O. Goldreich and A. Wigderson, Tiny families of functions with random properties: a quality-size trade-off for hashing, Proc. 26th ACM Symp. on Theory of Computing, 1994, pp. 574-583.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....poly(n) compute h i (x) Thus, investing enough true randomness, namely the amount needed to select a random member of H, one can extract something statistically close to a truly random string from the randomness in a given distribution X. Much work has been done in developing this area (e.g. [46, 32, 59, 64, 45, 61, 50, 49]) In particular, it turns out that one can extract almost all the randomness in X by investing very few truly random bits (i.e. having small H) We will use the following eciently constructible families of strong extractors developed by [59, 49] Theorem 4 ( 59, 49] For any n, m and such ....

O. Goldreich, A. Wigderson. Tiny Families of Functions with Random Properties: A Quality-Size Trade-o for Hashing. In Electronic Colloquium on Computational Complexity (ECCC), Rechnical Report TR94-002, 1994.

....continuous problems and compare them with a more general randomness. See Blum, Cucker, Shub, Smale [7] Novak ( 17] 18] 19] 21] and Traub, Wo zniakowski [24] The use of random bits for the summation problem and for related problems was studied in Chor, Goldreich [8] Goldreich, Wigderson [9], and Joffe [13] 2 The Summation Problem We are interested in the approximate computation of a mapping S : F R; 1) where F is a class of real valued functions on a set D and S is an arbitrary mapping the solution operator , mapping an input (instance) f 2 F of our numerical problem to ....

....f0; 1; N Gamma 1g. Furthermore, Z k and Z l are independent if and only if gcd(N; k Gamma l) 1: c) The idea behind algorithm A n , to construct pairwise independent indices, was independently found by different authors. See Bakhvalov [4] Chor, Goldreich [8] Goldreich, Wigderson [9], Joffe [13] Sugita, Takanobu [22] and papers mentioned by these authors for more information. Algorithm A n combines the optimality of algorithm A n (optimality in the sense error versus number of function values) with the small amount of randomness of A n . This latter algorithm seems ....

Goldreich, O., Wigderson, A.: Tiny families of functions with random properties: a quality-size trade-off for hashing. Random Structures and Algorithms, 11, 315--343 (1997)

....t local extractor with t = poly(log(1 #) 1 #) It is an interesting open problem, posed in [Gol97] to construct averaging samplers whose sample and randomness complexities are both within a constant factor of optimal. Without the averaging constraint, there are samplers which achieve this [BGG93, GW97, Gol97]. 6.4 Previous Constructions. Some previous constructions of cryptosystems in the bounded storage model can be understood using our approach, namely Theorem 10 together with Theorem 5 (of [Lu02] For example, the cryptosystem of Cachin and Maurer [CM97] amounts to using pairwise independence ....

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size trade-o# for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

....(n= extractor (n= log k) extractor Thm. 2 any k m = k n log(1= log k) extractor n log(1= log k) extractor Above, is an arbitrarily small constant. Figure 1: Summary of our constructions reference min entropy k output length m additional randomness d type [GW97] any k m = k d = O(n k log(1= extractor [Zuc97] k = n) m = 1 )k d = O(log(n= extractor [NT98] any k m = k d = O(log [Ta 98] any k m = k polylog(n) d = O(log(n= disperser [Tre99] any k m = k (n= log k) extractor ultimate goal any k m = k d = O(log(n= extractor ....

....bits. Our extractors use more truly random bits than the extractor of [Zuc97] and the disperser of [Ta 98] but our extractors have the advantage that they work for any min entropy (unlike [Zuc97] and are extractors rather than dispersers (unlike [Ta 98] The disadvantage of the extractors of [GW97] described in Figure 2 is that they only use a small number of truly random bits when the source min entropy k is very close to the input length n (e.g. k = n polylog(n) There are also extractors given in [GW97, SZ98] which extract all of the min entropy, but these use a small number of truly ....

[Article contains additional citation context not shown here]

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A qualitysize trade-o for hashing. Random Structures & Algorithms, 11(4):315-343, 1997.

