Non-malleable Statistically Hiding Commitment from Any One-Way Function

We show that the existence of one-way functions is necessary and sufficient for the existence of pseudo-random generators in the following sense. Let ƒ be an easily computable function such that when x is chosen randomly: (1) from ƒ(x) it is hard to recover an x1 with ƒ(x1) = ƒ(x) by a small circuit, or; (2) ƒ has small degeneracy and from ƒ(x) it is hard to recover x by a fast algorithm. From one-way functions of type (1) or (2) we show how to construct pseudo-random generators secure against small circuits or fast algorithms, respectively, and vice-versa. Previous results show how to construct pseudo-random generators from one-way functions that have special properties ([Blum, Micali 82], [Yao 82], [Levin 85], [Goldreich, Krawczyk, Luby 88]).We use the results of [Goldreich, Levin 89] in an essential way.

We give a new construction of pseudorandom generators from any one-way function. The construction achieves better parameters and is simpler than that given in the seminal work of H\aastad, Impagliazzo, Levin, and Luby [SIAM J. Comput., 28 (1999), pp. 1364--1396]. The key to our construction is a new notion of next-block pseudoentropy, which is inspired by the notion of “inaccessible entropy” recently introduced in [I. Haitner, O. Reingold, S. Vadhan, and H. Wee, Proceedings of the $41$st Annual ACM Symposium on Theory of Computing (STOC), 2009, pp. 611--620]. An additional advantage over previous constructions is that our pseudorandom generators are parallelizable and invoke the one-way function in a nonadaptive manner. Using [B. Applebaum, Y. Ishai, and E. Kushilevitz, SIAM J. Comput., 36 (2006), pp. 845--888], this implies the existence of pseudorandom generators in NC$^0$ based on the existence of one-way functions in NC$^1$.

One of the central lines of cryptographic research is identifying the weakest assumptions required for the construction of secure primitives. In the context of group signatures the gap between what is known to be necessary (one-way functions) and what is known to be sufficient (trapdoor permutations) is quite large. In this paper, we provide the first step towards closing this gap by showing that the existence of secure group signature schemes implies the existence of secure public-key encryption schemes. Our result shows that the construction of secure group signature schemes based solely on the existence of one-way functions is unlikely. This is in contrast to what is known for standard signature schemes, which can be constructed from any one-way function.

Liu and Pass (FOCS’20) recently demonstrated an equivalence between the existence of one-way functions (OWFs) and mild average-case hardness of the time-bounded Kolmogorov complexity problem. In this work, we establish a similar equivalence but to a different form of time-bounded Kolmogorov Complexity—namely, Levin’s notion of Kolmogorov Complexity—whose hardness is closely related to the problem of whether \(\mathsf{EXP}\ne \mathsf{BPP}\). In more detail, let Kt(x) denote the Levin-Kolmogorov Complexity of the string x; that is, \(Kt(x) = \min _{{\varPi }\in \{0,1\}^*, t \in \mathbb {N}}\{|{\varPi }| + \lceil \log t \rceil : U({\varPi }, 1^t) = x\}\), where U is a universal Turing machine, and \(U({\varPi },1^t)\) denotes the output of the program \(\varPi \) after t steps, and let \(\mathsf{MKtP}\) denote the language of pairs (x, k) having the property that \(Kt(x) \le k\). We demonstrate that: \(\mathsf{MKtP}\notin \mathsf{Heur}_{\mathsf{neg}}\mathsf{BPP}\) (i.e., \(\mathsf{MKtP}\) is infinitely-often two-sided error mildly average-case hard) iff infinitely-often OWFs exist. \(\mathsf{MKtP}\notin \mathsf{Avg}_{\mathsf{neg}}\mathsf{BPP}\) (i.e., \(\mathsf{MKtP}\) is infinitely-often errorless mildly average-case hard) iff \(\mathsf{EXP}\ne \mathsf{BPP}\).

