True Randomness from
Minimal Assumptions
--- Randomness Amplification from
Arbitrary Weak Sources
Kai-Min Chung
Academia Sinica
Yaoyun Shi
University of Michigan
Xiaodi Wu
University of Oregon
1
Randomness is PRECIOUS resource
• Cryptography
• Randomized algorithm
– Scientific simulations
• Statistics, Sampling,…
• Gambling
2
We are not always getting it…
consequence can be catastrophic
Heninger et al. (2012)
broke many RSA keys by
exploiting insufficient
randomness in key
generation.
3
We are not always getting it…
consequence can be catastrophic
From the introduction:
“Ultimately the results of
our study should serve as a
wake-up call that secure
random number generation
continues to be an unsolved
problem in important areas
of practice.”
4
How can we certify Randomness?
• How can we be certain an outcome is
fundamentally unpredicatable?
5
We can’t be sure … without believing
first of all its existence
What are the minimal assumptions for
One POSSIBILITY:
certifying
(almost)
uniform
randomness?
a deterministic “matrix” world!
6
Randomness Amplification [CR12]
• Certify truly random events from weak randomness
– via certifying Bell violation
7
Certify Randomness via Bell Violation
Use weak source to generate
inputs to test Bell violation
B
A
a
b
x
y
Win/Lose
Referee
Classical value = max Pr[ classical (A,B) win]
>
• Opt. classical strategy =
Opt. deterministic strategy
• Super-classical behavior
(Bell violation)
⇒ randomness!
Communication
impossible
Quantum value = max Pr[ quantum (A,B) win]
8
Randomness Amplification [CR12]
• Certify truly random events from weak randomness
– via certifying Bell violation
• Weak source = Santha-Vazirani ( -SV) sources
(1/2) - ≤ Pr[Xi = xi | X<i = x<i] ≤ (1/2) +
– Amplification from -SV for < 0.058
• Device-independent security (DI-RA)
– No trust on Device. Cryptographic setting
– Devices are prepared by adversary Eve
– Output close to uniform-to-Eve
9
DI-RA Protocol of [CR12]
SV Source
0101101010010010
Alice
xi
Eve
yi
A
ai
B
bi
Accept if Device “play well” &
Output z = ar for r ← SV Source
10
Dichotomy Theorem [CR12,GMT+13]
• Can we certify our physical world is random?
– NO if the world is fully deterministic (“super-determinism”)
• Dichotomy Thm: either deterministic, or certifiably random
• DI-RA: weak randomness ⟹ certifiably randomness
– Eve models external observer
• Require No-Signaling (NS) security [CR12]
– Should not assume quantum completeness
– Only assume NS condition (necessary)
– NS adversary Eve: may share NS correlation with Device
• Weaker assumptions ⟹ Stronger Dichotomy Thm
11
Eve’s Information
• [CR12]: Eve holds classical information W
– Model all info before DI-RA protocol starts
• Fully NS Eve [GMT+13,BRG+13,RBH+15]
– Hold extra NS device E
– Capture NS correlation between Eve & Devices
SV Source
0101101010010010
Alice
ME
A
B
Eve
E
OE
W
12
Source-Device-Eve Relation
• Implicit conditional independence assumption
– [CR12]: Cond. on W = w, Source indep. of Device
– [BRG+13,RBH+15]: Cond. on W = w, Source indep. of Device & Eve
– [GMT+13]: Cond. on W = w, Source indep. of Device
– Strong assumption: not testable & not guarantee by physic law
SV Source
0101101010010010
Eve
Alice
A
B
E
W
13
Structural of the Source
• SV source is highly structured
– Guarantee entropy for every bit of the Source
– Not “robust”: SV bit vs. SV block?
• Min-entropy source: remove structural assumption
– Only assume Hmin(Source|Device) ≤ k
i.e., Pguess(Source|Device) ≤ 2-k
SV Source
0101101010010010
0000000001010110
Eve
Alice
A
B
E
W
14
Ideal Dichotomy Theorem
• Randomness amplification assuming
– (Source|Device) has sufficient min-entropy
– NS condition among Eve & Devices
– No structural or independence assumptions
• DI-RA under minimal assumptions
– Both assumptions are necessary
• The most general dichotomy theorem
– Weak source = arbitrary source sufficient uncertainty
– Sufficient uncertainty ⟹ certifiable true randomness
15
Summary of DI-RA Protocols
Conditional independence
Source
[CR12]
SV
< 0.058
Eve
Source-Device
Source-Eve
Classical
Indep.
---
[GMT+13]
SV
any < 1/2
NS
Indep.
Arbitrary
[BRG+13]
SV
any < 1/2
NS
Indep.
Indep.
[RBH+15]
SV
any < 1/2
NS
Indep.
Indep.
[CSW14]
Any weak
Quantum
Arbitrary
Arbitrary
[WBG+16]
SV
< 0.0144
NS
Somewhat
Somewhat
[CSW16]
Any weak
NS
Arbitrary
Arbitrary
16
Summary of DI-RA Protocols
Conditional independence
Source
[CR12]
SV
< 0.058
Eve
Source-device
Source-Eve
Classical
Indep.