.... by using almost universal hash functions based on almost k wise independent random variables that can be constructed efficiently [AGHP92] Such functions g : X Y can be described with about 5 log jYj instead of log jX j bits and can replace universal hash functions in privacy amplification [GW96, SZ94] 5.4.6 Discussion Our results show that unconditional security can be based on assumptions about the adversary s available memory. In essence, such a system exploits the capacity gap between fast communication and mass storage technology. We discuss a few implications of this fact. ....

Oded Goldreich and Avi Wigderson, Tiny families of functions with random properties: A quality-size trade-off for hashing, Preprint available from the authors, preliminary version presented at 26th STOC (1994), January 1996.

.... [NZ96] Much of the motivation for research on extractors comes from work done on somewhat random sources [SV86, CG88, Vaz87b, VV85, Vaz84, Vaz87a] There have been a number of papers giving explicit constructions of dispersers and extractors, with a steady improvement in the parameters [Zuc96, NZ96, WZ95, GW97, SZ98, SSZ98, NT98, TS98, Tre98]. Most of the work on extractors is based on techniques such as k wise independence, the Leftover hash lemma [ILL89] and various forms of composition. A new approach to constructing extractors was recently initiated by Trevisan [Tre98] who discovered that the Nisan Wigderson pseudorandom ....

.... truly random bits than the extractors of [Zuc97, Tre98] and the disperser of [TS98] but our extractors have the advantage that they work for any min entropy (unlike [Zuc97] and extract all (or a constant fraction) of the min entropy (unlike [TS98, Tre98] The disadvantage of the extractors of [GW97] described in Figure 1 is that they only use a small number of truly random bits when the source min entropy k is very close to the input length n (e.g. k = n Gamma polylog(n) whereas ours uses O(log n) random bits for any min entropy. There are also extractors given in [GW97, SZ98] which ....

[Article contains additional citation context not shown here]

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A qualitysize trade-off for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

....s = O(log n) 2.1. 2 Previous work and Applications Extractors were first defined and constructed by Nisan and Zuckerman [NZ96] This followed a large body of work in the late 1980 s, regarding weak notions of randomness [SV86, VV85, CG88, Zuc90] Improved constructions of extractors appeared in [WZ95, GW97, SZ98, Zuc97, NT98]. A new approach to constructing extractors was recently initiated by Trevisan [Tre99] and then [RRV99a] who uses the Nisan Wigderson pseudo random generator [NW94] for constructing extractors (these constructions will be discussed in detail in subsection 2.1.3) Besides the natural ....

.... assumptions [STV99] and other problems in complexity theory [GZ97] For a detailed survey on previous work on extractors and their applications, see [NT98] The following table summarizes the best known constructions of extractors: reference min entropy k output length m additional randomness d [GW97] any k m = k d = O(n Gamma k log(1=ffl) Zuc97] k = Omega Gamma n) m = 1 Gamma ff)k d = O(log(n=ffl) Tre99, RRV99b] any k m = k 1 Gammaff d = O(log 2 n= log k log(1=ffl) RRV99a, RRV99b] any k m = 1 Gamma ff)k d = O(log 2 n log(1=ffl) RRV99a, RRV99b] any k m = k d = ....

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

....is that to hash from s bits to t bits, one needs at least s random bits. We show how a similar lemma can be achieved, using only O(log s t) random bits. Because this modification was so useful to us here, we believe it will be useful elsewhere too. A similar lemma was proved independently in [GW]; however, our proof is somewhat simpler. One key consequence of our lemma is an improvement of the extractor of [NZ] That is, we show how to add a small number t of truly random bits to a ffi source in order to extract almost random bits; we make t much smaller than in [NZ] By using this with ....

O. Goldreich and A. Wigderson, "Tiny Families of Functions with Random Properties: A Quality-Size Trade-off for Hashing," Random Structures & Algorithms, 11:315-343, 1997.

....modular a composite based pseudo random bit generators. In [GR00] it is used and proved that relative to the hardness of factoring the output of g x mod N for x #R 0, 1 k 2 is pseudo random in #g#. To obtain a pseudo random bit generator they use families of hash functions from [GW94]. The hash function h is specified by O(log 2 k) bits and the generator is given by GR(h,x) h, h(g x mod N ) In [HSS93] it is proved and used that relative to the hardness of factoring the k 2 least significant bits of the function g x mod N are simultaneously hard. To obtain a ....

