Physical Randomness Extractor - PowerPoint Presentation

Slide1

Physical Randomness Extractor

Feb 18th, 2014IQI Seminar, Caltech

Kai-Min Chung

IIS, Sinica,Taiwan

Yaoyun

Shi University of Michigan

Xiaodi Wu

MIT/UC Berkeley

device

…….

Ext(

x,s

i

)

Ext(x,0)

Decouple

…….

Z

1

Z

i

Z

i+1

Eve

Decouple

…….

…….

x

uniform

-to-all

uniform

-to-deviceSlide2

Randomness is PRECIOUS

Digital security

Randomized algorithms

Scientific simulations

Gambling

Statistics, Samplings,….Slide3

We are not always getting it ….

Heninger

et al. broke the

k

eys of many SSH hosts

b

y exploiting insufficient

randomness.

From the introduction:

“Ultimately the results of our

s

tudy should serve as a wake-up

c

all that

secure random number

g

eneration

continues to be an

u

nsolved problem in important

a

reas of practice.”Slide4

Wish list for Randomness

High quality

close to uniform

small error

Secure

classical/quantum adversary

Large quantity

1 trillion bits/day?

efficiency

Minimum assumptions

least amount of trustSlide5

How can we be sure it’s random?

How could fundamentally unpredictable

events

possible?Slide6

We can’t be sure … without believing first of all its existence

Super-Deterministic World

v.s

.

World with Randomness

we could live in the “Matrix”……Slide7

Assumptions:

Non-deterministic World

(conditional)

min-entropy

CLASSICAL

Solution

x~(

n,k

)

min-entropy: necessary and sufficient

Extract

Almost Uniform

Bits!

Either

Independent

short uniform Seed ~ log(n)

Extractor

Eve

Extractor

a

deterministic

function Ext:

Or

Independent

another min-entropy source

REQUIRES:

Independent

IMPOSSIBILITY:

x~(

n,k

)

Extractor

Eve

deterministic

extraction

impossible even for

Santha-Vazirani

(SV)

source

SV source

:

x

1

,x

2

,…,

x

n

,…,each bit x

i

has a bounded bias conditioned on previous bits

Highly

random:

linear

min-entropy

Independence Between Sources

hard to

enforce

/

verify

Slide8

Assumptions:

Non-deterministic World

(conditional)

min-entropy

QUANTUM

Solution (Trust-based)

Independence Between Sources

hard to

enforce

/ verify Quantum Mechanicsthe principle of the nature

IDQ/ Swiss

Goverment

Trust-based solutions are

simpleSlide9

Assumptions:

Non-deterministic World

(conditional)

min-entropy

QUANTUM

Solution (No-Trust)

Independence Between Sources

hard to

enforce

/ verify Quantum Mechanicsthe principle of the nature

IDQ/ Swiss Goverment

Trust-based solutions are simple

We, classical human being, only trust classical operations!

Can classical operations verify quantum behavior?

Well, this is not new……

Device-independent Quantum Cryptography

The Central Rule:

T

rust

classical operations

only. Q

uantum operations must be verified through classical means.Origins in the 90’s

[Mayers-Yao’98]Develop rapidly very recently!Slide10

Assumptions:

Non-deterministic World

(conditional)

min-entropy

Independence Between Sources

hard to

enforce / verify

Quantum Mechanics

the principle of the nature

IDQ/ Swiss GovermentTrust-based solutions are simple

Communication impossible

A

B

QUANTUM

Solution: How?

Similar to

Bell-Test

: separate

quantum

from

classical

!

1)

Non-locality

+ Statistical Test: enforce quantum behavior2

) Entanglement Monogamy: against quantum adversaries Successful Examples: (incomplete list)

QKD [BHK05, MRC+06, MPA, VV13, BCK13,

RUV13, MS13]Randomness Expansion [PAM+10, PM11, FGS11, VV12, CVY13, MS13, CY13]Free-randomness (SV) Amplification [CR12, GMdlT+12, MP13

,…]Quantum Bit Commitment & Coin Flipping [SCA+11]Quantum Computation Delegation [RUV13, MacK13]

Spatial Separationnot an assumption; verifiable

Special RelativityMINIMUM ASSUMPTIONS

another principle of the natureSlide11

Parameters:

Physical Randomness Extractors: Model

Adversary

d

eterministic

& classical

min-entropy

source

almost

perfect

randomness

Devices

Devices

Adversary:

all powerful quantum

Prepares devices

No communication

Devices:

spatially separated

User:

classical/deterministic

can

restrict communication among device components

only classical operations

Min-entropy

source

quality varies

Accept/Reject

options

Acc

: output uniform bits

Rej

: catch cheating devices

Source:

