Low complexity pseudorandom generators and indistinguishability obfuscation

Abstract

In the study of cryptography in NCO, it was previously known that Goldreich's candidate pseudorandom generator (PRG) is insecure when instantiated with a predicate P in 4 or fewer variables, if one wants to achieve polynomial stretch. On the other hand, there is a standard candidate PRG with locality 5 based on the "tri-sum-and" predicate ... However, locality is only one complexity measure of a PRG that one could hope to minimize. In this work, we consider the problem of minimizing three other complexity measures of a (local) PRG: decision tree (DT-)complexity, Q-degree (i.e., the degree of P as a polynomial over Q), and the recent notion of blockwise locality (due to Lin and Tessaro). These three complexity measures are all of interest for their possible applications to constructing indistinguishability obfuscation (IO) schemes based on low-degree multilinear maps. Indeed, Lin and Tessaro recently proposed an intriguing candidate IO scheme based on bilinear maps and a non-standard assumption on "Goldreich-like" pseudorandom generators. We obtain both positive and negative results on the existence of low complexity PRGs. First, we give a candidate predicate for Goldreich's PRG with DT-complexity 4 and Q-degree 3. We also show that all predicates with either DT-complexity less than 4 or Q-degree less than 3 yield insecure PRGs, so our candidate predicate simultaneously achieves the best possible locality, DT-complexity, Q-degree, and F2-degree according to all known attacks. Finally, we show polynomial-time attacks on the blockwise 2-local PRGs required in the Lin-Tessaro work, invalidating the security of their IO and FE candidates based on bilinear maps. Our attack uses tools from the literature on two-source extractors (Chor and Goldreich, SICOMP 1988) and efficient refutation of random 2-XOR instances (Charikar and Wirth, FOCS 2004).