Algebraic attacks against random local Functions and their countermeasures

Benny Applebaum, Shachar Lovett

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review


Suppose that you have n truly random bits x = (x1,..., xn) and you wish to use them to generate m ≥ n pseudorandom bits y = (y1,..., ym) using a local mapping, i.e., each yi should depend on at most d = O(1) bits of x. In the polynomial regime of m = ns, s > 1, the only known solution, originates from (Goldreich, ECCC 2000), is based on Random Local Functions: Compute yi by applying some fixed (public) d-ary predicate P to a random (public) tuple of distinct inputs (xi1,..., xid). Our goal in this paper is to understand, for any value of s, how the pseudorandomness of the resulting sequence depends on the choice of the underlying predicate. We derive the following results: (1) We show that pseudorandomness against F2-linear adversaries (i.e., the distribution y has low-bias) is achieved if the predicate is (a) k = Ω(s)-resilience, i.e., uncorrelated with any k-subset of its inputs, and (b) has algebraic degree of Ω(s) even after fixing Ω(s) of its inputs. We also show that these requirements are necessary, and so they form a tight characterization (up to constants) of security against linear attacks. Our positive result shows that a d-local lowbias generator can have output length of nΩ(d), answering an open question of Mossel, Shpilka and Trevisan (FOCS, 2003). Our negative result shows that a candidate for pseudorandom generator proposed by the first author (computational complexity, 2015) and by O'Donnell and Witmer (CCC 2014) is insecure. We use similar techniques to refute a conjecture of Feldman, Perkins and Vempala (STOC 2015) regarding the hardness of planted constraint satisfaction problems. (2) Motivated by the cryptanalysis literature, we consider security against algebraic attacks. We provide the first theoretical treatment of such attacks by formalizing a general notion of algebraic inversion and distinguishing attacks based on the Polynomial Calculus proof system. We show that algebraic attacks succeed if and only if there exist a degree e = O(s) non-zero polynomial Q whose roots cover the roots of P or cover the roots of P's complement. As a corollary, we obtain the first example of a predicate P for which the generated sequence y passes all linear tests but fails to pass some polynomial-time computable test, answering an open question posed by the first author (Question 4.9, computational complexity 2015).

Original languageEnglish
Title of host publicationSTOC 2016 - Proceedings of the 48th Annual ACM SIGACT Symposium on Theory of Computing
EditorsYishay Mansour, Daniel Wichs
PublisherAssociation for Computing Machinery
Number of pages14
ISBN (Electronic)9781450341325
StatePublished - 19 Jun 2016
Event48th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2016 - Cambridge, United States
Duration: 19 Jun 201621 Jun 2016

Publication series

NameProceedings of the Annual ACM Symposium on Theory of Computing
ISSN (Print)0737-8017


Conference48th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2016
Country/TerritoryUnited States


  • Algebraic attacks
  • Cryptography
  • Low-bias generators
  • NC0
  • Pseusorandomness


Dive into the research topics of 'Algebraic attacks against random local Functions and their countermeasures'. Together they form a unique fingerprint.

Cite this