Kolmogorov One-Way Functions Revisited

We continue the study of the efficiency of black-box reductions in cryptography. We focus on the question of constructing strong one-way functions (respectively, permutations) from weak one-way functions (respectively, permutations). To make our impossibility results stronger, we focus on the weakest type of constructions: those that start from a weak one-way permutation and define a strong one-way function. We show that for every “fully black-box” construction of a e(n)-secure function based on a (1–δ(n))-secure permutation, if q(n) is the number of oracle queries used in the construction and l(n) is the input length of the new function, then we have $q \geq {\it \Omega}(\frac {1}{\delta}\cdot {\rm log}\frac {1}{\epsilon})$ and l ≥ n + ${\it \Omega}$(log 1/e) – O(log q). This result is proved by showing that fully black-box reductions of strong to weak one-way functions imply the existence of “hitters” and then by applying known lower bounds for hitters. We also show a sort of reverse connection, and we revisit the construction of Goldreich et al. (FOCS 1990) in terms of this reverse connection. Finally, we prove that any “weakly black-box” construction with parameters q(n) and l(n) better than the above lower bounds implies the unconditional existence of strong one-way functions (and, therefore, the existence of a weakly black-box construction with q(n)=0). This result, like the one for fully black-box reductions, is proved by reasoning about the function defined by such a construction when using the identity permutation as an oracle.

The authors introduce encryption-free message authentication based entirely on the use of one-way hash functions. It is shown that fast one-way hash functions such as MD4 can be used as a foundation for some relatively novel implementations of security services. In particular, simple and inexpensive secret prefix and secret suffix methods provide protection against message substitution attacks when used in conjunction with a strong one-way hash function (which itself protects against message modification).< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

A user-chosen password is not appropriate for a shared secret by which an authenticated key exchange protocol is operated. This is because users choose their passwords so that they can be easily memorised and can be typed using an alphabetic keyboard or a numeric keypad. Therefore, the password becomes a weak secret which is vulnerable to guessing attacks. However, users prefer to utilise the short easily memorised passwords. Several protocols, which are resistant to guessing attacks, have been developed to overcome this problem. However, they are inefficient in terms of the computation and communication costs. As a more practical solution, the authors propose new authenticated key exchange protocols by reducing the number of random numbers, cipher operations, and protocol steps. To achieve this goal, they deliberately use a one-time pad and a strong one-way hash function in their protocols.

We consider two of the most fundamental theorems in cryptography. The first, due to Håstad et al. [SIAM J. Comput., 28 (1999), pp. 1364–1396] is that pseudorandom generators can be constructed from any one-way function. The second, due to Yao [Proceedings of the $23$rd Annual Symposium on Foundations of Computer Science (FOCS), 1982, pp. 80–91], states that the existence of weak one-way functions implies the existence of full-fledged one-way functions. These powerful plausibility results shape our understanding of hardness and randomness in cryptography, but unfortunately their proofs are not as tight (i.e., security preserving) as one may desire. This work revisits a technique that we call the randomized iterate, introduced by Goldreich, Krawczyk, and Luby [SIAM J. Comput., 22 (1993), pp. 1163–1175]. This technique was used by Goldreich, Krawczyk, and Luby [SIAM J. Comput., 22 (1993), pp. 1163–1175] to give a construction of pseudorandom generators from regular one-way functions. We simplify and strengthen this technique in order to obtain a similar construction, where the seed length of the resulting generators is as short as $\Theta(n \log n)$ (rather than $\Theta(n^3)$ achieved by Goldreich, Krawczyk, and Luby [SIAM J. Comput., 22 (1993), pp. 1163–1175]). Our technique has the potential of implying seed length $\Theta(n)$, and the only bottleneck for such a result are the parameters of current generators against bounded-space computations. We give a construction with similar parameters for security amplification of regular one-way functions. This improves upon the construction of Goldreich et al. [Proceedings of the $31$st Annual Symposium on Foundations of Computer Science, (FOCS), 1990, pp. 318–326] in that the construction does not need to “know" the regularity parameter of the functions (in terms of security, the two reductions are incomparable). In addition, we use the randomized iterate to show a construction of a pseudorandom generator based on an exponentially hard one-way function that has a seed length of only $\Theta(n^2)$. This improves a recent result of Holenstein [Proceedings of the Theory of Cryptography, Third Theory of Cryptography Conference (TCC), 2006] that shows a construction with seed length $\Theta(n^5)$ based on such one-way functions. Finally, we show that the randomized iterate may even be useful in the general context of Håstad et al. [SIAM J. Comput., 28 (1999), pp. 1364–1396]. In particular, we use the randomized iterate to replace the basic building block of the Håstad et al. [SIAM J. Comput., 28 (1999), pp. 1364–1396] construction. Interestingly, this modification improves efficiency by an $\Theta(n^2)$ factor and reduces the seed length to $\Theta(n^7)$ (which also implies improvement in the security of the construction).

