6

$G$ is a secure PRG in range $\{0,1\}^n\rightarrow\{0,1\}^{n+1}$.

Let us define $G'(S)=G(S\oplus G(S)_{1,...,n})$, s.t. $G(S)_{1,...,n}$ is the first n bits of $G(S)$.

Is $G'(S)$ a secure PRG?

Intuition

I'd like to say that since $G(S)$ is a secure PRG then it's first n bits should also be pseudo random, else if they weren't, we'd have a distinguisher for the first n-bits, and then last bit could be 0 or 1, and we could distinguish $G(S)$ with high probability... but I might be missing something.

SEJPM
  • 46,697
  • 9
  • 103
  • 214
Jjang
  • 365
  • 1
  • 5
  • 14

0 Answers0