What makes random affine transformations pairwise independent?

176 Views Asked by At

Consider the affine transformation $$ h(\vec{x}) = A\vec{x} + \vec{b} \bmod p $$ for some prime $p$. Now let $\vec{x}$ be fixed and select the entries of $A$ and $\vec{b}$ uniformly at random from $\{0, 1, ... , p-1\}$. Then $h(\vec{x})$ is a random variable. The claim now is that $h(\vec{x})$ is again a uniform random variable and moreover, if $\vec{x} \neq \vec{y}$, then $h(\vec{x})$ and $h(\vec{y})$ are independent.

The first claim is straightforward. $\vec{b}$ is uniformly random. So no matter how $A\vec{x}$ is distributed, adding $\vec{b}$ makes it uniform.

The trouble I have is with the independence. Here one can argue that $$ h(\vec{y}) = A\vec{y} + \vec{b} = A\vec{x} +\vec{b} + A(\vec{y} - \vec{x}) = h(\vec{x}) + A(\vec{y} - \vec{x})\,. $$ Because $\vec{x} \neq \vec{y}$ the vector $\vec{y} - \vec{x}$ isn't the zero vector. Therefore, it picks at least one uniformly random column of $A$ making $A(\vec{y} - \vec{x})$ uniformly random.

One fine point here is that the nonzero entry of $\vec{y} - \vec{x}$ might be $> 1$. So one has to do a little more work using the fact that $p$ is prime to show that this doesn't make the distribution only uniform over some strict subset of $\{0, 1, ..., p-1\}^n$.

But aside from that my real worry is that given $h(\vec{x})$ the matrix $A$ might no longer be uniformly random. Intuitively, the addition of $\vec{b}$ "destroys" any information about $A$ one might hope to get from $A\vec{x} + \vec{b}$. But I'm having trouble reducing this intuition to first principles. Can somebody help me with the details?