....hard. To obtain a pseudo random bit generator they use universal hashing. The hash function h is specified using 2k bits and the generator is given by HSS(h,x) h, h(g x mod N) x mod 2 k 2 ) The hash function can however be specified using just O(log 2 n) bits using the families from [GW94] yielding a larger expansion factor. However the price for this, which is also paid by GR is a sub exponential security. Our generator uses the stronger Conjecture 1 to obtain a larger expansion factor. We do not use any hash function. On the contrary we obtain a simple function specified by prg ....

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size trade-o# for hashing. In Proceedings of the Twenty-Sixth Annual ACM Symposium on the Theory of Computing, pages 574--583, Montreal, Quebec, Canada, 23--25 May 1994.

....uniform distribution even when the random function h is revealed. Perhaps the best known example of a strong extractor is given in the Leftover Hash Lemma of [11] where standard 2 universal hash families are shown to be strong extractors. Much work has been done in developing this area (e.g. [9, 22, 24, 17]) In particular, it turns out that one can extract almost all the randomness in X by investing very few truly random bits (i.e. having small H) For more information on these topics, see the excellent survey article of Nisan [16] The intuition behind our construction is as follows. Notice that ....

O. Goldreich, A. Wigderson. Tiny Families of Functions with Random Properties: A Quality-Size Trade-off for Hashing. In Proc. of STOC, pp. 574--583, 1994.

....poly(n) compute h i (x) Thus, investing enough true randomness, namely the amount needed to select a random member of H, one can extract something statistically close to a truly random string from the randomness in a given distribution X. Much work has been done in developing this area (e.g. [46, 32, 59, 64, 45, 61, 50, 49]) In particular, it turns out that one can extract almost all the randomness in X by investing very few truly random bits (i.e. having small H) We will use the following eciently constructible families of strong extractors developed by [59, 49] Theorem 4 ( 59, 49] For any n, m and such ....

O. Goldreich, A. Wigderson. Tiny Families of Functions with Random Properties: A Quality-Size Trade-o for Hashing. In Electronic Colloquium on Computational Complexity (ECCC), Rechnical Report TR94-002, 1994. Revised December 1996. http://www.eccc.uni-trier.de/eccc/. Preliminary version in Proc. of STOC, pp. 574-583, 1994.

....one sided error probability can be simulated by using weak random sources and dispersers. Saks et al. SSZ98] give a construction of dispersers that implies an entropy rate optimal simulation of one sided error randomized 2 Reference Min entropy k Output length m Additional randomness t Type [GW97] n a n (a) O(a) Extractor [Zuc96b] k = n) m = 1 )k t = O(log n) Extractor [TS96] any k m = k t = O( log n) 9 ) Extractor [TS96] k = n 19 m = k 1 t = O(log n log log n) Extractor [SSZ98] k = n 19 m = k 1 t = O(log n) Disperser [TS98] any k m = k poly log n t = O(log n) ....

O. Goldreich and A. Wigderson. Tiny families of functions with random properties: A quality-size trade-o for hashing. Random Structures and Algorithms, 11(4):315-343, 1997.

.... n s 2 n , there is a ( 1 )n; 1=s) deterministic extractor EXT n;s : f0; 1g n f0; 1g log s against circuit size s such that EXT n;s is computable in time poly(s) Now, to extract more than a logarithmic number of bits, we use a simple observation about high min entropy sources from [GW97] If we partition a high min entropy source into a prefix and suffix, then these two part each contain a lot of independent randomness . More precisely, if X = X 1 ; X 2 ) is of length n = n 1 n 2 (where n i is the length of X i ) and has min entropy n , then X 1 has min entropy n 1 , and ....

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

....2 any k m = 1 Gamma ff)k d = O(log 2 n Delta log(1= extractor Thm. 2 any k m = k d = O(log 2 n Delta log(1= Delta log k) extractor Above, ff is an arbitrarily small constant. Figure 1: Summary of our constructions reference min entropy k output length m additional randomness d type [GW97] any k m = k d = O(n Gamma k log(1= extractor [Zuc97] k = Omega Gamma n) m = 1 Gamma ff)k d = O(log(n= extractor [NT98] any k m = k d = O(log 9 n Delta log(1= extractor [Ta 98] any k m = k Gamma polylog(n) d = O(log(n= disperser [Tre99] any k m = k 1 Gammaff d = O(log 2 ....

