ν(n)/n c < n ln r < e ln r = r,

Transcription

1 January 6, Neither negligible nor nonnegligible? A function ν : N 0 is negligible if c, lim sup νn/n c = 0. Thus, ν is not negligible if c, there are infinity number of n such that νn/n c 1. A function ν : N 0 is nonnegligible if c, lim inf νn/n c > 0. Thus, ν is not nonnegligible if c, there are infinity number of n such that νn/n c < 1. I should say: ν is not nonnegligible if c and r > 0, there are infinity number of n such that νn/n c < r. However, if for r < 1 and c + ln r, there are infinity number of n such that νn/n c+ln r < 1, we have for such n, νn/n c < n ln r < e ln r = r, i.e., there are infinity number of n such that νn/n c < r. So, since we consider c, we can just consider this simpler situation that there are infinity number of n such that νn/n c < 1. Define f : N as the ceiling of factorial: x f = k!, if k 1! < x k!. For example, 6 f = 6 since 6 =!; 6.1 f = 4 since! < 6.1 4! = 4. Easy to see that f is monotonic non-decreasing. Consider νn = log n+1 f. For n = k! 1 and k, νn = k!. Thus for c =, νn/n c = k! k! 1 > k! > 1. So, there are infinity number of n = k! 1 for k such that νn/n c 1. So νn is not negligible. For any c, let k 0 = max { c, 1}. For any integer k k 0 and n = k!, log n + 1 f = k + 1!, thus νn = k+1! = n k 1. So from k k 0 c and n = k!, we know Thus νn is not nonnegligible. νn/n c n k 1 n k = n 1 < 1. νn is monotonic non-increasing, since log and f are both monotonic non-decreasing, and x is monotonic decreasing of x. So νn = log n+1 f is a monotonic non-increasing function that is neither negligible nor nonnegligible. 1

2 January 6, Alternate definition of SOF For any f : {0, 1} {0, 1} in SOF, there exist positive constants c 1 and c such that x c 1 fx x c. Thus fx 1/c x fx 1/c 1. For any PPT A, we can design: PPT Algorithm A : For input fx, compute k min = fx 1/c and k max = fx 1/c 1. For integer k U [k min, k max ] that is, k is randomly selected from within [k min, k max ] with uniform probability, return A1 k, fx. Since f SOF, there is a negligible function ν such that P fa fx = fx : x U {0, 1} k νk. Since k min fx 1/c x c 1/c, and k max fx 1/c 1 x c /c 1, the number of integers within [k min, k max ] is at most x c /c 1 x c 1/c + 1, and x is one of such integers. Since in algorithm A, k is selected with uniform distribution from all integers between k min and k max, we have P fa1 k, fx = fx : x U {0, 1} k k c /c 1 k c 1/c + 1 νk. νk is a negligible function, so is k c /c 1 k c 1/c + 1 νk. Thus with the property a of an SOF function, we know that f SOF. Thus SOF SOF. For any f SOF, we can modify it to f x = 1 x, 0, fx. That is, f x first outputs 1 x, then one 0, then fx. Since there is a PPT F such that F x = fx, then obviously there is a PPT F x = f x, since outputting 1 x and one 0 is of polynomial complex. And there is a positive constant c such that fx x c for x. Thus x 1 < f x x c + x + 1 < x c+1. Since the first 0 in f x s output indicates the length of the prefix 1 s, we have f x = f y x = y fx = fy. Thus for every PPT A, P f Af x = f x : x U {0, 1} k P fa1 k, 0, fx = fx : x U {0, 1} k. Using similar techniques used above, we can design a PPT A such that A first randomly inserts a 0 into the input the 0 should be inserted after consecutive 1 s; no other 0 is before the inserted one and then calls A to get the output. The number of positions that one 0 can be inserted is less than f x. Thus P fa1 k, 0, fx = fx : x U {0, 1} k x c+1 P fa 1 k, fx = fx : x U {0, 1} k. For A, since f SOF, we know there is a negligible function ν such that Thus we get P fa 1 k, fx = fx : x U {0, 1} k νk. P f Af x = f x : x U {0, 1} k x c+1 νk, where x c+1 νk is also a negligible function. So f x SOF. Since when x = 1 x c = 1 for any c, we can specify f x = 0 for x = 1. This will not destroy the whole proof since SOF or SOF only pay attention to input with sufficient large length. When x, c, we have x c 1 x 1 >, i.e., x c + x + 1 < x c+1.

