Skip to main content
gave hopefully correct construction
Source Link
user991
user991

One can't "get rid of" the factor 2.
However, there might be a way to replace it with $\:2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\:$
$2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\:$ where that depends on $q$ and the advantage.

$||$ is concatenation.
Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any integer
integer $n$ and probability $p$, let $\mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}$ be given by
$\;\;\;\;\;\;\;$$\;\;\;$ if $m$ has no ones and at least $n$ zeros$\: \operatorname{length}(m) < n \:$ then output $\: 000\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;$ with probability $p$$\: 1\hspace{-0.05 in}-\hspace{-0.03 in}(2\hspace{-0.05 in}\cdot \hspace{-0.05 in}p) \:$, $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.03 in}(m) \: = \: 00\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$$\:$ output $\: 000\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else if$\;\;\;$ choose a bit $m$ has no zeros and$b$ uniformly at least $n$ ones then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 1\hspace{-0.03 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$random
$\;\;\;\;\;\;\;$$\;\;\;$ if $m$ is all-$b$ then output $\: 1b1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m) \:$ else output $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 0\hspace{-0.02 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$$\: 1b\hspace{.02 in}0\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
.

(Decryption just removes the first twothree bits and then applies $\mathcal{D}\hspace{.02 in}'$.)

One can't "get rid of" the factor 2.
However, there might be a way to replace it with $\:2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\:$ where that depends on $q$ and the advantage.

$||$ is concatenation.
Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any integer $n$ and probability $p$, let $\mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}$ be given by
$\;\;\;\;\;\;\;$ if $m$ has no ones and at least $n$ zeros then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.03 in}(m) \: = \: 00\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else if $m$ has no zeros and at least $n$ ones then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 1\hspace{-0.03 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 0\hspace{-0.02 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
.

(Decryption just removes the first two bits and then applies $\mathcal{D}\hspace{.02 in}'$.)

One can't "get rid of" the factor 2.
However, there might be a way to replace it with
$2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\:$ where that depends on $q$ and the advantage.

$||$ is concatenation.
Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any
integer $n$ and probability $p$, let $\mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}$ be given by
$\;\;\;$ if $\: \operatorname{length}(m) < n \:$ then output $\: 000\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;$ with probability $\: 1\hspace{-0.05 in}-\hspace{-0.03 in}(2\hspace{-0.05 in}\cdot \hspace{-0.05 in}p) \:$, $\:$ output $\: 000\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;$ choose a bit $b$ uniformly at random
$\;\;\;$ if $m$ is all-$b$ then output $\: 1b1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m) \:$ else output $\: 1b\hspace{.02 in}0\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
.

(Decryption just removes the first three bits and then applies $\mathcal{D}\hspace{.02 in}'$.)

inserted length requirement
Source Link
user991
user991

One can't "get rid of" the factor 2.
However, there might be a way to replace it with $\:2-o(1)\:$$\:2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\:$ where that depends on $q$ and the advantage.

$||$ is concatenation. $\;$ Start
Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any integer $n$ and probability $p$, let $\mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}$$\mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}$ be given by
$\;\;\;\;\;\;\;$ if $m$ is all-zerohas no ones and at least $n$ zeros then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.03 in}(m) \: = \: 00\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$$\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.03 in}(m) \: = \: 00\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else if $m$ is all-onehas no zeros and at least $n$ ones then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 1\hspace{-0.03 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$$\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 1\hspace{-0.03 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 0\hspace{-0.02 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$$\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 0\hspace{-0.02 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
.

(Decryption just removes the first two bits and then applies $\mathcal{D}\hspace{.02 in}'$.)

One can't "get rid of" the factor 2.
However, there might be a way to replace it with $\:2-o(1)\:$ where that depends on $q$ and the advantage.

$||$ is concatenation. $\;$ Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any probability $p$, let $\mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}$ be given by
$\;\;\;\;\;\;\;$ if $m$ is all-zero then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.03 in}(m) \: = \: 00\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else if $m$ is all-one then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 1\hspace{-0.03 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 0\hspace{-0.02 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
.

(Decryption just removes the first two bits and then applies $\mathcal{D}\hspace{.02 in}'$.)

One can't "get rid of" the factor 2.
However, there might be a way to replace it with $\:2\hspace{-0.03 in}-\hspace{-0.03 in}o(1)\:$ where that depends on $q$ and the advantage.

$||$ is concatenation.
Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any integer $n$ and probability $p$, let $\mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}$ be given by
$\;\;\;\;\;\;\;$ if $m$ has no ones and at least $n$ zeros then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.03 in}(m) \: = \: 00\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else if $m$ has no zeros and at least $n$ ones then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 1\hspace{-0.03 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else $\;\;\; \mathcal{E}_{\hspace{.02 in}n,\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 0\hspace{-0.02 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
.

(Decryption just removes the first two bits and then applies $\mathcal{D}\hspace{.02 in}'$.)

Source Link
user991
user991

One can't "get rid of" the factor 2.
However, there might be a way to replace it with $\:2-o(1)\:$ where that depends on $q$ and the advantage.

$||$ is concatenation. $\;$ Start with some encryption scheme $\mathcal{E}'\hspace{-0.04 in}$, and for any probability $p$, let $\mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}$ be given by
$\;\;\;\;\;\;\;$ if $m$ is all-zero then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.03 in}(m) \: = \: 00\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else if $m$ is all-one then with probability $p$, $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 1\hspace{-0.03 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
$\;\;\;\;\;\;\;$ else $\;\;\; \mathcal{E}_{\hspace{.02 in}p}\hspace{-0.02 in}(m) \: = \: 0\hspace{-0.02 in}1\hspace{.04 in}||\hspace{.04 in}\mathcal{E}'\hspace{-0.03 in}(m)$
.

(Decryption just removes the first two bits and then applies $\mathcal{D}\hspace{.02 in}'$.)