.... 2 Our extractors use more truly random bits than the extractor of [Zuc97] and the disperser of [Ta 98] but our extractors have the advantage that they work for any min entropy (unlike [Zuc97] and are extractors rather than dispersers (unlike [Ta 98] The disadvantage of the extractors of [GW97] described in Figure 2 is that they only use a small number of truly random bits when the source min entropy k is very close to the input length n (e.g. k = n Gamma polylog(n) There are also extractors given in [GW97, SZ98] which extract all of the min entropy, but these use a small number of ....

[Article contains additional citation context not shown here]

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A qualitysize trade-off for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

....the uniform distribution even when the random function h is revealed. Perhaps the best known example of a strong extractor is given in the Leftover Hash Lemma of [15] where standard 2universal hash families are shown to be strong extractors. Much work has been done in developing this area (e.g. [12, 26, 28, 21]) In particular, it turns out that one can extract almost all the randomness in X by investing very few truly random bits (i.e. having small H) For more information on these topics, see the excellent survey article of Nisan [20] The intuition behind our construction is as follows: Notice that ....

O. Goldreich, A. Wigderson. Tiny Families of Functions with Random Properties: A Quality-Size Trade-off for Hashing. In Proc. of STOC, pp. 574--583, 1994.

..... Lemma 3.2 [SZ94] 5 Let m(n) n 1=2 fl for some constant fl 0, then for any ffl there is an explicit (n; m(n) O(log 2 n Delta log( 1 ffl ) m 2 (n) n ; ffl) extractor. The first extractor is actually a restatement of the existence of explicit tiny families of hash functions [SZ94, GW94], and can easily be achieved using small ffl biased sample spaces [SZ94] We also need the following simple lemma from [NZ93] Lemma 3.3 [NZ93] Let X and Y be two correlated random variables. Let B be a distribution, and call an x bad if (Y j X = x) is not ffl close to B. If Prob x2X (x is ....

O. Goldreich and A. Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. In Proceedings of the 26th Annual ACM Symposium on the Theory of Computing, ACM, pages 574--583, 1994.

.... and sorting networks [35, 30] constructive leader election [38, 23] and several diverse applications in complexity theory [18, 2, 29, 26, 10] The dispersers we use in this paper are ones that work on sources with very small min entropy; constructions for this parameter range are in [27, 9] (logarithmic degree) and [16, 32, 21] polylogarithmic degree) Extractors have been used before to prove hardness of approximation [36, 27] these methods can be best seen as an amplification of inapproximability results achieved using PCPs. The novelty of our approach is that we use dispersers ....

O. Goldreich and A. Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. Random Structures and Algorithms, 11(4):315--343, 1997.

.... [NZ93, WZ93, SZ94, SSZ95, Zuc93, Zuc] The first explicit construction of extractors came in [NZ93] and relied on techniques developed in [Zuc90, Zuc91] This construction had d = polylog(n) for k n=polylog(n) An efficient extractor working for small k s, k = Theta(log(n) was obtained by [GW94, SZ94] using tiny families of hash functions [NN93, AGHP92] This was used in [SZ94] to improve upon the [NZ93] extractor, and get it work for any k p n. In [SSZ95] a disperser with d = O(log n) was obtained for any k = n Omega Gamma1 . In [Zuc] d = O(log n) was obtained for k = ....

....table we list the currently known best explicitly constructible extractors and dispersers for various parameters. required crude randomness no. of truly random bits number of output bits reference k = Omega Gamma log(n) d = k m = 1 Omega Gamma408 Delta k ffl = 2 Gamma Omega Gamma k) GW94, SZ94] k = Omega Gamma n) d = O(log(n) log( 1 ffl ) m = Omega Gamma k) Zuc] k = Omega Gamma n 1=2 fl ) d = O(log 2 n Delta log( 1 ffl ) m = n ffi ; ffi fl [SZ94] k = Omega Gamma n fl ) d = O(logn) m = n ffi ; ffi fl Disperser, ffl = 1 2 [SSZ95] New Results We ....

[Article contains additional citation context not shown here]

O. Goldreich and A. Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. In Proceedings of the 26th Annual ACM Symposium on the Theory of Computing, ACM, pages 574--583, 1994.

