Unifying computational entropies via Kullback-Leibler divergence

TL;DR

This paper introduces a new notion called hardness in relative entropy that unifies different forms of computational entropy, providing a clearer understanding and simpler proofs of their relationships with one-way functions.

Contribution

It defines hardness in relative entropy, unifies multiple entropy notions, and offers a modular proof connecting one-way functions to various entropy forms.

Findings

Hardness in relative entropy is satisfied by all one-way functions.

It implies both next-block pseudoentropy and inaccessible entropy.

Provides a simpler proof that one-way functions imply next-block inaccessible entropy.

Abstract

We introduce hardness in relative entropy, a new notion of hardness for search problems which on the one hand is satisfied by all one-way functions and on the other hand implies both next-block pseudoentropy and inaccessible entropy, two forms of computational entropy used in recent constructions of pseudorandom generators and statistically hiding commitment schemes, respectively. Thus, hardness in relative entropy unifies the latter two notions of computational entropy and sheds light on the apparent "duality" between them. Additionally, it yields a more modular and illuminating proof that one-way functions imply next-block inaccessible entropy, similar in structure to the proof that one-way functions imply next-block pseudoentropy (Vadhan and Zheng, STOC '12).

Equations

$$\mathrm{KL}\left(X,Y\Vert \mathsf{S}(Y),Y\right)\ge \Delta ,$$

$$\sum _{i=1}^{m}H\left({\tilde{Y}}_i|{\tilde{R}}_1,\dots ,{\tilde{R}}_{i-1}\right)\le k.$$

$$\mathrm{KL}\left(\tilde{R},\tilde{Y}\Vert \mathsf{S}(Y),Y\right)$$

$$\mathrm{KL}\left(\tilde{R},\tilde{Y}\Vert \mathsf{S}(Y),Y\right)\ge \Delta .$$

$$\mathrm{KL}\left(X,f(X)\Vert \mathsf{S}(Y),Y\right)=\mathrm{KL}\left(\tilde{R},\tilde{Y}\Vert \mathsf{S}(Y),Y\right),$$

$$\sum _{i=1}^m\mathrm{KL}\left(X_i|X_{<i},Y\Vert \mathsf{S}(X_{<i},Y)|X_{<i},Y\right)\ge \Delta ,$$

$$\sum _{i=1}^m\mathrm{KL}\left({\tilde{R}}_i,{\tilde{Y}}_i|{\tilde{R}}_{<i},{\tilde{Y}}_{<i}\Vert {\hat{R}}_i,Y_i|{\hat{R}}_{<i},Y_{<i}\right)\ge \Delta .$$

$$\sum _{i=1}^m\mathrm{KL}\left({\tilde{Y}}_i|{\tilde{R}}_{<i},{\tilde{Y}}_{<i}\Vert Y_i|R_{<i},Y_{<i}\right)\ge \Delta ,$$

$$H\left(A|X\right)\stackrel{\mathrm{def}}{=}\underset{(a,x)\leftarrow (A,X)}{E}\left[\log \frac{1}{\mathrm{Pr}\left[A=a|X=x\right]}\right].$$

$${\mathrm{KL}}_a^{\ast }\left(A\Vert B\right)\stackrel{\mathrm{def}}{=}\log \frac{\mathrm{Pr}\left[A=a\right]}{\mathrm{Pr}\left[B=a\right]},$$

$$\mathrm{KL}\left(A\Vert B\right)\stackrel{\mathrm{def}}{=}\underset{a\leftarrow A}{E}\left[\log \frac{\mathrm{Pr}\left[A=a\right]}{\mathrm{Pr}\left[B=a\right]}\right].$$

$${\mathrm{KL}}_{a,x}^{\ast }\left(A|X\Vert B|Y\right)\stackrel{\mathrm{def}}{=}\log \frac{\mathrm{Pr}\left[A=a|X=x\right]}{\mathrm{Pr}\left[B=a|Y=x\right]},$$

$$\mathrm{KL}\left(A|X\Vert B|Y\right)\stackrel{\mathrm{def}}{=}\underset{(a,x)\leftarrow (A,X)}{E}\left[\log \frac{\mathrm{Pr}\left[A=a|X=x\right]}{\mathrm{Pr}\left[B=a|Y=x\right]}\right].$$

$$\mathrm{KL}\left(A,X\Vert B,Y\right)=\mathrm{KL}\left(A|X\Vert B|Y\right)+\mathrm{KL}\left(X\Vert Y\right),$$

$${\mathrm{KL}}_{a,x}^{\ast }\left(A,X\Vert B,Y\right)={\mathrm{KL}}_{a,x}^{\ast }\left(A|X\Vert B|Y\right)+{\mathrm{KL}}_x^{\ast }\left(X\Vert Y\right).$$

$$\mathrm{KL}\left(X\Vert Y\right)\ge \mathrm{KL}\left(f(X)\Vert f(Y)\right).$$

$$\underset{x\leftarrow X}{\mathrm{Pr}}\left[{\mathrm{KL}}_x^{\ast }\left(X\Vert Y\right)\le \Delta \right]\ge \delta ,$$

$${\mathrm{KL}}_{\min }^{\delta }\left(X\Vert Y\right)>\Delta ⟺\underset{x\leftarrow X}{\mathrm{Pr}}\left[{\mathrm{KL}}_x^{\ast }\left(X\Vert Y\right)\le \Delta \right]<\delta .$$

$$\mathrm{KL}\left(\tilde{R},{\tilde{\mathsf{G}}}_1(\tilde{R})\Vert \mathsf{S}(Y),Y\right)>\Delta ,$$

$${\mathrm{KL}}_{\min }^{\delta }\left(\tilde{R},{\tilde{\mathsf{G}}}_1(\tilde{R})\Vert \mathsf{S}(Y),Y\right)>\Delta .$$

$$\displaystyle\Pr\left[\Pi\big{(}Y,\mathsf{A}^{\mathsf{\widetilde{G}}_{\mathsf{w}},\mathsf{S}}(Y)\big{)}\right]$$

$$\ge \mathrm{Pr}\left[{\tilde{\mathsf{G}}}_1(\mathsf{S}(Y))=Y\right]$$

$$=\sum _{r\in \mathrm{Supp}(\tilde{R})}\mathrm{Pr}\left[\mathsf{S}(Y)=r\wedge Y={\tilde{\mathsf{G}}}_1(r)\right]$$

$$=\underset{r\leftarrow \tilde{R}}{E}\left[\frac{\mathrm{Pr}\left[\mathsf{S}(Y)=r\wedge Y={\tilde{\mathsf{G}}}_1(r)\right]}{\mathrm{Pr}\left[\tilde{R}=r\right]}\right]$$

$$=\underset{\begin{array}{c}r\leftarrow \tilde{R}\\ y\leftarrow {\tilde{\mathsf{G}}}_1(r)\end{array}}{E}\left[2^{-{\mathrm{KL}}_{r,y}^{\ast }\left(\tilde{R},{\tilde{\mathsf{G}}}_1(\tilde{R})\Vert \mathsf{S}(Y),Y\right)}\right].$$

$$\mathrm{KL}\left(Y,W\Vert Y,\mathsf{S}(Y)\right)>\Delta .$$

$$\mathrm{KL}\left(X,{\tilde{\mathsf{G}}}_1(X)\Vert \mathsf{S}(Y),Y\right)=\mathrm{KL}\left(X,f(X)\Vert \mathsf{S}(Y),Y\right).$$

$$\mathrm{KL}\left(\tilde{R},{\tilde{\mathsf{G}}}_1(\tilde{R}),{\tilde{\mathsf{G}}}_{\mathsf{w}}(\tilde{R})\Vert \mathsf{S}(Y),Y,W\right)>\Delta .$$

$${\mathrm{KL}}_{\min }^{\delta }\left(\tilde{R},{\tilde{\mathsf{G}}}_1(\tilde{R}),{\tilde{\mathsf{G}}}_{\mathsf{w}}(\tilde{R})\Vert \mathsf{S}(Y),Y,W\right)>\Delta .$$

$${\tilde{\mathsf{G}}}_i({\hat{r}}_{\le i})=y_i\mathrm{or}{\hat{r}}_i=\perp .$$

$$\sum _{i=1}^m\mathrm{KL}\left({\tilde{R}}_i,{\tilde{Y}}_i|{\tilde{R}}_{<i},{\tilde{Y}}_{<i}\Vert {\hat{R}}_i,Y_i|{\hat{R}}_{<i},Y_{<i}\right)>\Delta .$$

$$\underset{\begin{array}{c}{r}_{\le m}\leftarrow {\tilde{R}}_{\le m}\\ y_{\le m}\leftarrow \tilde{\mathsf{G}}(r_{\le m})\end{array}}{\mathrm{Pr}}\left[\sum _{i=1}^m{\mathrm{KL}}_{y_i,r_{<i},y_{<i}}^{\ast }\left({\tilde{R}}_i,{\tilde{Y}}_i|{\tilde{R}}_{<i},{\tilde{Y}}_{<i}\Vert {\hat{R}}_i,Y_i|{\hat{R}}_{<i},Y_{<i}\right)\le \Delta \right]<\delta .$$

Full text

Keywords: one-way function, pseudorandom generator, pseudoentropy, computational entropy, inaccessible entropy, statistically hiding commitment, next-bit pseudoentropy.

1 Introduction

1.1 One-way functions and computational entropy

One-way functions [DH76] are on one hand the minimal assumption for complexity-based cryptography [IL89], but on the other hand can be used to construct a remarkable array of cryptographic primitives, including such powerful objects as CCA-secure symmetric encryption, zero-knowledge proofs and statistical zero-knowledge arguments for all of ${\mathbf{NP}}$, and secure multiparty computation with an honest majority [GGM86, GMW91, GMW87, HILL99, Rom90, Nao91, HNO*+*09]. All of these constructions begin by converting the “raw hardness” of a one-way function (OWF) to one of the following more structured cryptographic primitives: a pseudorandom generator (PRG) [BM82, Yao82], a universal one-way hash function (UOWHF) [NY89], or a statistically hiding commitment scheme (SHC) [BCC88].

