Sublinear Bounds on the Distinguishing Advantage for Multiple Samples

Abstract

The maximal achievable advantage of a (computationally unbounded) distinguisher to determine whether a source Z is distributed according to distribution $P_0$ or $P_1$, when given access to one sample of Z, is characterized by the statistical distance $d(P_0,P_1)$. Here, we study the distinguishing advantage when given access to several i.i.d. samples of Z. For n samples, the advantage is then naturally given by $d(P_0^{\otimes n},P_1^{\otimes n})$, which can be bounded as $d(P_0^{\otimes n},P_1^{\otimes n}) \le n \cdot d(P_0,P_1)$. This bound is tight for some choices of $P_0$ and $P_1$; thus, in general, a linear increase in the distinguishing advantage is unavoidable.

In this work, we show new and improved bounds on $d(P_0^{\otimes n},P_1^{\otimes n})$ that circumvent the above pessimistic observation. Our bounds assume, necessarily, certain additional information on $P_0$ and/or $P_1$ beyond, or instead of, a bound on $d(P_0,P_1)$; in return, the bounds grow as $\sqrt{n}$, rather than linearly in n. Thus, whenever applicable, our bounds show that the number of samples necessary to distinguish the two distributions is substantially larger than what the standard bound would suggest.

Such bounds have already been suggested in previous literature, but our new bounds are more general and (partly) stronger, and thus applicable to a larger class of instances.

In a second part, we extend our results to a modified setting, where the distinguisher only has indirect access to the source Z. By this we mean that instead of obtaining samples of Z, the distinguisher now obtains i.i.d. samples that are chosen according to a probability distribution that depends on the (one) value produced by the source Z.

Finally, we offer applications of our bounds to the area of cryptography. We show on a few examples from the cryptographic literature how our bounds give rise to improved results. For instance, importing our bounds into the analyses of Blondeau et al. for the security of block ciphers against multidimensional linear and truncated differential attacks, we obtain immediate improvements to their results.

A Computing the Threshold Number in Power-Analysis Attacks

At the core of a power-analysis attack is the task to distinguish whether a source X over a finite set $\mathcal X$ is distributed according to $P_0$ or $P_1$ when given i.i.d. samples of the form $X+N$, where N is noise that follows a normal distribution with expected value 0 and standard deviation $\sigma$. Formally, given that X is distributed according to $P_b$, the random variable $X+N$ has density

$$ f_{Q_b}(t)= \sum _{x\in \mathcal Z} P_b(x)\frac{1}{\sigma \sqrt{2\pi }} \, e^{-\frac{(t-x)^2}{2\sigma ^2}} \, . $$

Hence, not worrying that we are now dealing with continuous random variables, we have

$$\begin{aligned} F(Q_0\Vert Q_1)&= \int _{-\infty }^{+\infty }\sqrt{f_{Q_0}(t)f_{Q_1}(t)}\;dt \\&= \frac{1}{\sigma \sqrt{2\pi }} \int _{-\infty }^{+\infty } \sqrt{ \sum _{x,y\in \mathcal X}P_0(x)P_1(y) e^{-\frac{(t-x)^2+(t-y)^2}{2\sigma ^2}} }\;dt \, . \end{aligned}$$

Thus, the threshold number of samples is given by

$$ n_{1/2}=\frac{\theta }{-2\log _2\left( \displaystyle \frac{1}{\sigma \sqrt{2\pi }} \int _{-\infty }^{+\infty } \sqrt{ \sum _{x,y\in \mathcal X}P_0(x)P_1(y) e^{-\frac{(t-x)^2+(t-y)^2}{2\sigma ^2}} }\;dt \right) } $$

for some $0.41\le \theta \le 2$.

As a concrete example, if $P_0$ and $P_1$ are such that $P_0(x) = 1 = P_1(y)$ for some fixed values $x,y \in \mathcal X$, then we get

$$\begin{aligned} F(Q_0\Vert Q_1)&= \frac{1}{\sigma \sqrt{2\pi }} \int _{-\infty }^{+\infty } \sqrt{ e^{-\frac{(t-x)^2+(t-y)^2}{2\sigma ^2}} }\;dt \\&= \frac{1}{\sigma \sqrt{2\pi }} \int _{-\infty }^{+\infty } e^{-\frac{(t-\frac{x+y}{2})^2+(\frac{x-y}{2})^2}{2\sigma ^2}} \;dt \\[1ex]&= e^{-\frac{(x-y)^2}{8\sigma ^2}} \end{aligned}$$

and thus

$$ -2\log F(Q_0\Vert Q_1) =\frac{(x-y)^2}{(4\ln 2)\cdot \sigma ^2} \, . $$

Thus, the number of samples needed to have a distinguishing advantage 1/2 (i.e., guess correctly with probability 3/4) is

$$ n_{1/2}=\theta \frac{(4\ln 2)\cdot \sigma ^2}{(x-y)^2} $$

with $0.41\le \theta \le 2$.