Unifying Leakage Classes: Simulatable Leakage and Pseudoentropy

Leakage resilient cryptography designs systems to withstand partial adversary knowledge of secret state. Ideally, leakage-resilient systems withstand current and future attacks; restoring confidence in the security of implemented cryptographic systems. Understanding the relation between classes of leakage functions is an important aspect.

In this work, we consider the memory leakage model, where the leakage class contains functions over the system’s entire secret state. Standard limitations include functions with bounded output length, functions that retain (pseudo) entropy in the secret, and functions that leave the secret computationally unpredictable.

Standaert, Pereira, and Yu (Crypto, 2013) introduced a new class of leakage functions they call simulatable leakage. A leakage function is

simulatable

if a simulator can produce indistinguishable leakage without access to the true secret state. We extend their notion to general applications and consider two versions. For

weak

simulatability: the simulated leakage must be indistinguishable from the true leakage in the presence of public information. For

strong

simulatability, this requirement must also hold when the distinguisher has access to the true secret state. We show the following:

Weakly simulatable functions retain computational unpredictability.

Strongly simulatability functions retain pseudoentropy.

There are bounded length functions that are not weakly simulatable.

There are weakly simulatable functions that remove pseudoentropy.

There are leakage functions that retain computational unpredictability are not weakly simulatable.