.... of dispersers we have d k Gamma m log log( 1 ffl ) Gamma O(1) Surprisingly, the entropy loss (which can be compared to the heat wasted in a physical process) has different magnitudes in dispersers (about log log 1 ffl ) and extractors (about 2 log 1 ffl ) Goldreich and Wigderson [GW94, section 6] show the existence of explicit (k; ffl) extractors E : f0; 1g n Theta f0; 1g d f0; 1g n , with d = n Gamma k 2 log 1 ffl 2. Theorem 3 shows that the entropy loss of 2 log 1 ffl in their extractor unavoidable, and the result of Wigderson and Zuckerman [WZ93] is tight up to a ....

O. Goldreich and A. Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. In Proceedings of the 26th Annual ACM Symposium on the Theory of Computing, ACM, pages 574--583, 1994.

....d) R(m 1 ; d 1 ) ffl=4) good, where m 1 = dm) O(1) d 1 = 1=ffl) O(1) and each is a power of 2. jF 1 j = d O(1) Let V 1 = m 1 ] d1 . 3 3. 3 The Range Reduction Function Family We will use a generator of Nisan and Zuckerman [12] based on an extractor of Goldreich and Wigderson [6]. The idea of using extractors for range reduction was inspired by that of Radhakrishnan and Ta Shma [13] We choose a more appropriate extractor and get a better reduction. Definition 3.1 A function E : f0; 1g s Theta f0; 1g t f0; 1g l is an (s; r; t; l; ffi) extractor if for x chosen ....

....distance 2 at most ffi to the uniform distribution over f0; 1g l . Extractors are used to extract randomness from weakly random sources, and have many other applications. For more details, please refer to an excellent survey by Nisan [11] We use an extractor due to Goldreich and Wigderson [6]. Lemma 3.1 There are constants c 1 and c 2 such that for any s, fl, and ffi with s fl, s Gamma fl l, and ffi 2 Gamma(s Gammal Gammac 1 fl) c 2 , an explicit (s; s Gamma fl; O(fl log 1 ffi ) l; ffi) extractor exists. Choose ffi = ffl= 4d 1 ) ffl O(1) fl = dlog 1=ffie, t = ....

O. Goldreich and A. Wigderson, Tiny families of functions with random properties: a quality-size tradeoff for hashing, In Proceedings of the 26th Annual ACM Symposium on Theory of Computing, pages 574-583, 1994.

.... [NZ96] Much of the motivation for research on extractors comes from work done on somewhat random sources [SV86, CG88, Vaz87b, VV85, Vaz84, Vaz87a] There have been a number of papers giving explicit constructions of dispersers and extractors, with a steady improvement in the parameters [Zuc96, NZ96, WZ95, GW97, SZ98, SSZ98, NT98, TS98, Tre98]. Most of the work on extractors is based on techniques such as k wise independence, the Leftover hash lemma [ILL89] and various forms of composition. A new approach to constructing extractors was recently initiated by Trevisan [Tre98] who discovered that the Nisan Wigderson pseudorandom ....

.... truly random bits than the extractors of [Zuc97, Tre98] and the disperser of [TS98] but our extractors have the advantage that they work for any min entropy (unlike [Zuc97] and extract all (or a constant fraction) of the min entropy (unlike [TS98, Tre98] The disadvantage of the extractors of [GW97] described in Figure 1 is that they only use a small number of truly random bits when the source min entropy k is very close to the input length n (e.g. k = n Gamma polylog(n) whereas ours uses O(log 3 n) random bits for any min entropy. There are also extractors given in [GW97, SZ98] which ....

[Article contains additional citation context not shown here]

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A qualitysize trade-off for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

.... [NZ96] Much of the motivation for research on extractors comes from work done on somewhat random sources [SV86, CG88, Vaz87b, VV85, Vaz84, Vaz87a] There have been a number of papers giving explicit constructions of dispersers and extractors, with a steady improvement in the parameters [Zuc96, NZ96, WZ95, GW97, SZ98, SSZ98, NT98, Zuc97, TS98b, Tre98]. Most of the work on extractors is based on techniques such as k wise independence, the Leftover hash lemma [ILL89] and various forms of composition. A new approach to constructing extractors was recently initiated by Trevisan [Tre98] who discovered that the Nisan Wigderson pseudorandom ....

