# 5.4: Extending the Stretch of a PRG

$$\newcommand{\vecs}[1]{\overset { \scriptstyle \rightharpoonup} {\mathbf{#1}} }$$ $$\newcommand{\vecd}[1]{\overset{-\!-\!\rightharpoonup}{\vphantom{a}\smash {#1}}}$$$$\newcommand{\id}{\mathrm{id}}$$ $$\newcommand{\Span}{\mathrm{span}}$$ $$\newcommand{\kernel}{\mathrm{null}\,}$$ $$\newcommand{\range}{\mathrm{range}\,}$$ $$\newcommand{\RealPart}{\mathrm{Re}}$$ $$\newcommand{\ImaginaryPart}{\mathrm{Im}}$$ $$\newcommand{\Argument}{\mathrm{Arg}}$$ $$\newcommand{\norm}[1]{\| #1 \|}$$ $$\newcommand{\inner}[2]{\langle #1, #2 \rangle}$$ $$\newcommand{\Span}{\mathrm{span}}$$ $$\newcommand{\id}{\mathrm{id}}$$ $$\newcommand{\Span}{\mathrm{span}}$$ $$\newcommand{\kernel}{\mathrm{null}\,}$$ $$\newcommand{\range}{\mathrm{range}\,}$$ $$\newcommand{\RealPart}{\mathrm{Re}}$$ $$\newcommand{\ImaginaryPart}{\mathrm{Im}}$$ $$\newcommand{\Argument}{\mathrm{Arg}}$$ $$\newcommand{\norm}[1]{\| #1 \|}$$ $$\newcommand{\inner}[2]{\langle #1, #2 \rangle}$$ $$\newcommand{\Span}{\mathrm{span}}$$

Recall that the stretch of a PRG is the amount by which the PRG’s output length exceeds its input length. A PRG with very long stretch seems much more useful than one with small stretch. Is there a limit to the stretch of a PRG? Using only $$?\lambda$$ bits of true uniform randomness, can we generate $$100\lambda$$, or even $$\lambda^3$$ pseudorandom bits?

In this section we will see that once you can extend a PRG a little bit, you can also extend it a lot. This is another magical feat that is possible with pseudorandomness but not with truly uniform distributions. We will demonstrate the concept by extending a PRG with stretch $$\lambda$$ into one with stretch $$2\lambda$$, but the idea can be used to increase the stretch of any PRG indefinitely (see the exercises).

Construction $$\PageIndex{1}$$ : PRG Feedback

Let $$G : \{0,1\}^{\lambda} \rightarrow \{0,1\}^{2\lambda}$$ be a length-doubling PRG (i.e., a PRG with stretch $$\lambda$$). When $$x \in \{0,1\}^{2\lambda}$$, we write $$x_{left}$$ to denote the leftmost $$\lambda$$ bits of $$x$$ and $$x_{right}$$ to denote the rightmost $$\lambda$$ bits. Define the length-tripling function $$H : \{0,1\}^{\lambda} \rightarrow \{0,1\}^{3\lambda}$$ as follows:

Claim $$\PageIndex{1}$$ :

If $$G$$ is a secure length-doubling $$PRG$$, then $$H$$ (defined above) is a secure length-tripling $$PRG$$.

Proof:

We want to show that $$\mathscr{L}^H_{\text{prg-real}} ≋ \mathscr{L}^H_{\text{prg-rand}}$$. As usual, we do so with a hybrid sequence. Since we assume that $$G$$ is a secure $$PRG$$, we are allowed to use the fact that $$\mathscr{L}^G_{\text{prg-real}} ≋ \mathscr{L}^G_{\text{prg-rand}}$$. In this proof, we will use the fact twice: once for each occurrence of $$G$$ in the code of $$H$$.

The starting point is $$\mathscr{L}^H_{\text{prg-real}}$$, shown here with the details of $$H$$ filled in.

The first invocation of $$G$$ has been factored out into a subroutine. The resulting hybrid library includes an instance of $$\mathscr{L}^G_{\text{prg-real}}$$.

From the PRG security of $$G$$, we can replace the instance of $$\mathscr{L}^G_{\text{prg-real}}$$ with $$\mathscr{L}^G_{\text{prg-rand}}|). The resulting hybrid library is indistinguishable. A subroutine has been inlined Choosing \(2\lambda$$ uniformly random bits and then splitting them into two halves has exactly the same effect as choosing $$\lambda$$ uniformly random bits and independently choosing $$\lambda$$ more.

The remaining appearance of $$G$$ has been factored out into a subroutine. Now $$\mathscr{L}^G_{\text{prg-real}}$$ makes its second appearance

Again, the PRG security of G lets us replace $$\mathscr{L}^G_{\text{prg-real}}$$ with $$\mathscr{L}^G_{\text{prg-rand}}$$. The resulting hybrid library is indistinguishable.

A subroutine has been inlined.

Similar to above, concatenating $$\lambda$$ uniform bits with $$2\lambda$$ independently uniform bits has the same effect as sampling $$3\lambda$$ uniform bits. The result of this change is $$\mathscr{L}^H_{\text{prg-rand}}$$.

Through this sequence of hybrid libraries, we showed that:

$$\mathscr{L}^H_{\text{prg-real}} \equiv \mathscr{L}_{\text{hyb-1}} ≋ \mathscr{L}_{\text{hyb-2}} \equiv \mathscr{L}_{\text{hyb-3}} \equiv \mathscr{L}_{\text{hyb-4}} \equiv \mathscr{L}_{\text{hyb-5}} ≋ \mathscr{L}_{\text{hyb-6}} \equiv \mathscr{L}_{\text{hyb-7}}\equiv \mathscr{L}^H_{\text{prg-rand}}$$.

Hence, $$H$$ is a secure PRG.

5.4: Extending the Stretch of a PRG is shared under a CC BY-NC-SA 4.0 license and was authored, remixed, and/or curated by Mike Rosulek.