiple parties.

18

Alice plays honestly, Bob cheats:Alice plays honestly, Bob cheats:

For any For any rr11, , rr2 2 , … , … rrn n , Pr, Prx x [ [ rr11 = = xx11 , … , … rrnn = = xxn n ] = 2 ] = 2 – – nn22

Pr[ Pr[ rr11 = = xx11 y y , … , … rrnn = = xxnn y y ] ] 2 2 n n – – nn22

where where yy is a function of the random is a function of the random xx11, , xx2 2 , , … … xxn n

H( H( xx11 y y , …, , …, xxnn y y ) ) nn 2 2 - - nn

E[[ H( E[[ H( xxii y y ) ]] ) ]] nn – 1 .– 1 .

H( H( RR ) ) n n – O(1)– O(1)