Cai and Selman [CS] defined a modification of Levin's [Le] notion of average polynomial time and proved, for every P-bi-immune language L and every polynomial-time computable distribution μ with infinite support, that L is not recognizable in polynomial time on the μ -average. We call such languages distributionally hard .Pavan and Selman [PS] proved that there exist distributionally hard sets that are not P-bi-immune if and only P contains P-printable-immune sets. We extend this characterizion to include assertions about several traditional questions about immunity, about finding witnesses for NP-machines, and about existence of one-way functions. Similarly, we address the question of whether NP contains sets that are distributionally hard. Several of our results are implications for which we cannot prove whether or not their converse holds. In nearly all such cases we provide oracles relative to which the converse fails. We use the techniques of Kolmogorov complexity to describe our oracles and to simplify the technical arguments.

On hiding information from an oracle

Presents a new commerce protocol that allows customers and merchants to conduct face-to-face credit-card authorizations with a credit card company securely, with the option of anonymity for the customer, the merchant, or both. Our protocol guarantees that both parties agree to and know the outcome of each transaction. Our protocol has three advantages over others. First, we need only two message authentication code (MAC) operations per party per transaction, fewer than most popular protocols. Second, our own MAC function, OTPMAC (One-Time Pad MAC), does not rely on the existence of one-way functions or on any other unproven hypothesis. Third, our protocol generates a new one-time identifier per party per transaction, preventing the linkage of multiple transactions to a single party. Additionally, the protocol can operate in modes using alternatives to the one-time pad, including cryptographic pseudo-random number generators and conventional cryptographic MAC functions.

Garbled RAM, introduced by Lu and Ostrovsky, enables the task of garbling a RAM (Random Access Machine) program directly, there by avoiding the inefficient process of first converting it into a circuit. Garbled RAM can be seen as a RAM analogue of Yao's garbled circuit construction, except that known realizations of Garbled RAM make non-black-box use of the underlying cryptographic primitives. In this paper we remove this limitation and provide the first black-box construction of Garbled RAM with polylogarithmic overhead. Our scheme allows for garbling multiple RAM programs being executed on a persistent database and its security is based only on the existence of one-way functions. We also obtain the first secure RAM computation protocol that is both constant round and makes only black-box use of one-way functions in the Oblivious Transfer hybrid model.

A central problem in cryptography is to establish the existence of one-way function. We introduce a new class of one-way functions based on the arithmetic theory of zeta functions and recent research on quantum algorithms on zeta function computation.

We present the first natural NP-complete problem whose average-case hardness w.r.t. the uniform distribution over instances is equivalent to the existence of one-way functions (OWFs). The problem, which originated in the 1960s, is the Conditional Time-Bounded Kolmogorov Complexity Problem: let K^t(x∣z) be the length of the shortest "program" that, given the "auxiliary input" z, outputs the string x within time t(|x|), and let McK^tP[ζ] be the set of strings (x,z,k) where |z| = ζ(|x|), |k| = log |x| and K^t(x∣z) < k, where, for our purposes, a "program" is defined as a RAM machine. Our main result shows that for every polynomial t(n) ≥ n², there exists some polynomial ζ such that McK^tP[ζ] is NP-complete. We additionally extend the result of Liu-Pass (FOCS'20) to show that for every polynomial t(n) ≥ 1.1n, and every polynomial ζ(⋅), mild average-case hardness of McK^tP[ζ] is equivalent to the existence of OWFs. Taken together, these results provide the following crisp characterization of what is required to base OWFs on NP ⊈ BPP: There exists concrete polynomials t,ζ such that "Basing OWFs on NP ⊈ BPP" is equivalent to providing a "worst-case to (mild) average-case reduction for McK^tP[ζ]". In other words, the "holy-grail" of Cryptography (i.e., basing OWFs on NP ⊈ BPP) is equivalent to a basic question in algorithmic information theory. As an independent contribution, we show that our NP-completeness result can be used to shed new light on the feasibility of the polynomial-time bounded symmetry of information assertion (Kolmogorov'68).

