Toward Separating the Strong Adaptive Pseudo-freeness from the Strong RSA Assumption

Abstract

The notion of pseudo-freeness of a group was introduced by Hohenberger, and formalized by Rivest in order to unify cryptographic assumptions. Catalano, Fiore and Warinschi proposed the adaptive pseudo-free group as a generalization of pseudo-free group. They showed that the RSA group \(\mathbb{Z}_N^\times\) is pseudo-free even if the adversary against pseudo-freeness is allowed to operate adaptively, provided that the adaptive behavior of the adversary is restricted by some specific parametric distribution. They also proposed the notion of strong adaptive pseudo-freeness in which the adaptive behavior of the adversary is not restricted. However, it remains open whether \(\mathbb{Z}_N^\times\) is also strongly-adaptive pseudo-free under the strong RSA (SRSA) assumption.In this paper, we give a negative circumstantial evidence for the question. We show that the SRSA assumption does not imply the strong adaptive pseudo-freeness of \(\mathbb{Z}_N^\times\), as far as the algebraic reduction is concerned. The algebraic reduction means that the algorithm of the black-box reduction performs only group operations for elements in \(\mathbb{Z}_N^\times\). Our result indicates that the strong adaptive pseudo-freeness for the RSA group \(\mathbb{Z}_N^\times\) cannot be shown under the SRSA assumption, by employing only current proof techniques which are used in ordinary security proofs.