Guessing Secrets Efficiently

1. Guessing Secrets Efficiently Shuchi Chawla 1/23/2002

2. A game similar to 20 questions • Alice has k secret n-bit strings • Bob wants to learn them • Bob can ask binary questions about one secret • Alice uses any secret of her choice to reply • What should he ask? • How should he figure out the secrets? • How many questions are needed? • Can he learn all?

3. How it all began… • Problem first defined by Chung, Graham & Leighton, EJC’01 • Efficiently solve for the 2 secrets case • Alon et al, SODA’02 • Chung et al, SODA’02 • Micciancio & Segerlind, Unpublished • K secrets case • Largely open

4. What can Bob hope to learn? • Consider the two secret case • He may hope to learn one of the secrets • What if Alice has 3 in mind and always goes with the majority of the two • All the three pairs are always consistent with the answers!

5. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph

6. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph • Alice chooses one part

7. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph • Alice chooses one part • Bob deletes all edges inside the other

8. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph • Alice chooses one part • Bob deletes all edges inside the other

9. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph • Alice chooses one part • Bob deletes all edges inside the other

10. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph • Alice chooses one part • Bob deletes all edges inside the other

11. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph • Alice chooses one part • Bob deletes all edges inside the other

12. Formalizing the problem • Alice’s secret is an edge in the graph • Bob specifies a partition of the graph • Alice chooses one part • Bob deletes all edges inside the other Bob cant do any better!

13. A star or triangle • Alice always picks the bigger set • Bob cant delete any more edges! • Bob cannot learn more if all pairs of edges intersect - star or triangle The model generalizes easily to k secrets k-uniform hypergraphs

14. Guessing “Efficiently” • Few, short questions, fast inversion algorithm • [Chung et al’01]: • At least 3n-5 queries required – information theoretic argument • Algorithm using 4n+3 queries – each 2n bit long, O(2n) time • [MS02] improve this to O(n)-bit questions, O(n2) time • [Chung et al’01] achieve similar bounds using inner product questions • All the above are Adaptive strategies

15. Oblivious strategies • Specify all questions up-front • Desirable – ease of implementation & inversion • [Alon et al] • Basic idea: view the strings as codes

16. Sequence of functions fi: [N] -> {0,1} • Each secret x[N]  f1(x),f2(x),…,fm(x) • Call this “code” C • A code is (2,2)-separating iff For all a,b,c,d[N] i for which C(a)=C(b)  C(c)=C(d) • Such a code would solve the guessing problem

17. Constructing a good code • If a binary linear code C is –biased, for some <1/14, then it is (2,2)-separating • [ABN+92] For any >0 there exists an explicit family of constant rate binary linear-biased codes. • Inversion can be done using list decoding in time O(n3)

18. Obtaining the solution • Say the secret is (x1,x2) • Bob uses code C • Alice answers a = (a1,a2,…,am) • For each i, C(x1)i=ai or C(x2)i=ai • C is -biased • for at least (1/2- )n i, C(x1)i=C(x2)i • Either C(x1) or C(x2) is within distance (1/4+ )n of a

19. Decoding a • wlog C(x1) is within distance (1/4+ )n of a • Decode C upto a distance of (1/4+ )n • For each x returned in the previous step, remove the answers that correspond to x, and then perform an “erasure list decoding” of C obtaining y • Return all pairs (x,y) • Paper proves we get either a star or triangle

20. K-secrets, k>2 • Looking for intersecting k-uniform hypergraphs • Representation is difficult • what does an intersecting hypergraph look like? • [Alon et al] show connection to 2k-universal families of binary strings

21. 0 0 1 1 1 0 0 1 1 0 0 1 1 0 0 1 0 1 1 1 0 0 1 0 0 1 0 1 0 0 1 0 1 0 1 1 N=6 k=1 S = 2k-universal families of binary strings • Find a small subset S{0,1}N such that: • For every set {i1,…,i2k} and string (a1,…,a2k),  xS such that xiy=ay for each y.

22. 2k-universal families of binary strings • Find a small subset S{0,1}N such that: • For every set {i1,…,i2k} and string (a1,…,a2k),  xS such that xiy=ay for each y. 0 0 1 1 1 0 0 1 1 0 0 1 1 0 0 1 0 1 1 1 0 0 1 0 0 1 0 1 0 0 1 0 1 0 1 1 N=6 k=1 Our functions S = Secrets

23. Filling in details.. • There is an explicit strategy for Bob that uses ~O(k26kn) questions [ABN+92] • [Alon et al’02] also give a poly(n) time algorithm for inversion that finds a set of size poly(n) secrets that contains at least one secret of Alice.