Simple Extractors for all Min-Entropies

11

R.Shaltiel and C.UmansR.Shaltiel and C.Umans

22

DefinitionsDefinitions

Def (min-entropy):Def (min-entropy): The min-entropy of a The min-entropy of a random variable random variable XX over over {0, 1}{0, 1}nn is defined as: is defined as:

Thus a random variable Thus a random variable XX has min-entropy at has min-entropy at least least kk if if Pr[X=x]≤2Pr[X=x]≤2-k-k for all for all xx. The maximum . The maximum possible min-entropy for such a R.V. is possible min-entropy for such a R.V. is nn

Def (statistical distance):Def (statistical distance): Two distributions on Two distributions on a domain a domain DD are are -close-close if the probabilities if the probabilities they give to any they give to any AADD differ by at most differ by at most (namely, using norm 1) (namely, using norm 1)

n 2

x 0,1H X Min log Pr X x

33

DefinitionsDefinitions

Def (extractor):Def (extractor): A ( A (k,k,)-extractor is a )-extractor is a functionfunction

E:E: n n ttmm

s.t. for any R.V. s.t. for any R.V. XX with min-entropy with min-entropy ≥k≥kE(X,UE(X,Utt)) is is -close to -close to UUmm

(where(where U Umm denotes the uniform distribution over denotes the uniform distribution over mm))

E

Weak random sourcen

Seedt

Random stringm

44

ParametersParametersThe relevant parameters are:The relevant parameters are: min entropy min entropy of the weak random source input – of the weak random source input –

kk. Relevant values . Relevant values log(n)log(n) k k n n (the seed length is (the seed length is t ≥ log(n)t ≥ log(n), , hence useless to consider lower min entropy).hence useless to consider lower min entropy).

seed lengthseed length t ≥ log(n) t ≥ log(n) .. Quality of the outputQuality of the output: : .. Size of the output Size of the output m=f(k)m=f(k). The optimum is . The optimum is m=km=k..

E

Weak random sourcen

Seedt

Random stringm

55

ExtractorsExtractors

2n 2m

2t

E

HighHigh Min-Entropy Min-Entropy distributiondistribution

Uniform-distribution Uniform-distribution seedseed

Close to Close to uniform outputuniform output

66

Next Bit PredictorsNext Bit Predictors

Claim:Claim: to prove to prove EE is an extractor, it suffices is an extractor, it suffices to prove that for all to prove that for all 0<i<m+10<i<m+1 and all and all predictorspredictors ff::i-1i-1

Proof:Proof: Assume Assume E E is not an extractor; then is not an extractor; then exists a distribution s.t. exists a distribution s.t. X X s.t. s.t. E(X,UE(X,Utt)) is is notnot -close to -close to UUmm, that is:, that is:

t t1...i 1 i

1Pr f E X,U E X,U

2 m

t t1...i 1 i

1Pr f E X,U E X,U

2 m

t m

m

s~U ,x~X y~U

A 0,1

P Pr E x,s A Pr y A

t m

m

s~U ,x~X y~U

A 0,1

P Pr E x,s A Pr y A

77

ProofProof

Now define the following hybrid distributions:Now define the following hybrid distributions:

0 m

1 t m 11

i 1 t m i 11..i 1

i t m i1..i

m t 1..m

H U

H E X,U U

...

H E X,U U

H E X,U U

...

H E X,U

0 m

1 t m 11

i 1 t m i 11..i 1

i t m i1..i

m t 1..m

H U

H E X,U U

...

H E X,U U

H E X,U U

...

H E X,U

88

ProofProofSumming the probabilities for the event Summing the probabilities for the event

corresponding to the set corresponding to the set AA for all distributions for all distributions yields:yields:

And because And because |∑a|∑aii|≤ ∑|a|≤ ∑|aii|| there exists an index there exists an index 0<i<m+10<i<m+1 for which: for which:

i i 1

m 0

m

x~H x~Hi 0

x~H x~H

Pr x A Pr x A

Pr x A Pr x A P ε

i i 1

m 0

m

x~H x~Hi 0

x~H x~H

Pr x A Pr x A

Pr x A Pr x A P ε

i 1 i

i i 1x~H x~H

H(A) H (A) Pr x A Pr x Am

i 1 ii i 1

x~H x~HH(A) H (A) Pr x A Pr x A

m

99

The PredictorThe Predictor

We now define a function We now define a function f:f:i-i-

11that can predict the that can predict the ii’th bit with ’th bit with probability at least probability at least ½+½+/m /m (“a next bit (“a next bit predictor”):predictor”):

The function The function ff uniformly and independently uniformly and independently draws the bits draws the bits yyii,…,y,…,ymm and outputs: and outputs:

NoteNote: the above definition is not : the above definition is not constructive, as constructive, as AA is not known! is not known!

i 1 i 1 i m1 i 1

i

y x ,...,x ,y...,y Af x ,...,x

y otherwise

i 1 i 1 i m1 i 1

i

y x ,...,x ,y...,y Af x ,...,x

y otherwise

1010

ProofProof

And And ffis indeed a next bit predictor:is indeed a next bit predictor:

Q.E.D.Q.E.D.