The original constructions of these three primitives from arbitrary one-way functions [HILL99, Rom90, HNO*+*09] were all very complicated and inefficient. Over the past decade, there has been a series of simplifications and efficiency improvements to these constructions [HRVW09, HRV13, HHR*+*10, VZ12], leading to a situation where the constructions of two of these primitives — PRGs and SHCs — share a very similar structure and seem “dual” to each other. Specifically, these constructions proceed as follows:

Show that every OWF $f:\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ has a gap between its “real entropy” and an appropriate form of “computational entropy”. Specifically, for constructing PRGs, it is shown that the function $\mathsf{G}(x)=(f(x),x_{1},x_{2},\ldots,x_{n})$ has “next-block pseudoentropy” at least $n+\omega(\log n)$ while its real entropy is $\operatorname{H}\left(\mathsf{G}(U_{n})\right)=n$ [VZ12] where $\operatorname{H}\left(\cdot\right)$ denotes Shannon entropy. For constructing SHCs, it is shown that the function $\mathsf{G}(x)=(f(x)_{1},\ldots,f(x)_{n},x)$ has “next-block accessible entropy” at most $n-\omega(\log n)$ while its real entropy is again $\operatorname{H}\left(\mathsf{G}(U_{n})\right)=n$ [HRVW09]. Note that the differences between the two cases are whether we break $x$ or $f(x)$ into individual bits (which matters because the “next-block” notions of computational entropy depend on the block structure) and whether the form of computational entropy is larger or smaller than the real entropy. 2. 2.

An “entropy equalization” step that converts $\mathsf{G}$ into a similar generator where the real entropy in each block conditioned on the prefix before it is known. This step is exactly the same in both constructions. 3. 3.

A “flattening” step that converts the (real and computational) Shannon entropy guarantees of the generator into ones on (smoothed) min-entropy and max-entropy. This step is again exactly the same in both constructions. 4. 4.

A “hashing” step where high (real or computational) min-entropy is converted to uniform (pseudo)randomness and low (real or computational) max-entropy is converted to a small-support or disjointness property. For PRGs, this step only requires randomness extractors [HILL99, NZ96], while for SHCs it requires (information-theoretic) interactive hashing [NOVY98, DHRS04]. (Constructing full-fledged SHCs in this step also utilizes UOWHFs, which can be constructed from one-way functions [Rom90]. Without UOWHFs, we obtain a weaker binding property, which nevertheless suffices for constructing statistical zero-knowledge arguments for all of ${\mathbf{NP}}$.)

This common construction template came about through a back-and-forth exchange of ideas between the two lines of work. Indeed, the uses of computational entropy notions, flattening, and hashing originate with PRGs [HILL99], whereas the ideas of using next-block notions, obtaining them from breaking $(f(x),x)$ into short blocks, and entropy equalization originate with SHCs [HRVW09]. All this leads to a feeling that the two constructions, and their underlying computational entropy notions, are “dual” to each other and should be connected at a formal level.

In this paper, we make progress on this project of unifying the notions of computational entropy, by introducing a new computational entropy notion that yields both next-block pseudoentropy and next-block accessible entropy in a clean and modular fashion. It is inspired by the proof of [VZ12] that $(f(x),x_{1},\ldots,x_{n})$ has next-block pseudoentropy $n+\omega(\log n)$, which we will describe now.

1.2 Next-block pseudoentropy via relative pseudoentropy

We recall the definition of next-block pseudoentropy, and the result of [VZ12] relating it to one-wayness.

Definition 1.1** (next-block pseudoentropy, informal).**

Let $n$ be a security parameter, and $X=(X_{1},\ldots,X_{m})$ be a random variable distributed on strings of length $\operatorname{poly}(n)$. We say that $X$ has next-block pseudoentropy at least $k$ if there is a random variable $Z=(Z_{1},\ldots,Z_{m})$, jointly distributed with $X$, such that:

For all $i=1,\ldots,m$, $(X_{1},\ldots,X_{i-1},X_{i})$ is computationally indistinguishable from $(X_{1},\ldots,X_{i-1},Z_{i})$. 2. 2.

$\sum_{i=1}^{m}\operatorname{H}\left(Z_{i}|X_{1},\ldots,X_{i-1}\right)\geq k$.

Equivalently, for $I$ uniformly distributed in $[m]$, $X_{I}$ has conditional pseudoentropy at least $k/m$ given $(X_{1},\ldots,X_{i-1})$.

It was conjectured in [HRV10] that next-block pseudoentropy could be obtained from any OWF by breaking its input into bits, and this conjecture was proven in [VZ12]:

Theorem 1.2** ([VZ12], informal).**

Let $f:\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ be a one-way function, let $X$ be uniformly distributed in $\{0,1\}^{n}$, and let $X=(X_{1},\ldots,X_{m})$ be a partition of $X$ into blocks of length $O(\log n)$. Then $(f(X),X_{1},\ldots,X_{m})$ has next-block pseudoentropy at least $n+\omega(\log n)$.

The intuition behind Theorem 1.2 is that since $X$ is hard to sample given $f(X)$, then it should have some extra computational entropy given $f(X)$. This intuition is formalized using the following notion of “relative pseudoentropy,” which is a renaming of [VZ12]’s notion of “KL-hard for sampling,” to better unify the terminology with the notions introduced in this work.

Definition 1.3** (relative pseudoentropy).**

Let $n$ be a security parameter, and $(X,Y)$ be a pair of random variables, jointly distributed over strings of length $\operatorname{poly}(n)$. We say that $X$ has relative pseudoentropy at least $\Delta$ given $Y$ if for all probabilistic polynomial-time $\mathsf{S}$, we have

[TABLE]

where $\operatorname{KL}\left(\cdot\,\middle\|\,\cdot\right)$ denotes the relative entropy (a.k.a. Kullback–Leibler divergence).111Recall that for random variables $A$ and $B$ with $\operatorname{Supp}(A)\subseteq\operatorname{Supp}(B)$, the relative entropy is defined by $\operatorname{KL}\left(A\,\middle\|\,B\right)=\operatorname*{E}_{a\overset{}{\leftarrow}A}\left[\log(\Pr\left[A=a\right]/\Pr\left[B=a\right])\right]$.

That is, it is hard for any efficient adversary $\mathsf{S}$ to sample the conditional distribution of $X$ given $Y$, even approximately.

The first step of the proof of Theorem 1.2 is to show that one-wayness implies relative pseudoentropy (which can be done with a one-line calculation):

Lemma 1.4**.**

Let $f:\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ be a one-way function and let $X$ be uniformly distributed in $\{0,1\}^{n}$. Then $X$ has relative pseudoentropy at least $\omega(\log n)$ given $f(X)$.

Next, we break $X$ into short blocks, and show that the relative pseudoentropy is preserved:

Lemma 1.5**.**

Let $n$ be a security parameter, let $(X,Y)$ be random variables distributed on strings of length $\operatorname{poly}(n)$, let $X=(X_{1},\ldots,X_{m})$ be a partition of $X$ into blocks, and let $I$ be uniformly distributed in $[m]$. If $X$ has relative pseudoentropy at least $\Delta$ given $Y$, then $X_{I}$ has relative pseudoentropy at least $\Delta/m$ given $(Y,X_{1},\ldots,X_{I-1})$.

Finally, the main part of the proof is to show that, once we have short blocks, relative pseudoentropy is equivalent to a gap between conditional pseudoentropy and real conditional entropy.

Lemma 1.6**.**

Let $n$ be a security parameter, $Y$ be a random variable distributed on strings of length $\operatorname{poly}(n)$, and $X$ a random variable distributed on strings of length $O(\log n)$. Then $X$ has relative pseudoentropy at least $\Delta$ given $Y$ iff $X$ has conditional pseudoentropy at least $\operatorname{H}\left(X|Y\right)+\Delta$ given $Y$.

Putting these three lemmas together, we see that when $f$ is a one-way function, and we break $X$ into blocks of length $O(\log n)$ to obtain $(f(X),X_{1},\ldots,X_{m})$, on average, the conditional pseudoentropy of $X_{I}$ given $(f(X),X_{1},\ldots,X_{I-1})$ is larger than its real conditional entropy by $\omega(\log n)/m$. This tells us that the next-block pseudoentropy of $(f(X),X_{1},\ldots,X_{m})$ is larger than its real entropy by $\omega(\log n)$, as claimed in Theorem 1.2.

We remark that Lemma 1.6 explains why we need to break the input of the one-way function into short blocks: it is false when $X$ is long. Indeed, if $f$ is a one-way function, then we have already seen that $X$ has $\omega(\log n)$ relative pseudoentropy given $f(X)$ (Lemma 1.4), but it does not have conditional pseudoentropy noticeably larger than $\operatorname{H}\left(X|f(X)\right)$ given $f(X)$ (as correct preimages can be efficiently distinguished from incorrect ones using $f$).

1.3 Inaccessible entropy

As mentioned above, for constructing SHCs from one-way functions, the notion of next-block pseudoentropy is replaced with next-block accessible entropy:

Definition 1.7** (next-block accessible entropy, informal).**

Let $n$ be a security parameter, and $Y=(Y_{1},\ldots,Y_{m})$ be a random variable distributed on strings of length $\operatorname{poly}(n)$. We say that $Y$ has next-block accessible entropy at most $k$ if the following holds.

Let $\mathsf{\widetilde{G}}$ be any probabilistic $\operatorname{poly}(n)$-time algorithm that takes a sequence of uniformly random strings $\widetilde{R}=(\widetilde{R}_{1},\ldots,\widetilde{R}_{m})$ and outputs a sequence $\widetilde{Y}=(\widetilde{Y}_{1},\ldots,\widetilde{Y}_{m})$ in an “online fashion” by which we mean that $\widetilde{Y}_{i}=\mathsf{\widetilde{G}}(\widetilde{R}_{1},\ldots,\widetilde{R}_{i})$ depends on only the first $i$ random strings of $\mathsf{\widetilde{G}}$ for $i=1,\ldots,m$. Suppose further that $\operatorname{Supp}(\widetilde{Y})\subseteq\operatorname{Supp}(Y)$.

Then we require:

[TABLE]

(Next-block) accessible entropy differs from (next-block) pseudoentropy in two ways:

Accessible entropy is useful as an upper bound on computational entropy, and is interesting when it is smaller than the real entropy $\operatorname{H}\left(Y\right)$. We refer to the gap $\operatorname{H}\left(Y\right)-k$ as the next-block inaccessible entropy of $Y$. 2. 2.

The accessible entropy adversary $\mathsf{\widetilde{G}}$ is trying to generate the random variables $Y_{i}$ conditioned on the history rather than recognize them. Note that we take the “history” to not only be the previous blocks $(\widetilde{Y}_{1},\ldots,\widetilde{Y}_{i-1})$, but the coin tosses $(\widetilde{R}_{1},\ldots,\widetilde{R}_{i-1})$ used to generate those blocks.

Note that one unsatisfactory aspect of the definition is that when the random variable $Y$ is not flat (i.e. uniform on its support), then there can be an adversary $\mathsf{\widetilde{G}}$ achieving accessible entropy even larger than $\operatorname{H}\left(Y\right)$, for example by making $\widetilde{Y}$ uniform on $\operatorname{Supp}(Y)$.

Similarly to (and predating) Theorem 1.2, it is known that one-wayness implies next-block inaccessible entropy.

