Error Detection and Correction in Computationally Bounded World
Explore the world of binary codes for error detection and correction in a computationally bounded setting, including topics like error correction codes, cryptography, and dealing with adversarial channels. Learn about limitations, prior work, and the concept of seeded codes for enhanced security and reliability.
Uploaded on | 0 Views
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Binary Codes for Error Detection and Correction in a Computationally Bounded World Jad Silbak Northeastern University Daniel Wichs Northeastern University
Error Correction Codes and Cryptography Cryptography Error Correction Codes This Talk Secret Sharing and MPC, Hardcore Bits, Multi-Server PIR, PCPs and Succinct Arguments, Code-based Crypto (McEliece, LPN),
Binary Error Correcting Codes ? ? ? = Channel ? = ? ? Induces errors ? 0,1? ???( ?) ? = ???(?) ? ? Detect: Output if codeword was changed Hamming channels: Can change any ?? bits in ??? ? . The channel is an information theoretic adversary that depends on ??? ? .
Computationally Bounded Adversaries ? ? ? = Channel ? = ? ? Induces errors ? 0,1? ???( ?) ? = ???(?) ? ? Detect: Output if codeword was changed Hamming channels: Can change any ?? bits in ??? ? . The channel is an information theoretic adversary that depends on ??? ? . This work: Codes for channels that are (non-uniform) probabilistic polytime (PPT) algorithms that induce at most ?? errors. Introduced by [Lip94]. Models real life . Hope: Better rates than what is information theoretically possible.
Limitations on bounded channels Codes against Information theoretic channel Codes against nonuniform PPTchannels Implies Solution: 1. Encoding has access to randomness. 2. Decoding succeeds only with high probability. ??? ? = ? ?? ?? ? ? = ? ? ? ?
Prior Work: Secret Setup [Lip94] Lipton: Shared secret key. [MPSW10] Micali, Peikert, Sudan, and Wilson: Public-key infrastructure.
Prior Work: More Recent Results Large alphabet: [SW24] optimal result under OWF/CRH without setup/CRS. Seeded codes: [GHY20] Grossman, Holmgren and Yogev Encoding and Decoding have access to a common reference string CRS. [GHY20] Constructed such codes form a strong form of two-input correlation intractability (instantiated in the random oracle model). This work: Binary seeded codes under standard assumptions.
Seeded Codes ? is uniformly chosen ? also receive ? ? is a PPT algorithm. ? = ? ?,? s.t.? ?,? ?. ? = ????(?) ? ????(?) ?
Seeded Codes: Selective VS Adaptive ? is uniformly chosen ? also receive ? ? is a PPT algorithm. ? = ? ?,? s.t.? ?,? ?. ? = ????(?) ? ????(?) ?
Seeded Codes: Selective VS Adaptive ? is uniformly chosen ? also receive ? ? is a PPT algorithm. ? = ? ?,? s.t.? ?,? ?. ? = ????(?) ? ????(?) ? Def: Selective security, for PPT ?: 1. ? ? 2. ? 0,1 , 3. ? ? ?,? s.t. ? ?,????? Def: Adaptive security, for PPT ?: 1. ? 0,1 , 2. ?,? ? ? s.t. ? ?,????? ?. ?. Correction: Pr ????? = ? 1 neg ? Detection: Pr ????? = {?, } 1 neg ?
Main Result of This Work Thm1: Under LWE Selective seeded codes for PPT channels Detection for ? 1/2 fraction of errors with rate ? 1. Correction for ? < 1/4 fraction of errors with rate ???? . Best know explicit list-decodable code, approaching the Blokh-Zyablov bound ???? . Better than what is possible against information theoretic adversaries. Example: For ? , ???p 0.037 while in the information theoretic setting ? = 0. Result can be extended given better explicit list-decodable codes (with a special property).
Main Result of This Work Boneh, Ishai, Passelegue, Sahai, and Wu: Compose linear operations over different moduli to get cryptographic hardness. Thm2: Under Crypto Dark Matter assumption Adaptive seeded codes for PPT Detection for ? 1/2 fraction of errors with rate ? 1. Correction for ? < 1/4 fraction of errors with rate ???? . Only for sufficiently small constant ?. Better than what is possible against information theoretic adversaries. Example: For ? , ???p 0.037 while in the information theoretic setting ? = 0. Result can be extended given better explicit list-decodable codes (with a special property).
Construction for Selective Seeded Codes A type of 2-input correlation intractability ? list-decodes from ? error with rate ?????. Ingredients: A T2CI hash family ? = ? with output size ?. ? list-decodes from 1/2 error with rate 0. ? ? ?+? ? . Linear nested list-decodable code generated by ? = ?2 Construction: Given a message ? and seed ?, ????? = ?, ?? ????? :????????? = ? ??,?? , output first ??s.t. ??? = ??, otherwise .