.... 2 Our extractors use more truly random bits than the extractor of [Zuc97] and the disperser of [TS98b] but our extractors have the advantage that they work for any min entropy (unlike [Zuc97] and are extractors rather than dispersers (unlike [TS98b] The disadvantage of the extractors of [GW97] described in Figure 2 is that they only use a small number of truly random bits when the source min entropy k is very close to the input length n (e.g. k = n Gamma polylog(n) There are also extractors given in [GW97, SZ98] which extract all of the minentropy, but these use a small number of ....

[Article contains additional citation context not shown here]

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size tradeoff for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

.... especially efficient when their output is substantially smaller than their input (since, they were mainly brought up in the context of authentication) which is not true in our case (but is relevant in Section 7) An additional objective is to reduce the size of the family of hash functions (e.g. [18, 23]) In our setting the purpose of this is to reduce the key length of the pseudo random permutations. 6 Reducing the Distinguishing Probability There are various circumstances where it is desirable to have a pseudo random permutation on relatively few bits (say 128) This is especially true when ....

O. Goldreich and A. Wigderson, Tiny families of functions with random properties: a quality-size trade-off for hashing, Proc. 26th ACM Symp. on Theory of Computing, 1994, pp. 574-583.

.... especially efficient when their output is substantially smaller than their input (since, they were mainly brought up in the context of authentication) which is not true in our case (but is relevant in Section 7) An additional objective is to reduce the size of the family of hash functions (e.g. [19, 24]) In our setting the purpose of this is to reduce the key size of the pseudo random permutations. 6 Reducing the Distinguishing Probability There are various circumstances where it is desirable to have a pseudo random permutation on relatively few bits (say 128) This is especially true when ....

O. Goldreich and A. Wigderson, Tiny families of functions with random properties: a quality-size trade-off for hashing, Proc. 26th ACM Symp. on Theory of Computing, 1994, pp. 574-583.

.... [NZ96] Much of the motivation for research on extractors comes from work done on somewhat random sources [SV86, CG88, Vaz87b, VV85, Vaz84, Vaz87a] There have been a number of papers giving explicit constructions of dispersers and extractors, with a steady improvement in the parameters [Zuc96, NZ96, WZ95, GW97, SZ98, SSZ98, NT98, TS98b, Tre98]. Most of the work on extractors is based on techniques such as k wise independence, the Leftover hash lemma [ILL89] and various forms of composition. A new approach to constructing extractors was recently initiated by Trevisan [Tre98] who discovered that the Nisan Wigderson pseudorandom ....

.... truly random bits than the extractors of [Zuc97, Tre98] and the disperser of [TS98b] but our extractors have the advantage that they work for any minentropy (unlike [Zuc97] and extract all (or a constant fraction) of the min entropy (unlike [TS98b, Tre98] The disadvantage of the extractors of [GW97] described in Figure 1 is that they only use a small number of truly random bits when the source min entropy k is very close to the input length n (e.g. k = n Gamma polylog(n) whereas ours uses O(log 3 n) random bits for any min entropy. There are also extractors given in [GW97, SZ98] which ....

[Article contains additional citation context not shown here]

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A qualitysize trade-off for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

No context found.

Goldreich, O., and Wigderson, A. Tiny families of functions with random properties: A quality{size trade{o for hashing. Journal of Random structures and Algorithms 11, 4 (Dec.

No context found.

Goldreich, O., and Wigderson, A. Tiny families of functions with random properties: A quality{size trade{o for hashing. Journal of Random structures and Algorithms 11, 4 (Dec.

....have 1. H1(Z) and H2(Z) are individually uniform in and 2. Pr [H1(Z) H2(Z) S] 2# . Such a function can be obtained explicitly with d # = d O(log(1 #) by taking a random edge on a su#ciently good expander or (almost equivalently) by using the high minentropy extractors of [8]. We define Con # (x, z) Con(x, H1(z) #Con(x, H2 (z) and Som # (x, z) Som(x, H1(z) Som(x,H2(z) Let X be a k source on and let con, som be the sets guaranteed by the win win property of Con. Define con # = z) x, H1(z) con and som # = z) x, H1 (z) ....

