Existence Of One-way Functions Research Articles

One-Way Functions and (Im)perfect Obfuscation

A program obfuscator takes a program and outputs a “scrambled” version of it, where the goal is that the obfuscated program will not reveal much about its structure beyond what is apparent from executing it. There are several ways of formalizing this goal. Specifically, in indistinguishability obfuscation, first defined by Barak et al. (CRYPTO 2001), the requirement is that the results of obfuscating any two functionally equivalent programs (circuits) will be computationally indistinguishable. Recently, a fascinating candidate construction for indistinguishability obfuscation was proposed by Garg et al. (FOCS 2013). This has led to a flurry of discovery of intriguing constructions of primitives and protocols whose existence was not previously known (for instance, fully deniable encryption by Sahai and Waters, STOC 2014). Most of them explicitly rely on additional hardness assumptions, such as one-way functions. Our goal is to get rid of this extra assumption. We cannot argue that indistinguishability obfuscation of all polynomial-time circuits implies the existence of one-way functions, since if P = NP, then program obfuscation (under the indistinguishability notion) is possible. Instead, the ultimate goal is to argue that if P 6= NP and program obfuscation is possible, then one-way functions exist. Our main result is that if NP 6⊆ io-BPP and there is an efficient (even imperfect) indistinguishability obfuscator, then there are one-way functions. In addition, we show that the existence of an indistinguishability obfuscator implies (unconditionally) the existence of SZKarguments for NP. This, in turn, provides an alternative version of our main result, based on the assumption of hard-on-the average NP problems. To get some of our results we need obfuscators for simple programs such as 3CNF formulas. ∗This paper incorporates the manuscript of Moran and Rosen [MR13]. †Weizmann Institute of Science. Email: {ilan.komargodski,moni.naor,eylon.yogev}@weizmann.ac.il. Supported in part by a grant from the I-CORE Program of the Planning and Budgeting Committee, the Israel Science Foundation, BSF, IMOS and the Citi Foundation. Moni Naor is the incumbent of the Judith Kleeman Professorial Chair. ‡IDC Herzliya. Email: talm@idc.ac.il. Supported by ISF grant no. 1790/13 and by the European Union Seventh Framework Programme (FP7/2007-2013) under grant agreement no. 293843 §Cornell University. Email: rafael@cs.cornell.edu. Supported in part by a Alfred P. Sloan Fellowship, Microsoft New Faculty Fellowship, NSF Award CNS1217821, NSF CAREER Award CCF-0746990, NSF Award CCF-1214844, AFOSR YIP Award FA9550-10-1-0093, and DARPA and AFRL under contract FA8750-11-20211. The views and conclusions contained in this document are those of the authors and should not be interpreted as representing the official policies, either expressed or implied, of the Defense Advanced Research Projects Agency or the US Government. ¶IDC Herzliya. Email: alon.rosen@idc.ac.il. Supported by ISF grant no. 1255/12 and by the ERC under the EU’s Seventh Framework Programme (FP/2007-2013) ERC Grant Agreement n. 307952.

A Note on Perfect Correctness by Derandomization

We show a general compiler that transforms a large class of erroneous cryptographic schemes (such as public-key encryption, indistinguishability obfuscation, and secure multiparty computation schemes) into perfectly correct ones. The transformation works for schemes that are correct on all inputs with probability noticeably larger than half, and are secure under parallel repetition. We assume the existence of one-way functions and of functions with deterministic (uniform) time complexity 2^{O(n)} and non-deterministic circuit complexity 2^{Omega (n)}. Our transformation complements previous results that showed how public-key encryption and indistinguishability obfuscation that err on a noticeable fraction of inputs can be turned into ones that for all inputs are often correct, showing that they can be made perfectly correct. The technique relies on the idea of “reverse randomization” [Naor, Crypto 1989] and on Nisan–Wigderson style derandomization, previously used in cryptography to remove interaction from witness-indistinguishable proofs and commitment schemes [Barak, Ong and Vadhan, Crypto 2003].

