Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Dagstuhl Seminar Proceedings

An efficient fuzzy extractor for limited noise

Boris Škorić, PT Tuyls

Published Jan 1, 2010• 8 citations
Publisher

Abstract

A fuzzy extractor is a security primitive that allows for reproducible extraction of an almost uniform key from a non-uniform noisy source. We analyze a fuzzy extractor scheme that uses universal hash functions for both information reconciliation and privacy amplification. This is a useful scheme when the number of error patterns likely to occur is limited, regardless of the error probabilities. We derive a sharp bound on the uniformity of the extracted key, making use of the concatenation property of universal hash functions and a recent tight formulation of the leftover hash lemma.

DOI
10.4230/dagsemproc.09282.3

Related papers

Sharp lower bounds on the extractable randomness from non-uniform sources

Boris Škorić, Chibuzo Obi, Evgeny A. Verbitskiy +1 more

Extraction of uniform randomness from (noisy) non-uniform sources is an important primitive in many security applications, e.g. (pseudo-)random number generators, privacy-preserving biometrics, and key storage based on Physical Unclonable Functions. Generic extraction methods exist, using universal hash functions. There is a trade-off between the length of the extracted bit string and the uniformity of the string. In the literature there are proven lower bounds on this length as a function of the desired uniformity. The best known bound involves a quantity known as smooth min-entropy. Unfortunately, there exist at least three definitions of smooth entropy. In this paper we compare three of these definitions, and we derive improved lower bounds on the extractable randomness.\nWe also investigate the use of almost universal hash functions, which are slightly worse at extracting randomness than universal hash functions, but are preferable in practice because they require far less resources in devices. We show that using them has negligible effect on the extractable randomness.\nKeywords: Leftover Hash Lemma; Universal hash function; Randomness extraction

•Jan 1, 2008•0 citations

Key Extraction From General Nondiscrete Signals

Evgeny A. Verbitskiy, Pim Tuyls, Chibuzo Obi +2 more

We address the problem of designing optimal schemes for the generation of secure cryptographic keys from continuous noisy data. We argue that, contrary to the discrete case, a universal fuzzy extractor does not exist. This implies that in the continuous case, key extraction schemes have to be designed for particular probability distributions. We extend the known definitions of the correctness and security properties of fuzzy extractors. Our definitions apply to continuous as well as discrete variables. We propose a generic construction for fuzzy extractors from noisy continuous sources, using independent partitions. The extra freedom in the choice of discretization, which does not exist in the discrete case, is advantageously used to give the extracted key a uniform distribution. We analyze the privacy properties of the scheme and the error probabilities in a one-dimensional toy model with simplified noise. Finally, we study the security implications of incomplete knowledge of the source's probability distribution${\BBP }$. We derive a bound on the min-entropy of the extracted key under the worst-case assumption, where the attacker knows${\BBP }$exactly.

IEEE Transactions on Information Forensics and Security•Mar 30, 2010•48 citations

Key Extraction From General Nondiscrete Signals

Evgeny A. Verbitskiy, Pim Tuyls, Chibuzo Obi +2 more

We address the problem of designing optimal schemes for the generation of secure crypto-\ngraphic keys from continuous noisy data. We argue that, contrary to the discrete case, a\nuniversal fuzzy extractor does not exist. This implies that in the continuous case, key ex-\ntraction schemes have to be designed for particular probability distributions. We extend the\nknown definitions of the correctness and security properties of fuzzy extractors. Our defini-\ntions apply to continuous as well as discrete variables.\nWe propose a generic construction for fuzzy extractors from noisy continuous sources, using independent partitions. The extra freedom in the choice of discretisation, which does not exist in the discrete case, is advantageously used to give the extracted key a uniform distribution. We analyze the privacy properties of the scheme and the error probabilities in a one-dimensional toy model with simplified noise.\nFinally, we study the security implications of incomplete knowledge of the source's probability distribution P. We derive a bound on the min-entropy of the extracted key under the worst case assumption, where the attacker knows P exactly.

