The ore tic a l C o m p ute r Sc ie nc e Theoretical Computer Science 19 1 ( 1998) 2 15-2 18 Computational Note indistinguishability: algorithms vs. circuits Oded Goldreich”, Bernd Meyerb,* a Department of Computer Science and Applied Mathematics, Weizmann Institute of Science, Rehovot, Israel b Pegasusstrabe 14, D-85716 Unterschleijheim. Germany Received July 1996 Communicated by 0. Watanabe A b stra c t We present a simple proof of the existence of a probability ensemble with tiny support which cannot be distinguished from the uniform ensemble by any recursive computation. Since the sup- port is tiny (i.e., sub-polynomial), this ensemble can be distinguished from the uniform ensemble by a (non-uniform) family of small circuits. It also provides an example of an ensemble which cannot be (recursively) distinguished from the uniform by one sample, but can be so distin- guished by two samples. In case we only wish to fool probabilistic polynomial-time algorithms the ensemble can be constructed in super-exponential time. 1. Introduction Computational indistinguishability, introduced by Goldwasser and Micali [4] and defined in full generality by Yao [7], is a central concept of complexity theory. Two probability ensembles, {X,,}nE~ and {Y } n Ned, where both X, and Y, range over zyxwvutsrqponml (0, zyxwvutsrqp 1 }“, are said to be indistinguishable by a complexity class if for every machine A4 in the class the difference Prob(M(&) = 1) - Prob(lM(Y,) = 1) is a negligible function in n (i.e., decreases faster than l/p(n) for any positive polynomial p). It has been known for a while (cf. [7,5,3]) that there exist probability ensem- bles which are statistically far from the uniform ensemble and yet computationally indistinguishable from it: In [7,5] indistinguishability is with respect to (probabilis- tic) polynomial-time algorithms, whereas in [3] indistinguishability is with respect to polynomial-size circuits. A simple proof is via the probabilistic method: Fix any fimc- tion d: (0, 1)" H (0, l}, and select at random O(t/&‘) strings of length n. Then, by Hoefding’s inequality, with probability greater than 1 - 2-’ the average value of d * Corresponding author. E-mail: Bernd.Meyer@munich.netsurf.de 0304-3975/98/$19.00 @ 1998-Elsevier Science B.V. All rights reserved PII SO304-3975(97)00162-X