The Security of All Bits Using List Decoding

Abstract

Abstract. The relation between list decoding and hard-core predicates has provided a clean and easy methodology to prove the hardness of certain predicates. So far this methodology has only been used to prove that the O(log log N ) least and most significant bits of any function with multiplicative access -which include the most common number theoretic trapdoor permutations-are secure. In this paper we show that the method applies to all bits of any function defined on a cyclic group of order N with multiplicative access for cryptographically interesting N . As a result, in this paper we reprove the security of all bits of RSA, the discrete logarithm in a group of prime order or the Paillier encryption scheme.

Hardness of Computing Individual Bits for One-Way Functions on Elliptic Curves

“…In 2009, Morillo and Ràfols [28] extended these results and were able to prove the security of all bits in RSA, Rabin and DL for prime orders or RSA moduli using a careful analysis of the Fourier coefficients of the function that maps an element of Z/nZ to the value of the kth bit of its corresponding representative in [0, n − 1]. They also extended the result to the Paillier trapdoor permutation [32].…”

“…end for 9: end for 10: [28] significantly simplify this computation by noticing that if the argument x was simple an integer (not an integer mod p) then B k (x) + B k (x + 2 k ) is identically zero and hence, is a constant function. This fails mod p, but it does not fail too much, so one still has good control over the coefficients.…”

Bit Security for Lucas-Based One-Way Function

“…More precisely, one can prove security of the ( ( )) least and most significant bits of these functions, where is the size of the input parameter of the one-way function. Using the listdecoding method, Morillo and Ràfols [16] extended these results and were able to prove the security of all bits in RSA, Rabin and DL for prime orders or RSA moduli using a specific analysis of the Fourier coefficients of the function that maps an element of to the value of the -th bit of its corresponding representative in [0, − 1]. They also extended the result to the Paillier trapdoor permutation [17].…”

“…This notion was extensively investigated in the early 1980's, culminating in proofs that some specific bits for these candidate oneway functions such as RSA, Rabin, ECL are individually hard( [7], [1], [5]), and that those ( ( )) bits are also simultaneously hard ( [1], [23]). All the subsequent efforts are to extend the techniques to prove the individual or simultaneous security of ( ) bits in these number theoretic functions ( [25], [3], [16]). …”

On sets of large Fourier transform under changes in domain

“…In recent years different areas of mathematics, such as additive number theory [2], combinatorial number theory [5] and cryptography [4], have seen results that take advantage of the structure arising from large values of the Fourier transform. Most notably, the quantum algorithm for period finding given by Shor [6] is an application that exploits this structure.…”