Advantage. The purpose of this problem is to clarify the concept of advantage. Consider the following two experiments $\mathsf{EXP}(0)$ and $\mathsf{EXP}(1)$:

• In $\mathsf{EXP}(0)$ the challenger flips a fair coin (probability $1/2$ for HEADS and $1/2$ for TAILS) and sends the result to the adversary $\mathsf{A}$.
• In $\mathsf{EXP}(1)$ the challenger always sends TAILS to the adversary.

The adversary’s goal is to distinguish these two experiments: at the end of each experiment the adversary outputs a bit $0$ or $1$ for its guess for which experiment it is in. For $b = 0,1$ let $W_{b}$ be the event that in experiment $b$ the adversary output $1$. The adversary tries to maximize its distinguishing advantage, namely the quantity $\mathsf{Adv} = \left| \mathsf{Pr}\left[W_{0}\right] − \mathsf{Pr}\left[W_{1}\right] \right| \in \left[0, 1\right]$ .

The advantage $\mathsf{Adv}$ captures the adversary’s ability to distinguish the two experiments. If the advantage is $0$ then the adversary behaves exactly the same in both experiments and therefore does not distinguish between them. If the advantage is $1$ then the adversary can tell perfectly what experiment it is in. If the advantage is negligible for all efficient adversaries (as defined in class) then we say that the two experiments are indistinguishable.

a. Calculate the advantage of each of the following adversaries:

• A1: Always output $1$.
• A2: Ignore the result reported by the challenger, and randomly output $0$ or $1$ with even probability.
• A3: Output $1$ if HEADS was received from the challenger, else output $0$.
• A4: Output $0$ if HEADS was received from the challenger, else output $1$.
• A5: If HEADS was received, output $1$. If TAILS was received, randomly output $0$ or $1$ with even probability.

b. What is the maximum advantage possible in distinguishing these two experiments? Explain why.

Let's use the experiment defined earlier as a pseudorandom generator ($\mathsf{PRG}$) as follows:

1. Set a desired output length $n$
2. Obtain a random sequence $R$ of bits of length $n$ (say flipping a coin, using a Linear-congruential generator, or any other method)
3. For each bit $r$ in the random sequence $R$ generated in the previous step, output a bit $b$ as follows:

• if the bit $r$ is $0$, then output a random bit $b$ (e.g. flip a coin and output either $0$ or $1$ depending on its result)
• if the bit $r$ is $1$, then output $1$

a. Implement the frequency (monobit) test from NIST (see section 2.1) and check if a sequence generated by the above $\mathsf{PRG}$ (say $n=100$) seems random or not.

b. Run the test on a random bitstring (e.g. a string such as R used by the above $\mathsf{PRG}$), and compare the result of the test.

If the two results are different across many iterations, this test already gives you an attacker that breaks the $\mathsf{PRG}$.

import random
 
def get_random_string(n): #generate random bit string
  bstr = bin(random.getrandbits(n)).lstrip('0b').zfill(n)
  return bstr

In this exercise we'll build a simple Linear Feedback Shift Register (LFSR). LFSRs produce random bit string with good statistical properties, but are very easy to predict.

The register is a sequence of $n$ bits; a LFSR is defined by:

• an initial state (the initial bit contents of the register)
• a polynomial that describes how bit shifts should be performed

For example, given an $18$ bit LFSRm the polynomial $X^{18} + X^{11} + 1$ and the initial state:

  state = '001001001001001001'
                     *      *

we generate a new random bit $b$ by $\mathsf{xor}$-ing bits $11$ ($0$) and $18$ ($1$), thus obtaining $b = 1$. We then shift the whole register to the right (thus dropping the right-most bit) and insert $b$ to the left. Thus, the new state is:

  state = '100100100100100100'

The process is repeated until the desired number of bits have been generated.

Using the above starting state and polynomial, generate $100$ random bits and run the monobit statistical test from the previous exercise to see if their frequency seems random.