Is it possible to emulate sampling from an arbitrary efficiently-samplable distribution using an efficient deterministic procedure which is initially fed with a short random seed and increments a counter after each query? Yes, under minimal cryptographic assumptions (the existence of one-way functions) as shown by a sequence of celebrated results in the 80s. Equivalently, one can view this problem as the goal to compress a large number of (seemingly) random samples into a short random seed. But what happens when multiple parties want, given short correlated random seeds distributed in a one-time initialization step, to deterministically and non-interactively obtain correlated samples that cannot be distinguished (even by a subset of the participants themselves) from random samples from a joint distribution? In other words, can cryptography help us compress (seemingly) random correlated samples? Our knowledge of this natural generalization of the problem is considerably more limited, and there is much more that we don't know than we know! Nevertheless, many special cases of this question have been explored in recent (and not so recent) works, motivated in part by numerous applications to other cryptographic tasks. In this article, I provide an introductory exposition of the topic, recasting a number of results originally introduced using various formalisms, under the lens of compressed samplers for multiple parties.
Is it possible to emulate sampling from an arbitrary efficiently-samplable distribution using an efficient deterministic procedure which is initially fed with a short random seed and increments a counter after each query? Yes, under minimal cryptographic assumptions (the existence of one-way functions) as shown by a sequence of celebrated results in the 80s. Equivalently, one can view this problem as the goal to compress a large number of (seemingly) random samples into a short random seed. But what happens when multiple parties want, given short correlated random seeds distributed in a one-time initialization step, to deterministically and non-interactively obtain correlated samples that cannot be distinguished (even by a subset of the participants themselves) from random samples from a joint distribution? In other words, can cryptography help us compress (seemingly) random correlated samples? Our knowledge of this natural generalization of the problem is considerably more limited, and there is much more that we don't know than we know! Nevertheless, many special cases of this question have been explored in recent (and not so recent) works, motivated in part by numerous applications to other cryptographic tasks. In this article, I provide an introductory exposition of the topic, recasting a number of results originally introduced using various formalisms, under the lens of compressed samplers for multiple parties.
This thesis presents a theoretical analysis of round complexity in cryptographic sampling protocols. We study the following problem: how can n participants agree on a random sample from the distribution D without anybody knowing any secret information hidden in the chosen sample? How many rounds of interactions are needed in any such protocol? Which assumptions are required? These questions are particularly interesting in the context of multiparty computation (MPC) due to the extensive reliance (often unavoidable) on trusted setups such as common reference strings (CRSs). These are samples from known distributions made public before the beginning of the protocol. Security proofs often require CRSs to hide trapdoors. However, if these trapdoors get leaked, security is often fatally compromised. Since trusted setups are inherently single points of failure, it is desirable to generate CRSs in a distributed fashion using MPC protocols: as long as at least one of the participants remains honest, any trapdoor hidden in the CRS is guaranteed to remain secret. Previous research (Garg et al. TCC ’14) had shown that, in the setting of semi-honest security with dishonest majority, any functionality can be implemented in two rounds. In this thesis, we show that, using strong primitives such as indistinguishability obfuscation (iO), it is possible to build one-round sampling protocols. We call these constructions distributed samplers. We show that these protocols can be used to securely generate large amounts of correlated randomness with sublinear communication in a single round. We study different ways to upgrade our semi-honest construction to active security. First, we try to circumvent Cleve’s impossibility (STOC ’86) by allowing the adversary limited influence on the output of the protocol: we consider the functionality F_D^{Active} that proposes a polynomial number of different outputs to the adversary, letting it choose its favourite one (F_D^{Active} can still be used to generate CRSs). We show how to implement F_D^{Active} in one round by relying on a programmable random oracle. In subsequent work, we show that random oracles are necessary: any actively secure distributed samplers implementing F_D^{Active} needs to rely on a CRS that is non-reusable, as large as a sample from D and structured (unless D is an obliviously samplable distribution). This suggests that, without random oracles, simulation-based, actively secure distributed samplers provide no advantage over trusted dealers. We get around this impossibility by proposing new game-based definitions for actively secure distributed samplers. Hardness-preserving distributed samplers allow the removal of CRSs from MPC protocols preserving at the same time the hardness of search problems. Indistinguishability-preserving distributed samplers, on the other hand, substitute the trusted setup while preserving the functionality, however, the protocol needs to satisfy particular conditions. We show how to build distributed samplers with the defined properties by relying on extremely lossy functions, the subexponential security of iO and other primitives. Next, in the context of active security with dishonest majority, we study the feasibility of protocols producing unbiased samples with guaranteed output: to circumvent Cleve's impossibility, we assume the existence of an auxiliary functionality that, upon invocation, publishes a random , short k-bit string. We first study the question when D is the uniform distribution over {0, 1}^m where m>k. This problem is called coin tossing extension (CTE) (Bellare et al. PODC '96). We show the existence of O(1)-round CTE constructions producing an arbitrarily large quantity of unbiased randomness based on various assumptions (OWFs, DDH, QR and DCR, class groups). Our most important result is an LWE-based, one-round, UC-secure, n-party CTE protocol withstanding adaptive corruption. The protocol can be viewed as an explainable randomness extractor. By relying on distributed samplers and the auxiliary functionality, we build one-round unbiased sampling protocols for any distribution. Finally, we present a lower bound for statistically secure CTE with black-box simulation: an R-round protocol can generate at most k+R·O(log λ) bits of randomness.
