Securely Obfuscating Re-Encryption

We present the first positive obfuscation result for a traditional cryptographic functionality. This positive result stands in contrast to well-known negative impossibility results [BGI + 01] for general obfuscation and recent negative impossibility and improbability [GK05] results for obfuscation of many cryptographic functionalities. Whereas other positive obfuscation results in the standard model apply to very simple point functions, our obfuscation result applies to the significantly more complicated and widely-used re-encryption functionality. This functionality takes a ciphertext for message m encrypted under Alice’s public key and transforms it into a ciphertext for the same message m under Bob’s public key. To overcome impossibility results and to make our results meaningful for cryptographic functionalities, we use a new definition of obfuscation. This new definition incorporates more security-aware provisions.

A faster single-term divisible electronic cash: ZCash

In the last 15 years much research has been done concerning practical applications of elliptic curves like integer factorization (Lenstra, Ann Math 126:649–673, 1987, [46]), primality proving (Atkin and Morain, Math Comput 61(205):29–68, 1993, [3]), algebraic geometry codes (van Lint and van der Geer, DMV Seminar, vol 12, 1988, [89]) and public-key cryptosystems (Koblitz, Math Comput 48(177):203–209, 1987, [36], Miller, Advances in Cryptology—CRYPTO ’85, 1986, pp 417–426 [58]).

The papers in this volume were presented at the 43rd ACM Symposium on Theory of Computing (STOC), held June 6-8, 2011 in San Jose, California, as part of the fifth Federated Computing Research Conference (FCRC). STOC is sponsored by the ACM Special Interest Group on Algorithms and Computation Theory (SIGACT). The papers at STOC were selected by the program committee from among 304 submissions received by November 4, 2010 (5 of which were withdrawn by authors during the review process). The committee did its work by a combination of extensive electronic discussion and a physical meeting of the entire committee in San Francisco on January 26-27, 2011. These proceedings contain the 84 papers that were accepted to STOC, one of which is a merge of two related submissions. Three pairs of papers having similar results shared presentation slots at the conference, for a total of 81 talks. All submissions received careful consideration, but they were not refereed in a formal sense. Authors are encouraged to submit full versions of their papers to journals for a complete review and archival publication. The committee selected two papers for a Best Paper Award: "Electrical Flows, Laplacian Systems, and Faster Approximation of Maximum Flow in Undirected Graphs," by Paul Christiano, Jonathan A. Kelner, Aleksander Madry, Daniel A. Spielman, and Shang-Hua Teng, and "Subexponential Lower Bounds for Randomized Pivoting Rules for the Simplex Algorithm," by Oliver Friedmann, Thomas Dueholm Hansen, and Uri Zwick. The committee selected "Analyzing Network Coding Gossip Made Easy" by Bernhard Haeupler for the Danny Lewin Best Student Paper Award. STOC was preceded by an FCRC plenary talk on June 5 given by Leslie Valiant as recipient of the 2011 ACM Turing Award for his transformative contributions to the theory of computation, including the theory of probably approximately correct (PAC) learning, the complexity of enumeration and of algebraic computation, and the theory of parallel and distributed computing. At the conference, the 11th Knuth Prize was awarded to Ravi Kannan for his work on algorithmic techniques that have fundamentally contributed to computational complexity, discrete mathematics, geometry, and operations research. He presented the Knuth Prize Lecture as an FCRC plenary talk on the morning of June 7. The program committee also decided to add a Poster Session, held on the evening of June 6, to increase the opportunities for disseminating and discussing research at the conference. Posters were not refereed; any registered FCRC attendee could present a poster on research in any aspect of theoretical computer science.

We give a new construction of pseudorandom generators from any one-way function. The construction achieves better parameters and is simpler than that given in the seminal work of H\aastad, Impagliazzo, Levin, and Luby [SIAM J. Comput., 28 (1999), pp. 1364--1396]. The key to our construction is a new notion of next-block pseudoentropy, which is inspired by the notion of “inaccessible entropy” recently introduced in [I. Haitner, O. Reingold, S. Vadhan, and H. Wee, Proceedings of the $41$st Annual ACM Symposium on Theory of Computing (STOC), 2009, pp. 611--620]. An additional advantage over previous constructions is that our pseudorandom generators are parallelizable and invoke the one-way function in a nonadaptive manner. Using [B. Applebaum, Y. Ishai, and E. Kushilevitz, SIAM J. Comput., 36 (2006), pp. 845--888], this implies the existence of pseudorandom generators in NC$^0$ based on the existence of one-way functions in NC$^1$.

This book presents a view of several important topics in the modern field of distributed algorithms. The book is intended to provide useful background and reference information for professional engineers dealing with distributed systems, and for entering researchers who wish to develop a sufficient background in distributed algorithms. In addition, the book is suitable for providing a textbook-style introduction to distributed algorithms for advanced undergraduates or early graduate students who are taking a relevant course or consider pursuing research in the field.The reference sources for this book incluude mainly research papers on the modern theory of Distributed Computing that routinely appear in conferences such as the ACM Symposium on Principles of Distributed Computing (PODC), or the International Symposium on DIStributed Computing (DISC). Fundamental milestones of this theory include also research papers from other major conferences of Theoretical Computer Science that are of wider interest, such as the ACM Symposium on Theory of Computing (STOC), or from leading theory journals, such as the Journal of the ACM or SIAM Journal on Computing.

We study problems in randomized communication complexity when the protocol is only required to attain some small advantage over purely random guessing, i.e., it produces the correct output with probability at least $$\epsilon$$ greater than one over the codomain size of the function. Previously, Braverman and Moitra (in: Proceedings of the 45th symposium on theory of computing (STOC), ACM, pp 161–170, 2013) showed that the set-intersection function requires $$\Theta(\epsilon{n})$$ communication to achieve advantage $$\epsilon$$ . Building on this, we prove the same bound for several variants of set-intersection: (1) the classic “tribes” function obtained by composing with And (provided $$1/\epsilon$$ is at most the width of the And), and (2) the variant where the sets are uniquely intersecting and the goal is to determine partial information about (say, certain bits of the index of) the intersecting coordinate.

For general antiferromagnetic 2-spin systems, including the hardcore model on weighted independent sets and the antiferromagnetic Ising model, there is an for the partition function on graphs of maximum degree when the infinite regular tree lies in the uniqueness region by Li, Lu, and Yin [Correlation Decay up to Uniqueness in Spin Systems, preprint, https://arxiv.org/abs/1111.7064, 2021]. Moreover, in the tree nonuniqueness region, Sly in [Computational transition at the uniqueness threshold, in Proceedings of the 51st Annual IEEE Symposium on Foundations of Computer Science, 2010, pp. 287–296] showed that there is no to estimate the partition function unless . The algorithmic results follow from the correlation decay approach due to Weitz [Counting independent sets up to the tree threshold, in Proceedings of the 38th Annual ACM Symposium on Theory of Computing, 2006, pp. 140–149] or the polynomial interpolation approach developed by Barvinok [Combinatorics and Complexity of Partition Functions, Springer, 2016]. However, the running time is only polynomial for constant . For the hardcore model, recent work of Anari, Liu, and Oveis Gharan [Spectral independence in high-dimensional expanders and applications to the hardcore model, in Proceedings of the 61st Annual IEEE Symposium on Foundations of Computer Science, 2020, pp. 1319–1330] establishes rapid mixing of the simple single-site Markov chain, known as the Glauber dynamics, in the tree uniqueness region. Our work simplifies their analysis of the Glauber dynamics by considering the total pairwise influence of a fixed vertex on other vertices, as opposed to the total influence of other vertices on , thereby extending their work to all 2-spin models and improving the mixing time. More important, our proof ties together the three disparate algorithmic approaches: we show that contraction of the so-called tree recursions with a suitable potential function, which is the primary technique for establishing efficiency of Weitz’s correlation decay approach and Barvinok’s polynomial interpolation approach, also establishes rapid mixing of the Glauber dynamics. We emphasize that this connection holds for all 2-spin models (both antiferromagnetic and ferromagnetic), and existing proofs for the correlation decay and polynomial interpolation approaches immediately imply rapid mixing of the Glauber dynamics. Our proof utilizes the fact that the graph partition function is a divisor of the partition function for Weitz’s self-avoiding walk tree. This fact leads to new tools for the analysis of the influence of vertices and may be of independent interest for the study of complex zeros.

We consider a model of game-theoretic network design initially studied by Anshelevich et al. (Proceedings of the 45th Annual Symposium on Foundations of Computer Science (FOCS), pp. 295–304, 2004), where selfish players select paths in a network to minimize their cost, which is prescribed by Shapley cost shares. If all players are identical, the cost share incurred by a player for an edge in its path is the fixed cost of the edge divided by the number of players using it. In this special case, Anshelevich et al. (Proceedings of the 45th Annual Symposium on Foundations of Computer Science (FOCS), pp. 295–304, 2004) proved that pure-strategy Nash equilibria always exist and that the price of stability—the ratio between the cost of the best Nash equilibrium and that of an optimal solution—is Θ(log k), where k is the number of players. Little was known about the existence of equilibria or the price of stability in the general weighted version of the game. Here, each player i has a weight w i ≥1, and its cost share of an edge in its path equals w i times the edge cost, divided by the total weight of the players using the edge. This paper presents the first general results on weighted Shapley network design games. First, we give a simple example with no pure-strategy Nash equilibrium. This motivates considering the price of stability with respect to α-approximate Nash equilibria—outcomes from which no player can decrease its cost by more than an α multiplicative factor. Our first positive result is that O(log w max )-approximate Nash equilibria exist in all weighted Shapley network design games, where w max is the maximum player weight. More generally, we establish the following trade-off between the two objectives of good stability and low cost: for every α=Ω(log w max ), the price of stability with respect to O(α)-approximate Nash equilibria is O((log W)/α), where W is the sum of the players’ weights. In particular, there is always an O(log W)-approximate Nash equilibrium with cost within a constant factor of optimal. Finally, we show that this trade-off curve is nearly optimal: we construct a family of networks without o(log w max / log log w max )-approximate Nash equilibria, and show that for all α=Ω(log w max /log log w max ), achieving a price of stability of O(log W/α) requires relaxing equilibrium constraints by an Ω(α) factor.

The natural relaxation for the group Steiner tree problem, as well as for its generalization, the directed Steiner tree problem, is a flow‐based linear programming relaxation. We prove new lower bounds on the integrality ratio of this relaxation. For the group Steiner tree problem, we show that the integrality ratio is $\Omega(\log^2 k)$, where k denotes the number of groups; this holds even for input graphs that are hierarchically well‐separated trees, introduced by Bartal [in Proceedings of the 37th Annual IEEE Symposium on Foundations of Computer Science, 1996, pp. 184–193], in which case this lower bound is tight. This also applies for the directed Steiner tree problem. In terms of the number n of vertices, our results for the directed Steiner problem imply an $\Omega(\frac{\log^2 n}{(\log \log n)^2})$ integrality ratio. For both problems, these are the first lower bounds on the integrality ratio that are superlogarithmic in the input size. This exhibits, for the first time, a relaxation of a natural optimization problem whose integrality ratio is known to be superlogarithmic but subpolynomial. Our results and techniques have been used by Halperin and Krauthgamer [in Proceedings of the 35th Annual ACM Symposium on Theory of Computing, 2003, pp. 585–594] to show comparable inapproximability results, assuming that NP has no quasi‐polynomial Las Vegas algorithms. We also show algorithmically that the integrality ratio for the group Steiner tree problem is much better for certain families of instances, which helps pinpoint the types of instances (parametrized by optimal solutions to their flow‐based relaxations) that appear to be most difficult to approximate.

Sums of squares based approximation algorithms for MAX-SAT

The distributed $(\Delta + 1)$-coloring problem is one of the most fundamental and well-studied problems in distributed algorithms. Starting with the work of Cole and Vishkin in 1986, a long line of gradually improving algorithms has been published. The state-of-the-art running time, prior to our work, is $O(\Delta \log \Delta + \log^* n)$, due to Kuhn and Wattenhofer [Proceedings of the $25$th Annual ACM Symposium on Principles of Distributed Computing, Denver, CO, 2006, pp. 7--15]. Linial [Proceedings of the $28$th Annual IEEE Symposium on Foundation of Computer Science, Los Angeles, CA, 1987, pp. 331--335] proved a lower bound of $\frac{1}{2} \log^* n$ for the problem, and Szegedy and Vishwanathan [Proceedings of the 25th Annual ACM Symposium on Theory of Computing, San Diego, CA, 1993, pp. 201--207] provided a heuristic argument that shows that algorithms from a wide family of locally iterative algorithms are unlikely to achieve a running time smaller than $\Theta(\Delta \log \Delta)$. We present a deterministic $(\Delta + 1)$-coloring distributed algorithm with running time $O(\Delta) + \frac{1}{2} \log^* n$. We also present a trade-off between the running time and the number of colors, and devise an $O(\lambda\cdot\Delta)$-coloring algorithm, with running time $O(\Delta / \lambda + \log^* n)$, for any parameter $\lambda > 1$. Our algorithm breaks the heuristic barrier of Szegedy and Vishwanathan and achieves running time which is linear in the maximum degree $\Delta$. On the other hand, the conjecture of Szegedy and Vishwanathan may still be true, as our algorithm does not belong to the family of locally iterative algorithms. On the way to this result we study a generalization of the notion of graph coloring, which is called defective coloring [L. Cowen, R. Cowen, and D. Woodall, J. Graph Theory, 10 (1986), pp. 187--195]. In an $m$-defective $p$-coloring the vertices are colored with $p$ colors so that each vertex has up to $m$ neighbors with the same color. We show that an $m$-defective $p$-coloring with reasonably small $m$ and $p$ can be computed very efficiently in the distributed setting. We also develop a technique to employ multiple defective colorings of various subgraphs of the original graph $G$ for computing a $(\Delta+1)$-coloring of $G$. We believe that these techniques are of independent interest.

Random languages for nonuniform complexity classes

One of the main lines of research in functional encryption (FE) has consisted in studying the security notions for FE and their achievability. This study was initiated by [Boneh et al. – TCC’11, O’Neill – ePrint’10] where it was first shown that for FE the indistinguishability-based (IND) security notion is not sufficient in the sense that there are FE schemes that are provably IND-Secure but concretely insecure. For this reason, researchers investigated the achievability of Simulation-based (SIM) security, a stronger notion of security. Unfortunately, the above-mentioned works and others [e.g., Agrawal et al. – CRYPTO’13] have shown strong impossibility results for SIM-Security. One way to overcome these impossibility results was first suggested in the work of Boneh et al. where it was shown how to construct, in the Random Oracle (RO) model, SIM-Secure FE for restricted functionalities and was asked the generalization to more complex functionalities as a challenging problem in the area. Subsequently, [De Caro et al. – CRYPTO’13] proposed a candidate construction of SIM-Secure FE for all circuits in the RO model assuming the existence of an IND-Secure FE scheme for circuits with RO gates. To our knowledge there are no proposed candidate IND-Secure FE schemes for circuits with RO gates and they seem unlikely to exist. We propose the first constructions of SIM-Secure FE schemes in the RO model that overcome the current impossibility results in different settings. We can do that because we resort to the two following models: Both results also assume the RO model, but not functionalities with RO gates and rely on extractability obfuscation [Boyle et al. – TCC’14] (and other standard primitives) secure only in the standard model.

We consider the client-server setting for the concurrent composition of secure protocols: in this setting, a single server interacts with multiple clients concurrently, executing with each client a specified protocol where only the client should receive any nontrivial output. Such a setting is easily motivated from an application standpoint. There are important special cases for which positive results are known – such as concurrent zero knowledge protocols – and it has been an open question whether other natural functionalities such as Oblivious Transfer (OT) are possible in this setting.In this work: We resolve this open question by showing that unfortunately, even in this very limited concurrency setting, broad new impossibility results hold, ruling out not only OT, but in fact all nontrivial finite asymmetric functionalities. Our new negative results hold even if the inputs of all honest parties are fixed in advance, and the adversary receives no auxiliary information. Along the way, we establish a new unconditional completeness result for asymmetric functionalities, where we characterize functionalities that are non-interactively complete secure against active adversaries. When we say that a functionality \(\mathcal {F}\) is non-interactively complete, we mean that every other asymmetric functionality can be realized by parallel invocations of several copies of \(\mathcal {F}\), with no other communication in any direction. Our result subsumes a completeness result of Kilian [STOC’00] that uses protocols which require additional interaction in both directions. KeywordsImpossibility ResultOblivious TransferHonest PartyErasure ChannelCorrupt PartyThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.