3 January 6, Length-preserving SOF Assume function f SOF. We want to design a length-preserving strong one way function f from f. First, give three functions and some of their properties: Append: Cx, k, where x {0, 1} and k > x, appends x with one 0 and 1 k x 1. If k = x + 1 then no 1 s appended. For example, C10, 4 = 1001 and C01, 7 = Thus Cx, k = k. Note that k > x for Cx, k. That is, Cx, k always appends some signature x. Thus we have similar to Problem 10. Cx, k = Cx, k x = x k = k. Append: C x, k, where x {0, 1} and k > x, append random string of length k x to x. Prefix: Ex, k, where x {0, 1} and k N, returns the first k symbols of x. For example, E1001, = 10. It is easy to see Ex, k = k, and EC x, k, x = x. Since f SOF, there exist a constant c N such that fx < x c. For any x with length n c, we define f x = CfEx, n, n c. Obviously, f is length-preserving, and can be calculated in polynomial time. From the properties of append function C, f x = f x x = x fex, n = fex, n, where n = x 1/c. For any PPT algorithm A that can invert f, we can design another PPT algorithm to invert f A[1 k, fx] = EA [1 kc, Cfx, k c ], k, where k = x. We have P fa[1 k, fx] = fx = P fea [1 kc, Cfx, k c ], k = fec x, k c, k = P f A [1 kc, Cfx, k c ] = f C x, k c = P f A [1 kc, f C x, k c ] = f C x, k c. The randomness of C assures that P fa[1 k, fx] = fx : x U {0, 1} k = P f A [1 kc, f x] = f x : x U {0, 1} kc. Thus, since f SOF, there exists a negligible function ν such that P fa[1 k, fx] = fx : x U {0, 1} k νk. Then we have P f A [1 kc, f x] = f x : x U {0, 1} kc νk c, and νk c is also a negligible function of k. So f is a length-preserving strong one-way function.

4 January 6, BPP a For such PPT A, we can design a PPT A x as: { Let K = 18 x b t, where t = max 4 }. b b 1, 1 un A on x for K times. The number of times that Ax = 1 is S = K i=1 A ix where A i x is the output of the i-th run of A. If S K then A x = 1 otherwise A x = 0. For x L, P Ax = 1 1+ x b P A x = 1 = 1 P S < K 1 P S < K P Ax = 1 x b 1 P S K P Ax = 1 > x b K 1 e x b 18 K = 1 e t. 4 For x, we have = x b x b 1 b 1 t. And for t > 1, te t is a decreasing function since dte t dt = 1 te t < 0. Thus te t e 1 < 1. So we have 1 x b 4 1 t > e t, or 1 e t > 1+ x b. So for x L, P A x = 1 1+ x b. Note: we can not achieve so high a probability when x = 1, since P Ax = 1 can not assure P A x = 1 = 1. For x L, P Ax = 1 1 x b P A x = 1 = P S K P S K P Ax = 1 + x b P S K P Ax = 1 x b K e x b 18 K = e t. Since we have proven that for x, 1 e t > 1+ x b, we have for x L, P A x = 1 1 x b. Note: For x = 1, this also holds since P Ax = 1 0. Since A is poly-time computable and K is a polynomial of x, we have A is also a PPT. b For such PPT A, we can design a PPT A x as: Let K = 16 x b. un A on x for K times. The number of times that Ax = 1 is S = K i=1 A ix where A i x is the output of the i-th run of A. If S K then A x = 1 otherwise A x = 0. 4