1 i 1 i

1 i 1 i m i i 1 i 1 i m i i

1 i 1 i i 1 m i i 1 i 1 i m i i

i i 1 i

i i 1

Pr f x ...x x

Pr x ...x y...y A y x Pr x ,...,x ,y,...y A y x

Pr x ...x xy ...y A y x 1 Pr x ,...,x ,y,...y A y x

1 1 1H A 1 H A H A

2 2 21

H A H A2

12 m

1 i 1 i

1 i 1 i m i i 1 i 1 i m i i

1 i 1 i i 1 m i i 1 i 1 i m i i

i i 1 i

i i 1

Pr f x ...x x

Pr x ...x y...y A y x Pr x ,...,x ,y,...y A y x

Pr x ...x xy ...y A y x 1 Pr x ,...,x ,y,...y A y x

1 1 1H A 1 H A H A

2 2 21

H A H A2

12 m

1111

Basic Example – Basic Example – Safra, Ta-Shma, ZukermanSafra, Ta-Shma, Zukerman

ConstructionConstruction: : Let Let BC:FBC:F{0,1}{0,1}ss be a (inefficient) binary- be a (inefficient) binary-

codecode Given Given

xx, a weak random source, interpreted as a , a weak random source, interpreted as a polynomial polynomial :F:F22FF and and

ss, a seed, interpreted as a random point , a seed, interpreted as a random point (a,b)(a,b), , and an index and an index jj to a binary code. to a binary code.

DefDef:: j j j

E x,s BC a,b ,BC a,b 1 ,...,BC a,b m j j j

E x,s BC a,b ,BC a,b 1 ,...,BC a,b m

1212

Basic Example – Basic Example – Illustration of ConstructionIllustration of Construction

x x s = ((a,b), 2)s = ((a,b), 2)

E(x,s)=01001E(x,s)=01001

001 110 000 101 110

(inefficient) binary code

(a,b) (a,b+m)(a,b+1)

(a,b)(a,b) (a,b+1)(a,b+1) (a,b+m)(a,b+m)

001 110 000 101 110

1313

Basic Example – Basic Example – Proof SketchProof Sketch

Assume, by way of contradiction:Assume, by way of contradiction:exists a exists a next bit predicatornext bit predicator function function ff..

Next, show a Next, show a reconstructionreconstruction function function

RR

Conclude, a contradiction!Conclude, a contradiction!(to the min-entropy assumption of (to the min-entropy assumption of XX))

12

t ti 1...i 1Pr E X,U f E X,U l

1

2t ti 1...i 1

Pr E X,U f E X,U l

f

x X

1Pr z.R (z) x 2

f

x X

1Pr z.R (z) x 2

1414

Basic Example – Basic Example – Reconstruction FunctionReconstruction Function

Random line List decoding by

the predictor fResolve into one value on the line

Repeat using the new points, until all FFdd is evaluated

h ~ nh ~ n1/21/2

j ~ lgnj ~ lgnm ~ desired entropym ~ desired entropy

“advice”““Few” red Few” red

points: points: a=mjO(h)a=mjO(h)

1515

2n

X

For For YY X X, let , let (Y)=(Y)=yyYYPr[y] Pr[y] (“the weight of (“the weight of YY”)”)

Let Let R:{0,1}R:{0,1}aann, s.t. , s.t. PrPrx~Xx~X[[z R(z)=x]z R(z)=x] 1/2 1/2

(for a uniform (for a uniform XX, , |R(S)| |R(S)| |X|/2 |X|/2 ) ) For an arbitrary distribution For an arbitrary distribution XX, , (R(S)) (R(S)) (X)/2(X)/2 Let Let X ~ X ~ min-entropy min-entropy k k, ,

then then (R(S))(R(S)) 22a-ka-k (there are at most (there are at most 22aa strings in strings in R(S)R(S), and , and xxX Pr[x] X Pr[x] 2 2-k-k))

and therefore and therefore k k a - log a - log22(1/2)(1/2) ((1 = 1 = (X) (X) (R(S)) (R(S)) 22 22a-ka-k 22-1 -1 a-k a-k hence hence k k a+1 a+1))

Counting ArgumentCounting Argument

22aa

SS

R(S)R(S)R

1616

Problems with Problems with Safra, Ta-Shma, ZukermanSafra, Ta-Shma, Zukerman

Curse of dimensionality - too many Curse of dimensionality - too many lines!lines!Solution: generator matrix.Solution: generator matrix.

1717

Next-q-it List-PredictorNext-q-it List-Predictor

ff is allowed to output a small list of is allowed to output a small list of ll possible next elementspossible next elements

1818

q-ary Extractorq-ary Extractor

Def:Def: Let Let FF be a field with be a field with qq elements. elements.

