Cryptography in $NC^0$

Applebaum, Benny; Ishai, Yuval; Kushilevitz, Eyal

doi:10.1137/s0097539705446950

Cited by 153 publications

(116 citation statements)

References 16 publications

Supporting

Mentioning

115

Contrasting

Order By: Relevance

“…Such a construction may in fact be a pseudorandom generator, and hence a one-way function. 1 Applebaum, Ishai and Kushilevtiz [4,5] show that, under standard assumptions, there are one-way functions and pseudorandom generators that can be computed in N C 0 ; their one-way function is computable with right-degree 3. 2 In their construction, the graph encodes the computation of a log-space machine computing a one-way function that is used as a primitive.…”

Section: Goldreich's Function and Cryptography In Ncmentioning

confidence: 99%

Goldreich’s One-Way Function Candidate and Myopic Backtracking Algorithms

Cook

Etesami

Miller

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Goldreich (ECCC 2000) proposed a candidate one-way function construction which is parameterized by the choice of a small predicate (over d = O(1) variables) and of a bipartite expanding graph of right-degree d. The function is computed by labeling the n vertices on the left with the bits of the input, labeling each of the n vertices on the right with the value of the predicate applied to the neighbors, and outputting the n-bit string of labels of the vertices on the right.Inverting Goldreich's one-way function is equivalent to finding solutions to a certain constraint satisfaction problem (which easily reduces to SAT) having a "planted solution," and so the use of SAT solvers constitutes a natural class of attacks.We perform an experimental analysis using MiniSat, which is one of the best publicly available algorithms for SAT. Our experiment shows that the running time required to invert the function grows exponentially with the length of the input, and that such an attack becomes infeasible already with small input length (a few hundred bits).Motivated by these encouraging experiments, we initiate a rigorous study of the limitations of back-tracking based SAT solvers as attacks against Goldreich's function. Results by Alekhnovich, Hirsch and Itsykson imply that Goldreich's function is secure against "myopic" backtracking algorithms (an interesting subclass) if the 3-ary parity predicate P (x1, x2, x3) = x1 ⊕ x2 ⊕ x3 is used. One must, however, use non-linear predicates in the construction, which otherwise succumbs to a trivial attack via Gaussian elimination.We generalized the work of Alekhnovich et al. to handle a more general class of predicates, and we present a lower bound for the construction that uses the predicate P d (x1, . . . , x d ) := x1 ⊕x2 ⊕· · ·⊕x d−2 ⊕(x d−1 ∧x d ) and a random graph.

show abstract

Section: Goldreich's Function and Cryptography In Ncmentioning

confidence: 99%

Goldreich’s One-Way Function Candidate and Myopic Backtracking Algorithms

Cook

Etesami

Miller

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…A result (we already mentioned briefly) by Applebaum, Ishai, Kushilevitz [AIK06] shows, under standard assumptions, that there are pseudorandom distributions computable by NC 0 circuits. Their result is obtained via a generic transformation that turns a distribution D into another "padded" distribution D that is computable in NC 0 and at the same time maintains interesting properties, such as pseudorandomness (but not stretch).…”

Section: Definition 12 a Function F : {0 1} → {0 1}mentioning

confidence: 91%

“…Blum-Micali-Yao). These use less resources than the algorithm to be derandomized, and in fact computing these generators can even be done in the restricted circuit class NC 0 [AIK06]. However, unconditional instantiations of these generators are rare, and in particular we are unaware of any unconditional cryptographic generator with large stretch, a key feature for derandomization.…”

Section: Definition 12 a Function F : {0 1} → {0 1}mentioning

confidence: 99%

“…Later, Impagliazzo and Naor [IN96] extend the construction (1) to show that small AC 0 circuits can even generate (x, b(x)) for more complicated functions, such as inner product b(x) = x 1 ·x 2 +x 3 ·x 4 +· · ·+x n−1 ·x n . They use this to construct cryptographic pseudorandom generators computable by poly-size AC 0 circuits based on the hardness of the subset-sum problem, and similar techniques are useful in constructing depth-efficient generators based on other assumptions [AIK06,Vio05].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

The Complexity of Distributions

Viola

2010

2010 IEEE 51st Annual Symposium on Foundations of Computer Science

View full text Add to dashboard Cite

Complexity theory typically studies the complexity of computing a function h(x) : {0, 1} m → {0, 1} n of a given input x. A few works have suggested to study the complexity of generating -or sampling -the distribution h(x) for uniform x, given random bits. We further advocate this study, with a new emphasis on lower bounds for restricted computational models. Our main results are:1. Any function f : {0, 1} → {0, 1} n such that (i) each output bit f i depends on o(log n) input bits, and (ii) ≤ log 2 n αn + n 0.99 , has output distribution f (U ) at statistical distance ≥ 1 − 1/n 0.49 from the uniform distribution over n-bit strings of hamming weight αn. We also prove lower bounds for generating (X, b(X)) for boolean b, and in the case in which each bit f i is a small-depth decision tree. These lower bounds seem to be the first of their kind; the proofs use anticoncentration results for the sum of random variables.2. Lower bounds for generating distributions imply succinct data structures lower bounds. As a corollary of (1), we obtain the first lower bound for the membership problem of representing a set S ⊆ [n] of size αn, in the case where 1/α is a power of 2: If queries "i ∈ S?" are answered by non-adaptively probing o(log n) bits, then the representation uses ≥ log 2 n αn + Ω(log n) bits. 3. Upper bounds complementing the bounds in (1) for various settings of parameters. Uniform randomized AC0 circuits of poly(n) size and depth d = O(1) with error can be simulated by uniform randomized AC 0 circuits of poly(n) size and depth d + 1 with error + o(1) using ≤ (log n) O(log log n) random bits. Previous derandomizations [Ajtai and Wigderson '85; Nisan '91] increase the depth by a constant factor, or else have poor seed length.

show abstract

“…Although the cloud infrastructures are much more powerful and reliable than personal computing devices, broad range of both internal and external threats for data integrity still exist. Examples of outages and data loss incidents of noteworthy cloud storage services appear from time to time [5], [6], [7], [8], [9].…”

Section: Proposed Systemmentioning

confidence: 99%

Cryptographic Cloud Storage with Hadoop Implementation

2013

IOSR-JCE

View full text Add to dashboard Cite

Cryptography in $NC^0$

Cited by 153 publications

References 16 publications

Goldreich’s One-Way Function Candidate and Myopic Backtracking Algorithms

Goldreich’s One-Way Function Candidate and Myopic Backtracking Algorithms

The Complexity of Distributions

Cryptographic Cloud Storage with Hadoop Implementation

Contact Info

Product

Resources

About