O. Goldreich and A. Wigderson. Tiny families of functions with random properties: A quality-size trade-o# for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

....to Pseudorandom Generators An immediate application of Theorem 3.2 is an efficient factoring based pseudorandom generator which nearly doubles the length of its input. The key tool used is a construction by Goldreich and Wigderson of a tiny family of functions which has good extraction properties [GW]. We also discuss how the parameters of the generator (a composite N 2 N n and an element g 2 Z N ) can be chosen in a randomness efficient way (which is polynomial time) In particular, we present a method of choosing a random n bit prime using only a linear number of random bits. This ....

....to be large: exponential in n. Thus the number of random bits needed to generate (and represent) a function in this family is polynomial in n, resulting in a considerably large loss in the expansion factor of their generator. Instead, we use an explicit construction due to Goldreich and Wigderson [GW] of a family of functions, which exhibits a trade off between the size of the family and the quality parameter ffl of the extraction property it achieves. Specifically, they demonstrate a construction of a family of functions of size poly(n=ffl) achieving the extraction property with quality ffl. ....

[Article contains additional citation context not shown here]

O. Goldreich and A. Wigderson, Tiny families of functions with random properties: A qualitysize trade-off for hashing, Proceedings of the 26th Annual ACM Symposium on the Theory of Computing, ACM, 1994, pp. 574-583.

....contains roughly m d random bits. We can now use another extractor to extract this randomness and dismantle the correlation between the seed and output. The extractor we need is one that works well when the source lacks only a very small amount of randomness. Such a construction was given by [GW97]. Theorem 8 [GW97] There are explicit strong (k; extractors GW : f0; 1g n f0; 1g O(n k log(1= f0; 1g k For = O(n k log(1= We therefore get the following simple de nition of Ext 0 : Let GW : f0; 1g m f0; 1g O(d) f0; 1g m d 1 be an (m d 1; extractor ....

....m d random bits. We can now use another extractor to extract this randomness and dismantle the correlation between the seed and output. The extractor we need is one that works well when the source lacks only a very small amount of randomness. Such a construction was given by [GW97] Theorem 8 [GW97] There are explicit strong (k; extractors GW : f0; 1g n f0; 1g O(n k log(1= f0; 1g k For = O(n k log(1= We therefore get the following simple de nition of Ext 0 : Let GW : f0; 1g m f0; 1g O(d) f0; 1g m d 1 be an (m d 1; extractor guaranteed by theorem 8. ....

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size trade-o for hashing. Random Structures & Algorithms, 11(4):315-343, 1997.

....(which is natural in several applications mentioned below) even smaller values of d are possible. It is natural in this case to define = n k to be the entropy deficiency of the k source and look for explicit extractors whose seed length depends only on , but not on n. Goldreich and Wigderson [GW97] studied this high min entropy case, giving an explicit extractor whose seed length is d = O( They also gave extractors (under the more general definition) with shorter seeds; however, these extractors lose more than bits of entropy (i.e. their output length is less than k , rather than ....

.... length is less than k , rather than being k) In this paper, we continue that work, giving explicit extractors with the optimal (up to constant factors) d = O(log ) for small values of (below loglog n) and nearly optimal d = O(log 3 ) for every value of (without losing entropy as in [GW97] Stated differently, we give a reduction from the problem of constructing high min entropy extractors for long sources (of length n) to that of constructing extractors for sources of length O( the deficiency This reduction is achieved using a Zig Zag Composition Theorem for extractors ....

[Article contains additional citation context not shown here]

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. Random Structures & Algorithms, 11(4):315--343, 1997.

....fi 0. In the next section, we further reduce the randomness complexity of samplers to n O(log(1=ffl) log(1=ffi) while maintaining the sample complexity (up to a multiplicative constant) 5 The Expander Sampler and two Generic Techniques The main result of this section is Theorem 5. 1 [7, 17]: There exists an efficient sampler which has ffl Sample Complexity: O( log(1=ffi) ffl 2 ) ffl Randomness Complexity: n log 2 (1=ffl) O(log(1=ffi) The theorem is proven by applying Theorem 4.1 to a new efficient sampler which makes O( 1 ffiffl 2 ) oracle queries and tosses n log 2 ....