Theorem 1.8** ([HRVW09]).**

Let $f:\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ be a one-way function, let $X$ be uniformly distributed in $\{0,1\}^{n}$, and let $(Y_{1},\ldots,Y_{m})$ be a partition of $Y=f(X)$ into blocks of length $O(\log n)$. Then $(Y_{1},\ldots,Y_{m},X)$ has next-block accessible entropy at most $n-\omega(\log n)$.

Unfortunately, however, the existing proof of Theorem 1.8 is not modular like that of Theorem 1.2. In particular, it does not isolate the step of relating one-wayness to entropy-theoretic measures (like Lemma 1.4 does) or the significance of having short blocks (like Lemma 1.6 does).

1.4 Our results

We remedy the above state of affairs by providing a new, more general notion of hardness in relative entropy that allows us to obtain next-block inaccessible entropy in a modular way while also encompassing what is needed for next-block pseudoentropy.

Like in relative pseudoentropy, we will consider a pair of jointly distributed random variables $(Y,X)$. Following the spirit of accessible entropy, the adversary $\mathsf{\widetilde{G}}$ for our new notion will try to generate $Y$ together with $X$, rather than taking $Y$ as input. That is, $\mathsf{\widetilde{G}}$ will take randomness $\widetilde{R}$ and output a pair $(\widetilde{Y},\widetilde{X})=\mathsf{\widetilde{G}}(\widetilde{R})=(\mathsf{\widetilde{G}}_{1}(\widetilde{R}),\mathsf{\widetilde{G}}_{2}(\widetilde{R}))$, which we require to be always within the support of $(Y,X)$. Note that $\mathsf{\widetilde{G}}$ need not be an online generator; it can generate both $\widetilde{Y}$ and $\widetilde{X}$ using the same randomness $\widetilde{R}$. Of course, if $(Y,X)$ is efficiently samplable (as it would be in most cryptographic applications), $\mathsf{\widetilde{G}}$ could generate $(\widetilde{Y},\widetilde{X})$ identically distributed to $(Y,X)$ by just using the “honest” sampler $\mathsf{G}$ for $(Y,X)$. So, in addition, we require that the adversary $\mathsf{\widetilde{G}}$ also come with a simulator $\mathsf{S}$, that can simulate its coin tosses given only $\widetilde{Y}$. The goal of the adversary is to minimize the relative entropy

[TABLE]

for a uniformly random $\widetilde{R}$. This divergence measures both how well $\mathsf{\widetilde{G}}_{1}$ approximates the distribution of $Y$ as well as how well $\mathsf{S}$ simulates the corresponding coin tosses of $\mathsf{\widetilde{G}}_{1}$. Note that when $\mathsf{\widetilde{G}}$ is the honest sampler $\mathsf{G}$, the task of $\mathsf{S}$ is exactly to sample from the conditional distribution of $\widetilde{R}$ given $\mathsf{G}_{1}(\widetilde{R})=Y$. However, the adversary may reduce the divergence by instead designing the sampler $\mathsf{\widetilde{G}}$ and simulator $\mathsf{S}$ to work in concert, potentially trading off how well $\mathsf{\widetilde{G}}(\widetilde{R})$ approximates $Y$ in exchange for easier simulation by $\mathsf{S}$. Explicitly, the definition is as follows.

Definition 1.9** **(hardness in relative entropy, informal version of

Definition 3.2).

Let $n$ be a security parameter, and $(Y,X)$ be a pair of random variables jointly distributed over strings of length $\operatorname{poly}(n)$. We say that $(Y,X)$ has hardness at least $\Delta$ in relative entropy if the following holds.

Let $\mathsf{\widetilde{G}}=(\mathsf{\widetilde{G}}_{1},\mathsf{\widetilde{G}}_{2})$ and $\mathsf{S}$ be probabilistic $\operatorname{poly}(n)$-time algorithms such that $\operatorname{Supp}(\mathsf{\widetilde{G}}(\widetilde{R}))\subseteq\operatorname{Supp}((Y,X))$, where $\widetilde{R}$ is uniformly distributed. Then writing $\widetilde{Y}=\mathsf{\widetilde{G}}_{1}(\widetilde{R})$, we require that

[TABLE]

Similarly to Lemma 1.4, we can show that one-way functions achieve this notion of hardness in relative entropy.

Lemma 1.10**.**

Let $f:\{0,1\}^{n}\rightarrow\{0,1\}^{n}$ be a one-way function and let $X$ be uniformly distributed in $\{0,1\}^{n}$. Then $(f(X),X)$ has hardness $\omega(\log n)$ in relative entropy.

Note that this lemma implies Lemma 1.4. If we take $\mathsf{\widetilde{G}}$ to be the “honest” sampler $\mathsf{\widetilde{G}}(x)=(f(x),x)$, then we have:

[TABLE]

which is is $\omega(\log n)$ by Lemma 1.10. That is, relative pseudoentropy (as in Definition 1.3 and Lemma 1.4) is obtained by fixing $\mathsf{\widetilde{G}}$ and focusing on the hardness for the simulator $\mathsf{S}$, i.e. the divergence $\operatorname{KL}\left(X,Y\,\middle\|\,S(Y),Y\right)$. Furthermore, the step of breaking into short blocks (Lemma 1.5) is equivalent to requiring the simulator be online and showing that relative pseudoentropy implies the following notion of next-block relative pseudoentropy:

Definition 1.11** (next-block relative pseudoentropy, informal).**

Let $n$ be a security parameter, $(X,Y)$ be jointly distributed random variables over strings of length $\operatorname{poly}(n)$, and let $X=(X_{1},\dots,X_{m})$ be a partition of $X$ into blocks. We say that $X$ has next-block relative pseudoentropy at least $\Delta$ given $Y$ if for all probabilistic polynomial-time $\mathsf{S}$, we have

[TABLE]

where we use the notation $z_{<i}\overset{\rm def}{=}(z_{1},\ldots,z_{i-1})$.

Here, the simulator $\mathsf{S}$ is required to be “online” in the sense that it cannot simulate $(X_{1},\dots,X_{m})$ at once, but must simulate $X_{i}$ only as a function of $X_{<i}$ and $Y$.

In particular, Lemma 1.6 is thus equivalent to the statement that having next-block relative pseudoentropy at least $\Delta$ for blocks of length $O(\log n)$ is equivalent to having next-block pseudoentropy at least $\Delta+\sum_{i=1}^{m}\operatorname{H}\left(X_{i}|X_{<i},Y\right)$ in the sense of Definition 1.1.

Conversely, we show that inaccessible entropy arises from hardness in relative entropy by first requiring the generator $\mathsf{G}$ to be online and breaking the relative entropy into blocks to obtain the following next-block hardness property.

Definition 1.12** (next-block hardness in relative entropy, informal).**

Let $n$ be a security parameter, and $Y=(Y_{1},\ldots,Y_{m})$ be a random variable distributed on strings of length $\operatorname{poly}(n)$. We say that $Y$ has next-block hardness at least $\Delta$ in relative entropy if the following holds.

Let $\mathsf{\widetilde{G}}$ be any probabilistic $\operatorname{poly}(n)$-time algorithm that takes a sequence of uniformly random strings $\widetilde{R}=(\widetilde{R}_{1},\ldots,\widetilde{R}_{m})$ and outputs a sequence $\widetilde{Y}=(\widetilde{Y}_{1},\ldots,\widetilde{Y}_{m})$ in an “online fashion” by which we mean that $\widetilde{Y}_{i}=\mathsf{\widetilde{G}}(\widetilde{R}_{1},\ldots,\widetilde{R}_{i})$ depends on only the first $i$ random strings of $\mathsf{\widetilde{G}}$ for $i=1,\ldots,m$. Suppose further that $\operatorname{Supp}(\widetilde{Y})\subseteq\operatorname{Supp}(Y)$. Additionally, let $\mathsf{S}$ be a probabilistic $\operatorname{poly}(n)$-time algorithms such for all $i=1,\dots,m$, $\mathsf{S}$ takes as input $\widehat{R}_{1},\dots,\widehat{R}_{i-1}$ and $Y_{i}$ and outputs $\widehat{R}_{i}$, where $\widehat{R}_{j}$ has the same length as $\widetilde{R}_{j}$. Then we require that for all such $(\mathsf{\widetilde{G}},\mathsf{S})$, we have:

[TABLE]

Observe that hardness in relative entropy can be seen as the specific case of next-block hardness in relative entropy when there is only one block (i.e., setting $m=1$ in the previous definition).

Next, we fix the simulator, analogously to how relative pseudoentropy was obtained by fixing the generator, and obtain next-block inaccessible relative entropy:

Definition 1.13** **(next-block inaccessible relative entropy,

informal).

Let $n$ be a security parameter, and $Y=(Y_{1},\ldots,Y_{m})$ be a random variable distributed on strings of length $\operatorname{poly}(n)$. We say that $Y$ has next-block inaccessible relative entropy at least $\Delta$ if the following holds.

Let $\mathsf{\widetilde{G}}$ be any probabilistic $\operatorname{poly}(n)$-time algorithm that takes a sequence of uniformly random strings $\widetilde{R}=(\widetilde{R}_{1},\ldots,\widetilde{R}_{m})$ and outputs a sequence $\widetilde{Y}=(\widetilde{Y}_{1},\ldots,\widetilde{Y}_{m})$ in an online fashion, and such that $\operatorname{Supp}(\widetilde{Y})\subseteq\operatorname{Supp}(Y)$. Then we require that for all such $\mathsf{\widetilde{G}}$, we have:

[TABLE]

where $R=(R_{1},\ldots,R_{m})$ is a dummy random variable independent of $Y$.

That is, the goal of the online generator $\mathsf{\widetilde{G}}$ is to generate $\widetilde{Y}_{i}$ given the history of coin tosses $\widetilde{R}_{<i}$ with the same conditional distribution as $Y_{i}$ given $Y_{<i}$. As promised, there is no explicit simulator in the definition of next-block inaccessible relative entropy, as we essentially dropped all $\widehat{R}$ variables from the definition of next-block hardness in relative entropy. Nevertheless we can obtain it from hardness in relative entropy by using sufficiently short blocks:

Lemma 1.14**.**

Let $n$ be a security parameter, let $Y$ be a random variable distributed on strings of length $\operatorname{poly}(n)$, and let $Y=(Y_{1},\ldots,Y_{m})$ be a partition of $Y$ into blocks of length $O(\log n)$.

If $(Y_{1},\dots,Y_{m})$ has next-block hardness at least $\Delta$ in relative entropy, then $(Y_{1},\ldots,Y_{m})$ has next-block inaccessible relative entropy at least $\Delta-\operatorname{negl}(n)$.

An intuition for the proof is that since the blocks are of logarithmic length, given $Y_{i}$ we can simulate the corresponding coin tosses of $\widetilde{R}_{i}$ of $\mathsf{\widetilde{G}}$ by rejection sampling and succeed with high probability in $\operatorname{poly}(n)$ tries.

