One bit of stretch, and the hybrid argument that pays for the rest.

A generator that adds a single bit looks useless. Iterate it and you get as many bits as you like — but the security proof no longer follows in one step, because the output now comes from many calls and the assumption speaks about one. The hybrid argument is how you cross that gap, and it charges you a factor of ℓ to do it.

given  G : {0,1}n → {0,1}n+1  ·  build  G : {0,1}n → {0,1}

01

Why the proof is not one line

The construction is the obvious one, and it is worth having in front of you. Write G(s) = (s′, σ), splitting each call's n+1 bits into n bits of state to carry forward and one bit of output. Set s₀ = s, put (sj, σj) = G(sj−1) for j = 1 … ℓ, and output σ₁ σ₂ ⋯ σ. The seed stays n bits and the cost is calls.

Here is the theorem, and then the difficulty.

theorem

If G is a pseudorandom generator with one bit of stretch, then G is a pseudorandom generator, for any polynomial .

Suppose D distinguishes G's output from uniform bits with advantage ε. To contradict the assumption we need a distinguisher for G — for one call, on n+1 bits. But D wants bits produced by chained calls, and we are handed only one challenge string. There is no way to feed the challenge straight through: it is the wrong length and the wrong shape.

The hybrid argument resolves this by refusing to compare the two ends directly. It builds a chain of distributions from one end to the other, each differing from its neighbour by a single call to G, and shows that a gap across the whole chain forces a gap across some one link.

02

The ladder of hybrids

definition

For i = 0 … ℓ, let Hi be the distribution on -bit strings given by: the first i bits uniform and independent, and the remaining ℓ − i bits produced by the construction started from a fresh uniform state.

H₀ is exactly G's output. H is exactly uniform bits. Everything in between is a partial swap.

walk the ladder · one sample from each Hi

H₀
uniform, tossed by hand generated by iterating G pale means the bit is 0

Slide from 0 to ℓ and the string converts from fully generated to fully random, one position at a time. Nothing about G is being assumed yet — this is just a definition.

the two ends are what we care about

|Pr[D(H₀) = 1] − Pr[D(H) = 1]| = ε is precisely the statement that D breaks G. The triangle inequality spreads that across the links:

ε ≤ Σi=0ℓ−1 |Pr[D(Hi) = 1] − Pr[D(Hi+1) = 1]|

terms summing to at least ε, so by pigeonhole at least one term is at least ε/ℓ. Find that link and you have found a break of a single call to G.

03

One link, one call

Fix i and look at Hi beside Hi+1. Both begin with i uniform bits. Both end with the construction run from a fresh state. They disagree at exactly one position: in Hi, position i+1 is the bit output by one call to G; in Hi+1 it is a coin flip, and the state that continues the string is fresh rather than the one that call produced.

the two neighbours

Hi
Hi+1

That is a difference of exactly one application of G, which is the shape the assumption can speak about. Build the distinguisher.

D′ D challenge z G(u) or uniform split z = (s′, σ) i ← {0, …, ℓ−1} u₁…u_i ← coin flips iterate G from s′, ℓ−i−1 times u₁…u_i ‖ σ ‖ rest D's output output whatever D said

build D′ yourself · each correct choice writes a line