---
[GMT+13]
SV
any < 1/2
NS
Indep.
Arbitrary
[BRG+13]
SV
any < 1/2
NS
Indep.
Indep.
[RBH+15]
SV
any < 1/2
NS
Indep.
Indep.
[CSW14]
Any weak
Quantum
Arbitrary
Arbitrary
[CSW16]
Any weak
NS
Arbitrary
Arbitrary
SV
< 0.0144
NS
Somewhat
Somewhat
[WBG+16]
17
Our Construction
18
All Existing Protocols
SV source
0000000001010110
0101101010010010
Alice
xi
yi
A
B
ai
Eve
bi
Directly use Source bits as inputs to Device
•
•
Require SV structure & sophisticated games
Impossible to handle unstructured weak sources
19
Our Method: Preprocessing & Decoupling
source
X
Y1
Y2
Y3
Yt
somewhere uniform
but correlated
DI-RA
DI-RA
DI-RA
DI-RA
acts as decoupler
Z1
Z2
Z3
̅=
Zt
Some Zi is
uniform-to-all
XOR ⟹ uniform output
20
Our Method: Preprocessing & Decoupling
• Preprocessing:
– Obtain somewhere almost-uniform-to-Device source
– Cannot get perfect uniform
• Decoupling:
– Need DI-RA for almost-uniform-to-Device source
– Cannot assume uniform-to-(Device+Eve) source
• NS vs. Quantum: much more difficult to analyze
21
Quantum Security
• Preprocessing:
– Obtain somewhere almost-uniform-to-Device source
– Use quantum-proof strong extractor: Yi = Ext(X,i)
• Decoupling:
– Need DI-RA for almost-uniform-to-Device source
– Handle imperfect source
• Easy for almost-uniform-to-(Device+Eve) source
• Bridge local vs. global distance by fidelity argument
22
NS Security: Challenges
• Preprocessing:
– Obtain somewhere almost-uniform-to-Device source
– Use quantum-proof strong extractor: Yi = Ext(X,i)
– NS-proof strong extractor does not exist!
• Decoupling:
– Need DI-RA for almost-uniform-to-Device source
– Handle imperfect source
• Easy for almost-uniform-to-(Device+Eve) source
• Bridge local vs. global distance by fidelity argument
– NS: no fidelity structure
23
NS Security: Solution
• Preprocessing:
– Obtain somewhere almost-uniform-to-Device source
– Use classical strong extractor: Yi = Ext(X,i)
• Sufficient to imply somewhere uniform-to-Devicei source
(with parameter loss)
• Decoupling:
– Need DI-RA for almost-uniform-to-Device source
– Handle imperfect source
• Look into key properties in the analysis of DI-RA protocol
• NS reduction technique to show key properties still hold
24
Summary
• Randomness amplification under minimal assumptions
– (Source|Device) has sufficient min-entropy
– NS condition among Eve & Devices
– No structural or independence assumptions
• Ideal dichotomy theorem
– Sufficient uncertainty ⟹ certifiable true randomness
– poly(1/ ) min-entropy ⟹ certify -close to uniform bits
• Our DI-RA: processing & decoupling
– Power of composition for protocol design
– Simple protocol but challenging to analyze
25
AQIS 2016 in Taiwan
26
Preprocessing Step:
Goal: Obtain somewhere almost-uniform-to-Device source
• Quantum security:
– Use quantum-proof strong seeded extractor: Yi = Ext(X,i)
– ∃ i s.t. Yi is -close to uniform-to-all-Device
• NS security:
– “NS-proof” strong seeded extractor does NOT exist!
• ∃ Source-Eve with (n-1)-bit min-entropy s.t. all extractors fail
– Classical strong extractor ⟶ NS somewhere uniform source!
– ∃ i s.t. Yi is (2m )-close to uniform-to-Devicei
27
Decoupling Step:
Goal: DI-RA for almost-uniform-to-Device source
• DI-RA for perfect uniform-to-Device seed by [GMT+13]
Challenge: handle imperfect source
• DI-RA for perfect uniform-to-(Device+Eve) seed
⟹ DI-RA for almost uniform-to-(Device+Eve) source
– By “union bound”
• DI-RA for perfect uniform-to-Device seed may not imply
DI-RA for almost uniform-to-Device source
– Local closeness not imply global closeness
28
Decoupling Step:
Goal: DI-RA for almost-uniform-to-Device source
• DI-RA for perfect uniform-to-Device seed by [GMT+13]
Challenge: handle imperfect source
• Quantum security:
– bridge local vs. global distance by standard “fidelity trick”
• NS security: no quantum fidelity
– Look into key properties in the analysis of DI-RA protocol
– New NS reduction technique to show key properties still hold
– Rely on our simplified & modularized analysis
29
Structural of the Source
• SV source is highly structured
– Guarantee entropy for every bit of the Source
– SV bit vs. SV block?
• Min-entropy source: remove structural assumption
– Only assume Hmin(Source|Device) ≤ k
i.e., Pguess(Source|Device) ≤ 2-k
SV source
0101101010010010
Eve
Alice
A
B
E
W
30
31