A nice feature of the definition of next-block inaccessible relative entropy compared to inaccessible entropy is that it is meaningful even for non-flat random variables, as the Kullback–Leibler divergence is always nonnegative. Moreover, for flat random variables, it equals the inaccessible entropy:

Lemma 1.15**.**

Suppose $Y=(Y_{1},\ldots,Y_{m})$ is a flat random variable. Then $Y$ has next-block inaccessible relative entropy at least $\Delta$ if and only if $Y$ has accessible entropy at most $\operatorname{H}\left(Y\right)-\Delta.$

Intuitively, this lemma comes from the identity that if $Y$ is a flat random variable and $\operatorname{Supp}(\widetilde{Y})\subseteq\operatorname{Supp}(Y)$, then $\operatorname{H}\left(\widetilde{Y}\right)=\operatorname{H}\left(Y\right)-\operatorname{KL}\left(\widetilde{Y}\,\middle\|\,Y\right)$. We stress that we do not require the individual blocks $Y_{i}$ have flat distributions, only that the random variable $Y$ as a whole is flat. For example, if $f$ is a function and $X$ is uniform, then $(f(X),X)$ is flat even though $f(X)$ itself may be far from flat.

Putting together Lemmas 1.10, 1.14, and 1.15, we obtain a new, more modular (and slightly tighter) proof of Theorem 1.8. The reduction implicit in the combination of these lemmas is the same as the one in [HRVW09], but the analysis is different. (In particular, [HRVW09] makes no use of KL divergence.) Like the existing proof of Theorem 1.2, this proof separates the move from one-wayness to a form of hardness involving relative entropies, the role of short blocks, and the move from hardness in relative entropy to computational entropy, as summarized in Figure 1. Moreover, this further illumination of and toolkit for notions of computational entropy may open the door to other applications in cryptography.

We remark that another interesting direction for future work is to find a construction of universal one-way hash functions (UOWHFs) from one-way functions that follows a similar template to the above constructions of PRGs and SHCs. There is now a construction of UOWHFs based on a variant of inaccessible entropy [HHR*+*10], but it remains more complex and inefficient than those of PRGs and SHCs.

2 Preliminaries

Notations.

For a tuple $x=(x_{1},\dots,x_{n})$, we write $x_{\leq i}$ for $(x_{1},\dots,x_{i})$, and $x_{<i}$ for $(x_{1},\dots,x_{i-1})$.

$\operatorname{poly}$ denotes the set of polynomial functions and $\operatorname{negl}$ the set of all negligible functions: $\varepsilon\in\operatorname{negl}$ if for all $p\in\operatorname{poly}$ and large enough $n\in\mathbb{N}$, $\varepsilon(n)\leq 1/p(n)$. We will sometimes abuse notations and write $\operatorname{poly}(n)$ to mean $p(n)$ for some $p\in\operatorname{poly}$ and similarly for $\operatorname{negl}(n)$.

ppt stands for probabilistic polynomial time and can be either in the uniform or non-uniform model of computation. All our results are stated as uniform polynomial time oracle reductions and are thus meaningful in both models.

For a random variable $X$ over $\mathcal{X}$, $\operatorname{Supp}(X)\overset{\rm def}{=}\{x\in\mathcal{X}\,:\,\Pr[X=x]>0\}$ denotes the support of $X$. A random variable is flat if it is uniform over its support. Random variables will be written with uppercase letters and the associated lowercase letter represents a generic element from its support.

Information theory.

Definition 2.1** (Entropy).**

For a random variable $X$ and $x\in\operatorname{Supp}(X)$, the sample entropy (also called surprise) of $x$ is $\operatorname{H}^{*}_{x}\left(X\right)\overset{\rm def}{=}\log(1/\Pr\left[X=x\right])$. The entropy $\operatorname{H}\left(X\right)$ of $X$ is the expected sample entropy: $\operatorname{H}\left(X\right)\overset{\rm def}{=}\operatorname*{E}_{x\overset{}{\leftarrow}X}\left[\operatorname{H}^{*}_{x}\left(X\right)\right]$.

Definition 2.2** (Conditional entropy).**

Let $(A,X)$ be a pair of random variables and consider $(a,x)\in\operatorname{Supp}(A,X)$, the conditional sample entropy of $(a,x)$ is $\operatorname{H}^{*}_{a,x}\left(A|X\right)\overset{\rm def}{=}\log(1/\Pr\left[A=a\,|\,X=x\right])$ and the conditional entropy of $A$ given $X$ is the expected conditional sample entropy:

[TABLE]

Proposition 2.3** (Chain rule for entropy).**

Let $(A,X)$ be a pair of random variables, then $\operatorname{H}\left(A,X\right)=\operatorname{H}\left(A|X\right)+\operatorname{H}\left(X\right)$ and for $(a,x)\in\operatorname{Supp}(A,X)$, $\operatorname{H}^{*}_{a,x}\left(A,X\right)=\operatorname{H}^{*}_{a,x}\left(A|X\right)+\operatorname{H}^{*}_{x}\left(X\right)$.

Definition 2.4** **(Relative entropy222Relative entropy is also

commonly referred to as Kullback–Liebler divergence, which explains the standard $\operatorname{KL}$ notation. We prefer to use relative entropy to have more uniformity across the notions discussed in this work.).

For a pair $(A,B)$ of random variables and $(a,b)\in\operatorname{Supp}(A,B)$ the sample relative entropy ($\log$-probability ratio) is:

[TABLE]

and the relative entropy of $A$ with respect to $B$ is the expected sample relative entropy:

[TABLE]

Definition 2.5** (Conditional relative entropy).**

For pairs of random variables $(A,X)$ and $(B,Y)$, and $(a,x)\in\operatorname{Supp}(A,X)$, the conditional sample relative entropy is:

[TABLE]

and the conditional relative entropy is:

[TABLE]

Proposition 2.6** (Chain rule for relative entropy).**

For pairs of random variables $(X,A)$ and $(Y,B)$:

[TABLE]

and for $(a,x)\in\operatorname{Supp}(A,X)$:

[TABLE]

Proposition 2.7** (Data-processing inequality).**

Let $(X,Y)$ be a pair of random variables and let $f$ be a function defined on $\operatorname{Supp}(Y)$, then:

[TABLE]

Definition 2.8** (min relative entropy).**

Let $(X,Y)$ be a pair of random variables and $\delta\in[0,1]$. We define $\operatorname{KL}_{\rm min}^{\delta}\left(X\,\middle\|\,Y\right)$ to be the quantile of level $\delta$ of $\operatorname{KL}^{*}_{x}\left(X\,\middle\|\,Y\right)$, equivalently it is the smallest $\Delta\in\mathbb{R}$ satisfying:

[TABLE]

and it is characterized by the following equivalence:

[TABLE]

Block generators

Definition 2.9** (Block generator).**

An $m$-block generator is a function $\mathsf{G}:\{0,1\}^{s}\overset{}{\rightarrow}\prod_{i=1}^{m}\{0,1\}^{\ell_{i}}$. $\mathsf{G}_{i}(r)$ denotes the $i$-th block of $\mathsf{G}$ on input $r$ and $|\mathsf{G}_{i}|=\ell_{i}$ denotes the bit length of the $i$-th block.

Definition 2.10** (Online generator).**

An online $m$-block generator is a function $\mathsf{\widetilde{G}}:\prod_{i=1}^{m}\{0,1\}^{s_{i}}\overset{}{\rightarrow}\prod_{i=1}^{m}\{0,1\}^{\ell_{i}}$ such that for all $i\in[m]$ and $r\in\prod_{i=1}^{m}\{0,1\}^{s_{i}}$, $\mathsf{\widetilde{G}}_{i}(r)$ only depends on $r_{\leq i}$. We sometimes write $\mathsf{\widetilde{G}}_{i}(r_{\leq i})$ when the input blocks $i+1,\dots,m$ are unspecified.

Definition 2.11** (Support).**

The support of a generator $\mathsf{G}$ is the support of the random variable \operatorname{Supp}\big{(}\mathsf{G}(R)\big{)} for uniform input $R$. If $\mathsf{G}$ is an $(m+1)$-block generator, and $\Pi$ is a binary relation, we say that $\mathsf{G}$ is supported on $\Pi$ if \operatorname{Supp}\big{(}\mathsf{G}_{\leq m}(R),\mathsf{G}_{m+1}(R)\big{)}\subseteq\Pi.

When $\mathsf{G}$ is an $(m+1)$-block generator supported on a binary relation $\Pi$, we will often use the notation $\mathsf{G}_{\mathsf{w}}\overset{\rm def}{=}\mathsf{G}_{m+1}$ to emphasize that the last block corresponds to a witness for the first $m$ blocks.

Cryptography.

Definition 2.12** (One-way Function).**

Let $n$ be a security parameter, $t=t(n)$ and $\varepsilon=\varepsilon(n)$. A function $f:\{0,1\}^{n}\overset{}{\rightarrow}\{0,1\}^{n}$ is a $(t,\varepsilon)$-one-way function if:

For all time $t$ randomized algorithm $\mathsf{A}$: \Pr_{x\overset{}{\leftarrow}U_{n}}\left[\mathsf{A}\big{(}f(x)\big{)}\in f^{-1}\big{(}f(x)\big{)}\right]\leq\varepsilon, where $U_{n}$ is uniform over $\{0,1\}^{n}$. 2. 2.

There exists a polynomial time algorithm $\mathsf{B}$ such that $\mathsf{B}(x)=f(x)$ for all $x\in\{0,1\}^{n}$.

If $f$ is $(n^{c},1/n^{c})$-one-way for every $c\in\mathbb{N}$, we say that $f$ is (strongly) one-way.

3 Search Problems and Hardness in Relative Entropy

In this section, we first present the classical notion of hard-on-average search problems and introduce the new notion of hardness in relative entropy. We then relate the two notions by proving that average-case hardness implies hardness in relative entropy.

3.1 Search problems

For a binary relation $\Pi\subseteq\{0,1\}^{*}\times\{0,1\}^{*}$, we write $\Pi(y,w)$ for the predicate that is true iff $(y,w)\in\Pi$ and say that $w$ is a witness for the instance $y$333We used the unconventional notation $y$ for the instance (instead of $x$) because our relations will often be of the form $\Pi^{f}$ for some function $f$; in this case an instance is some $y$ in the range of $f$ and a witness for $y$ is any preimage $x\in f^{-1}(y)$.. To each relation $\Pi$, we naturally associate (1) a search problem: given $y$, find $w$ such that $\Pi(y,w)$ or state that no such $w$ exist and (2) the decision problem defined by the language $L_{\Pi}\overset{\rm def}{=}\{y\in\{0,1\}^{*}\,:\,\exists w\in\{0,1\}^{*},\,\Pi(y,w)\}$. ${\mathbf{FNP}}$ denotes the set of all relations $\Pi$ computable by a polynomial time algorithm and such that there exists a polynomial $p$ such that $\Pi(y,w)\Rightarrow|w|\leq p(|y|)$. Whenever $\Pi\in{\mathbf{FNP}}$, the associated decision problem $L_{\Pi}$ is in ${\mathbf{NP}}$. We now define average-case hardness.