Construction for Selective Seeded Codes A type of 2-input correlation intractability ? list-decodes from ? error with rate ?????. Ingredients: A T2CI hash family ? = ? with output size ?. ? list-decodes from 1/2 error with rate 0. ? ? ?+? ? . Linear nested list-decodable code generated by ? = ?2 Construction: Given a message ? and seed ?, ????? = ?, ?? ????? :????????? = ? = m? + ?? ?. ??,?? , output first ??s.t. ??? = ??, otherwise .
Construction for Selective Seeded Codes A type of 2-input correlation intractability ? list-decodes from ? error with rate ?????. Ingredients: A T2CI hash family ? = ? with output size ?. ? list-decodes from 1/2 error with rate 0. ? ? ?+? ? . Linear nested list-decodable code generated by ? = ?2 Construction: Given a message ? and seed ?, ????? = ?, ?? ????? :????????? = ? = m? + ?? ?. ??,?? , output first ??s.t. ??? = ??, otherwise . Lemma1: The code detects from -errors. Lemma2: List-decoding + detection Correction.
Selectively Secure Error Detection Lemma1: The code detects from 1/2-errors. Proof: Error-Detection Selective Security, Adv chooses ? gets a random ?. Adv wins if it can find ? ? s.t. ? ????? ,????? Recall: ????? ?? + ?? ? < 1/2. ? ? ? + ?? ? ,?? + ?? ? < 1/2
Selectively Secure Error Detection Lemma1: The code detects from 1/2-errors. Proof: Error-Detection Selective Security, Adv chooses ? gets a random ?. Adv wins if it can find ? ? s.t. ? ????? ,????? Recall: ????? ?? + ?? ? < 1/2. ? ?? ? ,?? + ?? ? ? ? < 1/2
Selectively Secure Error Detection Lemma1: The code detects from 1/2-errors. Proof: Error-Detection Selective Security, Adv chooses ? gets a random ?. Adv wins if it can find ? ? s.t. ? ????? ,????? Recall: ????? ?? + ?? ? < 1/2. ? ?? ? ,?? + ?? ? ? ? < 1/2 ?? ?????????? + ?? ? ? ? ?(?,? , ?(?)) ? list-decodes from .
Selectively Secure Error Detection Lemma1: The code detects from 1/2-errors. Target 2-input correlation-intractable hash (T2CI): Proof: Error-Detection Selective Security, Adv chooses ? gets a random ?. Adv wins if it can find ? ? s.t. ? ????? ,????? ?? ?(?,? , ?? ) < 1/2. ? ?? ? ,?? + ?? ? ? ? < 1/2 ?? ?????????? + ?? ? ? ? ?(?,? , ?(?)) ? list-decodes from .
Selectively Secure Error Detection Detection holds if we construct a hash ? = ? for which it is hard to win the T2CI security game! Lemma1: The code detects from 1/2-errors. Target 2-input correlation-intractable hash (T2CI): Proof: Error-Detection Selective Security, Adv chooses ? gets a random ?. Adv wins if it can find ? ? s.t. ? ????? ,????? ?? ?(?,? , ?? ) < 1/2. ? ?? ? ,?? + ?? ? ? ? < 1/2 ?? ?????????? + ?? ? ? ? ?(?,? , ?(?)) ? list-decodes from .
Target2-input correlation-intractable hash Selective notion of security! Weaker than the general notion of 2-input CI. ? gets some leakage on ? from ?? Target 2-input correlation-intractable hash (T2CI): Proof: Error-Detection Selective Security, Adv chooses ? gets a random ?. Adv wins if it can find ? ? s.t. ? ????? ,????? ?? ?(?,? , ?? ) < 1/2. Canetti, Chen, Holmgren, Lombardi, Rothblum, Rothblum, and Wichs [CCHLRRW19]: For any constant ?, constructed a form of 1-input CI, under LWE for ? ????(??). Thm: Under LWE, for any fixed constant ?, we construct a hash family ? = ?, such that ? ????(??), and PPT adversary, the adversary wins with negligible probability.
Conclusions and Open Problems This work (main results): Uniquely decodable binary seeded codes against any PPT adversaries matching the rate of the best know list-decodable code. Selective security under LWE. Adaptive security under crypto dark matter assumption. New notion: Target 2-input correlation-intractable hash (T2CI). Open problems: Adaptive seeded codes under standard assumptions? Construct optimal binary codes without a seed/CRS.