Default journal•Jan 1, 2009•0 citations

Reusable and robust fuzzy extractor for CRS-dependent sources

Yucheng Ma, Peisong Shen, Xue Tian +2 more

Abstract Fuzzy extractors allow for the extraction and reproduction of a nearly uniform string from a noisy and non-uniform source. Reusable and robust fuzzy extractors further require that the output string should remain pseudorandom under multiple extractions and any modification of public value should be detectable. Existing constructions of reusable and robust fuzzy extractors are all designed in the Common Reference String (CRS) model and work only for CRS-independent sources. In this work, we introduce a construction of reusable and robust fuzzy extractor for CRS-dependent sources. Our construction is built upon some well-studied cryptography, including a collision resistant hash function, a symmetric key encryption that keeps secure with respect to auxiliary input, a public key encryption and simulation-sound non-interactive zero-knowledge argument. We also present some instantiations of these primitives from Learning with Parity Noise (LPN) assumption and Short Integer Solution (SIS) assumption. These instantiations result in the first reusable and robust fuzzy extractor for CRS-dependent sources that can tolerate linear errors.

Cybersecurity•Jan 14, 2025•0 citations

When Are Fuzzy Extractors Possible?

Benjamin W. Fuller, Leonid Reyzin, Adam Smith

Fuzzy extractors (Dodis et al., SIAM J. Computing 2008) convert repeated noisy readings of a high-entropy secret into the same uniformly distributed key. A minimum condition for the security of the key is the hardness of guessing a value that is similar to the secret, because the fuzzy extractor converts such a guess to the key. We quantify this property in a new notion called fuzzy min-entropy. We ask: is fuzzy min-entropy sufficient to build fuzzy extractors? We provide two answers for different settings. 1) If the construction is provided a description of the probability distribution W that defines the noisy source then fuzzy min-entropy is a sufficient condition for information-theoretic key extraction from W . 2) A more ambitious goal is to design a single extractor that works for all possible sources. This more ambitious goal is impossible: there is a family of sources with high fuzzy min-entropy for which no single fuzzy extractor is secure. This is true in three settings: a) for standard fuzzy extractors, b) for fuzzy extractors that are allowed to sometimes be wrong, c) and for secure sketches, which are the main ingredient of most fuzzy extractor constructions.

IEEE Transactions on Information Theory•Apr 1, 2020•25 citations

More Efficient Privacy Amplification With Less Random Seeds via Dual Universal Hash Function

Masahito Hayashi, Toyohiro Tsurumaru

We explicitly construct random hash functions for privacy amplification (extractors) that require smaller random seed lengths than the previous literature, and still allow efficient implementations with complexity O(n log n) for input length n. The key idea is the concept of dual universal2hash function introduced recently. We also use a new method for constructing extractors by concatenating δ-almost dual universal2hash functions with other extractors. Besides minimizing seed lengths, we also introduce methods that allow one to use non-uniform random seeds for extractors. These methods can be applied to a wide class of extractors, including dual universal2hash function, as well as to the conventional universal2hash functions.

