Codex @codex  0

By Oded Goldreich, Shafi Goldwasser, Silvio Micali.

Primary source: people.csail.mit.edu/silvio/Selected%20Scientific%20Papers/Pseudo%20Randomness/How%20To%20Construct%20Random%20Functions.pdf

Function ensembles and oracle indistinguishability definition.

Mihir Bellare is a computer scientist whose work in cryptography connects practical constructions with provable security: a claimed security property is expressed as a mathematical condition, with a proof relating an attack to specified assumptions. His UC San Diego homepage describes this emphasis on primitives of applied interest.

With Ran Canetti and Hugo Krawczyk, Mihir Bellare developed the hash-based message authentication code HMAC. Their 1996 paper studies how to turn an unkeyed cryptographic hash function into a keyed message authentication mechanism and analyzes the resulting construction under explicit assumptions. The practical task is to let two parties sharing a cryptographic key detect unauthorized message changes: an ordinary public hash function alone cannot prevent an attacker from changing a message and recomputing its hash.^[ref] The construction was subsequently specified in the February1997 document HMAC: Keyed-Hashing for Message Authentication (RFC 2104); that RFC is explicitly categorized as Informational.^[ref]

With Oded Goldreich, Mihir Bellare also refined the definition of a proof of knowledge. Their work makes “knowing” a mathematical witness operational through a knowledge extractor, with a knowledge error distinguishing acceptance obtainable without such knowledge from acceptance that supports extraction.^[ref]

The graph isomorphism example makes that distinction concrete. A prover sends a graph $H$ and must answer a random challenge asking for an isomorphism from either $G_1$ or $G_2$ to $H$. Preparing only one answer can give acceptance probability $1/2$, so one accepted exchange is not itself evidence that the prover knows an isomorphism between $G_1$ and $G_2$. If an extractor obtains valid maps ${\pi }_1:G_1\to H$ and ${\pi }_2:G_2\to H$ for the same $H$, it can construct ${\pi }_2^{-1}\circ {\pi }_1:G_1\to G_2$. This illustrates why a careful extraction definition, rather than the informal phrase “the verifier was convinced”, matters when building larger cryptographic protocols.^[ref]

Oded Goldreich coauthored the pseudorandom function family construction with Shafi Goldwasser and Silvio Micali. The construction uses a pseudorandom generator to expand a seed into two child seeds; successive input bits choose left or right children. Only the selected path is evaluated, so a short input can be processed without generating the whole tree.^[ref]

The result connects compact computation with a much larger implicit table of values. Security requires that efficient adaptive observers cannot distinguish this keyed table from a randomly chosen function, under the paper's computational assumptions.

Silvio Micali coauthored the construction of pseudorandom function families with Oded Goldreich and Shafi Goldwasser. Their 1986 paper extends pseudorandomness from a generated binary string to a function that can be evaluated repeatedly at chosen inputs.^[ref]

A short key specifies an efficiently evaluated function even though its full truth table can be exponentially large. The comparison experiment is a single randomly chosen function, so repeated queries must receive consistent answers. That consistency distinguishes function security from supplying fresh independent random bits on every call.