Distributionally Hard Languages

When we represent a decision problem, like CIRCUIT-SAT, as a language over the binary alphabet, we usually do not specify how to encode instances by binary strings. This relies on the empirical observation that the truth of a statement of the form “CIRCUIT-SAT belongs to a complexity class C” does not depend on the encoding, provided both the encoding and the class C are “natural”. In this sense most of the Complexity theory is “encoding invariant”. The notion of a polynomial time computable distribution from Average Case Complexity is one of the exceptions from this rule. It might happen that a distribution over some objects, like circuits, is polynomial time computable in one encoding and is not polynomial time computable in the other encoding. In this paper we suggest an encoding invariant generalization of a notion of a polynomial time computable distribution. The completeness proofs of known distributional problems, like Bounded Halting, are simpler for the new class than for polynomial time computable distributions. This paper has no new technical contributions. All the statements are proved using the known techniques.

Liu and Pass (FOCS’20) recently demonstrated an equivalence between the existence of one-way functions (OWFs) and mild average-case hardness of the time-bounded Kolmogorov complexity problem. In this work, we establish a similar equivalence but to a different form of time-bounded Kolmogorov Complexity—namely, Levin’s notion of Kolmogorov Complexity—whose hardness is closely related to the problem of whether \(\mathsf{EXP}\ne \mathsf{BPP}\). In more detail, let Kt(x) denote the Levin-Kolmogorov Complexity of the string x; that is, \(Kt(x) = \min _{{\varPi }\in \{0,1\}^*, t \in \mathbb {N}}\{|{\varPi }| + \lceil \log t \rceil : U({\varPi }, 1^t) = x\}\), where U is a universal Turing machine, and \(U({\varPi },1^t)\) denotes the output of the program \(\varPi \) after t steps, and let \(\mathsf{MKtP}\) denote the language of pairs (x, k) having the property that \(Kt(x) \le k\). We demonstrate that: \(\mathsf{MKtP}\notin \mathsf{Heur}_{\mathsf{neg}}\mathsf{BPP}\) (i.e., \(\mathsf{MKtP}\) is infinitely-often two-sided error mildly average-case hard) iff infinitely-often OWFs exist. \(\mathsf{MKtP}\notin \mathsf{Avg}_{\mathsf{neg}}\mathsf{BPP}\) (i.e., \(\mathsf{MKtP}\) is infinitely-often errorless mildly average-case hard) iff \(\mathsf{EXP}\ne \mathsf{BPP}\).

We show that the existence of one-way functions is necessary and sufficient for the existence of pseudo-random generators in the following sense. Let ƒ be an easily computable function such that when x is chosen randomly: (1) from ƒ(x) it is hard to recover an x1 with ƒ(x1) = ƒ(x) by a small circuit, or; (2) ƒ has small degeneracy and from ƒ(x) it is hard to recover x by a fast algorithm. From one-way functions of type (1) or (2) we show how to construct pseudo-random generators secure against small circuits or fast algorithms, respectively, and vice-versa. Previous results show how to construct pseudo-random generators from one-way functions that have special properties ([Blum, Micali 82], [Yao 82], [Levin 85], [Goldreich, Krawczyk, Luby 88]).We use the results of [Goldreich, Levin 89] in an essential way.

We give a new construction of pseudorandom generators from any one-way function. The construction achieves better parameters and is simpler than that given in the seminal work of H\aastad, Impagliazzo, Levin, and Luby [SIAM J. Comput., 28 (1999), pp. 1364--1396]. The key to our construction is a new notion of next-block pseudoentropy, which is inspired by the notion of “inaccessible entropy” recently introduced in [I. Haitner, O. Reingold, S. Vadhan, and H. Wee, Proceedings of the $41$st Annual ACM Symposium on Theory of Computing (STOC), 2009, pp. 611--620]. An additional advantage over previous constructions is that our pseudorandom generators are parallelizable and invoke the one-way function in a nonadaptive manner. Using [B. Applebaum, Y. Ishai, and E. Kushilevitz, SIAM J. Comput., 36 (2006), pp. 845--888], this implies the existence of pseudorandom generators in NC$^0$ based on the existence of one-way functions in NC$^1$.

One of the central lines of cryptographic research is identifying the weakest assumptions required for the construction of secure primitives. In the context of group signatures the gap between what is known to be necessary (one-way functions) and what is known to be sufficient (trapdoor permutations) is quite large. In this paper, we provide the first step towards closing this gap by showing that the existence of secure group signature schemes implies the existence of secure public-key encryption schemes. Our result shows that the construction of secure group signature schemes based solely on the existence of one-way functions is unlikely. This is in contrast to what is known for standard signature schemes, which can be constructed from any one-way function.

Cai and Selman [CS] proposed the following definition for measuring average computation time: A time function t is T on average over a distribution μ if, for all $ n \geq 1 $ , $ \sum_{|x|\geq n}T^{-1}(t(x))|x|^{-1}\mu (x) \leq W_n $ , where $ W_n = \mu (\{ x : |x| \geq n\} ) $ . This definition results in a modification of Levin's notion of average time [L]. The effect of the modification is to control the rate of convergence of the expressions that define average computation time. With this modification, they proved a hierarchy theorem for average-time complexity that is as tight as the Hartmanis—Stearns [HS] hierarchy theorem for worst-case deterministic time. They also proved that under a fairly reasonable condition on distributions, called condition W, a distributional problem is solvable in average polynomial time under the modification exactly when it is solvable in average polynomial time under Levin's definition. Various notions of reductions, as defined by Levin [L] and others, play a central role in the study of average-case complexity. However, the class of distributional problems that are solvable in average polynomial time under the modification is not closed under the standard reductions. In particular, we prove that there is a distributional problem that is not solvable in average polynomial time under the modification but is reducible, by the identity function, to a distributional problem that is, and whose distribution even satisfies condition W.