A A (k, l)(k, l) qq-ary extractor-ary extractor is a function is a functionE:E: n n ttFFmm

s.t. for all R.V. s.t. for all R.V. XX with min-entropy with min-entropy ≥k≥k

and all and all 0<i<m0<i<m

and all list-predictors and all list-predictors f:Ff:Fi-1i-1FFll

t ti 1...i 11Pr E X,U f E X,U

l t ti 1...i 1

1Pr E X,U f E X,Ul

1919

Generator MatrixGenerator Matrix

Def:Def: Define the Define the generator matrixgenerator matrix for the for the vector space vector space FFdd as a matrix as a matrix AAd×dd×d, s.t. for , s.t. for any non-zero vector any non-zero vector vvFFdd: :

(that is, any vector (that is, any vector 0≠v0≠vFFdd multiplied by all multiplied by all powers of powers of AA generates the entire vector generates the entire vector space space FFd d except for except for 00))

Lemma:Lemma: Such a generator matrix exists and Such a generator matrix exists and can be found in time can be found in time qqO(d)O(d)..

i d

iA v F \ 0 i d

iA v F \ 0

2020

ConstructionConstruction

Let Let FF be a field with be a field with qq elements, elements, Let Let FFdd be a vector space over be a vector space over FF. . Let Let hh be the smallest integer s.t. be the smallest integer s.t. For For xx nn, , let let denote the unique denote the unique dd-variate -variate

polynomial of total degree polynomial of total degree h-1h-1 whose coefficients whose coefficients are specified by are specified by xx..

h d nd logq

h d nd logq

Note that for such a polynomial, the number of coefficients is exactly:

(“choosing where to put d-1 bars between h-1 balls”)

h d nd logq

h d nd logq

2121

ConstructionConstruction

The definition of the The definition of the qq-ary extractor: -ary extractor: E:E: nn d log qd log qFFmm

1 2 mE x,v v , A v , A v ,..., A v 1 2 mE x,v v , A v , A v ,..., A v

AAmmvv

vv

AAiivv(v)(v)

(A(Aiiv)v)

(A(Ammvv)

FFdd

vv AAiivv AAmmvv

seed, seed, interpreted as interpreted as a vector a vector vv F Fdd

Generator Generator matrixmatrix

2222

Main TheoremMain Theorem

Thm:Thm: For any For any nn,,qq,,dd and and hh as as previously defined, previously defined, EE is a is a (k, l)(k, l) qq-ary -ary extractor if:extractor if:

Alternatively, Alternatively, EE is a is a (k, l)(k, l) qq-ary extractor if:-ary extractor if:

2 2 2

k mhdlogq log l

q h d l

2 2 2

k mhdlogq log l

q h d l

2

2

k mhdlog q log l

q l hdlogq

2

2

k mhdlog q log l

q l hdlogq

2323

What’s AheadWhat’s Ahead

Proving existence of a generator Proving existence of a generator matrixmatrix

How the counting argument worksHow the counting argument works The reconstruction paradigmThe reconstruction paradigm Basic example – Basic example – Safra, Ta-Shma, Safra, Ta-Shma,

ZukermanZukerman Proof of the main theoremProof of the main theorem From extractors to PRGsFrom extractors to PRGs

2424

Extension FieldsExtension Fields

A field A field F2F2 is called an extension of another field is called an extension of another field FF if if FF is contained in is contained in F2F2 as a subfield. as a subfield.

ThmThm: For every power : For every power ppkk ( (pp prime, prime, k>0k>0) there is a ) there is a uniqueunique (up to isomorphism) finite field containing (up to isomorphism) finite field containing ppkk elements. These fields are denoted elements. These fields are denoted GF(pGF(pkk))..All finite fields’ cardinality have that form.All finite fields’ cardinality have that form.

DefDef: A polynomial is called : A polynomial is called irreducibleirreducible in in GF(p)GF(p) if it if it does not factor over does not factor over GF(p)GF(p)

ThmThm: Let : Let f(x)f(x) be an irreducible polynomial of degree be an irreducible polynomial of degree kk over over GF(p)GF(p). The finite field . The finite field GF(pGF(pkk)) can be can be constructed using the set of degree constructed using the set of degree k-1k-1 polynomials over polynomials over ZZpp, with addition and , with addition and multiplication carried out modulo multiplication carried out modulo f(x)f(x)

2525

Extension Fields - ExampleExtension Fields - Example

Construct Construct GF(2GF(255)) as follows: as follows:

Let the irreducible polynomial be:Let the irreducible polynomial be:

Represent every Represent every kk degree polynomial as a vector of degree polynomial as a vector of k+1k+1 coefficient: coefficient:

Addition over this field:Addition over this field:

1)( 234 xxxxxf

)1(

)1(23

34

xxx

xxx

)1,1,1,1,1(1)( 234 xxxxxf

)0,0,1,0,1(

________

)1,1,1,1,0(

)1,1,0,1,1(

2626

Extension Fields - ExampleExtension Fields - Example

And multiplication:And multiplication:

And now modulo the irreducible polynomial:And now modulo the irreducible polynomial:

)1(

)1(3

34

xx

xxx

11110101

_________

___11011

__00000

_11011

11011

_________

)1,1,0,1,0(

)1,1,0,1,1(

)1( 34 xx

124567 xxxxx

1

mod

1

234

24567

xxxx

xxxxx

2727

Generator Matrix – Generator Matrix – Existence ProofExistence Proof

Denote byDenote by GF GF**(q(qdd)) the multiplicative group of the multiplicative group of the Galois Field the Galois Field GF(qGF(qdd).).