On the complexity of fair coin flipping

A two-party coin-flipping protocol is ε-fair if no efficient adversary can bias the output of the honest party (who always outputs a bit, even if the other party aborts) by more than ε. Cleve [STOC '86] showed that r-round o(1/r)-fair coin-flipping protocols do not exist. Awerbuch, Blum, Chor, Goldwasser, and Micali [Manuscript '85] constructed a Θ(1/r)-fair coin-flipping protocol, assuming the existence of one-way functions. Moran, Naor, and Segev [Journal of Cryptology '16] constructed an r-round coin-flipping protocol that is Θ(1/r)-fair (thus matching the aforementioned lower bound of Cleve [STOC '86]), assuming the existence of oblivious transfer.The above gives rise to the intriguing question of whether oblivious transfer, or more generally “public-key primitives,” is required for an o(1/r)-fair coin-flipping protocol. Towards answering this intriguing question, Maji and Wang [Crypto '18] have recently showed that in the random oracle model (ROM), any coin-flipping protocol can be biased by Ω(1/r). This implies that o(1/r)-fair coin-flipping protocol cannot be constructed from one-way function, or from a family of collision-resistant hash functions, in a black-box way. This result does not rule out, however, non black-box constructions, and black-box constructions based on primitives that cannot be realized in the ROM.We make a different progress towards answering above question by showing that, for any constant r∈N, the existence of an 1/(c⋅r)-fair, r-round coin-flipping protocol implies the existence of an infinitely-often key-agreement protocol, where c denotes some universal constant (independent of r). Our reduction is non black-box and makes a novel use of the recent dichotomy for two-party protocols of Haitner, Nissim, Omri, Shaltiel, and Silbak [SICOMP '20] to facilitate a two-party variant of the recent attack of Beimel, Haitner, Makriyannis, and Omri [FOCS '18] on multi-party coin-flipping protocols.

Experimental relativistic zero-knowledge proofs.

Protecting secrets is a key challenge in our contemporary information-based era. In common situations, however, revealing secrets appears unavoidable; for instance, when identifying oneself in a bank to retrieve money. In turn, this may have highly undesirable consequences in the unlikely, yet not unrealistic, case where the bank's security gets compromised. This naturally raises the question of whether disclosing secrets is fundamentally necessary for identifying oneself, or more generally for proving a statement to be correct. Developments in computer science provide an elegant solution via the concept of zero-knowledge proofs: a prover can convince a verifier of the validity of a certain statement without facilitating the elaboration of a proof at all1. In this work, we report the experimental realization of such a zero-knowledge protocol involving two separated verifier-prover pairs2. Security is enforced via the physical principle of special relativity3, and no computational assumption (such as the existence of one-way functions) is required. Our implementation exclusively relies on off-the-shelf equipment and works at both short (60 m) and long distances (≥400 m) in about one second. This demonstrates the practical potential of multi-prover zero-knowledge protocols, promising for identification tasks and blockchain applications such as cryptocurrencies or smart contracts4.

On continuous one-way functions

The existence of one-way functions seems to depend, intuitively, on certain irregular properties of polynomial-time computable functions. Therefore, for functions with continuity properties, it suggests that all such functions are not one-way. It is shown here that in the formal complexity theory of real functions, this nonexistence of continuous one-way functions can be proved for one-to-one one-dimensional real functions, but fails for one-to-one two-dimensional real functions, if certain strong discrete one-way functions exist. Furthermore, for k-to-one functions, we can prove the existence of four-to-one one-dimensional one-way functions under the same assumption of the existence of strong discrete one-way functions. (A function f is k-to-one if for any y there exist at most k distinct values x such that f(x)=y.)

PCPs and the Hardness of Generating Synthetic Data

Assuming the existence of one-way functions, we show that there is no polynomial-time differentially private algorithm $${\mathcal {A}}$$ that takes a database $$D\in (\{0,1\}^d)^n$$ and outputs a “synthetic database” $${\hat{D}}$$ all of whose two-way marginals are approximately equal to those of D. (A two-way marginal is the fraction of database rows $$x\in \{0,1\}^d$$ with a given pair of values in a given pair of columns.) This answers a question of Barak et al. (PODS ‘07), who gave an algorithm running in time $$\mathrm {poly}(n,2^d)$$ . Our proof combines a construction of hard-to-sanitize databases based on digital signatures (by Dwork et al., STOC ‘09) with encodings based on the PCP theorem. We also present both negative and positive results for generating “relaxed” synthetic data, where the fraction of rows in D satisfying a predicate c are estimated by applying c to each row of $${\hat{D}}$$ and aggregating the results in some way.

