---
res:
bibo_abstract:
- "Computational notions of entropy have recently found many applications, including
leakage-resilient cryptography, deterministic encryption or memory delegation.
The two main types of results which make computational notions so useful are (1)
Chain rules, which quantify by how much the computational entropy of a variable
decreases if conditioned on some other variable (2) Transformations, which quantify
to which extend one type of entropy implies another.\r\n\r\nSuch chain rules and
transformations typically lose a significant amount in quality of the entropy,
and are the reason why applying these results one gets rather weak quantitative
security bounds. In this paper we for the first time prove lower bounds in this
context, showing that existing results for transformations are, unfortunately,
basically optimal for non-adaptive black-box reductions (and it’s hard to imagine
how non black-box reductions or adaptivity could be useful here.)\r\n\r\nA variable
X has k bits of HILL entropy of quality (ϵ,s)\r\nif there exists a variable Y
with k bits min-entropy which cannot be distinguished from X with advantage ϵ\r\n\r\nby
distinguishing circuits of size s. A weaker notion is Metric entropy, where we
switch quantifiers, and only require that for every distinguisher of size s, such
a Y exists.\r\n\r\nWe first describe our result concerning transformations. By
definition, HILL implies Metric without any loss in quality. Metric entropy often
comes up in applications, but must be transformed to HILL for meaningful security
guarantees. The best known result states that if a variable X has k bits of Metric
entropy of quality (ϵ,s)\r\n, then it has k bits of HILL with quality (2ϵ,s⋅ϵ2).
We show that this loss of a factor Ω(ϵ−2)\r\n\r\nin circuit size is necessary.
In fact, we show the stronger result that this loss is already necessary when
transforming so called deterministic real valued Metric entropy to randomised
boolean Metric (both these variants of Metric entropy are implied by HILL without
loss in quality).\r\n\r\nThe chain rule for HILL entropy states that if X has
k bits of HILL entropy of quality (ϵ,s)\r\n, then for any variable Z of length
m, X conditioned on Z has k−m bits of HILL entropy with quality (ϵ,s⋅ϵ2/2m). We
show that a loss of Ω(2m/ϵ) in circuit size necessary here. Note that this still
leaves a gap of ϵ between the known bound and our lower bound.@eng"
bibo_authorlist:
- foaf_Person:
foaf_givenName: Krzysztof Z
foaf_name: Pietrzak, Krzysztof Z
foaf_surname: Pietrzak
foaf_workInfoHomepage: http://www.librecat.org/personId=3E04A7AA-F248-11E8-B48F-1D18A9856A87
orcid: 0000-0002-9139-1654
- foaf_Person:
foaf_givenName: Skorski
foaf_name: Maciej, Skorski
foaf_surname: Maciej
bibo_doi: 10.1007/978-3-662-53641-4_8
bibo_volume: 9985
dct_date: 2016^xs_gYear
dct_language: eng
dct_publisher: Springer@
dct_title: 'Pseudoentropy: Lower-bounds for chain rules and transformations@'
...