This multiplicative group of the Galois Field This multiplicative group of the Galois Field is cyclic, and thus has a generator is cyclic, and thus has a generator gg::

Let Let be the natural isomorphism between be the natural isomorphism between

the Galois Field the Galois Field GF(qGF(qdd) ) and the vector and the vector spacespace F Fdd, which matches a polynomial with , which matches a polynomial with its vector of coefficients:its vector of coefficients:

i d * dg | 0 i q GF q i d * dg | 0 i q GF q

4 3(x x x 1) (1,1,0,1,1) 4 3(x x x 1) (1,1,0,1,1)

2828


Now define the Now define the generator matrix generator matrix AA of of FFdd as the as the linear transformation that corresponds to linear transformation that corresponds to multiplication by the generator in multiplication by the generator in GFGF**(q(qdd)) : :

AA is a linear transformation because of the is a linear transformation because of the distributive property of both the vector space and distributive property of both the vector space and the field the field GF(qGF(qdd)), according to the isomorphism , according to the isomorphism properties:properties:

1 2

1 2

A u u g x f x h x

g x f x g x h x

g x f x g x h x

A u A u

1 2

1 2

A u u g x f x h x

g x f x g x h x

g x f x g x h x

A u A u

d 1u F .Au g u d 1u F .Au g u

2929


It remains to show that the It remains to show that the generator matrix generator matrix AA of of FFdd can be found in time can be found in time qqO(d)O(d). .

And indeed:And indeed: The Galois Field The Galois Field GF(qGF(qdd)) can be constructed in time can be constructed in time

qqO(d)O(d) using an irreducible polynomial of degree using an irreducible polynomial of degree dd over the field over the field ZZqq (and such a polynomial can also (and such a polynomial can also be found in time be found in time qqO(d)O(d) by exhaustive search). by exhaustive search).

The generator ofThe generator of GF(q GF(qdd)) can be found in time can be found in time qqO(d)O(d) by exhaustive searchby exhaustive search

Using the generator, for any basis of Using the generator, for any basis of FFdd, one can , one can construct construct dd independent equations so as to find independent equations so as to find the linear transformation the linear transformation AA.. This linear equation This linear equation system is also solvable in time system is also solvable in time qqO(d)O(d) . .

3030

““Reconstruction Proof Reconstruction Proof Paradigm”Paradigm”

Proof sketch:Proof sketch: For a certain R.V. For a certain R.V. XX with min-entropy at least with min-entropy at least kk, , assume a function assume a function f f that violates the properties of a that violates the properties of a

qq-ary extractor, -ary extractor,

construct another function, construct another function, R :R :aann, the , the ““reconstruction functionreconstruction function”. ”.

This function, using This function, using ff as a procedure, has the as a procedure, has the property that:property that:

Applying the “counting argument”, this is a Applying the “counting argument”, this is a contradiction to the assumption that contradiction to the assumption that XX has min- has min-entropy at least entropy at least kk

f

x~X

1Pr z.R z x 2 f

x~X

1Pr z.R z x 2

3131

Proof SketchProof Sketch Let Let XX be a random variable with min- be a random variable with min-

entropy at least entropy at least kk Assume, by way of contradiction:Assume, by way of contradiction:

exists a exists a next bit predicatornext bit predicator function function ff..

Next, show a Next, show a reconstructionreconstruction function function RR

Conclude, a contradiction!Conclude, a contradiction!(to the min-entropy assumption of (to the min-entropy assumption of XX))

f

x X

1Pr z.R z x 2 f

x X

1Pr z.R z x 2

12

t ti 1...i 1Pr E X,U f E X,U l

1

2t ti 1...i 1

Pr E X,U f E X,U l

3232

Main LemmaMain Lemma

Lemma:Lemma: Let Let n,q,d,hn,q,d,h be as in the main be as in the main theorem. There exists a probabilistic theorem. There exists a probabilistic function function R:R:aann with with a = O(mhd a = O(mhd logq)logq) such that for every such that for every xx on which: on which:

The following holds (the probability is over The following holds (the probability is over the random coins of the random coins of RR):):

12

1...i 1 ijy

1Pr j.f E x,y E x,y l2

12

1...i 1 ijy

1Pr j.f E x,y E x,y l2

f 1Pr z.R z x

2 f 1

Pr z.R z x2

3333

The Reconstruction Function The Reconstruction Function (R)(R)

TaskTask: allow many strings : allow many strings xx in the support in the support of of XX to be reconstructed from very short to be reconstructed from very short advice strings.advice strings.