Non-Malleable Zero-Knowledge Arguments with Lower Round Complexity

Abstract Round complexity is one of the fundamental problems in zero-knowledge (ZK) proof systems. Non-malleable zero-knowledge (NMZK) protocols are ZK protocols that provide security even when man-in-the-middle adversaries interact with a prover and a verifier simultaneously. It is known that the first constant-round public-coin NMZK arguments for NP can be constructed by assuming the existence of collision-resistant hash functions (Pass, R. and Rosen, A. (2005) New and Improved Constructions of Non-Malleable Cryptographic Protocols. In Gabow, H.N. and Fagin, R. (eds) Proc. 37th Annual ACM Symposium on Theory of Computing, Baltimore, MD, USA, May 2224, 2005, pp. 533542. ACM) and has relatively high round complexity; the first four-round private-coin NMZK arguments for NP can be constructed in the plain model by assuming the existence of one-way functions (Goyal, V., Richelson, S., Rosen, A. and Vald, M. (2014) An Algebraic Approach to Non-Malleability. In 55th IEEE Annual Symposium on Foundations of Computer Science, FOCS 2014, Philadelphia, PA, USA, October 1821, 2014, pp. 4150. IEEE Computer Society and Ciampi, M., Ostrovsky, R., Siniscalchi, L. and Visconti, I. (2017) Delayed-Input Non-Malleable Zero Knowledge and Multi-Party Coin Tossing in Four Rounds. In Kalai, Y. and Reyzin, L. (eds) Theory of Cryptography15th Int. Conf., TCC 2017. Lecture Notes in Computer Science, Baltimore, MD, USA, November 1215, 2017, Part I, Vol. 10677, pp. 711742. Springer). In this paper, we present a six-round public-coin NMZK argument of knowledge system assuming the existence of collision-resistant hash functions and a three-round private-coin NMZK argument system from multi-collision resistance of hash functions assumption in the keyless setting.

Statistical Concurrent Non-Malleable Zero-Knowledge from One-Way Functions

Concurrent non-malleable zero-knowledge ($$\mathrm {CNMZK}$$) protocols are zero-knowledge protocols that provides security even when adversaries interact with multiple provers and verifiers simultaneously. It is known that $$\mathrm {CNMZK}$$ arguments for $$\mathcal {NP}$$ can be constructed in the plain model. Furthermore, it was recently shown that statistical$$\mathrm {CNMZK}$$ arguments for $$\mathcal {NP}$$ can also be constructed in the plain model. However, although the former requires only the existence of one-way functions, the latter requires the DDH assumption. In this paper, we construct a statistical $$\mathrm {CNMZK}$$ argument for $$\mathcal {NP}$$ assuming only the existence of one-way functions. The security is proven via black-box simulation, and the round complexity is $$\mathsf {poly}(n)$$. Under the existence of collision-resistant hash functions, the round complexity is reduced to $$\omega (\log n)$$, which is essentially optimal for black-box concurrent zero-knowledge protocols.

