One way functions and pseudorandom generators

In their seminal paper [HILL99], Håstad, Impagliazzo, Levin and Luby show that a pseudorandom generator can be constructed from any one-way function. This plausibility result is one of the most fundamental theorems in cryptography and helps shape our understanding of hardness and randomness in the field. Unfortunately, the reduction of [HILL99] is not nearly as efficient nor as security preserving as one may desire. The main reason for the security deterioration is the blowup to the size of the input. In particular, given one-way functions on n bits one obtains by [HILL99] pseudorandom generators with seed length \(\cal{O}\)(n 8). Alternative constructions that are far more efficient exist when assuming the one-way function is of a certain restricted structure (e.g. a permutations or a regular function). Recently, Holenstein [Hol06] addressed a different type of restriction. It is demonstrated in [Hol06] that the blowup in the construction may be reduced when considering one-way functions that have exponential hardness. This result generalizes the original construction of [HILL99] and obtains a generator from any exponentially hard one-way function with a blowup of \(\cal{O}\)(n 5), and even \(\cal{O}\)(n 4 log2 n) if the security of the resulting pseudorandom generator is allowed to have weaker (yet super-polynomial) security.In this work we show a construction of a pseudorandom generator from any exponentially hard one-way function with a blowup of only \(\cal{O}\)(n 2) and respectively, only \(\cal{O}\)(n log2 n) if the security of the resulting pseudorandom generator is allowed to have only super-polynomial security. Our technique does not take the path of the original [HILL99] methodology, but rather follows by using the tools recently presented in [HHR05] (for the setting of regular one-way functions) and further developing them.KeywordsHash FunctionSeed LengthPseudorandom GeneratorPseudorandom FunctionInput LengthThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Article Free AccessOne-way functions are necessary and sufficient for secure signatures Author: J. Rompel Laboratory for Computer Science, Massachusetts Institute of Technology, Cambridge, MA Laboratory for Computer Science, Massachusetts Institute of Technology, Cambridge, MAView Profile Authors Info & Claims STOC '90: Proceedings of the twenty-second annual ACM symposium on Theory of ComputingApril 1990 Pages 387–394https://doi.org/10.1145/100216.100269Published:01 April 1990Publication History 433citation1,331DownloadsMetricsTotal Citations433Total Downloads1,331Last 12 Months122Last 6 weeks33 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

We show that the existence of one-way functions is necessary and sufficient for the existence of pseudo-random generators in the following sense. Let ƒ be an easily computable function such that when x is chosen randomly: (1) from ƒ(x) it is hard to recover an x1 with ƒ(x1) = ƒ(x) by a small circuit, or; (2) ƒ has small degeneracy and from ƒ(x) it is hard to recover x by a fast algorithm. From one-way functions of type (1) or (2) we show how to construct pseudo-random generators secure against small circuits or fast algorithms, respectively, and vice-versa. Previous results show how to construct pseudo-random generators from one-way functions that have special properties ([Blum, Micali 82], [Yao 82], [Levin 85], [Goldreich, Krawczyk, Luby 88]).We use the results of [Goldreich, Levin 89] in an essential way.

We give a new construction of pseudorandom generators from any one-way function. The construction achieves better parameters and is simpler than that given in the seminal work of H\aastad, Impagliazzo, Levin, and Luby [SIAM J. Comput., 28 (1999), pp. 1364--1396]. The key to our construction is a new notion of next-block pseudoentropy, which is inspired by the notion of “inaccessible entropy” recently introduced in [I. Haitner, O. Reingold, S. Vadhan, and H. Wee, Proceedings of the $41$st Annual ACM Symposium on Theory of Computing (STOC), 2009, pp. 611--620]. An additional advantage over previous constructions is that our pseudorandom generators are parallelizable and invoke the one-way function in a nonadaptive manner. Using [B. Applebaum, Y. Ishai, and E. Kushilevitz, SIAM J. Comput., 36 (2006), pp. 845--888], this implies the existence of pseudorandom generators in NC$^0$ based on the existence of one-way functions in NC$^1$.

