{"type":"conference","date_updated":"2021-01-12T06:48:53Z","volume":9985,"abstract":[{"lang":"eng","text":"Computational notions of entropy have recently found many applications, including leakage-resilient cryptography, deterministic encryption or memory delegation. The two main types of results which make computational notions so useful are (1) Chain rules, which quantify by how much the computational entropy of a variable decreases if conditioned on some other variable (2) Transformations, which quantify to which extend one type of entropy implies another.\r\n\r\nSuch chain rules and transformations typically lose a significant amount in quality of the entropy, and are the reason why applying these results one gets rather weak quantitative security bounds. In this paper we for the first time prove lower bounds in this context, showing that existing results for transformations are, unfortunately, basically optimal for non-adaptive black-box reductions (and it’s hard to imagine how non black-box reductions or adaptivity could be useful here.)\r\n\r\nA variable X has k bits of HILL entropy of quality (ϵ,s)\r\nif there exists a variable Y with k bits min-entropy which cannot be distinguished from X with advantage ϵ\r\n\r\nby distinguishing circuits of size s. A weaker notion is Metric entropy, where we switch quantifiers, and only require that for every distinguisher of size s, such a Y exists.\r\n\r\nWe first describe our result concerning transformations. By definition, HILL implies Metric without any loss in quality. Metric entropy often comes up in applications, but must be transformed to HILL for meaningful security guarantees. The best known result states that if a variable X has k bits of Metric entropy of quality (ϵ,s)\r\n, then it has k bits of HILL with quality (2ϵ,s⋅ϵ2). We show that this loss of a factor Ω(ϵ−2)\r\n\r\nin circuit size is necessary. In fact, we show the stronger result that this loss is already necessary when transforming so called deterministic real valued Metric entropy to randomised boolean Metric (both these variants of Metric entropy are implied by HILL without loss in quality).\r\n\r\nThe chain rule for HILL entropy states that if X has k bits of HILL entropy of quality (ϵ,s)\r\n, then for any variable Z of length m, X conditioned on Z has k−m bits of HILL entropy with quality (ϵ,s⋅ϵ2/2m). We show that a loss of Ω(2m/ϵ) in circuit size necessary here. Note that this still leaves a gap of ϵ between the known bound and our lower bound."}],"publication_status":"published","alternative_title":["LNCS"],"_id":"1179","conference":{"name":"TCC: Theory of Cryptography Conference","location":"Beijing, China","end_date":"2016-11-03","start_date":"2016-10-31"},"author":[{"last_name":"Pietrzak","id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87","first_name":"Krzysztof Z","full_name":"Pietrzak, Krzysztof Z","orcid":"0000-0002-9139-1654"},{"last_name":"Maciej","full_name":"Maciej, Skorski","first_name":"Skorski"}],"doi":"10.1007/978-3-662-53641-4_8","month":"10","date_created":"2018-12-11T11:50:34Z","citation":{"ieee":"K. Z. Pietrzak and S. Maciej, “Pseudoentropy: Lower-bounds for chain rules and transformations,” presented at the TCC: Theory of Cryptography Conference, Beijing, China, 2016, vol. 9985, pp. 183–203.","mla":"Pietrzak, Krzysztof Z., and Skorski Maciej. <i>Pseudoentropy: Lower-Bounds for Chain Rules and Transformations</i>. Vol. 9985, Springer, 2016, pp. 183–203, doi:<a href=\"https://doi.org/10.1007/978-3-662-53641-4_8\">10.1007/978-3-662-53641-4_8</a>.","ama":"Pietrzak KZ, Maciej S. Pseudoentropy: Lower-bounds for chain rules and transformations. In: Vol 9985. Springer; 2016:183-203. doi:<a href=\"https://doi.org/10.1007/978-3-662-53641-4_8\">10.1007/978-3-662-53641-4_8</a>","short":"K.Z. Pietrzak, S. Maciej, in:, Springer, 2016, pp. 183–203.","apa":"Pietrzak, K. Z., &#38; Maciej, S. (2016). Pseudoentropy: Lower-bounds for chain rules and transformations (Vol. 9985, pp. 183–203). Presented at the TCC: Theory of Cryptography Conference, Beijing, China: Springer. <a href=\"https://doi.org/10.1007/978-3-662-53641-4_8\">https://doi.org/10.1007/978-3-662-53641-4_8</a>","chicago":"Pietrzak, Krzysztof Z, and Skorski Maciej. “Pseudoentropy: Lower-Bounds for Chain Rules and Transformations,” 9985:183–203. Springer, 2016. <a href=\"https://doi.org/10.1007/978-3-662-53641-4_8\">https://doi.org/10.1007/978-3-662-53641-4_8</a>.","ista":"Pietrzak KZ, Maciej S. 2016. Pseudoentropy: Lower-bounds for chain rules and transformations. TCC: Theory of Cryptography Conference, LNCS, vol. 9985, 183–203."},"acknowledgement":"K. Pietrzak—Supported by the European Research Council consolidator grant (682815-TOCNeT).\r\nM. Skórski—Supported by the National Science Center, Poland (2015/17/N/ST6/03564).","department":[{"_id":"KrPi"}],"oa":1,"user_id":"3E5EF7F0-F248-11E8-B48F-1D18A9856A87","project":[{"call_identifier":"H2020","name":"Teaching Old Crypto New Tricks","_id":"258AA5B2-B435-11E9-9278-68D0E5697425","grant_number":"682815"}],"status":"public","page":"183 - 203","language":[{"iso":"eng"}],"intvolume":"      9985","publist_id":"6175","oa_version":"Preprint","scopus_import":1,"quality_controlled":"1","title":"Pseudoentropy: Lower-bounds for chain rules and transformations","main_file_link":[{"open_access":"1","url":"https://eprint.iacr.org/2016/159"}],"date_published":"2016-10-22T00:00:00Z","day":"22","year":"2016","publisher":"Springer","ec_funded":1}