New Insights on the (Non-)Hardness of Circuit Minimization and Related Problems

The Minimum Circuit Size Problem (MCSP) and a related problem (MKTP) that deal with time-bounded Kolmogorov complexity are prominent candidates for NP-intermediate status. We show that, under very modest cryptographic assumptions (such as the existence of one-way functions), the problem of approximating the minimum circuit size (or time-bounded Kolmogorov complexity) within a factor of n 1 − o (1) is indeed NP-intermediate. To the best of our knowledge, these problems are the first natural NP-intermediate problems under the existence of an arbitrary one-way function. Our technique is quite general; we use it also to show that approximating the size of the largest clique in a graph within a factor of n 1 − o (1) is also NP-intermediate unless NP⊆ P/poly. We also prove that MKTP is hard for the complexity class DET under non-uniform NC 0 reductions. This is surprising, since prior work on MCSP and MKTP had highlighted weaknesses of “local” reductions such as ≤ NC 0 m . We exploit this local reduction to obtain several new consequences: — MKTP is not in AC 0 [ p ]. — Circuit size lower bounds are equivalent to hardness of a relativized version MKTP A of MKTP under a class of uniform AC 0 reductions, for a significant class of sets A . — Hardness of MCSP A implies hardness of MCSP A for a significant class of sets A . This is the first result directly relating the complexity of MCSP A and MCSP A , for any A .

Error Correction by Structural Simplicity: Correcting Samplable Additive Errors

Abstract This paper explores the possibilities and limitations of error correction by the structural simplicity of error mechanisms. Specifically, we consider channel models, called samplable additive channels, in which (i) errors are efficiently sampled without the knowledge of the coding scheme or the transmitted codeword; (ii) the entropy of the error distribution is bounded; and (iii) the number of errors introduced by the channel is unbounded. For the channels, several negative and positive results are provided. Assuming the existence of one-way functions, there are samplable additive errors of entropy nε for ε∈(0,1) that are pseudorandom, and thus not correctable by efficient coding schemes. It is shown that there is an oracle algorithm that induces a samplable distribution over {0,1}n of entropy m=ω(logn) that is not pseudorandom, but is uncorrectable by efficient schemes of rate less than 1−m/n−o(1). The results indicate that restricting error mechanisms to be efficiently samplable and not pseudorandom is insufficient for error correction. As positive results, some conditions are provided under which efficient error correction is possible.

Coin Flipping of Any Constant Bias Implies One-Way Functions

We show that the existence of a coin-flipping protocol safe against any nontrivial constant bias (e.g., .499) implies the existence of one-way functions. This improves upon a result of Haitner and Omri (FOCS’11), who proved this implication for protocols with bias √ 2−1/2 − o (1) ≈ .207. Unlike the result of Haitner and Omri, our result also holds for weak coin-flipping protocols.

Round-Efficient Black-Box Construction of Composable Multi-Party Computation

We present a round-efficient black-box construction of a general multi-party computation (MPC) protocol that satisfies composability in the plain model. The security of our protocol is proven in the angel-based UC framework [Prabhakaran and Sahai, STOC’04] under the minimal assumption of the existence of semi-honest oblivious transfer protocols. The round complexity of our protocol is $$\max (\widetilde{O}(\log ^2n), O(R_{{{{\mathsf {O}}}{{\mathsf {T}}}}}))$$ when the round complexity of the underlying oblivious transfer protocol is $$R_{{{{\mathsf {O}}}{{\mathsf {T}}}}}$$ . Since constant-round semi-honest oblivious transfer protocols can be constructed under standard assumptions (such as the existence of enhanced trapdoor permutations), our result gives a $$\widetilde{O}(\log ^2n)$$ -round protocol under these assumptions. Previously, only an $$O(\max (n^{\epsilon }, R_{{{{\mathsf {O}}}{{\mathsf {T}}}}}))$$ -round protocol was shown, where $$\epsilon >0$$ is an arbitrary constant. We obtain our MPC protocol by constructing a $$\widetilde{O}(\log ^2n)$$ -round CCA-secure commitment scheme in a black-box way under the assumption of the existence of one-way functions.

Characterization of Secure Multiparty Computation Without Broadcast

A major challenge in the study of cryptography is characterizing the necessary and sufficient assumptions required to carry out a given cryptographic task. The focus of this work is the necessity of a broadcast channel for securely computing symmetric functionalities (where all the parties receive the same output) when one third of the parties, or more, might be corrupted. Assuming all parties are connected via a peer-to-peer network, but no broadcast channel (nor a secure setup phase) is available, we prove the following characterization: 1) A symmetric $n$-party functionality can be securely computed facing $n/3\le t<n/2$ corruptions (\ie honest majority), if and only if it is \emph{$(n-2t)$-dominated}; a functionality is $k$-dominated, if \emph{any} $k$-size subset of its input variables can be set to \emph{determine} its output. 2) Assuming the existence of one-way functions, a symmetric $n$-party functionality can be securely computed facing $t\ge n/2$ corruptions (\ie no honest majority), if and only if it is $1$-dominated and can be securely computed with broadcast. It follows that, in case a third of the parties might be corrupted, broadcast is necessary for securely computing non-dominated functionalities (in which "small" subsets of the inputs cannot determine the output), including, as interesting special cases, the Boolean XOR and coin-flipping functionalities.

