Theory and AppDcations of Trapdoor Functions

(extended abstract)

Andrew C. Yao·
Computer Science Di,ision
UniYeTSity ofCalifornia
Berktlq, CaljfomiQ 94720

Allstract bits to B. What is the most efficient way (in tenns of minimizing the
The purpose of this paper is to introduce a new information number of bits sent) for A to inform B of the string generated by
theory and explore its appplications. Using modem computational 81 More precisely, suppose A wants to send n consecutive symbols
complexity, we study the notion of information that can be accessed output by S, what is L n , the minimum expected number of bits A
through a feasible computation. has to send? (See [22] for a precise definition o.f L,,).

In Part 1 of this paper, we lay the foundation of the theory Shannon's First Theorem [22]. lim,,-+oo L.",
n
= H( S).
and set up a framework for cryptography and pseudorandom number In fact, it is true that
aeneration. In Pan 2, we study the concept of trapdoor functions and
examine applications ofsuch functions in cryptography, pseudorandom
nH(8) ~ L" ~ nH(S) + 1.
Dumber generation, and abstract complexity theory.
In other words, the minimum average number of bits to describe one
P.rt 1: Computetionel ~n'ormetion Theory symbol output by 8 is H(S).

1. INTRODUcnON This is one of the two fundamental theorems in information

By now, Shannon's definition of information (in tenns of entropy) theory; we will review the other one later on. But right now,
has been universally accepted as the correct measure of statistical events we are ready to give a detailed illustration of how computational
[22]. It possesses a number of desirable properties, and has been shown considerations may affect the conclusions supplied by information
to be the only possible definition which can satj.sfy these properties theory.
(see Shannon [22]). It appears in several important theorems, always Exemple 1. Let E be the set of all k-bit binary strings with k =
providing the natural interpretation. Then, why are we interested in
104 • For any 100-bit integers x and m, let 02:,m denote the string
modifying this fundamental definition, and hence the entire theory?
CtC2 •• •c" where Cj = parity of (xi mod m). Let A ~ E be the
The answer is that, roughly speaking, sometimes it may take an multi-set {02:,m I x,m}. Thus, IAI = 2 200 and lEI = 2 1000 °.
astronomical amount of computation to extract the Shannon informa- Consider the source S over E with distribution density p(y) = l/lAI
tion contained in a string; and on such occasions, the conclusions if yEA and p(y) = 0 otherwise. Clearly, H(S) ~ log21AI = 200.
reached by information theory may become inconsequential. To il- Shannon's First Theorem states that, in principle, A can send n output
lustrate this more precisely, let us first review some basic facts in the
symbols of S to B usilig nH(S) = 200n bits. In fact, A can simply
Shannon theory.
represent each output 02:,m by the 200-bit string xm. However, in
Let E ={at, a2, ..., Q a } be an alphabet, i.e., a finite set of order to do this, A has to compute x and m from the lOOOO-bit string
symbols, and P a probability density over E, with Pi = p(ail. 02:,m, as the latter is all A knows. It is not obvious that this can be
Consider a device S that stochastically generates an infinite sequence done in a reasonable amount of computing time.
b1 b2 bs . .. one symbol at a time, where each bj is independently
distributed according to p. Call such a device S a sou;ce, and let the The above example is only used to demonstrate that Shannon's

entropy of S be H(S) = E i Pi log2(1/Pi). One could think of H(S) First Theorem does not immediately guarantee a computationally
as the amount of uncertainty, or information, contained in each output feasible encoding using H(S) bits per source output. We do not
symbol generated by S. That this is a reasonable interpretation will know the true answer to this particular problem.
be borne out in the next theorem. We now review some more infonnation theory. Again, assume
Suppose two people A and B are far apart, with a source 8 on that A wishes to inform B of the output of a source S. This time
A's side, and a communication medium by which A can send binary however, the communication medium C.between A and B, while still