Efficiency:

Errors:

conditional

completeness

error

(honest devices)

soundness

error

(cheating devices)

output

quality

(

dist

to uniform)

running time T

o

utput length N

# devices DSlide12

Parameters:

Physical Randomness Extractors: Goals

Adversary

d

eterministic

& classical

min-entropy

source

almost

perfect

randomness

Devices

Devices

Source:

Efficiency:

Errors:

conditional

completeness

error

(honest devices)

soundness

error

(cheating devices)

output

quality

(

dist

to uniform)

running time T

o

utput length N

# devices D

BASIC

Security

:

quantum

2.

Arbitrary

min-entropy

source

3. Reasonable errors

e.g.,

,

4. Reasonable quality

,

good for most uses

e.g.,

5. Output length N at least

6. Efficiency: running time polynomial in N

e.g.,

 Slide13

Cryptographic Security

i.e.,

Optimal Running Time

i.e

,

note that

Optimal Length N:

exponential or unbounded?

note:

conflict

between 1 and 3

4. Robustness

critical for realization

allow constant noise (honest devices)

Resource Efficiency

i.e. # devices D, or

entanglement usage E

Parameters:

Physical Randomness Extractors: Goals

Adversary

d

eterministic

& classical

min-entropy

source

almost

perfect

randomness

Devices

Devices

Source:

Efficiency:

Errors:

conditional

completeness

error

(honest devices)

soundness

error

(cheating devices)

output

quality

(

dist

to uniform)

running time T

o

utput length N

# devices D

BASIC

PREMIUM

Entanglement UsageSlide14

Main Results:

Goal List

:

BASIC

PREMIUM

Quantum Security

a

ny min-entropy

good

output

Polynomial time

negligible

optimal

optimal

robustness

const

# devices

Main Theorem:

there exist

physical randomness extractors

that achieve

all

basic goals

and a subset of

premium goals

with any

random-to-device

source.

NOTE:

random-to-

device

:

v.s.

random-to-

all

:

Instantiation 1:

there exist a

physical randomness extractor

that extracts

arbitrarily long

uniform bits against any

quantum

adversary

from an arbitrary

random-to-device

min-entropy

source. Moreover, this extractor is

robust

and makes use of a

constant number

of devices and runs in

optimal running time

.

~

constant,

good for

most

applications.

 Slide15

Main Results:

Goal List

:

BASIC

PREMIUM

Quantum Security

a

ny min-entropy

good

output

Polynomial time

negligible

optimal

optimal

robustness

const

# devices

Main Theorem:

there exist

physical randomness extractors

that achieve

all

basic goals

and a subset of

premium goals

with any

random-to-device

source.

NOTE:

random-to-

device

:

v.s.

random-to-

all

:

Instantiation 2:

there exist a

physical randomness extractor

that extracts

N

uniform bits against any

quantum

adversary

from any

random-to-device

source of

poly-log(N)

conditional

min-entropy

. Moreover, this extractor is

robust

and makes use of

poly(N)

devices and runs in

poly(N)quasi-poly(1/

.

~

negligible in N,

good for

cryptographic

applications.

 Slide16

Why physicists should pay attention?

Super-deterministic

world

vs

Uniformly random world

God does not play dice~~~~ A.E.

Do

completely unpredictable (

uniformly random

) events exist in the nature? A Possible Dichotomy Theorem:

Weak "uncertainty" (e.g., an event happen w.p. 1%) against environment

Full "uncertainty“(uniformly random)

against environment

d

eterministic operationno introduction

of randomnessGet rid of

SV source assumption [CR12]: a restricted version of weak uncertainty.

Nature could be more tricky!

a

pplication to close the “free-choice” loophole of Bell-Tests!

If the world is not deterministic, then can faithfully create

uniformly random eventsSlide17
Slide18

Challenges from

arbitrary

min-entropy source

x~(

n,k

)

Sanity Check:

How to certify super-classical behavior using non-uniform/low quality randomness?

Well, most known examples use

uniform

bits, e.g., CHSH, randomness expansionand quantum/classical separation sensitive to input distribution

Known Examples: Santha-Vazirani source [CR12, GMdlT13+…]

SV source:

x1,x2,…,

xn,…,each bit x

i has a bounded bias conditioned on previous bitsHighly

random: linear min-entropy

for CHSH game, if the input is only uniform over {(0,0), (0,1), (1,0)},

then

NO

quantum/classical separation!

still with very large min-entropy, but not with full support!Proof Idea: brute force analysis

 protocol non-constructive, inefficient, non-robustMoreover, still rely on SV being very “close”

to uniform!Slide19

Improve the

quality

of the source

Somewhere Random Source (SR source):

A random object divided into blocks. There exists

one

block (marginal) that is uniformly random.