By obfuscation we mean any efficient semantic-preserving transformation of computer programs aimed at bringing a program into such a form, which impedes the understanding of its algorithm and data structures or prevents the extracting of some valuable information from the plaintext of a program. The main difficulty in designing an effective program obfuscator is to guarantee security, i.e. to prove that no algorithm can break software protection in reasonable time. All obfuscation techniques and tools developed so far rely on the informal concept of security and therefore can’t be regarded as provably secure. In this paper we (1) introduce for the first time a formal information-theoretic definition of obfuscation security, (2) present a new obfuscation technique which takes advantage of cryptographic primitives (one-way functions, hard-core predicates), and (3) demonstrate, taking a conventional password identification scheme as a case study, how to prove security of the obfuscating transformations.

Evidence is given for the difficulty of an eventual proof of computational security for cryptosystems based on one-way functions, such as the one proposed by Diffie and Hellman. A proof of NP-completeness for the cryptanalytic effort would imply NP=CoNP.

In this paper, we first demonstrate a gap between the security of verifiably committed signatures in the two-party setting and the security of verifiably committed signatures in the multi-party setting. We then extend the state-of-the-art security model of verifiably committed signatures in the two-party setting to that of multiparty setting. Since there exists trivial setup-driven solutions to multiparty verifiably committed signatures (e.g., two-signature based solutions, we propose solutions to the multi-party stand-alone verifiably committed signatures in the setup-free model, and show that our implementation is provably secure under the joint assumption that the underlying Zhu's signature scheme is secure against adaptive chosen-message attack, Fujisaki-Okamoto's commitment scheme is statistically hiding and computationally binding and Paillier's encryption is semantically secure and one-way as well as the existence of collision-free one-way hash functions.

Public key cryptosystems are constructed by embedding a trapdoor into a one‐way function. So, the one‐wayness and the trapdoorness are vital to public key cryptography. In this paper, we propose a novel public key cryptographic primitive called preimage selective trapdoor function. This scenario allows to use exponentially many preimage to hide a plaintext even if the underlying function is not one‐way. The compact knapsack problem is used to construct a probabilistic public key cryptosystem, the underlying encryption function of which is proven to be preimage selective trapdoor one‐way functions under some linearization attack models. The constructive method can guarantee the noninjectivity of the underlying encryption function and the unique decipherability for ciphertexts simultaneously. It is heuristically argued that the security of the proposal cannot be compromised by a polynomial‐time adversary even if the compact knapsack is easy to solve. We failed to provide any provable security results about the proposal; however, heuristic illustrations show that the proposal is secure against some known attacks including brute force attacks, linearization attacks, and key‐recovery attacks. The proposal turns out to have acceptable key sizes and performs efficiently and hence is practical.

There is a close relationship between encryption and randomness. The security of encryption algorithms usually depends on the random choice of keys and bit sequences. A famous example is Shannon’s result. Ciphers with perfect secrecy require randomly chosen key strings, which are of the same length as the encrypted message. In Chapter 9, we will study the classical Shannon approach to provable security, together with more recent notions of security. One main problem is that truly random bit sequences of sufficient length are not available in most practical situations. Therefore, one works with pseudorandom bit sequences. They appear to be random, but actually they are generated by an algorithm. Such algorithms are called pseudorandom bit generators. They output, given a short random input value (called the seed), a long pseudorandom bit sequence. Classical techniques for the generation of pseudorandom bits or numbers (see [Knuth98]) yield well-distributed sequences. Therefore, they are well-suited for Monte Carlo simulations. However, they are often cryptographically insecure. For example, in linear congruential pseudorandom number generators or linear feedback shift registers (see, e.g., [MenOorVan96]), the secret parameters and hence the complete pseudorandom sequence can be efficiently computed from a small number of outputs.