We consider two of the most fundamental theorems in cryptography. The first, due to Håstad et al. [SIAM J. Comput., 28 (1999), pp. 1364–1396] is that pseudorandom generators can be constructed from any one-way function. The second, due to Yao [Proceedings of the $23$rd Annual Symposium on Foundations of Computer Science (FOCS), 1982, pp. 80–91], states that the existence of weak one-way functions implies the existence of full-fledged one-way functions. These powerful plausibility results shape our understanding of hardness and randomness in cryptography, but unfortunately their proofs are not as tight (i.e., security preserving) as one may desire. This work revisits a technique that we call the randomized iterate, introduced by Goldreich, Krawczyk, and Luby [SIAM J. Comput., 22 (1993), pp. 1163–1175]. This technique was used by Goldreich, Krawczyk, and Luby [SIAM J. Comput., 22 (1993), pp. 1163–1175] to give a construction of pseudorandom generators from regular one-way functions. We simplify and strengthen this technique in order to obtain a similar construction, where the seed length of the resulting generators is as short as $\Theta(n \log n)$ (rather than $\Theta(n^3)$ achieved by Goldreich, Krawczyk, and Luby [SIAM J. Comput., 22 (1993), pp. 1163–1175]). Our technique has the potential of implying seed length $\Theta(n)$, and the only bottleneck for such a result are the parameters of current generators against bounded-space computations. We give a construction with similar parameters for security amplification of regular one-way functions. This improves upon the construction of Goldreich et al. [Proceedings of the $31$st Annual Symposium on Foundations of Computer Science, (FOCS), 1990, pp. 318–326] in that the construction does not need to “know" the regularity parameter of the functions (in terms of security, the two reductions are incomparable). In addition, we use the randomized iterate to show a construction of a pseudorandom generator based on an exponentially hard one-way function that has a seed length of only $\Theta(n^2)$. This improves a recent result of Holenstein [Proceedings of the Theory of Cryptography, Third Theory of Cryptography Conference (TCC), 2006] that shows a construction with seed length $\Theta(n^5)$ based on such one-way functions. Finally, we show that the randomized iterate may even be useful in the general context of Håstad et al. [SIAM J. Comput., 28 (1999), pp. 1364–1396]. In particular, we use the randomized iterate to replace the basic building block of the Håstad et al. [SIAM J. Comput., 28 (1999), pp. 1364–1396] construction. Interestingly, this modification improves efficiency by an $\Theta(n^2)$ factor and reduces the seed length to $\Theta(n^7)$ (which also implies improvement in the security of the construction).

We study entropy flattening: Given a circuit CX implicitly describing an n-bit source X (namely, X is the output of CX on a uniform random input), construct another circuit CY describing a source Y such that (1) source Y is nearly flat (uniform on its support), and (2) the Shannon entropy of Y is monotonically related to that of X. The standard solution is to have CY evaluate CX altogether Θ(n2) times on independent inputs and concatenate the results (correctness follows from the asymptotic equipartition property). In this paper, we show that this is optimal among black-box constructions: Any circuit CY for entropy flattening that repeatedly queries CX as an oracle requires ω(n2) queries.Entropy flattening is a component used in the constructions of pseudorandom generators and other cryptographic primitives from one-way functions [12, 22, 13, 6, 11, 10, 7, 24]. It is also used in reductions between problems complete for statistical zero-knowledge [19, 23, 4, 25]. The Θ(n2) query complexity is often the main efficiency bottleneck. Our lower bound can be viewed as a step towards proving that the current best construction of pseudorandom generator from arbitrary one-way functions by Vadhan and Zheng (STOC 2012) has optimal efficiency.

Very efficient constructions, based on the intractability of the subset sum problem for certain dimensions, are shown for a pseudorandom generator and for a universal one-way hash function. (Pseudorandom generators can be used for private key encryption, and universal one-way hash functions for signature schemes). The increase in efficiency in the construction is due to the fact that many bits can be generated/hashed with one application of the assumed one-way function. All the constructions can be implemented in NC using an optimal number of processors. >

One-way are those functions which are easy to compute, but hard to invert on a non-negligible fraction of instances. The existence of such functions with some additional assumptions was shown to be sufficient for generating perfect pseudorandom strings |Blum, Micali 82|, |Yao 82|, |Goldreich, Goldwasser, Micali 84|. Below, among a few other observations, a weaker assumption about one-way functions is suggested, which is not only sufficient, but also necessary for the existence of pseudorandom generators. The main theorem can be understood without reading the sections 3-6.

We construct a general-purpose multi-input functional encryption scheme in the private-key setting. Namely, we construct a scheme where a functional key corresponding to a function f enables a user holding encryptions of $$x_1, \ldots , x_t$$x1,',xt to compute $$fx_1, \ldots , x_t$$fx1,',xt but nothing else. This is achieved starting from any general-purpose private-key single-input scheme without any additional assumptions, and is proven to be adaptively secure for any constant number of inputs t. Moreover, it can be extended to a super-constant number of inputs assuming that the underlying single-input scheme is sub-exponentially secure. Instantiating our construction with existing single-input schemes, we obtain multi-input schemes that are based on a variety of assumptions such as indistinguishability obfuscation, multilinear maps, learning with errors, and even one-way functions, offering various trade-offs between security and efficiency. Previous and concurrent constructions of multi-input functional encryption schemes either rely on stronger assumptions and provided weaker security guarantees Goldwasser et al. [EUROCRYPT '14], and Ananth and Jain [CRYPTO '15], or relied on multilinear maps and could be proven secure only in an idealized generic model Boneh et al. [EUROCRYPT '15]. In comparison, we present a general transformation that simultaneously relies on weaker assumptions and guarantees stronger security.