OutlinesOutlines: : Use Use ff in a sequence of prediction steps in a sequence of prediction steps

to evaluate to evaluate on on all pointsall points of of FFdd,.,. Interpolate to recover coefficients of Interpolate to recover coefficients of , , which giveswhich gives x x

Next We ShowNext We Show: there exists a : there exists a sequence of sequence of prediction stepsprediction steps that works for that works for manymany xx in in the support of the support of XX and requires and requires fewfew advice advice stringsstrings

3434

CurvesCurves Let Let r=r=(d)(d), , Pick random vectors and valuesPick random vectors and values

2r2r random points random points yy11,…,y,…,y2r2rFFdd, and, and 2r2r values values tt11,…,t,…,t2r2rFF, and, and

Define degree Define degree 2r-12r-1 polynomials polynomials pp11,p,p22 pp11:F:FFFdd defined by defined by pp11(t(tii)=y)=yii, , i=1,..,2ri=1,..,2r.. pp22:F:FFFdd defined by defined by pp22(t(tii)=Ay)=Ayii, , i=1,..,ri=1,..,r, and , and pp22(t(tii)=y)=yii, , i=r+1,..,2ri=r+1,..,2r..

Define vector sets Define vector sets PP11={p={p11(z)}(z)}zzFF and and PP22={p={p22(z)}(z)}zzFF

i>0i>0 define define PP2i+12i+1=AP=AP2i-12i-1 and and PP2i+22i+2=AP=AP2i2i(({Pi}{Pi}, the , the sequence of prediction stepssequence of prediction steps are low-degree are low-degree curves in curves in FFdd, chosen using the coin tosses of , chosen using the coin tosses of RR))

3535t1 t2 tr tr+1 t2r F

Fd

y1

y2

yr

yr+1

y2r

AAiivv

vv

AAmmvv

vv

AAiivv

AAmm

vv

A(y1)

A(y2)

A(yr)A(yr+1)

A(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)Ai*(yr+1)

Ai*(y2r)

A2(y1)

A2(y2)

A(yr)A2(yr+1)

A2(y2r)

A(y1)

A(y2)

A(yr)

yr+1

y2r

A2(y1)

A2(y2)

A2(yr)

A(yr+1))

A(y2r)

A3(y1)

A3(y2)

A3(yr)

A2(yr+1))

A2(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)

Ai*-1(yr+1))

Ai*-1(y2r)

CurvesCurves

3636

Simple ObservationsSimple Observations AA is non-singular linear-transform, hence is non-singular linear-transform, hence ii

PPii is is 2r-wise independent 2r-wise independent collection of pointscollection of points PPii and and PPi+1i+1 intersect at intersect at rr random points random points |Pi|Pi is a univariate polynomial of degree at most is a univariate polynomial of degree at most

2hr2hr.. Given evaluation of Given evaluation of on on Av,AAv,A22v,…,Av,…,Ammvv, we , we

may use the predictor function may use the predictor function ff to predict to predict (A(Am+1m+1v) v) to within to within ll values. values.

We needWe need advice stringadvice string: : 2hr2hr coefficients of coefficients of |Pi|Pi for for i=1,…,mi=1,…,m. . (l(length: at most mhr log q ≤ a))

3737t1 t2 tr tr+1 t2r F

Fd

y1

y2

yr

yr+1

y2r

vv

AAiivv

AAmm

vv

A(y1)

A(y2)

A(yr)A(yr+1)

A(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)Ai*(yr+1)

Ai*(y2r)

A2(y1)

A2(y2)

A(yr)A2(yr+1)

A2(y2r)

A(y1)

A(y2)

A(yr)

yr+1

y2r

A2(y1)

A2(y2)

A2(yr)

A(yr+1))

A(y2r)

A3(y1)

A3(y2)

A3(yr)

A2(yr+1))

A2(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)

Ai*-1(yr+1))

Ai*-1(y2r)

Using N.B.P.Using N.B.P.

Cannot resolve into one value!

3838


t1 t2 tr tr+1 t2r F

Fd

y1

y2

yr

yr+1

y2r

vv

AAiivv

AAmm

vv

A(y1)

A(y2)

A(yr)A(yr+1)

A(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)Ai*(yr+1)

Ai*(y2r)

A2(y1)

A2(y2)

A(yr)A2(yr+1)

A2(y2r)

A(y1)

A(y2)

A(yr)

yr+1

y2r

A2(y1)

A2(y2)

A2(yr)

A(yr+1))

A(y2r)

A3(y1)

A3(y2)

A3(yr)

A2(yr+1))

A2(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)

Ai*-1(yr+1))

Ai*-1(y2r)

Ai*+1(y1)

Ai*+1(y2)

Ai*+1(yr)

Can resolve into one value using the second curve!

3939


t1 t2 tr tr+1 t2r F

Fd

y1

y2

yr

yr+1

y2r

vv

AAiivv

AAmm

vv

A(y1)

A(y2)

A(yr)A(yr+1)

A(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)Ai*(yr+1)

Ai*(y2r)

A2(y1)

A2(y2)

A(yr)A2(yr+1)

A2(y2r)

A(y1)

A(y2)

A(yr)

yr+1

y2r

A2(y1)

A2(y2)

A2(yr)

A(yr+1))

A(y2r)

A3(y1)

A3(y2)

A3(yr)

A2(yr+1))

A2(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)

Ai*-1(yr+1))

Ai*-1(y2r)

Ai*+1(y1)

Ai*+1(y2)

Ai*+1(yr)

Can resolve into one value using the second curve!

yr+1

y2r

4040

Main Lemma Proof Cont.Main Lemma Proof Cont.

