Today we will study some conditions under which a very powerful pseudorandom generator can be shown to exist, and also some consequences of the existence of such a pseudorandom generator. We will start by assuming the existence of a permutation p : {0, 1}n → {0, 1}n which is computable in poly(n) time and which, for some constant δ > 0, is (2δn, 2−δn)-one way. (This is an extremely strong assum...

Q: Why are we using circuit lower bounds here, as opposed to a claim such as E ̸⊆ P for example? A: The proof of the Nisan-Wigderson pseudorandom generator relies on nonuniformity, by showing that distinguishing a pseudorandom generator implies a circuit for solving a hard problem – this reduction involves hardwiring advice into a circuit in order to solve the hard problem. A contradiction requi...

We postulate that a distribution is pseudorandom if it cannot be told apart from the uniform distribution by any eecient procedure. This yields a robust deenition of pseudorandom generators as eecient deterministic programs stretching short random seeds into longer pseudorandom sequences. Thus, pseudorandom generators can be used to reduce the randomness-complexity in any eecient procedure. Pse...

AC 0 circuits of size n log n augmented with log n MODm gates, for every odd integer m and any sufficiently small . As a consequence, for every odd integer m, we obtain a pseudorandom generator, based on the MOD2 function, for circuits of size S containing log S MODm gates. Our results are based on recent bounds of exponential sums that were previously introduced for proving lower bounds for MA...

We consider constant depth circuits augmented with few modular, or more generally, arbitrary symmetric gates. We prove that circuits augmented with o(log n) symmetric gates must have size n n) to compute a certain (complicated) function in ACC. This function is also hard on the average for circuits of size n logn augmented with o(log n) symmetric gates, and as a consequence we can get a pseudor...

This work shows that the cryptanalysis of the shrinking generator requires fewer intercepted bits than that indicated by the linear complexity. Indeed, whereas the linear complexity of shrunken sequences is between A·2(S−2) and A·2(S−1), we claim that the initial states of both component registers are easily computed with less than A · S shrunken bits. Such a result is proven thanks to the defi...