There has been much recent progress in constructing cryptosystems that maintain their security without requiring uniform randomness and perfect secrecy. These schemes are motivated by a diverse set of problems such as providing resilience to side-channel leakage, using weak physical sources of randomness as secret keys, and allowing deterministic encryption for high-entropy messages. The study of these problems has significantly deepened our understanding of how randomness is used in cryptographic constructions and proofs. Nevertheless, despite this progress, some basic and seemingly achievable security properties have eluded our reach. For example, we are unable to prove the security of basic tools for manipulating weak/leaky random sources, such as as pseudo-entropy generators and seed-dependent computational condensers. We also do not know how to prove leakage-resilient security of any cryptosystem with a uniquely determined secret key. In the context of deterministic encryption we do not have a standardmodel constructions achieving the strongest notion of security proposed by Bellare, Boldyreva and O’Neill (CRYPTO ’07), that would allow us to encrypt arbitrarily correlated messages of sufficiently large individual entropy. In this work, we provide broad black-box separation results, showing that the security of such primitives cannot be proven under virtually any standard cryptographic hardness assumption via a reduction that treats the adversary as a black box. We do so by formalizing the intuition that “the only way that a reduction can simulate the correctly distributed view for an attacker is to know all the secrets, in which case it does not learn anything useful from the attack”. Such claims are often misleading and clever way of getting around them allow us to achieve a wealth of positive results with imperfect/leaky randomness. However, in this work we show that this intuition can be formalized and that it indeed presents a real barrier for the examples given above. ∗IBM Research. wichs@cs.nyu.edu
Motivated by applications in cryptography, we consider a generalization of randomness extraction and the related notion of privacy amplification to the case of two correlated sources. We introduce the notion of correlation extractors, which extract nearly perfect independent instances of a given joint distribution from imperfect, or "leaky," instances of the same distribution. More concretely, suppose that Alice holds a and Bob holds b, where (a, b) are obtained by taking n independent samples from a joint distribution (X, Y) and letting a include all X instances and b include all Y instances. An adversary Eve obtains partial information about (a, b) by choosing a function L with output length t and learning L(a, b). The goal is to design a protocol between Alice and Bob which may use additional fresh randomness, such that for every L as above the following holds. In the end of the interaction, Alice outputs a' and Bob outputs b' such that (a', b') are statistically indistinguishable from m independent instances of (X, Y) even when conditioned on Eve's view, and even when conditioned on the joint view of Eve together with either Alice or Bob. The standard questions of privacy amplification and randomness extraction correspond to the case where X and Y are identical random bits. In this work we address this question for other types of correlations. A central special case is that of OT extractors, which are correlation extractors for the correlation (X, Y) corresponding to the cryptographic primitive of oblivious transfer. Our main result is that for any finite joint distribution (X, Y) there is an explicit correlation extractor which extracts m = ?(n) instances using O(n) bits of communication, even when t = ?(n) bits of information can be leaked to Eve. We present several applications which motivate the concept of correlation extractors and our main result. These include: ? Protecting certain cryptographic protocols against sidechannel attacks. ? A protocol which realizes m instances of oblivious transfer by communicating only O(m) bits. The security of the protocol relies on a number-theoretic intractability assumption. ? A constant-rate unconditionally secure construction of oblivious transfer (for semi-honest parties) from any nontrivial channel. This establishes constant-rate equivalence of any two nontrivial finite channels.