ClaimClaim: with probability at least : with probability at least 1-1/8q1-1/8qdd over the over the coins tosses of coins tosses of RR: :

ProofProof: We use the following : We use the following tail boundtail bound::

Let Let t>4t>4 be an even integer, and be an even integer, and X1,…,XnX1,…,Xn be be tt--wise independent R.V. with values in wise independent R.V. with values in [0,1][0,1]. Let . Let X=X=XiXi, , =E[X]=E[X], and , and A>0. A>0. Then:Then:

i

i* 1 1j

z P

1Pr j.f A z ,..., A z z

4 l

i

i* 1 1j

z P

1Pr j.f A z ,..., A z z

4 l

t / 22

2

t tPr X A 8

A

t / 22

2

t tPr X A 8

A

4141


According to the next bit predictor, the probability According to the next bit predictor, the probability for successful prediction is at least for successful prediction is at least 1/2√l1/2√l..

In the In the ii’th iteration we make ’th iteration we make qq predictions (as predictions (as many points as there are on the curve).many points as there are on the curve).

Using the tail bounds provides the result.Using the tail bounds provides the result.

Q.E.D (of the claim).Q.E.D (of the claim).

Main Lemma Proof (cont.)Main Lemma Proof (cont.): Therefore, w.h.p. there : Therefore, w.h.p. there are at least are at least q/4√lq/4√l evaluations points of evaluations points of PPii that that agree with the degree agree with the degree 2hr2hr polynomial on the polynomial on the ii’th ’th curve (out of a total of at most curve (out of a total of at most lqlq). ).

4242

Main Lemma Proof Cont.Main Lemma Proof Cont. A list decoding boundA list decoding bound: given : given n n distinct pairs distinct pairs

(x(xii,y,yii)) in field in field FF and Parameters and Parameters kk and and dd, with , with k>(2dn)k>(2dn)1/21/2, There are at most , There are at most 2n/k2n/k degree degree dd polynomials polynomials gg such that such that g(xg(xii)=y)=yii for at least for at least kk pairs. pairs.

Furthermore, a list of all such polynomials can Furthermore, a list of all such polynomials can be computed in time be computed in time poly(n,log|F|)poly(n,log|F|)..

Using this bound and the previous claim, at Using this bound and the previous claim, at most most 8l8l3/23/2 degree degree 2rh 2rh polynomials agree on this polynomials agree on this number of points (number of points (q/4√lq/4√l ). ).

4343

Lemma Proof Cont.Lemma Proof Cont.

Now, Now, PPii intersect intersect PPi-1i-1 at at rr random positions, and random positions, and we know the evaluation of we know the evaluation of at the points in at the points in PPi-1i-1

Two degree Two degree 2rh2rh polynomials can agree on at polynomials can agree on at most most 2rh/q2rh/q fraction of their points, fraction of their points,

So the probability that an “incorrect” So the probability that an “incorrect” polynomial among our candidates agrees on polynomial among our candidates agrees on all all rr random points in at most random points in at most

dr

qq

rhl

8

1)

2)(8( 2/3

4444


So, with probability at leastSo, with probability at least we learn points we learn points PPii successfully. successfully.

After After 2q2qdd prediction steps, we have prediction steps, we have learned learned on on FFdd\{0}\{0} (since (since AA is a is a generatorgenerator of of FFdd\{0}\{0}))

by the by the union boundunion bound, the probability that , the probability that every step of the reconstruction is every step of the reconstruction is successful is at least successful is at least ½½..

Q.E.D Q.E.D (main lemma)(main lemma)

dq8

11

4545

First,First, By averaging argument:By averaging argument:

Therefore, there must be a fixing of Therefore, there must be a fixing of the coins of the coins of RR, such that:, such that:

Proof of Main Theorem Cont.Proof of Main Theorem Cont.

llyxEyxEfj ijiyXx

2/12/1),()),((.PrPr *1*...1

llyxEyxEfj ijiyXx

2/12/1),()),((.PrPr *1*...1

lyxEyxEfj ijiyXx

/1]),()),((.[Pr *1*...1,

lyxEyxEfj iji

yXx/1]),()),((.[Pr *1*...1

,

ll

xzRz f

Xx 4

1

2

1

2

1)(.Pr

llxzRz f

Xx 4

1

2

1

2

1)(.Pr

4646

Using N.B.P. – Take 2Using N.B.P. – Take 2

t1 t2 tr tr+1 t2r F

Fd

y1

y2

yr

yr+1

y2r

vv

AAiivv

AAmm

vv

A(y1)

A(y2)

A(yr)A(yr+1)

A(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)Ai*(yr+1)

Ai*(y2r)

A2(y1)

A2(y2)

A(yr)A2(yr+1)

A2(y2r)

A(y1)

A(y2)

A(yr)

yr+1

y2r

A2(y1)

A2(y2)

A2(yr)

A(yr+1))

A(y2r)

A3(y1)

A3(y2)

A3(yr)

A2(yr+1))

A2(y2r)

Ai*(y1)

Ai*(y2)

Ai*(yr)

Ai*-1(yr+1))

Ai*-1(y2r)

Ai*+1(y1)

Ai*+1(y2)

Ai*+1(yr)

Unse N.B.P over all points in F, so that we

get enough ”good evaluation”

4747

Proof of Main Theorem Cont.Proof of Main Theorem Cont.