Patterns of everyday functioning in preschool children born preterm and at term

The planted clique conjecture states that no polynomial-time algorithm can find a hidden clique of size k ≪ √n in an n-vertex Erdős–Rényi random graph with a k-clique planted. In this paper, we prove the equivalence among many (in fact, most) variants of planted clique conjectures, such as search versions with a success probability exponentially close to 1 and with a non-negligible success probability, a worst-case version (the k-clique problem on incompressible graphs), decision versions with small and large success probabilities, and decision versions with adversarially chosen k and binomially distributed k. In particular, we establish the equivalence between the planted clique problem introduced by Jerrum and Kučera and its decision version suggested by Saks in the 1990s. Moreover, the equivalence among decision versions identifies the optimality of a simple edge counting algorithm: By counting the number of edges, one can efficiently distinguish an n-vertex random graph from a random graph with a k-clique planted with probability Θ(k2/n) for any k ≤ √n. We show that for any k, no polynomial-time algorithm can distinguish these two random graphs with probability ≫ k2 / n if and only if the planted clique conjecture holds. The equivalence among search versions identifies the first one-way function that admits a polynomial-time security-preserving self-reduction from exponentially weak to strong one-way functions. These results reveal a detection-recovery gap in success probabilities for the planted clique problem. We also present another equivalence between the existence of a refutation algorithm for the planted clique problem and an average-case polynomial-time algorithm for the k-clique problem with respect to the Erdős–Rényi random graph.

The classical Matrosov theorem concludes uniform asymptotic stability of time-varying systems via a weak Lyapunov function (positive definite, decrescent, with negative semi-definite derivative along solutions) and another auxiliary function with derivative that is strictly nonzero where the derivative of the Lyapunov function is zero (Mastrosov in J Appl Math Mech 26:1337–1353, 1962). Recently, several generalizations of the classical Matrosov theorem have been reported in Loria et al. (IEEE Trans Autom Control 50:183–198, 2005). None of these results provides a construction of a strong Lyapunov function (positive definite, decrescent, with negative definite derivative along solutions) which is a very useful analysis and controller design tool for nonlinear systems. Inspired by generalized Matrosov conditions in Loria et al. (IEEE Trans Autom Control 50:183–198, 2005), we provide a construction of a strong Lyapunov function via an appropriate weak Lyapunov function and a set of Lyapunov-like functions whose derivatives along solutions of the system satisfy inequalities that have a particular triangular structure. Our results will be very useful in a range of situations where strong Lyapunov functions are needed, such as robustness analysis and Lyapunov function-based controller redesign. We illustrate our results by constructing a strong Lyapunov function for a simple Euler-Lagrange system controlled by an adaptive controller and use this result to determine an ISS controller.