Definition 3.1** (distributional search problem).**

A distributional search problem is a pair $(\Pi,Y)$ where $\Pi\subseteq\{0,1\}^{*}\times\{0,1\}^{*}$ is a binary relation and $Y$ is a random variable supported on $L_{\Pi}$.

The problem $(\Pi,Y)$ is (t, $\varepsilon$)-hard if \Pr\big{[}\Pi\big{(}Y,\mathsf{A}(Y)\big{)}\big{]}\leq\varepsilon for all time $t$ randomized algorithm $\mathsf{A}$, where the probability is over the distribution of $Y$ and the randomness of $\mathsf{A}$.

Example*.*

For $f:\{0,1\}^{n}\overset{}{\rightarrow}\{0,1\}^{n}$, the problem of inverting $f$ is the search problem associated with the relation $\Pi^{f}\overset{\rm def}{=}\{(f(x),x)\,:\,x\in\{0,1\}^{n}\}$. If $f$ is a $(t,\varepsilon)$-one-way function, then the distributional search problem \big{(}\Pi^{f},f(X)\big{)} of inverting $f$ on a uniform random input $X\in\{0,1\}^{n}$ is $(t,\varepsilon)$-hard.

Remark*.*

Consider a distributional search problem $(\Pi,Y)$. Without loss of generality, there exists a (possibly inefficient) two-block generator $\mathsf{G}=(\mathsf{G}_{1},\mathsf{G}_{\mathsf{w}})$ supported on $\Pi$ such that $\mathsf{G}_{1}(R)=Y$ for uniform input $R$. If $\mathsf{G}_{\mathsf{w}}$ is polynomial-time computable, it is easy to see that the search problem \big{(}\Pi^{\mathsf{G}_{1}},\mathsf{G}_{1}(R)\big{)} is at least as hard as $(\Pi,Y)$. The advantage of writing the problem in this “functional” form is that the distribution $(\mathsf{G}_{1}(R),R)$ over (instance, witness) pairs is flat, which is a necessary condition to relate hardness to inaccessible entropy (see Theorem 4.9).

Furthermore, if $\mathsf{G}_{1}$ is also polynomial-time computable and $(\Pi,Y)$ is $(\operatorname{poly}(n),\operatorname{negl}(n))$-hard, then $R\mapsto\mathsf{G}_{1}(R)$ is a one-way function. Combined with the previous example, we see that the existence of one-way functions is equivalent to the existence of $(\operatorname{poly}(n),\operatorname{negl}(n))$-hard search problems for which (instance, witness) pairs can be efficiently sampled.

3.2 Hardness in relative entropy

Instead of considering an adversary directly attempting to solve a search problem $(\Pi,Y)$, the adversary in the definition of hardness in relative entropy comprises a pair of algorithm $(\mathsf{\widetilde{G}},\mathsf{S})$ where $\mathsf{\widetilde{G}}$ is a two-block generator outputting valid (instance, witness) pairs for $\Pi$ and $\mathsf{S}$ is a simulator for $\mathsf{\widetilde{G}}$: given an instance $y$, the goal of $\mathsf{S}$ is to output randomness $r$ for $\mathsf{\widetilde{G}}$ such that $\mathsf{\widetilde{G}}_{1}(r)=y$. Formally, the definition is as follows.

Definition 3.2** (hardness in relative entropy).**

Let $(\Pi,Y)$ be a distributional search problem. We say that $(\Pi,Y)$ has hardness $(t,\Delta)$ in relative entropy if:

[TABLE]

for all pairs $(\mathsf{\widetilde{G}},\mathsf{S})$ of time $t$ algorithms where $\mathsf{\widetilde{G}}$ is a two-block generator supported on $\Pi$ and $\widetilde{R}$ is uniform randomness for $\mathsf{\widetilde{G}}_{1}$. Similarly, for $\delta\in[0,1]$, $(\Pi,Y)$ has hardness $(t,\Delta)$ in $\delta$-min relative entropy if for all such pairs:

[TABLE]

Note that a pair $(\mathsf{\widetilde{G}},\mathsf{S})$ achieves a relative entropy of zero in Definition 3.2 if $\mathsf{\widetilde{G}}_{1}(R)$ has the same distribution as $Y$ and if \mathsf{\widetilde{G}}_{1}\big{(}\mathsf{S}(y)\big{)}=y for all $y\in\operatorname{Supp}(Y)$. In this case, writing $\mathsf{\widetilde{G}}_{\mathsf{w}}\overset{\rm def}{=}\mathsf{\widetilde{G}}_{2}$, we have that \mathsf{\widetilde{G}}_{\mathsf{w}}\big{(}\mathsf{S}(Y)\big{)} is a valid witness for $Y$ since $\mathsf{\widetilde{G}}$ is supported on $\Pi$.

More generally, the composition $\mathsf{\widetilde{G}}_{\mathsf{w}}\circ\mathsf{S}$ solves the search problem $(\Pi,Y)$ whenever \mathsf{\widetilde{G}}_{1}\big{(}\mathsf{S}(Y)\big{)}=Y. When the relative entropies in Definition 3.2 are upper-bounded, we can lower bound the probability of the search problem being solved (Lemma 3.4). This immediately implies that hard search problems are also hard in relative entropy.

Theorem 3.3**.**

Let $(\Pi,Y)$ be a distributional search problem. If $(\Pi,Y)$ is $(t,\varepsilon)$-hard, then it has hardness $(t^{\prime},\Delta^{\prime})$ in relative entropy and $(t^{\prime},\Delta^{\prime\prime})$ in $\delta$-min relative entropy for every $\delta\in[0,1]$ where $t^{\prime}=\Omega(t)$,444For the theorems in this paper that relate two notions of hardness, the notation $t^{\prime}=\Omega(t)$ means that there exists a constant $C$ depending only on the computational model such that $t^{\prime}\geq C\cdot t$. $\Delta^{\prime}=\log(1/\varepsilon)$ and $\Delta^{\prime\prime}=\log(1/\varepsilon)-\log(1/\delta)$.

Remark*.*

As we see, a “good” simulator $\mathsf{S}$ for a generator $\mathsf{\widetilde{G}}$ is one for which \mathsf{\widetilde{G}}_{1}\big{(}\mathsf{S}(Y)\big{)}=Y holds often. It will be useful in Section 4 to consider simulators $\mathsf{S}$ which are allowed to fail by outputting a failure string $r\notin\operatorname{Supp}(\widetilde{R})$, (e.g. $r=\bot$) and adopt the convention that $\mathsf{\widetilde{G}}_{1}(r)=\bot$ whenever $r\notin\operatorname{Supp}(\widetilde{R})$. With this convention, we can without loss of generality add the requirement that \mathsf{\widetilde{G}}_{1}\big{(}\mathsf{S}(Y)\big{)}=Y whenever $\mathsf{S}(Y)\in\operatorname{Supp}(\widetilde{R})$: indeed, $\mathsf{S}$ can always check that it is the case and if not output a failure symbol. For such a simulator $\mathsf{S}$, observe that for all $r\in\operatorname{Supp}(\widetilde{R})$, the second variable on both sides of the relative entropy in Definition 3.2 is obtained by applying $\mathsf{\widetilde{G}}_{1}$ on the first variable and can thus be dropped, leading to a simpler definition of hardness in relative entropy: $\operatorname{KL}\left(\widetilde{R}\,\middle\|\,\mathsf{S}(Y)\right)>\Delta$.

Theorem 3.3 is an immediate consequence of the following lemma.

Lemma 3.4**.**

Let $(\Pi,Y)$ be a distributional search problem and $(\mathsf{\widetilde{G}},\mathsf{S}$) be a pair of algorithms with $\mathsf{\widetilde{G}}=(\mathsf{\widetilde{G}}_{1},\mathsf{\widetilde{G}}_{\mathsf{w}})$ a two-block generator supported on $\Pi$. Define the linear-time oracle algorithm $\mathsf{A}^{\mathsf{\widetilde{G}}_{\mathsf{w}},\mathsf{S}}(y)\overset{\rm def}{=}\mathsf{\widetilde{G}}_{\mathsf{w}}(\mathsf{S}(y))$. For $\Delta\in\mathbb{R}^{+}$ and $\delta\in[0,1]$:

If $\operatorname{KL}\left(\widetilde{R},\mathsf{\widetilde{G}}_{1}(\widetilde{R})\,\middle\|\,\mathsf{S}(Y),Y\right)\leq\Delta$ then $\Pr\left[\Pi(Y,\mathsf{A}^{\mathsf{\widetilde{G}}_{\mathsf{w}},\mathsf{S}}(Y))\right]\geq 1/2^{\Delta}$. 2. 2.

If $\operatorname{KL}_{\rm min}^{\delta}\left(\widetilde{R},\mathsf{\widetilde{G}}_{1}(\widetilde{R})\,\middle\|\,\mathsf{S}(Y),Y\right)\leq\Delta$ then $\Pr\left[\Pi(Y,\mathsf{A}^{\mathsf{\widetilde{G}}_{\mathsf{w}},\mathsf{S}}(Y))\right]\geq\delta/2^{\Delta}$.

Proof.

We have:

[TABLE]

Now, the first claim follows by Jensen’s inequality (since $x\mapsto 2^{-x}$ is convex) and the second claim follows by Markov’ inequality when considering the event that the sample relative entropy is smaller than $\Delta$ (which occurs with probability at least $\delta$ by assumption). ∎

Relation to relative pseudoentropy.

In [VZ12], the authors introduced the notion of relative pseudoentropy555As already mentioned in the introduction, this notion was in fact called “$\operatorname{KL}$-hardness for sampling” in [VZ12] but we rename it here to unify the terminology between the various notions discussed here.: for jointly distributed variables $(Y,W)$, $W$ has relative pseudoentropy given $Y$ if it is hard for a polynomial time adversary to approximate—measured in relative entropy—the conditional distribution $W$ given $Y$. Formally:

Definition 3.5** (relative pseudoentropy, Def. 3.4 in [VZ12]).**

Let $(Y,W)$ be a pair of random variables, we say that $W$ has relative pseudoentropy $(t,\Delta)$ given $Y$ if for all time $t$ randomized algorithm $\mathsf{S}$, we have:

[TABLE]

As discussed in Section 1.2, it was shown in [VZ12] that if $f:\{0,1\}^{n}\overset{}{\rightarrow}\{0,1\}^{n}$ is a one-way function, then \big{(}f(X),X_{1},\dots,X_{n}) has next-bit pseudoentropy for uniform $X\in\{0,1\}^{n}$ (see Theorem 1.2). The first step in proving this result was to prove that $X$ has relative pseudoentropy given $f(X)$ (see Lemma 1.4).