According to the counting argument, this implies According to the counting argument, this implies that: that:

Recall that Recall that r=r=(d).(d). A contradiction to the parameter choice:A contradiction to the parameter choice:

Q.E.D (main theorem)!Q.E.D (main theorem)!

)log2()4

log()4

log( qmhrOadvicek

)log2()4

log()4

log( qmhrOadvicek

)1

log()log(l

qmhdk )1

log()log(l

qmhdk

4848

4949

From q-ary extractors to From q-ary extractors to (regular) extractors(regular) extractors

The simple technique - using error correcting codes:The simple technique - using error correcting codes:

Lemma:Lemma: Let Let FF be a field with be a field with qq elements. Let elements. Let C:C:k=log(q)k=log(q)nn be a binary error correcting be a binary error correcting code with distance at least code with distance at least 0.5-O(0.5-O(22) ) . If . If

E: E: nnttFFmm is a is a (k,O((k,O()))) q-ary extractor, q-ary extractor, then then

E’: E’: nnt+log(n)t+log(n)FFmm defined by: defined by:

1 j m jE'(x;(y, j)) C(E(x;y) ) ... C(E(x;y) ) Is a Is a (k,(k,m)m) binary extractor. binary extractor.

5050


A more complex transformation from q-ary A more complex transformation from q-ary extractors to binary extractors achieves the extractors to binary extractors achieves the following parameters:following parameters:

Thm:Thm: Let Let FF be a field with be a field with q<2q<2mm elements. There is elements. There is a polynomial time computable function:a polynomial time computable function:

*logq log m 1O(log ) (mlog )

mB: F {0,1} {0,1}

Such that for any Such that for any (k,(k,)) q-ary extractor E, q-ary extractor E, E’(x;E’(x;(y,j))=B(E(x;y),j)(y,j))=B(E(x;y),j) is a is a (k,(k,log*m)log*m) binary extractor. binary extractor.

5151


The last theorem allows using theorem The last theorem allows using theorem 1 for 1 for = O( = O(/log*m)/log*m) , and implies a , and implies a (k,(k,)) extractor with seed length extractor with seed length t=O(log n)t=O(log n) and output length and output length m=k/(log n)m=k/(log n)O(1)O(1)

5252

Extractor Extractor PRG PRG Identify: Identify:

string string xx{0,1}{0,1}log nlog n with the with the function function x:{0,1}x:{0,1}log nlog n{0,1}{0,1} by setting by setting x(i)=xx(i)=xii

Denote by Denote by S(x)S(x) the size of the smallest circuit the size of the smallest circuit computing function computing function xx

Def (PRG)Def (PRG): an : an -PRG-PRG for size for size ss is a function is a function G:G:{0,1}{0,1}tt{0,1}{0,1}mm with the following property: with the following property: 11iimm and all function and all function f:{0,1}f:{0,1}i-1i-1{0,1}{0,1}ii with size with size ss circuits, circuits,

Pr[f(G(UPr[f(G(Utt))1...i-11...i-1)=G(U)=G(Utt))ii] ] ½ + ½ + /m/mThis imply:This imply:for all size for all size s-O(1)s-O(1) circuits circuits CC

|Pr[C(G(Ut))=1] – Pr[C(Um)=1]||Pr[C(G(Ut))=1] – Pr[C(Um)=1]|

5353

q-ary PRGq-ary PRG

Def (q-ary PRG)Def (q-ary PRG): Let : Let FF be the field with be the field with qq elements. A elements. A --qq-ary PRG-ary PRG for size for size ss is a is a function function G:{0,1}G:{0,1}ttFFmm with the following with the following property: property: 11iimm and all function and all function f:Ff:Fi-i-

11FF((-2)-2) with size with size ss circuits, circuits,

Pr[Pr[j f(G(Uj f(G(Utt))1...i-11...i-1))jj=G(U=G(Utt))ii] ]

FactFact:: O( O()-q)-q-ary PRG for size -ary PRG for size ss can be can be transformed into (regular) transformed into (regular) mm--PRG for size PRG for size not much smaller than not much smaller than ss

