Negligible Function (cryptography)

In mathematics, a negligible function is a function $\mu:\mathbb\to\mathbb$ such that for every positive integer ''c'' there exists an integer ''N''_''c'' such that for all ''x'' > ''N''_''c'',

:$, \mu(x), <\frac.$

Equivalently, we may also use the following definition.
A function $\mu:\mathbb\to\mathbb$ is negligible, if for every positive polynomial poly(·) there exists an integer ''N''_poly > 0 such that for all ''x'' > ''N''_poly

: $, \mu(x), <\frac 1 .$

History

The concept of ''negligibility'' can find its trace back to sound models of analysis. Though the concepts of " continuity" and " infinitesimal" became important in mathematics during Newton and Leibniz's time (1680s), they were not well-defined until the late 1810s. The first reasonably rigorous definition of ''continuity'' in mathematical analysis was due to Bernard Bolzano, who wrote in 1817 the modern definition of continuity. Later Cauchy, Weierstrass and Heine also defined as follows (with all numbers in the real number domain $\mathbb$):

:( Continuous function) A function $f:\mathbb\mathbb$ is ''continuous'' at $x=x_0$ if for every $\varepsilon>0$, there exists a positive number $\delta>0$ such that $, x-x_0, <\delta$ implies $, f(x)-f(x_0), <\varepsilon.$

This classic definition of continuity can be transformed into the
definition of negligibility in a few steps by changing parameters used in the definition. First, in the case $x_0=\infty$ with $f(x_0)=0$, we must define the concept of "''infinitesimal function''":

:( Infinitesimal) A continuous function $\mu:\mathbb\to\mathbb$ is ''infinitesimal'' (as $x$ goes to infinity) if for every $\varepsilon>0$ there exists $N_\varepsilon$ such that for all $x>N_\varepsilon$
::$, \mu(x), <\varepsilon\,.$

Next, we replace $\varepsilon>0$ by the functions $1/x^c$ where $c>0$ or by $1/\operatorname(x)$ where $\operatorname(x)$ is a positive polynomial. This leads to the definitions of negligible functions given at the top of this article. Since the constants $\varepsilon>0$ can be expressed as $1/\operatorname(x)$ with a constant polynomial this shows that negligible functions are a subset of the infinitesimal functions.

Use in cryptography

In complexity-based modern cryptography, a security scheme is
''provably secure'' if the probability of security failure (e.g.,
inverting a one-way function, distinguishing cryptographically strong pseudorandom bits from truly random bits) is negligible in terms of the input $x$ = cryptographic key length $n$. Hence comes the definition at the top of the page because key length $n$ must be a natural number.

Nevertheless, the general notion of negligibility doesn't require that the input parameter $x$ is the key length $n$. Indeed, $x$ can be any predetermined system metric and corresponding mathematical analysis would illustrate some hidden analytical behaviors of the system.

The reciprocal-of-polynomial formulation is used for the same reason that computational boundedness is defined as polynomial running time: it has mathematical closure properties that make it tractable in the asymptotic setting (see #Closure properties). For example, if an attack succeeds in violating a security condition only with negligible probability, and the attack is repeated a polynomial number of times, the success probability of the overall attack still remains negligible.

In practice one might want to have more concrete functions bounding the adversary's success probability and to choose the security parameter large enough that this probability is smaller than some threshold, say 2⁻¹²⁸.

Closure properties

One of the reasons that negligible functions are used in foundations of complexity-theoretic cryptography is that they obey closure properties. Specifically,

# If $f,g:\mathbb\to\mathbb$ are negligible, then the function $x\mapsto f(x)+g(x)$ is negligible.
# If $f:\mathbb\to\mathbb$ is negligible and $p$ is any real polynomial, then the function $x\mapsto p(x)\cdot f(x)$ is negligible.

Conversely, if $f:\mathbb\to\mathbb$ is not negligible, then neither is $x\mapsto f(x)/p(x)$ for any real polynomial $p$.

Examples

* $n\mapsto a^$ is negligible for any $a\geq 2$.
*$f(n) = 3^$ is negligible.
*$f(n) = n^$ is negligible.
*$f(n) = (\log n)^$ is negligible.
*$f(n) = 2^$ is not negligible, for positive $c$.

See also

*Negligible set
*Colombeau algebra
* Nonstandard numbers
*Gromov's theorem on groups of polynomial growth
*Non-standard calculus

References

*
*
*
*
* {{cite journal , first = Mihir , last = Bellare , date = 1997 , citeseerx = 10.1.1.43.7900 , title = A Note on Negligible Functions , journal = Journal of Cryptology , volume = 15 , page = 2002 , publisher = Dept. of Computer Science & Engineering University of California at San Diego

Mathematical analysis
Types of functions