模拟辅助输入，再访
Simulating Auxiliary Inputs, Revisited
摘要：
对于任何一对相关随机变量$(X,Z)$，我们可以将$Z$看作是$X$的随机化函数。如果$Z$很短，则可以通过允许它仅近似正确来使该函数在计算上高效。在民间传说中，这个问题被称为\emph{simulating auxiliary inputs}。事实证明，模拟辅助信息的想法是计算机科学中的一个强大工具，在复杂性理论、密码学、伪随机性和零知识中找到了应用。在本文中，我们重新审视了这个问题，并取得了以下结果：\begin{enumerate}[（a）]我们讨论并比较了已知结果的效率，找到了TCC'14论文“如何伪造辅助输入”中声称的最著名界限中的缺陷。我们提出了一种新的升压算法构建的模拟器。我们的技术基本上修复了缺陷。这个提升证明是独立的兴趣，因为它展示了如何在下降算法中构造概率测度时处理“负质量”问题。我们的边界比迄今为止已知的边界好得多。为了使模拟器$(s,ε)$ -不可区分，我们需要在时间/电路大小的复杂性$O\left(s\cdot 2^{5\ell}ε^{-2}\right)$，这是更好的一个因素$ε^{-2}$相比，以前的界限。特别是，与我们的技术，我们（最终）得到有意义的可证明的安全性EURONETPT '09泄漏弹性流密码实例与标准的256位块密码，如$\mathsf{AES256}$。
英文摘要：
For any pair $(X,Z)$ of correlated random variables we can think of $Z$ as a randomized function of $X$. Provided that $Z$ is short, one can make this function computationally efficient by allowing it to be only approximately correct. In folklore this problem is known as \emph{simulating auxiliary inputs}. This idea of simulating auxiliary information turns out to be a powerful tool in computer science, finding applications in complexity theory, cryptography, pseudorandomness and zero-knowledge. In this paper we revisit this problem, achieving the following results: \begin{enumerate}[(a)] We discuss and compare efficiency of known results, finding the flaw in the best known bound claimed in the TCC'14 paper "How to Fake Auxiliary Inputs". We present a novel boosting algorithm for constructing the simulator. Our technique essentially fixes the flaw. This boosting proof is of independent interest, as it shows how to handle "negative mass" issues when constructing probability measures in descent algorithms. Our bounds are much better than bounds known so far. To make the simulator $(s,ε)$-indistinguishable we need the complexity $O\left(s\cdot 2^{5\ell}ε^{-2}\right)$ in time/circuit size, which is better by a factor $ε^{-2}$ compared to previous bounds. In particular, with our technique we (finally) get meaningful provable security for the EUROCRYPT'09 leakage-resilient stream cipher instantiated with a standard 256-bit block cipher, like $\mathsf{AES256}$.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