In this paper we use strong one-time signatures schemes and adaptive Non-Interactive Zero-Knowledge (NIZK) proof systems to construct an efficient unbounded simulation-sound NIZK proof system, assuming the existence of one-way permutation and pseudorandom generator. Furthermore, we can obtain an unbounded non-malleable NIZK proof system when replacing the adaptive NIZK proof systems in our construction with adaptive NIZK proof of knowledge.KeywordsSignature SchemeProof SystemReference StringChoose Ciphertext AttackCommon Reference StringThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The next bit test was introduced by Blum and Micali and proved by Yao to be a universal test for cryptographic pseudorandom generators. On the other hand, no universal test for the cryptographic one-wayness of functions (or permutations) is known, though the existence of cryptographic pseudorandom generators is equivalent to that of cryptographic one-way functions. In the quantum computation model, Kashefi, Nishimura and Vedral gave a sufficient condition of (cryptographic) quantum one-way permutations and conjectured that the condition would be necessary. In this paper, we relax their sufficient condition and give a new condition that is necessary and sufficient for quantum one-way permutations. Our condition can be regarded as a universal test for quantum one-way permutations, since our condition is described as a collection of stepwise tests similar to the next bit test for pseudorandom generators.

We study the following natural question: Which cryptographic primitives (if any) can be realized by functions with constant input locality, namely functions in which every bit of the input influences only a constant number of bits of the output? This continues the study of cryptography in low complexity classes. It was recently shown by Applebaum et al. (FOCS 2004) that, under standard cryptographic assumptions, most cryptographic primitives can be realized by functions with constant output locality, namely ones in which every bit of the output is influenced by a constant number of bits from the input. We (almost) characterize what cryptographic tasks can be performed with constant input locality. On the negative side, we show that primitives which require some form of non-malleability (such as digital signatures, message authentication, or non-malleable encryption) cannot be realized with constant input locality. On the positive side, assuming the intractability of certain problems from the domain of error correcting codes (namely, hardness of decoding a random binary linear code or the security of the McEliece cryptosystem), we obtain new constructions of one-way functions, pseudorandom generators, commitments, and semantically-secure public-key encryption schemes whose input locality is constant. Moreover, these constructions also enjoy constant output locality and thus they give rise to cryptographic hardware that has constant-depth, constant fan-in and constant fan-out. As a byproduct, we obtain a pseudorandom generator whose output and input locality are both optimal (namely, 3).

The existence of extremal combinatorial objects, such as Ramsey graphs and expanders, is often shown using the probabilistic method. It is folklore that pseudo-random generators can be used to obtain explicit constructions of these objects, if the test that the object is extremal can be implemented in polynomial time. In this talk, we pose several questions geared towards initiating a structural approach to the relationship between extremal combinatorics and computational complexity. One motivation for such an approach is to understand better why circuit lower bounds are hard. Another is to formalize connections between the two areas, so that progress in one leads automatically to progress in the other.Keywordscomputational complexityexplicit constructions

Almost all the important cryptographic protocols we have today base their security on unproven assumptions, which all imply NP \(\ne\) P, and thus having unconditional proofs of their security seems far beyond our reach. One research effort then is to identify more basic primitives and prove the security of these protocols by reductions to the security of these primitives. However, in doing so, one often observes some security loss in the form that the security of the protocols is measured against weaker adversaries, e.g., adversaries with a smaller running time. Is such a security loss avoidable? We study two of the most basic cryptographic reductions: hardness amplification of one-way functions and constructing pseudorandom generators from one-way functions. We show that when they are done in a certain black-box way, such a security loss is in fact unavoidable.KeywordsOblivious TransferHard FunctionMarkov InequalityCircuit SizeOracle QueryThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Pseudorandom generators are constructed which convertO(SlogR) truly random bits toR bits that appear random to any algorithm that runs inSPACE(S). In particular, any randomized polynomial time algorithm that runs in spaceS can be simulated using onlyO(Slogn) random bits. An application of these generators is an explicit construction of universal traversal sequences (for arbitrary graphs) of lengthn O(logn). The generators constructed are technically stronger than just appearing random to spacebounded machines, and have several other applications. In particular, applications are given for “deterministic amplification” (i.e. reducing the probability of error of randomized algorithms), as well as generalizations of it.