5454

The ConstructionThe Construction

Plan for building a PRG Plan for building a PRG GGxx:{0,1}:{0,1}tt {0,1} {0,1}mm:: use a hard function use a hard function x:{0,1}x:{0,1}log nlog n {0,1} {0,1} let let be the low-degree extension of be the low-degree extension of xx obtain obtain ll “candidate” PRGs, where “candidate” PRGs, where l=d(log l=d(log

q / log m) q / log m) as follows:as follows:For For 00j<lj<l define define GGxx

(j)(j):{0,1}:{0,1}d log qd log q F Fmm by byGGxx

(j)(j)(v) = (v) = (A(A11mmjjv) v) (A(A22mmjj

v) v) ...... (A(AMMmmjjv)v)

where where AA is a generator of is a generator of FFdd\{0}\{0}

Note: Note: GGxx(j)(j) corresponds to using our corresponds to using our qq-ary -ary

extractor construction with the “successor extractor construction with the “successor function” function” AAmmjj

We show: We show: xx is hard is hard at least one at least one GGxx

(j)(j) is a is a qq-ary PRG-ary PRG

5555

Getting into DetailsGetting into Details

Let Let F’F’ be a subfield of be a subfield of FF of size of size hhLemmaLemma: there exist invertible : there exist invertible dddd

matrices matrices AA and and A’A’ with entries from with entries from FF which satisfy:which satisfy:

vvFFdd s.t. v s.t. v0, {A0, {Aiiv}v}ii=F=Fdd\{0}\{0} vvF’F’dd s.t. v s.t. v0, {A’0, {A’iiv}v}ii=F’=F’dd\{0}\{0} A’=AA’=App for for p=(qp=(qdd-1)/(h-1)/(hdd-1)-1) AA and and A’A’ can be found in time can be found in time qqO(d)O(d)

think of think of FFdd as both a vector space and the as both a vector space and the extension field of extension field of FF

Note Note F’F’dd is a subset of is a subset of FFddperhaps we should just say: immediate perhaps we should just say: immediate from the correspondence between the from the correspondence between the cyclic group GF(qcyclic group GF(qdd) and F) and Fdd\{0} ??? \{0} ??? otherwise in details we may say:otherwise in details we may say:

ProofProof: : There exists a natural correspondence There exists a natural correspondence between between FFdd and and GF(qGF(qdd)), and between , and between F’F’dd and and GF(hGF(hdd)),,GF(qGF(qdd)) is cyclic of order qd-1, i.e. there here exists a generator exists a generator ggggpp generates the generates the uniqueunique subgroup of subgroup of order order hhdd-1-1, the multiplicative group of , the multiplicative group of GF(hGF(hdd))..AA and and A’A’ are the linear transforms are the linear transforms corresponding to corresponding to gg and and ggpp respectively. respectively.

5656

require require hhdd>n>n Define Define as followsas follows (A’(A’ii11)=x(i))=x(i), where , where 11 is is

the all the all 11 vector (low degree extension). vector (low degree extension). Recall: For Recall: For 00j<lj<l define define GGxx

(j)(j):{0,1}:{0,1}d log qd log q FFmm by byGGxx

(j)(j)(v) = (v) = (A(A11mmjjv) v) (A(A22mmjj

v) v) ...... (A(AMMmmjjvv

Theorem (PRG main)Theorem (PRG main): for every : for every nn,,dd, and , and hh satisfying satisfying hhdd>n>n, at least one of , at least one of GGxx

(j)(j) is an is an --qq-ary PRG for size -ary PRG for size ((-4 -4 h dh d22 log log22q). q). Furthermore, all the Furthermore, all the GGxx

(j)(j)ss are computable are computable in time in time poly(qpoly(qdd,n),n) with oracle access to with oracle access to xx..

sincesince h hdd>n>n, there are enough “slots” to , there are enough “slots” to embed all embed all xx in a in a dd dimensional cube of dimensional cube of size size hhdd

and since and since A’ A’ generates generates F’F’dd\{0}\{0}, indeed , indeed xx is embedded in a is embedded in a dd dimensional cube of dimensional cube of size size hhdd

Note Note hh denotes the degree denotes the degree in individual individual variables, and the total degree is at most variables, and the total degree is at most hdhd

The computation of The computation of from from xx can be done can be done in in poly(n,qpoly(n,qdd)=q)=qO(d) O(d) timetime

5757

5858

5959

Extension FieldExtension Field

DefDef: if : if FF is a subset of is a subset of EE, then we say , then we say that that EE is an is an extension fieldextension field of of FF..

LemmaLemma: let: let EE be an be an extension fieldextension field of of FF,, f(x)f(x) be a polynomial over be a polynomial over FF ((i.e.i.e.

f(x)f(x)F[X]F[X])),, ccEE,,

then then f(x)f(x)f(c)f(c) is an is an homomorphism homomorphism of of F[X]F[X] into into EE..

6060

Construction of the Galois Field Construction of the Galois Field GF(qGF(qdd))

ThmThm: let : let p(x)p(x) be irreducible in be irreducible in F[X]F[X], , then there exists then there exists EE, an extension , an extension field of field of FF, where there exists a root of , where there exists a root of p(x)p(x)..

Proof SketchProof Sketch: : add a add a (a new element) to F. (a new element) to F. is to be a root of p(x). is to be a root of p(x).

In F[In F[] (polynomials with variable ] (polynomials with variable ))

6161

Example: Example: F=realsF=reals p(x)=xp(x)=x22+1+1

Documents

Simple Extractors for all Min-Entropies