We present the first natural NP-complete problem whose average-case hardness w.r.t. the uniform distribution over instances is equivalent to the existence of one-way functions (OWFs). The problem, which originated in the 1960s, is the Conditional Time-Bounded Kolmogorov Complexity Problem: let K^t(x∣z) be the length of the shortest "program" that, given the "auxiliary input" z, outputs the string x within time t(|x|), and let McK^tP[ζ] be the set of strings (x,z,k) where |z| = ζ(|x|), |k| = log |x| and K^t(x∣z) < k, where, for our purposes, a "program" is defined as a RAM machine. Our main result shows that for every polynomial t(n) ≥ n², there exists some polynomial ζ such that McK^tP[ζ] is NP-complete. We additionally extend the result of Liu-Pass (FOCS'20) to show that for every polynomial t(n) ≥ 1.1n, and every polynomial ζ(⋅), mild average-case hardness of McK^tP[ζ] is equivalent to the existence of OWFs. Taken together, these results provide the following crisp characterization of what is required to base OWFs on NP ⊈ BPP: There exists concrete polynomials t,ζ such that "Basing OWFs on NP ⊈ BPP" is equivalent to providing a "worst-case to (mild) average-case reduction for McK^tP[ζ]". In other words, the "holy-grail" of Cryptography (i.e., basing OWFs on NP ⊈ BPP) is equivalent to a basic question in algorithmic information theory. As an independent contribution, we show that our NP-completeness result can be used to shed new light on the feasibility of the polynomial-time bounded symmetry of information assertion (Kolmogorov'68).

Liu and Pass (FOCS’20) recently demonstrated an equivalence between the existence of one-way functions (OWFs) and mild average-case hardness of the time-bounded Kolmogorov complexity problem. In this work, we establish a similar equivalence but to a different form of time-bounded Kolmogorov Complexity—namely, Levin’s notion of Kolmogorov Complexity—whose hardness is closely related to the problem of whether \(\mathsf{EXP}\ne \mathsf{BPP}\). In more detail, let Kt(x) denote the Levin-Kolmogorov Complexity of the string x; that is, \(Kt(x) = \min _{{\varPi }\in \{0,1\}^*, t \in \mathbb {N}}\{|{\varPi }| + \lceil \log t \rceil : U({\varPi }, 1^t) = x\}\), where U is a universal Turing machine, and \(U({\varPi },1^t)\) denotes the output of the program \(\varPi \) after t steps, and let \(\mathsf{MKtP}\) denote the language of pairs (x, k) having the property that \(Kt(x) \le k\). We demonstrate that: \(\mathsf{MKtP}\notin \mathsf{Heur}_{\mathsf{neg}}\mathsf{BPP}\) (i.e., \(\mathsf{MKtP}\) is infinitely-often two-sided error mildly average-case hard) iff infinitely-often OWFs exist. \(\mathsf{MKtP}\notin \mathsf{Avg}_{\mathsf{neg}}\mathsf{BPP}\) (i.e., \(\mathsf{MKtP}\) is infinitely-often errorless mildly average-case hard) iff \(\mathsf{EXP}\ne \mathsf{BPP}\).

Symmetry of information (in Kolmogorov complexity) is a concept that comes out of formalizing the idea of how much information about a string y is contained in a string x. The situation is symmetric because it can be shown that the amount of information contained in the string y about the string x is almost exactly the same as that contained in x about y.