Let Ext:

be a strong seeded

extractors and

be any (

k,n

) source.

Let

X :

any

(

n,k

)

sourceEXT(X,s1)

EXT(X,s2)

EXT(X,s3)

EXT(X,S)EXT(X,s2d)

…….…….

-close to

SR

source

 Device

Device

quantum-proof

s.t.,

, no idea which

it is……

random-to-device

uniform-to-device

Can we

pick up

the right

by

?

Unfortunately

NO

! because of

correlations

!

locally !Slide20

Quantum Aid: certify fresh uniform bits

EXT(X,

)

EXT(X,

)

XOR fails because of

correlations

!

in fact,

IMPOSSBILE

by any classical operation!

Decouple

Decouple

Quantum Randomness Decoupling

Input X: only

uniform to device

, any correlated otherwise

Output Z:

uniform to all

, even conditioned on X

Key Observations:

1)

known

randomness expansion

protocols serve as “

quantum randomness decoupling

” except they require

uniform-to-all

seeds.

Quality of source again!

2) Security lift by “

Equivalence Lemma

”: any such protocols that work with

uniform-to-all

seeds also work with just

uniform-to-device

seeds.

Fundamental Principle for such compositions!

uniform-to-deviceSlide21

The

“Equivalence”

Lemma

Statement

:

uniform-to-all seeds can be replaced by

uniform-to-device seeds for randomness expansion protocols.

Seeds

D

evice

Environment

uniform-to-all

seeds :

PROTOCOL

a

ny such protocols!

uniform-to-device

seeds : only

A

fundamental principle

of studying composition in device-independent protocols. Already find

a powerful application in “unbounded expansion”.

to-device -> to-all

Attack

to-device

Proof Sketch:

(to-device -> to-all)-1

Assume an attack (to-device seeds)Construct “to-device -> to- all”Require: invertible & commute with ProtocolFind contradiction!uniform-to-deviceuniform-to-allSUCCESS

FAIL

(to-device -> to-all)

-1

Contradiction!Slide22

The

“Equivalence”

Lemma: Applications

Example: Unbounded Expansion with const # devices

Expansion 1

Expansion 2

A simple proposal

[

FGS11, folklore?]

Hard to Analyze!

Reason:

uniform-to-all

seeds vs

uniform-to-device

seeds again!

t

he output of a device is

correlated

with that device, thus

not uniform-to-all

.

Coudron

-Yuen uses heavy machinery [RUV13] to achieve the same goal (called “Input Security”)

lead to a non-robust version of unbounded expansionDIRECTLY

implied by the “Equivalence Lemma”, lead to a robust version of unbounded expansion [Miller-Shi]Slide23

Put things together

device

…….

Ext(

x,s

i

)

Ext(x,0)

Ext(x,s

2^d

)

Decouple

…….

Z

1

Z

i

Z

i+1

Eve

Decouple

Decouple

…….

…….

x

random-to-device

uniform

-to-all

uniform

-to-device

Instantiations:

Extractor

Trevisan’s

extractors

(

quantum-proof

)

Instantiation 1:

Instantiation 2:

Decouple

Decouple

Miller-Shi unbounded

(

robust

)

Coudron

-Yuen unbounded

(

non-robust

)

Vazirani-Vidick +tweak

(

non-robust,

)

Miller-Shi exponential

(

robust, crypt. secure

)

Vazirani-Vidick

exponential

(

non-robust

)Slide24

Where is the randomness from?

a

personal view

Adversary

d

eterministic

& classical

min-entropy

source

almost

perfect

randomness

Devices

Devices

Is it from the source?

UNLIKELY!

output

input

Is it from the EPRs?

Not Sure! Seems NO!

Nonlocality

helps certification!

New View:

Entanglement and min-entropy

source just to help certify:

Or slightly more complicated!

s

ource

& entanglementSlide25

Summary

Open Questions

We propose “

Physical Randomness Extractors

” based on

MINIMUM ASSUMPTIONS

Main Theorem:

there exist

physical randomness extractors

that achieve

all basic goals and a subset of premium goals with any

random-to-device source.

Instantiation 2: improve the dependence on

, achieve more goals in the premium list.Where is the randomness from?How much entanglement is necessary then?

 Slide26

Thank You!

Q & A