We study interactive oracle proofs (IOPs) [BCS16,RRR16], which combine aspects of probabilistically checkable proofs (PCPs) and interactive proofs (IPs). We present IOP constructions and techniques that enable us to obtain tradeoffs in proof length versus query complexity that are not known to be achievable via PCPs or IPs alone. Our main results are: 1. Circuit satisfiability has 3-round IOPs with linear proof length (counted in bits) and constant query complexity. 2. Reed-Solomon codes have 2-round IOPs of proximity with linear proof length and constant query complexity. 3. Tensor product codes have 1-round IOPs of proximity with sublinear proof length and constant query complexity. For all the above, known PCP constructions give quasilinear proof length and constant query complexity [BS08,Din07]. Also, for circuit satisfiability, [BKKMS13] obtain PCPs with linear proof length but sublinear (and super-constant) query complexity. As in [BKKMS13], we rely on algebraic-geometry codes to obtain our first result; but, unlike that work, our use of such codes is much "lighter" because we do not rely on any automorphisms of the code. We obtain our results by proving and combining "IOP-analogues" of tools underlying numerous IPs and PCPs: * Interactive proof composition. Proof composition [AS98] is used to reduce the query complexity of PCP verifiers, at the cost of increasing proof length by an additive factor that is exponential in the verifier's randomness complexity. We prove a composition theorem for IOPs where this additive factor is linear. * Sublinear sumcheck. The sumcheck protocol [LFKN92] is an IP that enables the verifier to check the sum of values of a low-degree multi-variate polynomial on an exponentially-large hypercube, but the verifier's running time depends linearly on the bound on individual degrees. We prove a sumcheck protocol for IOPs where this dependence is sublinear (e.g., polylogarithmic). Our work demonstrates that even constant-round IOPs are more efficient than known PCPs and IPs.

A basic combinatorial interpretation of Shannon's entropy function is via the "20 questions" game. This cooperative game is played by two players, Alice and Bob: Alice picks a distribution Π over the numbers {1,…,n}, and announces it to Bob. She then chooses a number x according to Π, and Bob attempts to identify x using as few Yes/No queries as possible, on average.

Motivated by applications in cryptography, we introduce and study the problem of distribution design. The goal of distribution design is to find a joint distribution on $n$ random variables that satisfies a given set of constraints on the marginal distributions. Each constraint can either require that two sequences of variables be identically distributed or, alternatively, that the two sequences have disjoint supports. We present several positive and negative results on the existence and efficiency of solutions for a given set of constraints.

Subspace codes have received an increasing interest recently due to their application in error correction for random network coding. In particular, cyclic subspace codes are possible candidates for large codes with efficient encoding and decoding algorithms. In this paper, we consider such cyclic codes and provide constructions of optimal codes for which their codewords do not have full orbits. We further introduce a new way to represent subspace codes by a class of polynomials called subspace polynomials. We present some constructions of such codes, which are cyclic and analyze their parameters.

We propose a new model of a weakly random source that admits randomness extraction. Our model of additive sources includes such natural sources as uniform distributions on arithmetic progressions (APs), generalized arithmetic progressions (GAPs), and Bohr sets, each of which generalizes affine sources. We give an explicit extractor for additive sources with linear min-entropy over both Zp and Zn/p, for large prime p, although our results over Zn/p require that the source further satisfy a list-decodability condition. As a corollary, we obtain explicit extractors for APs, GAPs, and Bohr sources with linear min-entropy, although again our results over Zn/p require the list-decodability condition.

Subspace codes have received an increasing interest recently due to their application in error-correction for random network coding. In particular, cyclic subspace codes are possible candidates for large codes with efficient encoding and decoding algorithms. In this paper we consider such cyclic codes. We provide constructions of optimal cyclic codes for which their codewords do not have full length orbits. We further introduce a new way to represent subspace codes by a class of polynomials called subspace polynomials. We present some constructions of such codes which are cyclic and analyze their parameters.