The humidity effect, namely the markedly positive correlation between the stable isotopic ratio in precipitation and the dew-point deficit ΔTd in the atmosphere, is put forward firstly and the relationships between the δ18O in precipitation and ΔTd are analyzed for the Urumqi and Kunming stations, which have completely different climatic characteristics. Although the seasonal variations in δ18O and ΔTd exhibit differences between the two stations, their humidity effect is notable. The correlation coefficient and its confidence level of the humidity effect are higher than those of the amount effect at Kunming, showing the marked influence of the humidity conditions in the atmosphere on stable isotopes in precipitation. Using a kinetic model for stable isotopic fractionation, and according to the seasonal distribution of mean monthly temperature at 500 hPa at Kunming, the variations of the δ18O in condensate in cloud are simulated. A very good agreement between the seasonal variations of the simulated mean δ18O and the mean monthly temperature at 500 hPa is obtained, showing that the oxygen stable isotope in condensate of cloud experiences a temperature effect. Such a result is markedly different from the amount effect at the ground. Based on the simulations of seasonal variations of δ18O in falling raindrops, it can be found that, in the dry season from November to April, the increasing trend with falling distance of δ18O in falling raindrops corresponds remarkably to the great ΔTd, showing a strong evaporation enrichment function in falling raindrops; however, in the wet season from May to October, the δ18O in falling raindrops displays an unapparent increase corresponding to the small ΔTd, except in May. By comparing the simulated mean δ18O at the ground with the actual monthly δ18O in precipitation, we see distinctly that the two monthly δ18O variations agree very well. On average, the δ18O values are relatively lower because of the highly moist air, heavy rainfall, small ΔTd and weak evaporation enrichment function of stable isotopes in the falling raindrops, under the influence of vapor from the oceans; but they are relatively higher because of the dry air, light rainfall, great ΔTd and strong evaporation enrichment function in falling raindrops, under the control of the continental air mass. Therefore, the δ18O in precipitation at Kunming can be used to indicate the humidity situation in the atmosphere to a certain degree, and thus indicate the intensity of the precipitation and the strength of the monsoon indirectly. The humidity effect changes not only the magnitude of the stable isotopic ratio in precipitation but also its seasonal distribution due to its influence on the strength of the evaporation enrichment of stable isotopes in falling raindrops and the direction of the net mass transfer of stable isotopes between the atmosphere and the raindrops. Consequently, it is inferred that the humidity effect is probably one of the foremost causes generating the amount effect.

We present a new class of distributed key generation and recovery algorithms suitable for group communication systems where the group membership is either static or slowly time-varying, and must be tightly controlled. The proposed key generation approach allows entities which may have only partial trust in each other to jointly generate a shared key without the aid of an external third party. The shared key is generated using a strong one-way function of the group parameter. This scheme also has perfect forward secrecy. The validity of key generation can be checked using verifiable secret sharing techniques. The key retrieval method does not require the keys to be stored in an external retrieval center. We note that many internet-based applications may have these requirements. Fulfillment of these requirements is realized through the use of fractional keys-a distributed technique developed to enhance the security of distributed systems in a non-cryptographic manner.

In this paper, by virtue of a nonlinear scalarization function, two nonlinear weak separation functions, a nonlinear regular weak separation function, and a nonlinear strong separation function are first introduced, respectively. Then, by the image space analysis, a global saddle-point condition for a nonlinear function is investigated. It is shown that the existence of a saddle point is equivalent to a nonlinear separation of two suitable subsets of the image space. Finally, some necessary and sufficient optimality conditions are obtained for constrained extremum problems.

In this paper, the extended layerwise method (XLWM), which was developed for laminated composite beams with multiple delaminations and transverse cracks (Li et al. in Int J Numer Methods Eng 101:407---434, 2015), is extended to laminated composite plates. The strong and weak discontinuous functions along the thickness direction are adopted to simulate multiple delaminations and interlaminar interfaces, respectively, whilst transverse cracks are modeled by the extended finite element method (XFEM). The interaction integral method and maximum circumferential tensile criterion are used to calculate the stress intensity factor (SIF) and crack growth angle, respectively. The XLWM for laminated composite plates can accurately predicts the displacement and stress fields near the crack tips and delamination fronts. The thickness distribution of SIF and thus the crack growth angles in different layers can be obtained. These information cannot be predicted by using other existing shell elements enriched by XFEM. Several numerical examples are studied to demonstrate the capabilities of the XLWM in static response analyses, SIF calculations and crack growth predictions.

Design of novel catalysts for synthesis of 1,5-benzodiazepines from 1,2-phenylenediamine and ketones: NH2-MIL-101(Al) as integrated structural scaffold for catalytic materials based on calix[4]arenes