1. Can we base cryptography on SZK-Hardness? Salil Vadhan Harvard University

2. Obstacles to Crypto from NP-Hardness 1.NP * BPP ) NP hard on average? – Impossible via nonadaptive black-box reductions unless PH = AM Å coAM [BT] 2.NP hard on average ) OWF? Q: What if we replace NP by SZK?

3. Crypto from SZK-Hardness? 1.SZK * BPP ) SZK hard on average? – Impossible via nonadaptive black-box reductions unless PH = AM Å coAM [BT] 2.SZK hard on average ) OWF? – Yes! [O91]

4. Worst-case Complexity of SZK Thm [DGRV]: Complete Problem for SZK L, the class of problems having SZK proofs w/logspace verifier & simulator: “Given a degree 3 polynomial p : Z 2 n ! Z 2 m, approximate H(p(U n )) to within § 1 bit.” Pf: combine standard SZK reductions [GV99] w/randomizing polys [IK00,AIK04,GGHKR07].

5. Worst-Case/Avg-Case Reductions? Approach 1: show that some lattice problem (e.g. GapSVP poly(n) ) is SZK-complete. Approach 2: worst-case /avg-case reductions for approximating entropy of polynomials. – Entropy related to algebraic quantities over large fields [DGW07].

6. Average-Case Complexity of SZK [RV] SZK hard-on-average O(1)-round statistically hiding commitments 1-round statistical OT Collision-resistant Hashing 1-round PIR Homomorphic+ encryption Rerandomizable encryption O(1)-round statistical OT [NY89,DPP93] w/ perfect correctness Using [OV07] trivial [KO97] [PW08] Lossy trapdoor funcs [PW08] [IKO05] [PW08] folklore

7. More Research Questions Natural crypto primitive equivalent to avg- case hardness of SZK? Understand entropy of low-degree polys of small fields. More SZK L -complete problems?