On the Impossibility of Cryptography with Tamperable Randomness

We initiate a study of the security of cryptographic primitives in the presence of efficient tampering attacks to the randomness of honest parties. More precisely, we consider p-tampering attackers that may efficiently tamper with each bit of the honest parties’ random tape with probability p, but have to do so in an “online” fashion. Our main result is a strong negative result: We show that any secure encryption scheme, bit commitment scheme, or zero-knowledge protocol can be “broken” with advantage $$\Omega (p)$$ by a p-tampering attacker. The core of this result is a new algorithm for biasing the output of bounded-value functions, which may be of independent interest. We also show that this result cannot be extended to primitives such as signature schemes and identification protocols: assuming the existence of one-way functions, such primitives can be made resilient to -tampering attacks where n is the security parameter.

Non-Black-Box Simulation from One-Way Functions and Applications to Resettable Security

The simulation paradigm, introduced by Goldwasser, Micali, and Rackoff, is of fundamental importance to modern cryptography. In a breakthrough work from 2001, Barak [FOCS 2001, IEEE Computer Society, Los Alamitos, CA, 2001, pp. 106--115] introduced a novel non-black-box simulation technique. This technique enabled the construction of new cryptographic primitives, such as resettably sound zero-knowledge arguments, that cannot be proven secure using just black-box simulation techniques. The work of Barak and its follow-ups, however, all require stronger cryptographic hardness assumptions than the minimal assumption of one-way functions: the work of Barak requires the existence of collision-resistant hash functions, and a very recent result by Bitansky and Paneth [FOCS 2012, IEEE, Piscataway, NJ, 2012, pp. 223--232] instead requires the existence of an oblivious transfer protocol. In this work, we show how to perform non-black-box simulation assuming just the existence of one-way functions. In particular, we...

Towards efficient private distributed computation on unbounded input streams

Abstract In the problem of private “swarm” computing, n agents wish to securely and distributively perform a computation on common inputs, in such a way that even if the entire memory contents of some of them are exposed, no information is revealed about the state of the computation. Recently, Dolev, Garay, Gilboa and Kolesnikov [Innov. Comput. Sci. (2011), 32–44] considered this problem in the setting of information-theoretic security, showing how to perform such computations on input streams of unbounded length. However, the cost of their solution is exponential in the size of the finite state automaton (FSA) computing the function. In this work we are interested in an efficient (i.e., polynomial time) computation of the above model, at the expense of minimal additional assumptions. Relying on the existence of one-way functions, we show how to process unbounded inputs (polynomial in the security parameter) at a cost linear in m, the number of FSA states. In particular, our algorithms achieve the following: In the case of (n,n)-reconstruction (i.e., in which all n agents participate in the reconstruction of the distributed computation) and at most n - 1 agents are corrupted, the time required to process each input symbol and the time complexity for reconstruction are O ( m n ) $O(mn)$ , while agent storage is O ( m + n ) $O(m+n)$ . In the case of ( n - t , n ) $(n-t,n)$ -reconstruction (where only n - t $n-t$ agents take part in the reconstruction) and at most t agents are corrupted, the agents' storage is O ( n - 1 n - t + m ) $O(\binom{n-1}{n-t}+m)$ , the time required to process each input symbol is O ( m n - 1 n - t ) $O(m\binom{n-1}{n-t})$ and the time complexity of reconstruction is O ( m t ) $O(mt)$ . We achieve the above through a carefully orchestrated use of pseudo-random generators and secret-sharing, and in particular a novel share re-randomization technique which might be of independent interest.

