In cryptography and the theory of computation, the next-bit test is a test against pseudo-random number generators. We say that a sequence of bits passes the next bit test for at any position i {\displaystyle i} in the sequence, if any attacker who knows the i {\displaystyle i} first bits (but not the seed) cannot predict the ( i + 1 ) {\displaystyle (i+1)} st with reasonable computational power.
Precise statement(s) Let P {\displaystyle P} be a polynomial, and S = { S k } {\displaystyle S=\{S_{k}\}} be a collection of sets such that S k {\displaystyle S_{k}} contains P ( k ) {\displaystyle P(k)} -bit long sequences. Moreover, let μ k {\displaystyle \mu _{k}} be the probability distribution of the strings in S k {\displaystyle S_{k}} . We now define the next-bit test in two different ways.
Boolean circuit formulation A predicting collection C = { C k i } {\displaystyle C=\{C_{k}^{i}\}} is a collection of boolean circuits, such that each circuit C k i {\displaystyle C_{k}^{i}} has less than P C ( k ) {\displaystyle P_{C}(k)} gates and exactly i {\displaystyle i} inputs. Let p k , i C {\displaystyle p_{k,i}^{C}} be the probability that, on input the i {\displaystyle i} first bits of s {\displaystyle s} , a string randomly selected in S k {\displaystyle S_{k}} with probability μ k ( s ) {\displaystyle \mu _{k}(s)} , the circuit correctly predicts s i + 1 {\displaystyle s_{i+1}} , i.e. :
Now, we say that { S k } k {\displaystyle \{S_{k}\}_{k}} passes the next-bit test if for any predicting collection C {\displaystyle C} , any polynomial Q {\displaystyle Q} :
Probabilistic Turing machines We can also define the next-bit test in terms of probabilistic Turing machines, although this definition is somewhat stronger (see Adleman's theorem). Let M {\displaystyle {\mathcal {M}}} be a probabilistic Turing machine, working in polynomial time. Let p k , i M {\displaystyle p_{k,i}^{\mathcal {M}}} be the probability that M {\displaystyle {\mathcal {M}}} predicts the ( i + 1 ) {\displaystyle (i+1)} st bit correctly, i.e.
We say that collection S = { S k } {\displaystyle S=\{S_{k}\}} passes the next-bit test if for all polynomial Q {\displaystyle Q} , for all but finitely many k {\displaystyle k} , for all 0 < i < k {\displaystyle 0<i<k} :
Completeness for Yao's test The next-bit test is a particular case of Yao's test for random sequences, and passing it is therefore a necessary condition for passing Yao's test. However, it has also been shown a sufficient condition by Yao. We prove it now in the case of the probabilistic Turing machine, since Adleman has already done the work of replacing randomization with non-uniformity in his theorem. The case of Boolean circuits cannot be derived from this case (since it involves deciding potentially undecidable problems), but the proof of Adleman's theorem can be easily adapted to the case of non-uniform Boolean circuit families. Let M {\displaystyle {\mathcal {M}}} be a distinguisher for the probabilistic version of Yao's test, i.e. a probabilistic Turing machine, running in polynomial time, such that there is a polynomial Q {\displaystyle Q} such that for infinitely many k {\displaystyle k}
… excerpt ends here. Continue reading the full article.
