Hybrid argument (cryptography) explained

In cryptography, the hybrid argument is a proof technique used to show that two distributions are computationally indistinguishable.

History

Hybrid arguments had their origin in a papers by Andrew Yao in 1982 and Shafi Goldwasser and Silvio Micali in 1983.^[1]

Formal description

Formally, to show two distributions D₁ and D₂ are computationally indistinguishable, we can define a sequence of hybrid distributions D₁ := H₀, H₁, ..., H_t =: D₂ where t is polynomial in the security parameter n. Define the advantage of any probabilistic efficient (polynomial-bounded time) algorithm A as

Adv ^{dist} _{H _{i,} H _{i+1}} ( A ) : = \left|\Pr[x \stackrel{\$}{\gets} H _{i} : A (x) =1 ] - \Pr[x \stackrel{\$}{\gets} H _{i+1} : A (x) =1 ] \right|,

where the dollar symbol ($) denotes that we sample an element from the distribution at random.

By triangle inequality, it is clear that for any probabilistic polynomial time algorithm A,

Adv ^{dist} _{D _{1,} D _{2}} ( A ) \leq \sum ^{t -1} _{i =0} Adv ^{dist} _{H _{i,} H _{i+1}} ( A ).

Thus there must exist some k s.t. 0 ≤ k < t(n) and

Adv ^{dist} _{H _{k,} H _{k+1}} ( A ) \geq Adv ^{dist} _{D _{1,} D _{2}} ( A )/t(n).

Since t is polynomial-bounded, for any such algorithm A, if we can show that it has a negligible advantage function between distributions H_i and H_i+1 for every i, that is,

\epsilon(n) \ge Adv ^{dist} _{H _{k,} H _{k+1}} ( A ) \geq Adv ^{dist} _{D _{1,} D _{2}} ( A )/t(n),

then it immediately follows that its advantage to distinguish the distributions D₁ = H₀ and D₂ = H_t must also be negligible. This fact gives rise to the hybrid argument: it suffices to find such a sequence of hybrid distributions and show each pair of them is computationally indistinguishable.^[2]

Applications

The hybrid argument is extensively used in cryptography. Some simple proofs using hybrid arguments are:

• If one cannot efficiently predict the next bit of the output of some number generator, then this generator is a pseudorandom number generator (PRG).^[3]
• We can securely expand a PRG with 1-bit output into a PRG with n-bit output.^[4]

See also

• Interactive proof system
• Universal composability

References

• Web site: Dodis. Yevgeniy. Introduction to Cryptography Lecture 5 notes. https://web.archive.org/web/20141225222349/http://www.cs.nyu.edu/courses/fall08/G22.3210-001/lect/lecture5.pdf . 2014-12-25 .
• Web site: Pass. Rafael. A Course in Cryptography.
• Web site: Fischlin. Marc. Mittelbach. Arno. An Overview of the Hybrid Argument.

Notes and References

1. Bellare, Mihir, and Phillip Rogaway. "Code-based game-playing proofs and the security of triple encryption." Cryptology ePrint Archive (2004)
2. Lemma 3 in Dodis's notes.
3. Theorem 1 in Dodis's notes.
4. Lemma 80.5, Corollary 81.7 in Pass's notes.