We give a construction of non-malleable statistically hiding commitments based on the existence of one-way functions. Our construction employs statistically hiding commitment schemes recently proposed by Haitner and Reingold [1], and special-sound WI proofs. Our proof of security relies on the message scheduling technique introduced by Dolev, Dwork and Naor [2], and requires only the use of black-box techniques.

On hiding information from an oracle

Presents a new commerce protocol that allows customers and merchants to conduct face-to-face credit-card authorizations with a credit card company securely, with the option of anonymity for the customer, the merchant, or both. Our protocol guarantees that both parties agree to and know the outcome of each transaction. Our protocol has three advantages over others. First, we need only two message authentication code (MAC) operations per party per transaction, fewer than most popular protocols. Second, our own MAC function, OTPMAC (One-Time Pad MAC), does not rely on the existence of one-way functions or on any other unproven hypothesis. Third, our protocol generates a new one-time identifier per party per transaction, preventing the linkage of multiple transactions to a single party. Additionally, the protocol can operate in modes using alternatives to the one-time pad, including cryptographic pseudo-random number generators and conventional cryptographic MAC functions.

Garbled RAM, introduced by Lu and Ostrovsky, enables the task of garbling a RAM (Random Access Machine) program directly, there by avoiding the inefficient process of first converting it into a circuit. Garbled RAM can be seen as a RAM analogue of Yao's garbled circuit construction, except that known realizations of Garbled RAM make non-black-box use of the underlying cryptographic primitives. In this paper we remove this limitation and provide the first black-box construction of Garbled RAM with polylogarithmic overhead. Our scheme allows for garbling multiple RAM programs being executed on a persistent database and its security is based only on the existence of one-way functions. We also obtain the first secure RAM computation protocol that is both constant round and makes only black-box use of one-way functions in the Oblivious Transfer hybrid model.

A central problem in cryptography is to establish the existence of one-way function. We introduce a new class of one-way functions based on the arithmetic theory of zeta functions and recent research on quantum algorithms on zeta function computation.

Average polynomial time complexity of some NP-complete problems

Consider the problem of sampling signals which are not bandlimited, but still have a finite number of degrees of freedom per unit of time, such as, for example, nonuniform splines or piecewise polynomials, and call the number of degrees of freedom per unit of time the rate of innovation. Classical sampling theory does not enable a perfect reconstruction of such signals since they are not bandlimited. Recently, it was shown that, by using an adequate sampling kernel and a sampling rate greater or equal to the rate of innovation, it is possible to reconstruct such signals uniquely . These sampling schemes, however, use kernels with infinite support, and this leads to complex and potentially unstable reconstruction algorithms. In this paper, we show that many signals with a finite rate of innovation can be sampled and perfectly reconstructed using physically realizable kernels of compact support and a local reconstruction algorithm. The class of kernels that we can use is very rich and includes functions satisfying Strang-Fix conditions, exponential splines and functions with rational Fourier transform. This last class of kernels is quite general and includes, for instance, any linear electric circuit. We, thus, show with an example how to estimate a signal of finite rate of innovation at the output of an RC circuit. The case of noisy measurements is also analyzed, and we present a novel algorithm that reduces the effect of noise by oversampling

In this paper we develop new algorithms for factoring polynomials over finite fields by exploring an interesting connection between the algebraic factoring problem and the combinatorial problem of stable coloring of tournaments. We present an algorithm which can be viewed as a recursive refinement scheme through which most cases of polynomials are completely factored in deterministic polynomial time within the first level of refinement, most of the remaining cases are factored completely before the end of the second level refinement, and so on. The algorithm has average polynomial time complexity and (n \(^{\rm log{\it n}}\) logp)O(1) worst case complexity. Under a purely combinatorial conjecture concerning tournaments, the algorithm has worst case complexity (n \(^{\rm loglog{\it n}}\) logp)O(1). Our approach is also useful in reducing the amount of randomness needed to factor a polynomial completely in expected polynomial time. We present a random polynomial time algorithm for factoring polynomials over finite fields which requires only log p random bits. All these results assume the Extended Riemann Hypothesis.KeywordsPolynomial TimeZero DivisorStable ColoringPrimitive IdempotentFactoring PolynomialThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

In 1998, at the request of the International Mathematical Union, Steve Smale published a list of mathematical problems for the twenty-first century. The 17th problem in the list reads as follows: Can a zero of n complex polynomial equations in n unknowns be found approximately, on the average, in polynomial time with a uniform algorithm? Using the framework developed in the previous chapters, it is easy to give precise meaning to the terms “approximately”, “average”, and “uniform algorithm”. However, as of today, there is no conclusive answer to this problem. But a number of partial results towards such an answer have been obtained in recent years. We devote this and the next chapter to the exposition of these results. The core of this is an algorithm, proposed by Carlos Beltran and Luis Miguel Pardo, that finds an approximate zero in average polynomial time but makes random choices (flips coins, so to speak) during the computation. This adaptive homotopy algorithm with random start system leads to a probabilistic solution of Smale’s 17th problem.