We observe that when $(Y,W)$ is of the form $(f(X),X)$ for some function $f:\{0,1\}^{n}\overset{}{\rightarrow}\{0,1\}^{n}$ and variable $X$ over $\{0,1\}^{n}$, then relative pseudoentropy is implied by hardness in relative entropy by simply fixing $\mathsf{\widetilde{G}}$ to be the “honest sampler” $\mathsf{\widetilde{G}}(X)=(f(X),X)$. Indeed, in this case we have:

[TABLE]

We can thus recover Lemma 1.4 as a direct corollary of Theorem 3.3.

Corollary 3.6**.**

Consider a function $f:\{0,1\}^{n}\overset{}{\rightarrow}\{0,1\}^{n}$ and define $\Pi^{f}\overset{\rm def}{=}\{(f(x),x):x\in\{0,1\}^{n}\}$ and $Y\overset{\rm def}{=}f(X)$ for $X$ uniform over $\{0,1\}^{n}$. If $f$ is $(t,\varepsilon)$-one-way, then $(\Pi^{f},Y)$ has hardness \big{(}t^{\prime},\log(1/\varepsilon)\big{)} in relative entropy and $X$ has relative pseudoentropy \big{(}t^{\prime},\log(1/\varepsilon)\big{)} given $Y$ with $t^{\prime}=\Omega(t)$.

Witness hardness in relative entropy.

We also introduce a relaxed notion of hardness in relative entropy called witness hardness in relative entropy. In this notion, we further require $(\mathsf{\widetilde{G}},\mathsf{S})$ to approximate the joint distribution of (instance, witness) pairs rather than only instances. For example, the problem of inverting a function $f$ over a random input $X$ is naturally associated with the distribution \big{(}f(X),X\big{)}. The relaxation in this case is analogous to the notion of distributional one-way function for which the adversary is required to approximate the uniform distribution over preimages.

Definition 3.7** (witness hardness in relative entropy).**

Let $\Pi$ be a binary relation and $(Y,W)$ be a pair of random variables supported on $\Pi$. We say that $(\Pi,Y,W)$ has witness hardness $(t,\Delta)$ in relative entropy if for all pairs of time $t$ algorithms $(\mathsf{\widetilde{G}},\mathsf{S})$ where $\mathsf{\widetilde{G}}$ is a two-block generator supported on $\Pi$, for uniform $\widetilde{R}$:

[TABLE]

Similarly, for $\delta\in[0,1]$, $(\Pi,Y,W)$ has witness hardness $(t,\Delta)$ in $\delta$-min relative entropy, if for all such pairs:

[TABLE]

We introduced hardness in relative entropy first, since it is the notion which is most directly obtained from the hardness of distribution search problems. Observe that by the data processing inequality for relative entropy (Proposition 2.7), dropping the third variable on both sides of the relative entropies in Definition 3.7 only decreases them. Hence, hardness in relative entropy implies witness hardness as stated in (Theorem 3.8). As we will see in Section 4 witness hardness in relative entropy is the “correct” notion to obtain inaccessible entropy from: it is in fact equal to inaccessible entropy up to $1/\operatorname{poly}$ losses.

Theorem 3.8**.**

Let $\Pi$ be a binary relation and $(Y,W)$ be a pair of random variables supported on $\Pi$. If $(\Pi,Y)$ is $(t,\varepsilon)$-hard, then $(\Pi,Y,W)$ has witness hardness $(t^{\prime},\Delta^{\prime})$ in relative entropy and $(t^{\prime},\Delta^{\prime\prime})$ in $\delta$-min relative entropy for every $\delta\in[0,1]$ where $t^{\prime}=\Omega(t)$, $\Delta^{\prime}=\log(1/\varepsilon)$ and $\Delta^{\prime\prime}=\log(1/\varepsilon)-\log(1/\delta)$.

Remark*.*

The data processing inequality does not hold exactly for $\operatorname{KL}_{\rm min}$, hence the statement about $\delta$-min relative entropy in Theorem 3.8 does not follow with the claimed parameters in a black-box manner from Theorem 3.3. However, an essentially identical proof given in Appendix A yields the result.

4 Inaccessible Entropy and Hardness in Relative Entropy

In this section, we relate our notion of witness hardness in relative entropy to the inaccessible entropy definition of [HRVW16]. Roughly speaking, we “split” the relative entropy into blocks and obtain the intermediate notion of next-block inaccessible relative entropy (Section 4.1) which we then relate to inaccessible entropy (Section 4.2). Together, these results show that if $f$ is a one-way function, the generator \mathsf{G}^{f}(X)=\big{(}f(X)_{1},\dots,f(X)_{n},X\big{)} has superlogarithmic inaccessible entropy.

4.1 Next-block hardness and rejection sampling

For an online (adversarial) generator $\mathsf{\widetilde{G}}$, it is natural to consider simulators $\mathsf{S}$ that also operate in an online fashion. That is:

Definition 4.1** (online simulator).**

Let $\mathsf{\widetilde{G}}:\prod_{i=1}^{m}\{0,1\}^{s_{i}}\overset{}{\rightarrow}\prod_{i=1}^{m}\{0,1\}^{\ell_{i}}$ be an online $m$-block generator. An online simulator for $\mathsf{\widetilde{G}}$ is a PPT algorithm $\mathsf{S}$ such that for all $y=(y_{1},\dots,y_{m})\in\prod_{i=1}^{m}\{0,1\}^{\ell_{i}}$, defining inductively $\widehat{r}_{i}\overset{\rm def}{=}\mathsf{S}(\widehat{r}_{<i},y_{i})\in\{0,1\}^{s_{i}}$, we have for all $i\in[m]$:

[TABLE]

The running time of $\mathsf{S}$ is the total amount of time required to compute $\widehat{r}_{1},\dots,\widehat{r}_{m}$.

The goal of such an online simulator $\mathsf{S}$ is to ensure that the distribution of $\widehat{R}_{i}=\mathsf{S}(\widehat{r}_{<i},y_{i})$ is close to that of $\widetilde{R}_{i}|\widetilde{R}_{<i}=\widehat{r}_{<i},\widetilde{Y}_{i}=y_{i}$ where $(\widetilde{Y}_{1},\dots,\widetilde{Y}_{m})\overset{\rm def}{=}\mathsf{\widetilde{G}}(\widetilde{R}_{\leq m})$ for uniformly random $(\widetilde{R}_{1},\dots,\widetilde{R}_{m})$. Equivalently, $\widehat{R}_{i}$ should be close to uniform on $\{\widehat{r}_{i}\,:\,\mathsf{\widetilde{G}}_{i}(\widehat{r}_{\leq i})=y_{i}\}$. Measuring closeness with relative entropy, we have:

Definition 4.2** (next-block hardness in relative entropy).**

The joint distribution $Y=(Y_{1},\dots,Y_{m})$ has next-block hardness $(t,\Delta)$ in relative entropy if the following holds for every time $t$ online $m$-block generator $\mathsf{\widetilde{G}}$ and every time $t$ online simulator $\mathsf{S}$ for $\mathsf{\widetilde{G}}$.

Write $\widetilde{Y}_{\leq m}\overset{\rm def}{=}\mathsf{\widetilde{G}}(\widetilde{R}_{\leq m})$ for uniform $\widetilde{R}_{\leq m}$, and define inductively $\widehat{R}_{i}\overset{\rm def}{=}\mathsf{S}(\widehat{R}_{<i},Y_{i})$. Then we require:

[TABLE]

Similarly, for $\delta\in[0,1]$, we say that $(Y_{1},\dots,Y_{m})$ has next-block hardness $(t,\Delta)$ in $\delta$-min relative entropy if, with the same notations as above:

[TABLE]

Observe that using the chain rule for relative entropy, the sum of relative entropies appearing in Definition 4.2 is exactly equal to the relative entropies appearing in Definition 3.2. Since, furthermore considering an online generator $\mathsf{\widetilde{G}}$ and online simulator $\mathsf{S}$ is only less general than arbitrary pairs $(\mathsf{\widetilde{G}},\mathsf{S})$, we immediately obtain the following theorem.

Theorem 4.3**.**

Let $(\Pi,Y)$ be a distributional search problem. If $(\Pi,Y)$ has hardness $(t,\Delta)$ in relative entropy then $(Y_{1},\dots,Y_{m})$ has next-block hardness $(t,\Delta)$ in relative entropy.

Similarly, for any $\delta\in[0,1]$, if $(\Pi,Y)$ has hardness $(t,\Delta)$ in $\delta$-min relative entropy then $(Y_{1},\dots,Y_{m})$ has next-block hardness $(t,\Delta)$ in $\delta$-min relative entropy.

Proof.

Immediate using the chain rule for relative (sample) entropy. ∎

The next step is to obtain a notion of hardness that makes no reference to simulators by considering, for an online block generator $\mathsf{\widetilde{G}}$, a specific simulator $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$ which on input $(\widehat{r}_{<i},y_{i})$, generates $\widehat{R}_{i}$ using rejection sampling until $\mathsf{\widetilde{G}}_{i}(\widehat{r}_{<i},\widehat{R}_{i})=y_{i}$. The superscript $T$ is the maximum number of attempts after which $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$ gives up and outputs $\bot$. The formal definition of $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$ is given in Algorithm 1.

For the rejection sampling simulator $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$, we will show in Lemma 4.5 that the next-block hardness in relative entropy in Definition 4.2 decomposes as the sum of two terms:

A term measuring how well $\mathsf{\widetilde{G}}_{\leq m}$ approximates the distribution $Y$ in an online manner, without any reference to a simulator. 2. 2.

An error term measuring the failure probability of the rejection sampling procedure due to having a finite time bound $T$.

As we show in Lemma 4.6, the error term can be made arbitrarily small by setting the number of trials $T$ in $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$ to be a large enough multiple of $m\cdot 2^{\ell}$ where $\ell$ is the length of the blocks of $\mathsf{\widetilde{G}}_{\leq m}$. This leads to a $\operatorname{poly}(m)$ time algorithm whenever $\ell$ is logarithmic in $m$. That is, given an online block generator $\mathsf{\widetilde{G}}$ for which $\mathsf{\widetilde{G}}_{\leq m}$ has short blocks, we obtain a corresponding simulator “for free”. Thus, considering only the first term leads to the following clean definition of next-block inaccessible relative entropy that makes no reference to simulators.

