{"publist_id":"3440","date_updated":"2021-01-12T07:42:03Z","volume":6841,"extern":1,"type":"conference","intvolume":"      6841","_id":"3240","doi":" 10.1007/978-3-642-22792-9_1","conference":{"name":"CRYPTO: International Cryptology Conference"},"author":[{"full_name":"Barak,  Boaz","first_name":"Boaz","last_name":"Barak"},{"last_name":"Dodis","first_name":"Yevgeniy","full_name":"Dodis, Yevgeniy"},{"first_name":"Hugo","full_name":"Krawczyk, Hugo","last_name":"Krawczyk"},{"full_name":"Pereira, Olivier","first_name":"Olivier","last_name":"Pereira"},{"first_name":"Krzysztof Z","full_name":"Krzysztof Pietrzak","orcid":"0000-0002-9139-1654","last_name":"Pietrzak","id":"3E04A7AA-F248-11E8-B48F-1D18A9856A87"},{"first_name":"François","full_name":"Standaert, François-Xavier","last_name":"Standaert"},{"full_name":"Yu, Yu","first_name":"Yu","last_name":"Yu"}],"quality_controlled":0,"alternative_title":["LNCS"],"title":"Leftover hash lemma revisited","publication_status":"published","abstract":[{"text":"The famous Leftover Hash Lemma (LHL) states that (almost) universal hash functions are good randomness extractors. Despite its numerous applications, LHL-based extractors suffer from the following two limitations: - Large Entropy Loss: to extract v bits from distribution X of min-entropy m which are ε-close to uniform, one must set v ≤ m - 2log(1/ε), meaning that the entropy loss L = def m - v ≥ 2 log(1/ε). For many applications, such entropy loss is too large. - Large Seed Length: the seed length n of (almost) universal hash function required by the LHL must be at least n ≥ min (u - v, v + 2log(1/ε)) - O(1), where u is the length of the source, and must grow with the number of extracted bits. Quite surprisingly, we show that both limitations of the LHL - large entropy loss and large seed - can be overcome (or, at least, mitigated) in various important scenarios. First, we show that entropy loss could be reduced to L = log(1/ε) for the setting of deriving secret keys for a wide range of cryptographic applications. Specifically, the security of these schemes with an LHL-derived key gracefully degrades from ε to at most ε + √ε2-L. (Notice that, unlike standard LHL, this bound is meaningful even when one extracts more bits than the min-entropy we have!) Based on these results we build a general computational extractor that enjoys low entropy loss and can be used to instantiate a generic key derivation function for any cryptographic application. Second, we study the soundness of the natural expand-then-extract approach, where one uses a pseudorandom generator (PRG) to expand a short &quot;input seed&quot; S into a longer &quot;output seed&quot; S′, and then use the resulting S′ as the seed required by the LHL (or, more generally, by any randomness extractor). We show that, in general, the expand-then-extract approach is not sound if the Decisional Diffie-Hellman assumption is true. Despite that, we show that it is sound either: (1) when extracting a &quot;small&quot; (logarithmic in the security of the PRG) number of bits; or (2) in minicrypt. Implication (2) suggests that the expand-then-extract approach is likely secure when used with &quot;practical&quot; PRGs, despite lacking a reductionist proof of security! © 2011 International Association for Cryptologic Research.","lang":"eng"}],"citation":{"ieee":"B. Barak <i>et al.</i>, “Leftover hash lemma revisited,” presented at the CRYPTO: International Cryptology Conference, 2011, vol. 6841, pp. 1–20.","ama":"Barak B, Dodis Y, Krawczyk H, et al. Leftover hash lemma revisited. In: Vol 6841. Springer; 2011:1-20. doi:<a href=\"https://doi.org/ 10.1007/978-3-642-22792-9_1\"> 10.1007/978-3-642-22792-9_1</a>","mla":"Barak, Boaz, et al. <i>Leftover Hash Lemma Revisited</i>. Vol. 6841, Springer, 2011, pp. 1–20, doi:<a href=\"https://doi.org/ 10.1007/978-3-642-22792-9_1\"> 10.1007/978-3-642-22792-9_1</a>.","short":"B. Barak, Y. Dodis, H. Krawczyk, O. Pereira, K.Z. Pietrzak, F. Standaert, Y. Yu, in:, Springer, 2011, pp. 1–20.","apa":"Barak, B., Dodis, Y., Krawczyk, H., Pereira, O., Pietrzak, K. Z., Standaert, F., &#38; Yu, Y. (2011). Leftover hash lemma revisited (Vol. 6841, pp. 1–20). Presented at the CRYPTO: International Cryptology Conference, Springer. <a href=\"https://doi.org/ 10.1007/978-3-642-22792-9_1\">https://doi.org/ 10.1007/978-3-642-22792-9_1</a>","ista":"Barak B, Dodis Y, Krawczyk H, Pereira O, Pietrzak KZ, Standaert F, Yu Y. 2011. Leftover hash lemma revisited. CRYPTO: International Cryptology Conference, LNCS, vol. 6841, 1–20.","chicago":"Barak, Boaz, Yevgeniy Dodis, Hugo Krawczyk, Olivier Pereira, Krzysztof Z Pietrzak, François Standaert, and Yu Yu. “Leftover Hash Lemma Revisited,” 6841:1–20. Springer, 2011. <a href=\"https://doi.org/ 10.1007/978-3-642-22792-9_1\">https://doi.org/ 10.1007/978-3-642-22792-9_1</a>."},"month":"01","date_created":"2018-12-11T12:02:12Z","year":"2011","status":"public","publisher":"Springer","page":"1 - 20","day":"01","date_published":"2011-01-01T00:00:00Z"}