Nearly-Linear Time Seeded Extractors with Short Seeds

TL;DR

The paper addresses the inefficiency of existing seeded extractors with short seeds and large outputs, particularly the runtime barrier of $\Omega(n \log(1/\varepsilon))$. It presents a construction of strong seeded extractors for $n$-bit sources with any min-entropy $k$ and any $\varepsilon$, achieving seed length $d=O(\log(n/\varepsilon))$ and output $m=(1-\eta)k$, and running in nearly-linear time $O(n \log^c n)$. This is accomplished by combining modern condensers with classical extractor techniques; a one-time preprocessing step handles extreme parameter regimes. Additionally, the paper provides an instantiation of Trevisan's extractor that can be evaluated in truly linear time in the RAM model when the number of output bits satisfies $m \le \frac{n}{\log(1/\varepsilon)\mathrm{polylog}(n)}$, expanding the range of fast extractors. These results enable privacy amplification protocols with near-linear time, large output, and low communication costs, making practical cryptographic applications more feasible.

Abstract

Seeded extractors are fundamental objects in pseudorandomness and cryptography, and a deep line of work has designed polynomial-time seeded extractors with nearly-optimal parameters. However, existing constructions of seeded extractors with short seed length and large output length run in time $Ω(n \log(1/\varepsilon))$ and often slower, where $n$ is the input source length and $\varepsilon$ is the error of the extractor. Since cryptographic applications of extractors require $\varepsilon$ to be small, the resulting runtime makes these extractors impractical. Motivated by this, we explore constructions of strong seeded extractors with short seeds computable in nearly-linear time $O(n \log^c n)$, for any error $\varepsilon$. We show that an appropriate combination of modern condensers and classical approaches for constructing seeded extractors for high min-entropy sources yields such extractors. More precisely, we obtain strong extractors for $n$-bit sources with any min-entropy $k$ and any target error $\varepsilon$ with seed length $d=O(\log(n/\varepsilon))$ and output length $m=(1-η)k$ for an arbitrarily small constant $η>0$, running in nearly-linear time. When $k$ or $\varepsilon$ are very small, our construction requires a reasonable one-time preprocessing step. These extractors directly yield privacy amplification protocols with nearly-linear time complexity (possibly after a one-time preprocessing step), large output length, and low communication complexity. As a second contribution, we give an instantiation of Trevisan's extractor that can be evaluated in truly linear time in the RAM model, as long as the number of output bits is at most $\frac{n}{\log(1/\varepsilon)polylog(n)}$. Previous fast implementations of Trevisan's extractor ran in $\widetilde{O}(n)$ time in this setting.