Definition 4.4** (next-block inaccessible relative entropy).**

The joint distribution $(Y_{1},\dots,Y_{m})$ has next-block inaccessible relative entropy $(t,\Delta)$, if for every time $t$ online $m$-block generator $\mathsf{\widetilde{G}}$ supported on $Y_{\leq m}$, writing $\widetilde{Y}_{\leq m}\overset{\rm def}{=}\mathsf{\widetilde{G}}(\widetilde{R}_{\leq m})$ for uniform $\widetilde{R}_{\leq m}$, we have:

[TABLE]

where $R_{i}$ is a “dummy” random variable over the domain of $\mathsf{\widetilde{G}}_{i}$ and independent of $Y_{\leq m+1}$. Similarly, for $\delta\in[0,1]$, we say that $(Y_{1},\dots,Y_{m+1})$ has next-block inaccessible $\delta$-min relative entropy $(t,\Delta)$ if for every $\mathsf{\widetilde{G}}$ as above:

[TABLE]

where $(\widetilde{Y}_{\leq m},\widetilde{R}_{\leq m})$ are defined as above.

Remark*.*

Since $\widetilde{Y}_{<i}$ is a function of $\widetilde{R}_{<i}$, the first conditional distribution in the KL is effectively $\widetilde{Y}_{i}|\widetilde{R}_{<i}$. Similarly the second distribution is effectively $Y_{i}|Y_{<i}$. The extra random variables are there for syntactic consistency.

With this definition in hand, we can make formal the claim that, even as sample notions, the next-block hardness in relative entropy decomposes as next-block inaccessible relative entropy plus an error term.

Lemma 4.5**.**

For a joint distribution $(Y_{1},\dots,Y_{m})$, let $\mathsf{\widetilde{G}}$ be an online $m$-block generator supported on $Y_{\leq m}$. Define $(\widetilde{Y}_{1},\dots,\widetilde{Y}_{m})\overset{\rm def}{=}\mathsf{\widetilde{G}}(\widetilde{R})$ for uniform random variable $\widetilde{R}=(\widetilde{R}_{1},\dots,\widetilde{R}_{m})$ and let $R_{i}$ be a “dummy” random variable over the domain of $\mathsf{\widetilde{G}}_{i}$ and independent of $Y_{\leq m}$. We also define $\widehat{R}_{i}\overset{\rm def}{=}\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}(\widehat{R}_{<i},Y_{i})$ and $\widehat{Y}_{i}=\mathsf{\widetilde{G}}(\widehat{R}_{\leq i})$. Then, for all $r\in\operatorname{Supp}(\widetilde{R})$ and $y\overset{\rm def}{=}\mathsf{\widetilde{G}}(r)$:

[TABLE]

Moreover, the running time of $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$ on input $\widehat{R}_{<i},Y_{i}$ is $O(\lvert r_{i}\rvert\cdot T)$, with at most $T$ oracle calls to $\mathsf{\widetilde{G}}$.

Proof.

Consider $r\in\operatorname{Supp}(\widetilde{R})$ and $y\overset{\rm def}{=}\mathsf{\widetilde{G}}(r)$. Then:

[TABLE]

The first equality is because $Y_{i}=\widehat{Y}_{i}$ since we are only considering non-failure cases ($r_{i}\neq\bot$). The second equality is the chain rule. The penultimate equality is by definition of rejection sampling: $\widetilde{R}_{i}|\widetilde{R}_{<i},\widetilde{Y}_{\leq i}$ and $\widehat{R}_{i}|\widehat{R}_{<i},\widehat{Y}_{\leq i}$ are identical on $\operatorname{Supp}(\widetilde{R}_{i})$ since conditioning on $\widehat{Y}_{i}=y$ implies that only non-failure cases ($r_{i}\neq\bot$) are considered. The last equality is because $\widetilde{Y}_{<i}$ (resp. $\widehat{Y}_{<i}$) is a deterministic function of $\widetilde{R}_{<i}$ (resp. $\widehat{R}_{<i}$).

We now relate $\widehat{Y}_{i}|\widehat{R}_{<i}$ to $Y_{i}|Y_{<i}$:

[TABLE]

where the last equality is because when $r\in\operatorname{Supp}(\widetilde{R})$, $\widehat{R}_{<i}=r_{<i}\Rightarrow Y_{<i}=y_{<i}$ and because $Y_{i}$ is independent of $\widehat{R}_{<i}$ given $Y_{<i}$ (as $\widehat{R}_{<i}$ is simply a randomized function of $Y_{<i}$). The conclusion of the lemma follows by combining the previous two derivations. ∎

Observe that taking expectations with respect to a uniform $\widetilde{R}$ on both sides in the conclusion of Lemma 4.5, we get that next-block hardness in relative entropy is equal to the sum of next-block inaccessible relative entropy and the expectation of the error term coming from the rejection sampling procedure. The following lemma upper bounds this expectation.

Lemma 4.6**.**

Let $\mathsf{\widetilde{G}}$ be an online $m$-block generator, and let $L_{i}\overset{\rm def}{=}2^{|\mathsf{\widetilde{G}}_{i}|}$ be the size of the codomain of $\mathsf{\widetilde{G}}_{i}$, $i\in[m]$. Then for all $i\in[m]$, $r_{<i}\in\operatorname{Supp}(\widetilde{R}_{<i})$ and uniform $\widetilde{R}_{i}$:

[TABLE]

Proof of Lemma 4.6.

By definition of $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$, we have:

[TABLE]

Applying Jensen’s inequality, we have:

[TABLE]

where $p_{y}=\Pr\left[\mathsf{\widetilde{G}}_{i}(r_{<i},\widetilde{R}_{i})=y\right]$. Since the function $x/\left(1-(1-x)^{T}\right)$ is convex (see Lemma A.1 in the appendix), the maximum of the expression inside the logarithm over probability distributions $\{p_{y}\}$ is achieved at the extremal points of the standard probability simplex. Namely, when all but one $p_{y}\overset{}{\rightarrow}0$ and the other one is $1$. Since \lim_{x\overset{}{\rightarrow}0}x/\big{(}1-(1-x)^{T}\big{)}=1/T:

[TABLE]

By combining Lemmas 4.5 and 4.6, we are now ready to state the main result of this section, relating witness hardness in relative entropy to next-block inaccessible relative entropy.

Theorem 4.7**.**

Let $\Pi$ be a binary relation and let $(Y,W)$ be a pair of random variables supported on $\Pi$. Let $Y=(Y_{1},\dots,Y_{m})$ be a partition of $Y$ into blocks of at most $\ell$ bits. Then we have:

if $(\Pi,Y,W)$ has witness hardness $(t,\Delta)$ in relative entropy, then for every $0<\Delta^{\prime}\leq\Delta$, $(Y_{1},\dots,Y_{m},W)$ has next-block inaccessible relative entropy $(t^{\prime},\Delta-\Delta^{\prime})$ where $t^{\prime}=\Omega(t\Delta^{\prime}/(m^{2}2^{\ell}))$. 2. 2.

if $(\Pi,Y,W)$ has witness hardness $(t,\Delta)$ in $\delta$-min relative entropy then for every $0<\Delta^{\prime}\leq\Delta$ and $0\leq\delta^{\prime}\leq 1-\delta$, we have that $(Y_{1},\dots,Y_{m},W)$ has next-block inaccessible $(\delta+\delta^{\prime})$-min relative entropy $(t^{\prime},\Delta-\Delta^{\prime})$ where $t^{\prime}=\Omega(t\delta^{\prime}\Delta^{\prime}/(m^{2}2^{\ell}))$.

Proof.

We consider an online generator $\mathsf{\widetilde{G}}$ supported on $(Y_{1},\dots,Y_{m},W)$ and the simulator $\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}$. For convenience, we sometimes write $Y_{m+1}$ for $W$. Define $\widetilde{R}\overset{\rm def}{=}\widetilde{R}_{\leq m}$ where $\widetilde{R}_{\leq m}$ is a sequence of independent and uniformly random variables, $\widetilde{Y}_{\leq m+1}\overset{\rm def}{=}\mathsf{\widetilde{G}}(\widetilde{R})$, $\mathsf{\widetilde{G}}_{1}(\widetilde{R})\overset{\rm def}{=}\widetilde{Y}_{\leq m}$ and $\mathsf{\widetilde{G}}_{\mathsf{w}}(\widetilde{R})\overset{\rm def}{=}\widetilde{Y}_{m+1}$. We also write for $1\leq i\leq m$, $\widehat{R}_{i}\overset{\rm def}{=}\operatorname{\mathsf{Sim}}^{\mathsf{\widetilde{G}},T}(\widehat{R}_{<i},Y_{i})$, $\widehat{Y}_{i}\overset{\rm def}{=}\mathsf{\widetilde{G}}(\widehat{R}_{\leq i})_{i}$. Finally we define $\mathsf{S}^{\mathsf{\widetilde{G}},T}(Y)\overset{\rm def}{=}\widehat{R}_{\leq m}$.

Observe that $(\mathsf{\widetilde{G}}_{1},\mathsf{\widetilde{G}}_{\mathsf{w}})$ is a two-block generator supported on $\Pi$, so the pair $(\mathsf{\widetilde{G}},\mathsf{S}^{\mathsf{\widetilde{G}},T})$ forms a pair a algorithms as in the definition of witness hardness in relative entropy (Definition 3.7). We focus on sample notions first, and consider $r\in\operatorname{Supp}(\widetilde{R})$, $y\in\operatorname{Supp}(\widetilde{Y}_{\leq m})$ and $w\in\operatorname{Supp}(\widetilde{Y}_{m+1})$. First we use the chain rule to isolate the witness block:

[TABLE]

Next, as in Theorem 4.3 we apply the chain rule to decompose the second term on the right-hand side and obtain next-block hardness in relative entropy:

[TABLE]

Finally, we use Lemma 4.5 to further decompose the right-hand side term into inaccessible relative entropy and the rejection sampling error:

[TABLE]

Combining the previous derivations, we obtain:

[TABLE]

Now, the first claim of the theorem follows by taking expectations on both sides and observing that when $T=m\cdot 2^{\ell}/(\Delta^{\prime}\ln 2)$, Lemma 4.6 implies that the expected value of the rejection sampling error is smaller than $\Delta^{\prime}$.

For the second claim, we first establish using Lemma 4.6 and Markov’s inequality that:

[TABLE]

and we reach a similar conclusion by setting $T=m\cdot 2^{\ell}/(\delta^{\prime}\Delta^{\prime}\ln 2)$. ∎

Remark*.*

For fixed distribution and generators, in the limit where $T$ grows to infinity, the error term caused by the failure of rejection sampling in time $T$ vanishes. In this case, hardness in relative entropy implies next-block inaccessible relative entropy without any loss in the hardness parameters.

4.2 Next-block inaccessible relative entropy and inaccessible entropy

We first recall the definition from [HRVW16], slightly adapted to our notations.