arXiv:1311.5322•IEEE Transactions on Information Theory•Feb 4, 2016•84 citations
A fuzzy extractor is a security primitive that allows for reproducible extraction of an almost uniform key from a non-uniform noisy source. We analyze a fuzzy extractor scheme that uses universal hash functions for both information reconciliation and privacy amplification. This is a useful scheme when the number of error patterns likely to occur is limited, regardless of the error probabilities. We derive a sharp bound on the uniformity of the extracted key, making use of the concatenation property of universal hash functions and a recent tight formulation of the leftover hash lemma.
Extraction of uniform randomness from (noisy) non-uniform sources is an important primitive in many security applications, e.g. (pseudo-)random number generators, privacy-preserving biometrics, and key storage based on Physical Unclonable Functions. Generic extraction methods exist, using universal hash functions. There is a trade-off between the length of the extracted bit string and the uniformity of the string. In the literature there are proven lower bounds on this length as a function of the desired uniformity. The best known bound involves a quantity known as smooth min-entropy. Unfortunately, there exist at least three definitions of smooth entropy. In this paper we compare three of these definitions, and we derive improved lower bounds on the extractable randomness.\nWe also investigate the use of almost universal hash functions, which are slightly worse at extracting randomness than universal hash functions, but are preferable in practice because they require far less resources in devices. We show that using them has negligible effect on the extractable randomness.\nKeywords: Leftover Hash Lemma; Universal hash function; Randomness extraction
We address the problem of designing optimal schemes for the generation of secure cryptographic keys from continuous noisy data. We argue that, contrary to the discrete case, a universal fuzzy extractor does not exist. This implies that in the continuous case, key extraction schemes have to be designed for particular probability distributions. We extend the known definitions of the correctness and security properties of fuzzy extractors. Our definitions apply to continuous as well as discrete variables. We propose a generic construction for fuzzy extractors from noisy continuous sources, using independent partitions. The extra freedom in the choice of discretization, which does not exist in the discrete case, is advantageously used to give the extracted key a uniform distribution. We analyze the privacy properties of the scheme and the error probabilities in a one-dimensional toy model with simplified noise. Finally, we study the security implications of incomplete knowledge of the source's probability distribution${\BBP }$. We derive a bound on the min-entropy of the extracted key under the worst-case assumption, where the attacker knows${\BBP }$exactly.
We address the problem of designing optimal schemes for the generation of secure crypto-\ngraphic keys from continuous noisy data. We argue that, contrary to the discrete case, a\nuniversal fuzzy extractor does not exist. This implies that in the continuous case, key ex-\ntraction schemes have to be designed for particular probability distributions. We extend the\nknown definitions of the correctness and security properties of fuzzy extractors. Our defini-\ntions apply to continuous as well as discrete variables.\nWe propose a generic construction for fuzzy extractors from noisy continuous sources, using independent partitions. The extra freedom in the choice of discretisation, which does not exist in the discrete case, is advantageously used to give the extracted key a uniform distribution. We analyze the privacy properties of the scheme and the error probabilities in a one-dimensional toy model with simplified noise.\nFinally, we study the security implications of incomplete knowledge of the source's probability distribution P. We derive a bound on the min-entropy of the extracted key under the worst case assumption, where the attacker knows P exactly.
Abstract Fuzzy extractors allow for the extraction and reproduction of a nearly uniform string from a noisy and non-uniform source. Reusable and robust fuzzy extractors further require that the output string should remain pseudorandom under multiple extractions and any modification of public value should be detectable. Existing constructions of reusable and robust fuzzy extractors are all designed in the Common Reference String (CRS) model and work only for CRS-independent sources. In this work, we introduce a construction of reusable and robust fuzzy extractor for CRS-dependent sources. Our construction is built upon some well-studied cryptography, including a collision resistant hash function, a symmetric key encryption that keeps secure with respect to auxiliary input, a public key encryption and simulation-sound non-interactive zero-knowledge argument. We also present some instantiations of these primitives from Learning with Parity Noise (LPN) assumption and Short Integer Solution (SIS) assumption. These instantiations result in the first reusable and robust fuzzy extractor for CRS-dependent sources that can tolerate linear errors.
Fuzzy extractors (Dodis et al., SIAM J. Computing 2008) convert repeated noisy readings of a high-entropy secret into the same uniformly distributed key. A minimum condition for the security of the key is the hardness of guessing a value that is similar to the secret, because the fuzzy extractor converts such a guess to the key. We quantify this property in a new notion called fuzzy min-entropy. We ask: is fuzzy min-entropy sufficient to build fuzzy extractors? We provide two answers for different settings. 1) If the construction is provided a description of the probability distribution W that defines the noisy source then fuzzy min-entropy is a sufficient condition for information-theoretic key extraction from W . 2) A more ambitious goal is to design a single extractor that works for all possible sources. This more ambitious goal is impossible: there is a family of sources with high fuzzy min-entropy for which no single fuzzy extractor is secure. This is true in three settings: a) for standard fuzzy extractors, b) for fuzzy extractors that are allowed to sometimes be wrong, c) and for secure sketches, which are the main ingredient of most fuzzy extractor constructions.
We explicitly construct random hash functions for privacy amplification (extractors) that require smaller random seed lengths than the previous literature, and still allow efficient implementations with complexity O(n log n) for input length n. The key idea is the concept of dual universal2hash function introduced recently. We also use a new method for constructing extractors by concatenating δ-almost dual universal2hash functions with other extractors. Besides minimizing seed lengths, we also introduce methods that allow one to use non-uniform random seeds for extractors. These methods can be applied to a wide class of extractors, including dual universal2hash function, as well as to the conventional universal2hash functions.