We revisit the question of securely compressing multiparty correlations using only symmetric cryptography. A linear correlation C, defined by a linear subspace C ⊆ 𝔽ⁿ, samples a secret random 𝐜 ∈ C and assigns to each party a fixed subset of the entries of 𝐜. Gilboa and Ishai (Crypto 1999) and Cramer, Damgård and Ishai (TCC 2005) provide a general technique for securely compressing many independent samples from C by replicating independent keys of a pseudorandom function (PRF) among the parties. This implies a pseudorandom correlation function (PCF) for C from any PRF, where the PCF key size scales with the number of minimal-support codewords in C. We observe that the above generalizes to other types of useful target correlations C_T by using a secret replication pattern obtained via a random secret assignment of parties in C to parties in C_T. We present several corollaries of this general blueprint. These include a re-derivation of two-party PCF constructions for VOLE and subfield-VOLE over small domains (Roy, Crypto 2022) as well as new multiparty PCFs for small-domain VOLE-style correlations, including scalar-vector multiplication triples and their authenticated variants. Finally, we discuss applications to secure computation.
The unifying topic of this thesis is the relation of randomness to computation. We study two different facets of this: the hardness of sampling from probability distributions and the extent of usefulness of randomness in communication complexity. Hardness of Sampling. A circuit samples the distribution of its output on a uniformly random input. What distributions are samplable with small circuits? What about local circuits (NC0)? We make two contributions in this direction. The first is to show that sampling uniformly from the set of Hamming-weight-k n-bit string is hard for NC0-circuits (and even constant-width DNFs) as long as k=o(n). The second is to show that sampling a uniformly random permutation of [n] elements requires polylog(n) adaptive queries to a sequence of uniform input symbols from [n]---adaptive cell probes. These results refine our understanding of sampling by constant-depth de Morgan circuits (AC0). Randomness in Communication. The classical example separating deterministic and randomized communication is the Equality problem: Alice and Bob are to decide whether their n-bit inputs are equal. It requires transmitting n+1 in the deterministic model, but is solvable with a constant-cost protocol using public randomness. An active line of research found many non-trivial problems that are solvable with just constant-cost randomized communication [Harms-Wild-Zamaraev, STOC 2022; Hambardzumyan-Hatami-Hatami, Isr. J. Math.; Fang-Hambardzumyan-Harms-Hatami, STOC 2024; Fang-Göös-Harms-Hatami, STOC 2025]. All of those problems can be solved with polylog(n) queries to Equality oracle. Our first contribution is to exhibit a problem that is solvable with constant-cost randomized communication, but requires polynomially many calls to Equality oracle. This resolves an open problem in the survey [Hatami-Hatami, ACM SIGACT News]. Our second contribution is to investigate when the randomized communication complexity can be localized or condensed: for a matrix of randomized communication cost k, can we find its 2^k-by-2^k submatrix that retains communication cost at least linear in k$? In general this is impossible [Hambardzumyan-Hatami-Hatami, Discrete Appl. Math.]. We show, however, that in an important case it can be done: we condense randomized communication cost of sink-of-xor function---a recent counterexample to log-approximate-rank conjecture by [Chattopadhyay-Mande-Sherif, J. ACM], and thereby quantitatively improve the counterexample.
A basic problem in information theory is the following: Let P = (X, Y) be an arbitrary distribution where the marginals X and Y are (potentially) correlated. Let Alice and Bob be two players where Alice gets samples {xi}i≥1 and Bob gets samples {yi}i≥i and for all i, (xi,yi) ∼ P. What joint distributions Q can be simulated by Alice and Bob without any interaction? Classical works in information theory by Gács-Körner and Wyner answer this question when at least one of P or Q is the distribution Eq (Eq is defined as uniform over the points (0, 0) and (1, 1)). However, other than this special case, the answer to this question is understood in very few cases. Recently, Ghazi, Kamath and Sudan showed that this problem is decidable for Q supported on {0, 1} × {0, 1}. We extend their result to Q supported on any finite alphabet. Moreover, we show that If Q can be simulated, our algorithm also provides a (non-interactive) simulation protocol. We rely on recent results in Gaussian geometry (by the authors) as well as a new smoothing argument inspired by the method of boosting from learning theory and potential function arguments from complexity theory and additive combinatorics.