Definition 4.8** (Inaccessible Entropy).**

Let $(Y_{1},\dots,Y_{m+1})$ be a joint distribution.666We write $m+1$ the total number of blocks, since in this section we will think of $Y_{m+1}$ (also written as $W$) as the witness of a distributional search problem and $(Y_{1},\dots,Y_{m})$ are the blocks of the instance as in the previous section. We say that $(Y_{1},\dots,Y_{m+1})$ has inaccessible entropy $(t,\Delta)$ if for all $(m+1)$-block online generators $\mathsf{\widetilde{G}}$ running in time $t$ and consistent with $(Y_{1},\dots,Y_{m+1})$:

[TABLE]

where $(\widetilde{Y}_{1},\dots,\widetilde{Y}_{m+1})=\mathsf{\widetilde{G}}(\widetilde{R}_{1},\dots,\widetilde{R}_{m+1})$ for a uniform $\widetilde{R}_{\leq m+1}$.

Similarly $(Y_{1},\dots,Y_{m+1})$ has inaccessible $\delta$-max entropy $(t,\Delta)$ if for all $(m+1)$-block online generators $\mathsf{\widetilde{G}}$ running in time $t$ and consistent with $(Y_{1},\dots,Y_{m+1})$:

[TABLE]

Unfortunately, one unsatisfactory aspect of Definition 4.8 is that inaccessible entropy can be negative since the generator $\mathsf{\widetilde{G}}$ could have more entropy than $(Y_{1},\dotsc,Y_{m+1})$: if all the $Y_{i}$ are independent biased random bits, then a generator $\mathsf{\widetilde{G}}$ outputting unbiased random bits will have negative inaccessible entropy. On the other hand, next-block inaccessible relative entropy (Definition 4.4) does not suffer from this drawback.

Moreover, in the specific case where $(Y_{1},\dots,Y_{m+1})$ is a flat distribution777For example, the distribution $(Y_{\leq m},Y_{m+1})=(f(U),U)$ for a function $f$ and uniform input $U$ is always a flat distribution even if $f$ itself is not regular., then no distribution with the same support can have higher entropy and in this case Definitions 4.4 and 4.8 coincide as stated in the following theorem.

Theorem 4.9**.**

Let $(Y_{1},,\dots,Y_{m+1})$ be a flat distribution and $\mathsf{\widetilde{G}}$ be an $(m+1)$-block generator consistent with $Y_{\leq m+1}$. Then for $\widetilde{Y}_{\leq m+1}=\mathsf{\widetilde{G}}(\widetilde{R}_{\leq m+1})$ for uniform $\widetilde{R}_{\leq m+1}$:

For every $y_{\leq m+1},r_{\leq m+1}\in\operatorname{Supp}(\widetilde{Y}_{\leq m+1},\widetilde{R}_{\leq m+1})$, it holds that

[TABLE]

In particular, $(Y_{1},\dots,Y_{m+1})$ has next-block inaccessible $\delta$-min relative entropy $(t,\Delta)$ if and only if it has inaccessible $\delta$-max entropy $(t,\Delta)$. 2. 2.

Furthermore,

[TABLE]

so in particular, $(Y_{1},\dots,Y_{m+1})$ has next-block inaccessible relative entropy $(t,\Delta)$ if and only if it has inaccessible entropy $(t,\Delta)$.

Proof.

For the sample notions, the chain rule (Proposition 2.6) gives:

[TABLE]

for all $y$ since $Y$ is flat. Hence:

[TABLE]

so the second claim follows by taking the expectation over $(\widetilde{Y}_{\leq m+1},\widetilde{R}_{\leq m+1})$ on both sides. ∎

By chaining the reductions between the different notions of hardness considered in this work (hardness in relative entropy, next-block inaccessible relative entropy and inaccessible entropy), we obtain a more modular proof of the theorem of Haitner *et al. * [HRVW16], obtaining inaccessible entropy from any one-way function.

Theorem 4.10**.**

Let $n$ be a security parameter, $f:\{0,1\}^{n}\overset{}{\rightarrow}\{0,1\}^{n}$ be a $(t,\varepsilon)$-one-way function, and $X$ be uniform over $\{0,1\}^{n}$. For $\ell\in\{1,\dots,n\}$, decompose $f(X)\overset{\rm def}{=}(Y_{1},\dots,Y_{n/\ell})$ into blocks of length $\ell$. Then:

For every $0\leq\Delta\leq\log(1/\varepsilon)$, $(Y_{1},\dots,Y_{n/\ell},X)$ has inaccessible entropy $\left(t^{\prime},\log(1/\varepsilon)-\Delta\right)$ for $t^{\prime}=\Omega\left(t\cdot\Delta\cdot\ell^{2}/(n^{2}\cdot 2^{\ell})\right)$. 2. 2.

For every $0<\delta\leq 1$ and $0\leq\Delta\leq\log(1/\varepsilon)-\log(2/\delta)$, $(Y_{1},\dots,Y_{n/\ell},X)$ has inaccessible $\delta$-max entropy $\left(t^{\prime},\log(1/\varepsilon)-\log(2/\delta)-\Delta\right)$ for $t^{\prime}=\allowbreak\Omega\left(t\cdot\delta\cdot\Delta\cdot\ell^{2}/(n^{2}\cdot 2^{\ell})\right)$.

Proof.

Since $f$ is $(t,\varepsilon)$-one-way, the distributional search problem \big{(}\Pi^{f},f(X)\big{)} where $\Pi^{f}=\{(f(x),x):x\in\{0,1\}^{n}\}$ is $(t,\varepsilon)$-hard. Clearly, $(f(X),X)$ is supported on $\Pi^{f}$, so by applying Theorem 3.8, we have that $(\Pi^{f},f(X),X)$ has witness hardness $(\Omega(t),\log(1/\varepsilon))$ in relative entropy and $(\Omega(t),\log(1/\varepsilon)-\log(2/\delta))$ in $\delta/2$-min relative entropy. Thus, by Theorem 4.7 we have that $(Y_{1},\dotsc,Y_{n/\ell},X)$ has next-block inaccessible relative entropy $\left(\Omega\left(t\cdot\Delta\cdot\ell^{2}/(n^{2}\cdot 2^{\ell})\right),\log(1/\varepsilon)-\Delta\right)$ and next-block inaccessible $\delta$-min relative entropy $\left(\Omega\left(t\cdot\delta\cdot\Delta\cdot\ell^{2}/(n^{2}\cdot 2^{\ell})\right),\log(1/\varepsilon)-\log(2/\delta)-\Delta\right)$, and we conclude by Theorem 4.9. ∎

Remark*.*

For comparison, the original proof of [HRVW16] shows that for every $0<\delta\leq 1$, $(Y_{1},\dots,Y_{n/\ell},X)$ has inaccessible $\delta$-max entropy $\left(t^{\prime},\log(1/\varepsilon)-2\log(1/\delta)-O(1)\right)$ for $t^{\prime}=\tilde{\Omega}\left(t\cdot\delta\cdot\ell^{2}/(n^{2}\cdot 2^{\ell})\right)$, which in particular for fixed $t^{\prime}$ has quadratically worse dependence on $\delta$ in terms of the achieved inaccessible entropy: $\log(1/\varepsilon)-2\cdot\log(1/\delta)-O(1)$ rather than our $\log(1/\varepsilon)-1\cdot\log(1/\delta)-O(1)$.

Corollary 4.11** (Theorem 4.2 in [HRVW16]).**

Let $n$ be a security parameter, $f:\{0,1\}^{n}\allowbreak\overset{}{\rightarrow}\{0,1\}^{n}$ be a strong one-way function, and $X$ be uniform over $\{0,1\}^{n}$. Then for every $\ell=O(\log n)$, $(f(X)_{1\dotsc\ell},\dots,f(X)_{n-\ell+1\dotsc n},X)$ has inaccessible entropy $\left(n^{\omega(1)},\omega(\log n)\right)$ and inaccessible $1/n^{\omega(1)}$-max entropy $\left(n^{\omega(1)},\omega(\log n)\right)$.

Acknowledgements

We thank Muthuramakrishnan Venkitasubramaniam for an inspiring conversation which sparked this work.

Appendix A Missing Proofs

Lemma A.1**.**

For all $t\geq 1$, $f:x\mapsto\frac{x}{1-(1-x)^{t}}$ is convex over $[0,1]$.

Proof.

We instead show convexity of $\tilde{f}:x\mapsto f(1-x)$. A straightforward computation gives:

[TABLE]

so that it suffices to show the non-negativity of $g(x)=t(1-x)(x^{t}+1)-(1+x)(1-x^{t})$ over $[0,1]$. The function $g$ has second derivative $t(1-x)(t^{2}-1)x^{t-2}$, which is non-negative when $x\in[0,1]$, and thus the first derivative $g^{\prime}$ is non-decreasing. Also, the first derivative at $1$ is equal to zero, so that $g^{\prime}$ is non-positive over $[0,1]$ and hence $g$ is non-increasing over this interval. Since $g(1)=0$, this implies that $g$ is non-negative over $[0,1]$ and $f$ is convex as desired. ∎

Theorem A.2** (Theorem 3.8 restated).**

Let $\Pi$ be a binary relation and let $(Y,W)$ be pair of random variables supported on $\Pi$. If $(\Pi,Y)$ is $(t,\varepsilon)$-hard, then $(\Pi,Y,W)$ is $(t^{\prime},\Delta^{\prime})$ witness hard in relative entropy and $(t^{\prime},\Delta^{\prime\prime})$ witness hard in $\delta$-min relative entropy for every $\delta\in[0,1]$ where $t^{\prime}=\Omega(t)$, $\Delta^{\prime}=\log(1/\varepsilon)$ and $\Delta^{\prime\prime}=\log(\delta/\varepsilon)$.

Proof.

We proceed similarly to the proof of Theorem 3.3. Let $(\mathsf{\widetilde{G}},\mathsf{S})$ be a pair of algorithms with $\mathsf{\widetilde{G}}=(\mathsf{\widetilde{G}}_{1},\mathsf{\widetilde{G}}_{\mathsf{w}})$ a two-block generator supported on $\Pi$. Define the linear-time oracle algorithm $\mathsf{A}^{\mathsf{\widetilde{G}}_{\mathsf{w}},\mathsf{S}}(y)\overset{\rm def}{=}\mathsf{\widetilde{G}}_{\mathsf{w}}(\mathsf{S}(y))$. Then

[TABLE]

The witness hardness in relative entropy then follows by applying Jensen’s inequality (since $2^{-x}$ is convex) and the witness hardness in $\delta$-min relative entropy follows by Markov’s inequality by considering the event that the sample relative entropy is smaller than $\Delta$ (this event has density at least $\delta$). ∎