....hitting a witness set [20] cf. Appendix C) yet the analysis is somewhat more involved. Furthermore, to get an algorithm which samples the universe only on O(1=ffi ffl 2 ) points, it is crucial to use a Ramanujan graph in role of the expander in the Karp Pippinger Sipser method. The sampler [17]. We use an expander of degree d = 4=ffi ffl 2 second eigenvalue bounded by and associate the vertex set of the expander with f0; 1g n . The sampler consists of uniformly selecting a vertex, v, of the expander) and averaging over the values assigned (by ) to all the neighbors of v; namely, ....

[Article contains additional citation context not shown here]

O. Goldreich and A. Wigderson, "Tiny Families of Functions with Random Properties: A Quality--Size Trade--off for Hashing", to appear in Journal of Random structures and Algorithms. Preliminary version in 26th STOC, pp. 574--583, 1994.

....2 (1=ffi) In the next section, we further reduce the randomness complexity of samplers to n O(log(1=ffl) log(1=ffi) while maintaining the sample complexity (up to a multiplicative constant) 5 The Expander Sampler and two Generic Techniques The main result of this section is Theorem 5. 1 [7, 17]: There exists an efficient sampler which has ffl Sample Complexity: O( log(1=ffi) ffl 2 ) ffl Randomness Complexity: n log 2 (1=ffl) O(log(1=ffi) The theorem is proven by applying Theorem 4.1 to a new efficient sampler which makes O( 1 ffiffl 2 ) oracle queries and tosses n log 2 ....

....outputs the estimate def = 1 d X u2N (v) u) where N (v) denotes the set of neighbors of vertex v. The algorithm has ffl Sample Complexity: O( 1 ffiffl 2 ) ffl Randomness Complexity: n. ffl Computational Complexity: polynomial in n, ffl Gamma1 and ffi Gamma1 . Lemma 5. 3 [17]: The above algorithm constitutes an efficient Boolean sampler. Proof: We denote by B the set of bad choices for the algorithm; namely, the set of vertices that once selected by the algorithm yield a wrong estimate. That is, v 2 B if fi fi fi fi fi fi 1 d X u2N (v) u) Gamma fi fi fi ....

[Article contains additional citation context not shown here]

O. Goldreich and A. Wigderson, "Tiny Families of Functions with Random Properties: A Quality--Size Trade--off for Hashing", to appear in Journal of Random structures and Algorithms. Preliminary version in 26th STOC, pp. 574--583, 1994.

....ffl 2 ln 4 ffi samples, and tosses only n log n 2 log 2 ffi 2 coins. Recently, Goldreich and Wigderson have presented an explicit (and efficient) sampler that given ffl, ffi , and n as above uses O( 1 ffl 2 log 1 ffi ) samples and tosses n O(log 1 ffl ) O(log 1 ffi ) coins [GW]. 2 The setting We use the following notational conventions. Let a 2 R A denote a random variable, a, uniformly distributed over the set A. Let Prob e2 R D (T (e) denote the probability of event T (e) when element e is chosen uniformly at random from domain D. Let E e2 R D (X(e) denote the ....

O. Goldreich and A. Wigderson, "Tiny Families of Functions with Random Properties: A Quality-Size Trade-off for Hashing", 26th STOC, 1994.

No context found.

O. Goldreich and A. Wigderson, Tiny families of functions with random properties: a quality-size trade-off for hashing, Proc. 26th ACM Symp. on Theory of Computing, 1994, pp. 574-583.

No context found.

Goldreich, O., Wigderson, A.: Tiny Families of Functions with Random Properties: A Quality-Size Trade-o for Hashing. Random Structures and Algorithms 11:4 (1997) 315343 31

No context found.

O. Goldreich and A. Wigderson, Tiny families of functions with random properties: A quality-size trade-o# for hashing, Random Structures Algorithms, 11 (1997), pp. 315--343.

No context found.

O. Goldreich and A. Wigderson. Tiny families of functions with random properties: A quality-size trade-off for hashing. In Proceedings of the 26th Annual ACM Symposium on the Theory of Computing, ACM, pages 574--583, 1994.

No context found.

O. Goldreich and A. Wigderson, Tiny families of functions with random properties: A quality-size trade-off for hashing, in Proceedings, 26th Annual ACM Symposium on the Theory of Computing, ACM, 1994," pp. 574#583.

No context found.

Oded Goldreich and Avi Wigderson. Tiny families of functions with random properties: A quality-size trade-o for hashing. Random Structures & Algorithms, 11(4):315-343, 1997.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC