1. Lecturer: Moni Naor Weizmann Institute of Science
Foundations of Cryptography Lecture 2: One-way functions are essential for identification. Amplification: from weak to strong one-way functions
Lecturer: Moni Naor
Weizmann Institute of Science

2. Recap
Key Idea of Cryptography: use the intractability of some problems to create secure system.
The Identification Problem
Shannon and Min Entropies
One-way functions
Solution to the identification problem with multiple verifiers
Cryptographic Reductions: using one adversary to create another

3. Rigorous Specification of Security
To define security of a system must specify:
What constitute a failure of the system
The power of the adversary
computational
access to the system
what it means to break the system.
Why is this more relevant in cryptography than other realms?

4. Function and inversions
We say that a function f is hard to invert if given y=f(x) it is hard to find x’ such that y=f(x’)
x’ need not be equal to x
We will use f-1(y) to denote the set of preimages of y
To discuss hard must specify a computational model
Use two flavors:
Concrete
Asymptotic

5. Computational Models Asymptotic: Turing Machines with random tape
For classical models: precise model does not matter up to polynomial factor
Random tape 1 1 1 1
Both algorithm for evaluating f and the adversary are modeled by PTM
Input tape

6. One-way functions - asymptotic
A function f: {0,1}* → {0,1}* is called a one-way function, if
f is a polynomial-time computable function
Also polynomial relationship between input and output length
for every probabilistic polynomial-time algorithm A, every positive polynomial p(.), and all sufficiently large n’s
Prob[ A(f(x))  f-1(f(x)) ] ≤ 1/p(n)
Where x is chosen uniformly in {0,1}n and the probability is also over the internal coin flips of A

7. Computational Models Concrete : Boolean circuits (example)
precise model makes a difference
Time = circuit size
Input
Output

8. One-way functions – concrete version
A function f:{0,1}n → {0,1}n is called a (t,ε) one-way function, if
f is a polynomial-time computable function (independent of t)
for every t-time algorithm A,
Prob[A(f(x))  f-1(f(x)) ] ≤ ε
Where x is chosen uniformly in {0,1}n and the probability is also over the internal coin flips of A
Can either think of t and ε as being fixed or as t(n), ε(n)
Boolean circuit

9. The two guards problem
Perfect completeness Or
1-ε completeness
Completeness: If Alice wants to `approve’ and Eve does not interfere – Bob moves to state Y
Soundness: If Alice does not `approve’, then for any behavior from Eve and Charlie, Bob stays in N
Similarly if Bob and Charlie are switched
Charlie
Alice
Bob
Eve

10. Solution to the password problem
Assume that
f: {0,1}n → {0,1}n is a (t,ε) one-way function
Adversary’s run times is bounded by t
Setup phase:
Alice chooses xR {0,1}n
computes y=f(x)
Gives y to Bob and Charlie
Approval phase: when Alice wants to approve – she sends x
If Bob gets any symbols on channel – call them z; compute f(z) and compares to y
If equal moves to state Y
If not equal moves permanently to state N
Bob
Alice

11. Are one-way functions essential to the two guards password problem?
Suppose that we have a solution to the two guards problem
Alice, Bob and Charlie can be implemented by polynomial time machines
for every probabilistic polynomial-time algorithm A controlling Eve and Charlie
every polynomial p(.),
and all sufficiently large n’s
Prob[Bob moves to Y | Alice does not approve] ≤ 1/p(n)
Already saw
Theorem: the two guards password problem has a solution if and only if one-way functions exist

12. One-way functions are essential to the two guards password problem
Want to put protocol in canonical form
Recall observation: what Bob and Charlie received in the setup phase might as well be public
Claim: can get rid of interaction:
given an interactive identification protocol possible to construct a noninteractive one. In the new protocol:
Alice` sends Bob` the random bits Alice used to generate the setup information
Bob` simulates the conversation between Alice and Bob in original protocol and accepts only if simulated Bob accepts.
Claim: Probability of cheating remains
the same in both protocols
With Alice and bob
With Alice’ and Bob’

13. One-way functions are essential to the two guards password problem
Given a noninteracive identification protocol want to define a one-way function:
Define g(r): the setup phase mapping between the random bits r of Alice and the information y given to Bob and Charlie
random bits r
Alice
setup
Charlie y
Bob

14. One-way functions are essential to the two guards password problem
Define g(r): the setup phase mapping between the random bits r of Alice and the information y given to Bob and Charlie
Are we done?
Yes: if we have perfect completeness
But, the function g(r) is not necessarily one-way without perfect completeness…
Can be unlikely ways to generate it. Can be exploited to invert.
Example: Alice chooses x, x’{0,1}n. If x’= 0n, set y=x, o.w. set y=f(x).
The protocol is still secure, but with probability 1/2n not complete
The resulting function g(x,x’) is easy to invert:
given y {0,1}n set inverse as (y, 0n )

15. One-way functions are essential to the two guards password problem…
However: possible to estimate the probability that Bob accepts on a given string from Alice
Should be close to 1 for most r
Second attempt: define function g(r) as
the mapping that Alice does in the setup phase between her random bits r and the information given to Bob and Charlie,
plus a bit indicating whether probability of Bob accepts given r is greater than 2/3
Theorem: the two guards password problem has a solution if and only if one-way functions exist
Arbitrary…

16. Examples of One-way functions
Examples of hard problems:
Subset sum
Discrete log
Factoring (numbers, polynomials) into prime components
How do we get a one-way function out of them?
Easy problem

17. Subset Sum Subset sum problem: given
n numbers 0 ≤ a1, a2 ,…, an ≤ 2m
Target sum T
Find subset S⊆ {1,...,n} ∑ i S ai,=T
(n,m)-subset sum assumption: for uniformly chosen
a1, a2 ,…, an R{0,…2m -1} and S⊆ {1,...,n}
For any probabilistic polynomial time algorithm, the probability of finding S’⊆{1,...,n} such that
∑ i S ai= ∑ i S’ ai
is negligible, where the probability is over the random choice of the ai‘s, S and the inner coin flips of the algorithm
Not true for very small or very large m. most difficult case m=n
Subset sum one-way function f:{0,1}mn+n → {0,1}mn+m
f(a1, a2 ,…, an , b1, b2 ,…, bn ) =
(a1, a2 ,…, an , ∑ i=1n bi ai mod 2m )

18. Exercise Show a function f such that
if f is polynomial time invertible on all inputs, then P=NP
f is not one-way

19. x is called the discrete log of y to base g.
Discrete Log Problem
Let G be a group and g an element in G.
Let y=gz and x the minimal non negative
integer satisfying the equation.
x is called the discrete log of y to base g.
Example: y=gx mod p in the multiplicative group of Zp
In general: easy to exponentiate via repeated squaring
Consider binary representation
What about discrete log?
If difficult, f(g,x) = (g, gx ) is a one-way function

20. Prob[A[f(x)]  f-1(f(x)) ] ≤ 1-1/p(n)
Weak One-way function
A function f: {0,1}n → {0,1}n is called a weak one-way function, if
f is a polynomial-time computable function
There exists a polynomial p(¢), for every probabilistic polynomial-time algorithm A, and all sufficiently large n’s
Prob[A[f(x)]  f-1(f(x)) ] ≤ 1-1/p(n)
Where x is chosen uniformly in {0,1}n and the probability is also over the internal coin flips of A

21. Why is it polynomial time computable?
Integer Factoring
Consider f(x,y) = x • y
Easy to compute
Is it one-way?
No: if f(x,y) is even, can set inverse as (f(x,y)/2,2)
If factoring a number into prime factors is hard:
Specifically given N= P • Q , the product of two random large (n-bit) primes, it is hard to factor
Then somewhat hard – there are a non-negligible fraction of such numbers ~ 1/n2 from the density of primes
Hence a weak one-way function
Alternatively:
let g(r) be a function mapping random bits into random primes.
The function f(r1,r2) = g(r1) • g(r2) is one-way
Why is it polynomial time computable?

22. Exercise: weak exist if strong exists
Show that if strong one-way functions exist, then there exists a function which is a weak one-way function but not a strong one

23. What about the other direction?
Given
a function f that is guaranteed to be a weak one-way
Let p(n) be such that Prob[A[f(x)]  f-1(f(x)) ] ≤ 1-1/p(n)
can we construct a function g that is (strong) one-way?
An instance of a hardness amplification problem
Simple idea: repetition. For some polynomial q(n) define
g(x1, x2 ,…, xq(n) )=f(x1), f(x2), …, f(xq(n))
To invert g need to succeed in inverting f in all q(n) places
If q(n) = p2(n) seems unlikely (1-1/p(n))p2(n) ≈ e-p(n)
But how to we show? Sequential repetition intuition – not a proof.

24. Want: Inverting g with low probability implies inverting f with high probability
Given a machine B that inverts g want a machine B’
operating in similar time bounds
inverts f with high probability
Idea: given y=f(x) plug it in some place in g and generate the rest of the locations at random
z=(y, f(x2), …, f(xq(n)))
Ask machine B to invert g at point z
Probability of success should be at least (exactly) B’s Probability of inverting g at a random point
Once is not enough
How to amplify?
Repeat while keeping y fixed
Put y at random position (or sort the inputs to g )

25. Proof of Amplification for Repetition of Two
Concentrate on a two-repetition: g(x1, x2 ) = f(x1), f(x2)
Goal: show that the probability of inverting g is roughly squared the probability of inverting f
just as would be sequentially
Claim:
Let (n) be a function that for some p(n) satisfies
1/p(n) ≤ (n) ≤ 1-1/p(n)
Let ε(n) be any inverse polynomial function
Suppose that for every polynomial time A and sufficiently large n
Prob[A[f(x)]  f-1(f(x)) ] ≤ (n)
Then for every polynomial time B and sufficiently large n
Prob[B[g(x1, x2 )]  g-1(g(x1, x2 )) ] ≤ 2(n) + ε(n)

26. Proof of Amplification for Two Repetition
Given a better than 2+ε algorithm B for inverting g construct the following:
B’(y): Inversion algorithm for f
Repeat t times
Choose x’ at random and compute y’=f(x’)
Run B(y,y’).
Check the results
If correct: Halt with success
Output failure
Inner loop
Helpful for constructive algorithm

27. Probability of Success
Define
S={y=f(x) | Prob[Inner loop successful| y ] > β}
Since the choices of the x’ are independent
Prob[B’ succeeds| yS] > 1-(1- β)t
Taking t= n/β means that when yS almost surely B’ will invert it
Hence want to show that Prob[yS] > (n)
Probability is over the choice of x

28. The success of B Fix the random bits of B.
Define P={(y1, y2)| B succeeds on (y1,y2)}
P= P ⋂ {(y1,y2 )| y1,y2 S}
⋃ P ⋂ {(y1,y2 )| y1 S}
⋃ P ⋂ {(y1,y2 )| y2 S} y1
Well behaved part y2
Want to bound P by a square P

29. S is the only success... But
Prob[B[y1, y2]  g-1(y1, y2) | y1  S] ≤ β
and similarly
Prob[B[y1, y2]  g-1(y1, y2) | y2  S] ≤ β so
Prob[(y1, y2)  P and y1,y2  S]
≥ Prob[(y1, y2)  P ] - 2β
≥ 2+ ε - 2β
Setting β =ε/3 we have
Prob[(y1, y2) P and y1,y2  S] ≥ 2 + ε/3

30. Prob[y S] ≥ √(α2+ ε/3) > α
Contradiction
But
Prob[(y1, y2) P and y1,y2 S]
≤ Prob[y1 S] Prob[y2 S]
= Prob2[y S] So
Prob[y S] ≥ √(α2+ ε/3) > α

31. Is there an ultimate one-way function? aka `universal’
Do not know: P≠NP implies the existence of one-way functions,
Can we show a specific function f so that if some one-way exists, then f is one-way?
If f1:{0,1}* → {0,1}* and f2:{0,1}* → {0,1}* are guaranteed to:
Be polynomial time computable
At least one of them is one-way.
then can construct a function g:{0,1}* → {0,1}* which is one-way:
g(x1, x2 ) = (f1(x1),f2 (x2 ))
Robust Combiner
Can generalizes to a 1-out-m combiner

32. g(x1, x2 ,…, xlog (n) )=M1(x1), M2(x2), …, Mlog n(xlog (n))
The Construction
If a 5n2 time one-way function is guaranteed to exist, can construct an O(n2 log n) one-way function g:
Idea: enumerate Turing Machine and make sure they run 5n2 steps
g(x1, x2 ,…, xlog (n) )=M1(x1), M2(x2), …, Mlog n(xlog (n))
Eventually get to the TM of the one-way function
If a one-way function is guaranteed to exist, then there exists a 5n2 time one-way:
Idea: concentrate on the prefix, ignore the rest
n’ where n=p(n’)

33. Ultimate one-way function conclusions
Original proof due to L. Levin
Be careful what you wish for
Problem with resulting one-way function:
Cannot learn about behavior on large inputs from small inputs
Whole rational of considering asymptotic results is eroded!
Construction does not work for non-uniform one-way functions
Notion of robust combiner seems fundamental
See “Robust Combiners for Oblivious Transfer and Other Primitives” by Harnik, Kilian, Naor, Reingold and Rosen, Eurocrypt 2005

34. Distributionally One-Way Functions
A function f:{0,1}*  {0,1}* is one-way if:
it is computable in poly-time
the probability of successfully finding an inverse in poly-time is negligible (on a random input)
A function f :{0,1}*  {0,1}* is distributionally one-way if:
No poly-time algorithm can successfully find a random inverse (on a random input)
Distribution on inverting algorithm far from uniform on the pre-images
Theorem [Impagliazzo Luby 89]: distributionally one-way functions exist iff one-way functions exists
Example: function from two guards problem