5
$\begingroup$

SOURCE states the following in the proof of Theorem 2:

Without loss of generality, I will assume that A is deterministic. If A is randomized, we can determinize it by fixing a sequence of coins that maximizes A’s conditional success probability; it is easy to see that this cannot reduce A’s advantage.

Is this correct? Does it mean that we do not need to consider probabilistic adversaries in cryptographic security games?

$\endgroup$
4
$\begingroup$

Following fkraiem's answer, I would share my thoughts.

Generally speaking, we do not know if randomness helps, i.e., P=BPP is an open question. So probabilistic-polynomial-time (PPT) adversaries may not equal to deterministic ones.

However, it seems that cryptography always (correct me if I am wrong) focuses on advantages (or something similar) related to PPT adversaries. In this case, it is sufficient to consider only deterministic adversaries. Here is a simple proof:

Suppose you have a PPT adversary A that has advantage $p$. Then you can fix all possible random coins and get a bunch of deterministic adversaries $A_1, A_2, ..., A_n$, where $A$ runs $A_i$ with probability $p_i$. Since $Adv(A) = p_1Adv(A_1) + \cdots + p_nAdv(A_n)$ and $1=p_1+\cdots+p_n$, there exists $k$ such that $Adv(A_k) \geq Adv(A) = p$. Note that $n$ may be exponential but each adversary $A_i$ runs in polynomial time. Also, knowing that $A_k$ exists does not imply that one can find it in polynomial time.

===================

Update: The above argument can also be adapted to information-theoretic (i.e., computationally unbounded) adversaries.

|improve this answer|||||
$\endgroup$
1
$\begingroup$

If you are asked to show that a certain result holds for all probabilistic adversaries, you must show that, and it is not sufficient to show that it holds for all determinic adversaries.

However, in some cases you can show that for any probabilistic adversary there is a deterministic adversary with essentially the same "advantage", and in that case, yes, it is then sufficient to show that the result holds for all deterministic adversaries.

|improve this answer|||||
$\endgroup$
0
$\begingroup$

Without disputing the specific claim. In general the answer is no. Or more accurately, we don't know. We don't know if determinstic algorithms are as powerfull as randomized ones. Formally we do not know if P=RP, when referring to complexity classes.

Primality testing is comonly done with a probobalistic algorithm (Miller Rabin). And though a Polynomial time deterministic algorithm was discovered it is still far less efficient.

For practical purposes we can emulate randomness using PRNGs and if our PRNG is cryptographiclly secure it will be impractical to craft a problem which will fail our simulated randomized algorithm. But it is clear this is not the same as having true randomess and knowing that your algorithm gives trustworthy results even if the input was crafter by an omniscient devil.

|improve this answer|||||
$\endgroup$
0
$\begingroup$

Yes, for any security model applicable to reality, deterministic adversaries are as powerful as probabilistic adversaries.

We can emulate any randomized algorithm deterministically, using a PRNG as the source of the randomness. It is rare that it changes the big-O cost of the algorithm: it adds less than $O(r\cdot n^2\log n)$ time and $O(n\log n)$ memory, where $r$ is the number of random bits needed and $n$ is the security parameter in bits (or something on that tune).


Update: seeding the PRNG is not a problem in any security model applicable to reality. Actual adversaries enjoy working RNGs, only systems under attack are concerned with their trueness and reliability.

It is entirely possible to reason in a model where true randomness is postulated to be unavailable including to adversaries. However, the conclusions reached, when they differ from that reached in a model where adversaries have unlimited true randomness, will not apply in the practice of cryptography. An analogy is elliptic geometry, which postulates that given a line and a point not on it, no line parallel to the given line can be drawn through the point. It is a consistent mathematical construction, but not useful as an applied model of reality at the scale of things considered in cryptography.

|improve this answer|||||
$\endgroup$
  • 1
    $\begingroup$ And how do you seed your PRG? $\endgroup$ – fkraiem Jul 7 '18 at 2:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.