Limits on the Usefulness of Random Oracles

In their seminal work, Impagliazzo and Rudich (STOC'89) showed that no key-agreement protocol exists in the random-oracle model, yielding that key agreement cannot be black-box reduced to one-way functions. In this work, we generalize their result, showing that, to a large extent, no-private-input, semi-honest, two-party functionalities that can be securely implemented in the random oracle model can be securely implemented information theoretically (where parties are assumed to be all powerful, and no oracle is given). Using a recent information-theoretic impossibility result by McGregor et al. (FOCS'10), our result yields that certain functionalities (e.g. inner product) cannot be computed both in an accurately and in a differentially private manner in the random oracle model, implying that protocols for computing these functionalities cannot be black-box reduced to the existence of one-way functions.

Efficiency Improvements in Constructing Pseudorandom Generators from One-Way Functions

We give a new construction of pseudorandom generators from any one-way function. The construction achieves better parameters and is simpler than that given in the seminal work of H\aastad, Impagliazzo, Levin, and Luby [SIAM J. Comput., 28 (1999), pp. 1364--1396]. The key to our construction is a new notion of next-block pseudoentropy, which is inspired by the notion of “inaccessible entropy” recently introduced in [I. Haitner, O. Reingold, S. Vadhan, and H. Wee, Proceedings of the $41$st Annual ACM Symposium on Theory of Computing (STOC), 2009, pp. 611--620]. An additional advantage over previous constructions is that our pseudorandom generators are parallelizable and invoke the one-way function in a nonadaptive manner. Using [B. Applebaum, Y. Ishai, and E. Kushilevitz, SIAM J. Comput., 36 (2006), pp. 845--888], this implies the existence of pseudorandom generators in NC$^0$ based on the existence of one-way functions in NC$^1$.

Secrecy without one-way functions

We show that some problems in information security can be solved without using one-way functions. The latter are usually regarded as a central concept of cryptography, but the very existence of one-way functions depends on difficult conjectures in complexity theory, most notably on the notorious “” conjecture. This is why cryptographic primitives that do not employ one-way functions are often called “unconditionally secure”. In this paper, we suggest protocols for secure computation of the sum, product, and some other functions of two or more elements of an arbitrary constructible ring, without using any one-way functions. A new input that we offer here is that, in contrast with other proposals, we conceal “intermediate results” of a computation. For example, when we compute the sum of k numbers, only the final result is known to the parties; partial sums are not known to anybody. Other applications of our method include voting/rating over insecure channels and a rather elegant and efficient solution of the “two millionaires problem”. Then, while it is fairly obvious that a secure (bit) commitment between two parties is impossible without a one-way function, we show that it is possible if the number of parties is at least 3. We also show how our unconditionally secure (bit) commitment scheme for three parties can be used to arrange an unconditionally secure (bit) commitment between just two parties if they use a “dummy” (e.g., a computer) as the third party. We explain how our concept of a “dummy” is different from the well-known concept of a “trusted third party”. Based on a similar idea, we also offer an unconditionally secure k - n oblivious transfer protocol between two parties who use a “dummy”. We also suggest a protocol, without using a one-way function, for the so-called “mental poker”, i.e., a fair card dealing (and playing) over distance. Finally, we propose a secret sharing scheme where an advantage over Shamir's and other known secret sharing schemes is that nobody, including the dealer, ends up knowing the shares (of the secret) owned by any particular player. It should be mentioned that computational cost of our protocols is negligible to the point that all of them can be executed without a computer.

P versus UP

The existence of one-way functions is a question that has not yet been answered. If we solve the problem P versus UP showing that both classes are different, then it would result in fact there are strong one-way functions and thus P is not equal to NP. In this work we showed that some kinds of unambiguous Turing machines can not be converted into deterministic, because it will imply that some Turing machines which do not halt for some inputs could be decided in polynomial time by certain deterministic Turing machines. But, is impossible that we can decide in polynomial time over a deterministic Turing machine if any deterministic Turing machine does not halt in polynomial time. Therefore by the rule of reduction ad absurdum we have that P and UP are different.