Hardness of distinguishing the MSB or LSB of secret keys in diffie-hellman schemes

  • Authors:
  • Pierre-Alain Fouque;David Pointcheval;Jacques Stern;Sébastien Zimmer

  • Affiliations:
  • CNRS-École normale supérieure, Paris, France;CNRS-École normale supérieure, Paris, France;CNRS-École normale supérieure, Paris, France;CNRS-École normale supérieure, Paris, France

  • Venue:
  • ICALP'06 Proceedings of the 33rd international conference on Automata, Languages and Programming - Volume Part II
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper we introduce very simple deterministic randomness extractors for Diffie-Hellman distributions. More specifically we show that the k most significant bits or the k least significant bits of a random element in a subgroup of $\mathbb Z^\star_p$ are indistinguishable from a random bit-string of the same length. This allows us to show that under the Decisional Diffie-Hellman assumption we can deterministically derive a uniformly random bit-string from a Diffie-Hellman exchange in the standard model. Then, we show that it can be used in key exchange or encryption scheme to avoid the leftover hash lemma and universal hash functions