We describe new constructions of error correcting codes, obtained by "degree-lifting" a short algebraic geometry base-code of block-length q to a lifted-code of block-length qm, for arbitrary integer m. The construction generalizes the way degree-d, univariate polynomials evaluated over the q-element field (also known as Reed-Solomon codes) are "lifted" to degree-d, m-variate polynomials (Reed-Muller codes). A number of properties are established: The rate of the degree-lifted code is approximately a 1/m!-fraction of the rate of the base-code. The relative distance of the degree-lifted code is at least as large as that of the base-code. This is proved using a generalization of the Schwartz-Zippel Lemma to degree-lifted Algebraic-Geometry codes. [Local correction] If the base code is invariant under a group that is "close" to being doubly-transitive (in a precise manner defined later then the degree-lifted code is locally correctable with query complexity at most q2. The automorphisms of the base-code are crucially used to generate query-sets, abstracting the use of affine-lines in the local correction procedure of Reed-Muller codes. Taking a concrete illustrating example, we show that degree-lifted Hermitian codes form a family of locally correctable codes over an alphabet that is significantly smaller than that obtained by Reed-Muller codes of similar constant rate, message length, and distance.

Let Fqbe the field of q elements. An (n, k)-affine extractor is a mapping D : Fqn→ {0,1} such that for any k-dimensional affine subspace X ⊆ Fqn, D(x) is an almost unbiased bit when x is chosen uniformly from X. Loosely speaking, the problem of explicitly constructing affine extractors gets harder as q gets smaller and easier as k gets larger. This is reflected in previous results: When q is 'large enough', specifically q = Ω(n2), Gabizon and Raz construct affine extractors for any k ≥ 1. In the 'hardest case', i.e. when q = 2, Bourgain constructs affine extractors for k ≥ δn for any constant (and even slightly subconstant) δ > 0. Our main result is the following: Fix any k ≥ 2 and let d = 5n/k. Then whenever q > 2 · d2and p = char(Fq) > d, we give an explicit (n, k)-affine extractor. For example, when k = δn for constant δ > 0, we get an extractor for a field of constant size Ω((1/δ)2). We also get weaker results for fields of arbitrary characteristic (but can still work with a constant field size when k = δn for constant δ > 0). Thus our result may be viewed as a 'field-size/dimension' tradeoff for affine extractors. For a wide range of k this gives a new result, but even for large k where we do not improve (or even match) the previous result of, we believe that our construction and proof have the advantage of being very simple: Assume n is prime and d is odd, and fix any non-trivial linear map T : Fqn→ Fq. Define QR : Fq→ {0,1} by QR(x) = 1 if and only if x is a quadratic residue. Then, the function D : Fqn→ {0,1} defined by D(x) =△QR(T(xd)) is an (n, k)-affine extractor. Our proof uses a result of Heur, Leung and Xiang giving a lower bound on the dimension of products of subspaces.

In this paper we construct explicit deterministic extractors from polynomial sources, namely from distributions sampled by low degree multivariate polynomials over finite fields. This naturally generalizes previous work on extraction from affine sources. A direct consequence is a deterministic extractor for distributions sampled by polynomial size arithmetic circuits over exponentially large fields. The first step towards extraction is a construction o/rank extractors, which are polynomial mappings that "extract" the algebraic rank from any system of low degree polynomials. More precisely, for any n polynomials, k of which are algebraically independent, a rank extractor outputs k algebraically independent polynomials of slightly higher degree. A result of Wooley allows us to relate algebraic rank and min-entropy and to show that a rank extractor is also a high quality condenser for polynomial sources over polynomially large fields. Finally, to turn this condenser into an extractor, we employ a theorem of Bombieri, giving a character sum estimate for polynomials defined over curves. It allows extracting all the randomness (up to a multiplicative constant) from polynomial sources over exponentially large fields.

