Bounded indistinguishability and the complexity of recovering secrets

Motivated by cryptographic applications, we study the notion of bounded indistinguishability, a natural relaxation of the well studied notion of bounded independence. We say that two distributions μ and ν over Σⁿare k-wise indistinguishable if their projections to any k symbols are identical. We say that a function f:Σⁿ→ {0, 1} is _-fooled by k-wise indistinguishability if f cannot distinguish with advantage _ between any two k-wise indistinguishable distributions μ and ν over Σⁿ. We are interested in characterizing the class of functions that are fooled by k-wise indistinguishability. While the case of k-wise independence (corresponding to one of the distributions being uniform) is fairly well understood, the more general case remained unexplored. When Σ = {0, 1}, we observe that whether f is fooled is closely related to its approximate degree. For larger alphabets Σ, we obtain several positive and negative results. Our results imply the first efficient secret sharing schemes with a high secrecy threshold in which the secret can be reconstructed in AC⁰. More concretely, we show that for every 0 < σ < ρ ≤ 1 it is possible to share a secret among n parties so that any set of fewer than σn parties can learn nothing about the secret, any set of at least ρn parties can reconstruct the secret, and where both the sharing and the reconstruction are done by constant-depth circuits of size poly(n). We present additional cryptographic applications of our results to low-complexity secret sharing, visual secret sharing, leakage-resilient cryptography, and eliminating “selective failure” attacks.