5 January 6, 001 For x L, P Ax = 1 1+ x b P A x = 1 = 1 P S < K 1 P S < K P Ax = 1 x b 1 P S K P Ax = 1 > x b K 1 e x b 8 K = 1 e >. For x L, P Ax = 1 1 x b P A x = 1 = P S K P S K P Ax = 1 + x b P S K P Ax = 1 x b K e x b 8 K = e < 1. Since A is poly-time computable and K is a polynomial of x, we have A is also a PPT. So L BPP. c If L BPP, then there exists a PPT algorithm A such that for x L, P Ax = 1 / and for x L, P Ax = 1 1/. Thus we can design a PPT A x as: Let K = 7 x + 1. un A on x for K times. The number of times that Ax = 1 is S = K i=1 A ix where A i x is the output of the i-th run of A. If S K then A x = 1 otherwise A x = 0. For x L, P Ax = 1 P A x = 0 = P S < K P S < K P Ax = 1 16 P S K P Ax = 1 > K 6 e K/7 = e e x < e x. For x L, P Ax = 1 1 P A x = 1 = P S K P S K P Ax = P S K P Ax = 1 K 6 e K/7 < e x. Since A is poly-time computable and K is a polynomial of x, we have A is also a PPT, and the probability of A making an error is at most e x. 5

6 January 6, SOP a For f a SOP and π a PPT permutation, π f is also a PPT permutation, since both f and π are poly-time computable and are permutations. If π f is not a SOP, then there exists a PPT A with not negligible probability such that π faπ fx = π fx. We can design A x = Aπx, which is a PPT since A and π are both PPT. Thus for fx, we have π fa fx = π fx with not negligible probability. Since π is one-to-one, we have fa fx = fx with not negligible probability, conflicting with that f is a SOF. So π f is also a SOP. b Collaborate with Adam Granicz, Ke Yang Given a strong one way function f, we can design f 1 x = 0 fx, fx, and f x = fex, x, where E is the prefix function defined in Problem 10.. It is obviously f 1 and f are both one-way functions. However, f f 1 is a constant, i.e., f f 1 x = f0 fx is not a one-way function. 6

7 January 6, Poly-time distinguishable If and are poly-time distinguishable, there exists a PPT test T such that P x n T x = 1 P x n T x = 1 is a nonnegligible function. Let P n denote P x n T x = 1 and P n denote P x n T x = 1 for convenience. Thus c > 0, n 0 N such that for n n 0, P n P n > n c. Design a statistical test T : 1. T has access to random samples from and ;. T calculates S q = K T q i, S r = i=1 K T r i, and returns T x if S q S r, otherwise returns 1 T x. Here q i and r i are samples from n and n respectively, and K = 1n c. If for n n 0, P n P n n 0, then P P n > n c P S q < S r P S q < K P n 1 n c S r > K P n + 1 n c P S q < K P n 1 n c + P S r > K P n + 1 n c Sq P K P n > K Sr n c + P K P n > K n c i=1 4e n c 4 K = 4e nc < 1 4 n c. The last inequality is due to c > 0 n c > 16n c e nc < 16e < 1. So P x n T x = 1 P S q S r P n n c P n P n 1 4 n c, and P x n T x = 1 = P S q S r P n + P S q < S r 1 P n P n n c. Thus P x n T x = 1 P x n T x = 1 P n P n 1 n c 1 n c. If for n n 0, P n P n n < 0, then P P n > n c P S q S r P S q > K P n + 1 n c S r K P n 1 n c P S q > K P n + 1 n c + P S r K P n 1 n c Sq P K P n > K Sr n c + P K P n K n c 4e n c 4 K = 4e nc < 1 4 n c. 7

8 January 6, 001 So P x n T x = 1 P S q < S r 1 P n n c 1 P n 1 P n 1 4 n c, and P x n T x = 1 = P S q < S r 1 P n + P S q S r P n 1 P n n c. Thus P x n T x = 1 P x n T x = 1 P n P n 1 n c 1 n c. Thus, for n n 0, we always have P x n T x = 1 P x n T x = 1 1 n c, positive and nonnegligible. 8