An $(n,k)$‐bit‐fixing source is a distribution X over $\{0,1\}^n$ such that there is a subset of k variables in $X_1,\ldots,X_n$ which are uniformly distributed and independent of each other, and the remaining $n-k$ variables are fixed. A deterministic bit‐fixing source extractor is a function $E:\{0,1\}^n \rightarrow \{0,1\}^m$ which on an arbitrary $(n,k)$‐bit‐fixing source outputs m bits that are statistically close to uniform. Recently, Kamp and Zuckerman [Proceedings of the 44th Annual IEEE Symposium on Foundations of Computer Science, 2003, pp. 92–101] gave a construction of a deterministic bit‐fixing source extractor that extracts $\Omega(k^2/n)$ bits and requires $k>\sqrt{n}$. In this paper we give constructions of deterministic bit‐fixing source extractors that extract $(1-o(1))k$ bits whenever $k>(\log n)^c$ for some universal constant $c>0$. Thus, our constructions extract almost all the randomness from bit‐fixing sources and work even when k is small. For $k \gg \sqrt{n}$ the extracted bits have statistical distance $2^{-n^{\Omega(1)}}$ from uniform, and for $k \le \sqrt{n}$ the extracted bits have statistical distance $k^{-\Omega(1)}$ from uniform. Our technique gives a general method to transform deterministic bit‐fixing source extractors that extract few bits into extractors which extract almost all the bits.

An (n, k)-affine source over a finite field F is a random variable X = (X/sub 1/, ..., X/sub n/) /spl epsi/ F/sub n/, which is uniformly distributed over an (unknown) k-dimensional affine subspace of F/sub n/. We show how to (deterministically) extract practically all the randomness from affine sources, for any field of size larger than n/sup c/ (where c is a large enough constant). Our main results are as follows: 1. (For arbitrary k): For any n, k and any F of size larger than n/sub 20/, we give an explicit construction for a function D : F/sub n/ /spl rarr/ F/sub k-1/, such that for any (n, k)-affine source X over F, the distribution of D(X) is /spl epsiv/-close to uniform, where /spl epsiv/ is polynomially small in |F|. 2. (For k = 1): For any n and any F of size larger than n/sup c/, we give an explicit construction for a function D : F/sup n/ /spl rarr/ {0,1}/sup (1-/spl sigma/)log//sub 2/|F|, such that for any (n, 1)-affine source X over F, the distribution of D(X) is /spl epsiv/-close to uniform, where /spl epsiv/ is polynomially small in |F|. Here, /spl delta/ > 0 is an arbitrary small constant, and c is a constant depending on /spl delta/.

An {n, k)-bit-fixing source is a distribution X over {0, 1}/sup n/ such that there is a subset of k variables in X/sub 1/, ..., X/sub n/ which are uniformly distributed and independent of each other, and the remaining n - k variables are fixed. A deterministic bit-fixing source extractor is a function E : {0, l}/sup n/ /spl rarr/ {0, l}/sup m/ which on an arbitrary (n, k)-bit-fixing source outputs m bits that are statistically-close to uniform. Recently, Kamp and Zuckerman (2003) gave a construction of deterministic bit-fixing source extractor that extracts /spl Omega/(k/sup 2//n) bits, and requires k > /spl radic/n. In this paper we give constructions of deterministic bit-fixing source extractors that extract (1 -o(1))k bits whenever k > (log n)/sup c/ for some universal constant c > 0. Thus, our constructions extract almost all the randomness from bit-fixing sources and work even when k is small. For k /spl Gt/ /spl radic/n the extracted bits have statistical distance 2/sup -n/spl Omega/(1)/ from uniform, and for k /spl les/ /spl radic/n the extracted bits have statistical distance k/sup -/spl Omega/(1)/ from uniform. Our technique gives a general method to transform deterministic bit-fixing source extractors that extract few bits into extractors which extract almost all the bits.