80
0272·5428/82/0000/0080$00.75 © 1982 IEEE

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
carrying 0,1 signals, is imperfect in the sense that there is a probability 2. EfFECIlVE ENTROPY
q for a "0" signal to be received as a "1", and similarly a probability Given a source S with a large alphabet such as in Example 1,
q for a "1" to be received as a "0". In the literature, C is called a how should we define the information contained in its output? We
binary symmetric channel, or BSC. How Inany bits must be sent over will adopt the view that the minimum average number of bits needed
the· channel C in order to communicate n output bits of 8? As errors to describe an output in a computationally feasible way is the proper
are inevitable if q > 0, we are interested in keeping the probability measure. In other words, we will regard Shannon's First Theorem as
for error below any pre-assigned level f > O. a definition.
Let I = {O, I}, J = {O, I} denote the input and output We have in mind the following situation. The source has an
alphabets of C. A code of length m is a subset E ~ 1m ; a decoding alphabet whose symbols are finite binary strings wjth an average length
rule is a function f : Jm ..... 1m . For any x E E, let P( x) be the n (say n ~ 200). Person A is interested in communicating to B a
probability that f(y) ~ x if y is received when x is input to C. sequence (] of n t output symbols of 8 (t is a fixed integer, say t = 3).
I)efine the capacity of C by capacity(C) = 1- qlog 2 (I/q) - (1- The question is, how short a string p can A compute in a reasonable
q) log2(1/(1 - q)). amount of time (say in time n k for some fixed k), so that B, on
receiving p, can recover (J in a reasonable amount of time? To define
Shannon's Second Theorem [22]. For any R < capacity(C) and
this concept precisely, we resort to the well-developed computational
£ > 0, there exists (for sufficiently large m) a code E of length m
complexity theory. In this theory, the complexity of a computational
and a decoding rule f such that (a) lEI ~ 2Rm , (b) P(x) < f for
problem is· measured by the asymptotic behavior of algorithms as
all x E E.
the input length becomes large. To apply the theoretical results to
The ratio (log2IED/m is called the rate of the code E, as it is input of a particular length, we tacitly assume that this length is large
the average number of nlessage bits communicated for each bit sent enough that the asymptotic results can be used. For example, suppose
over the channel when code E is used. theoretically one can prove that the decision problem for a certain
There are converses to the above theorem. Essentially, they state formal logic system has complexity 0(2 2 "), Le. any algorithm T
that to transmit at rate R > capacity(C) is impossible without making for the decision problem must have a running time .~ CT2 2" for
the error f -+ 1. some constant CT > o. We will then regard that, for formula size
n ~ 1000, any reasonable algorithm must use time ~ 221000 for
Shannon's Second Theorem is true for channels more general than
BSC. Define a channel C to bean r X t matrix (Vij) satisfying Vij ~ 0 some input formula. Taking this approach, we need to consider not
and E j Vij = 1. The interpretation is that C has an input alphabet one source, but a sequence of sources, and look at the asymptotic
I = {bb b2 , ••• , br } and an output alphabet J = {Cll C2,···, Ck}, behavior of the quantities of interest
such that if b;, is input, then the output will be Cj with probability vii· Deflnition 1. Let E be a fixed, finite alphabet. A source 8 is
It can be proved that Shannon's Theorem is true for properly defined a probability distribution p over E+ with a finite expected length
capacity(C). We refer the readers to textbooks on information theoty P(8) = E:r; p(x)lxl· A source ensemble S is a sequence of sources
(e.g. [8]) for details. 81,82, ... , with probability distributions PlI P2, .•. , such that for
In theory, Shannon's Second Theorem makes it possible to some fixed t2 > tl > 0, Pn(Y) > 0 implies n t1 < Iyl < nta .
construct an explicit code with given rate R < capacity(C) and error
Remark. This last assumption is not essential, but useful for
bound f > 0 in O(1) time, by exhaustive search over all possible
simplifying later discussions; it is satisfied by most applications that
codes of length 1,2, .... However, such a procedure is in practice
we are interested in.
computationally prohibitive. The study of finding practical codes has a
large literature [8], and there has also been improved theoretical results In the following, a probabilistic algorithnl means a probabilistic
on the time and storage requirements for codes achieving given Rand multi-tape Turing Machine [9] that always halts. One can alternatively
£: (Ziv[26]). It is therefore true that the computational complexity thinks of it as a program on a random access computer that always
has already received much attention in information theory. However, halts, since we will only prove results that are polynomially invariant
the computational aspect in which we are interested is quite different
For our purpose, the coding problem. for the classical channels has Notation. We will use the notation O(v(n)) for any function f{n)
essentially been solved. We are mainly interested in the situation that vanishes faster than 1/ n t for every fix.ed t.
when the source becomes non-classical, Le., the alphabet size can no The following definition specifies precisely how A is allowed to
longer be regarded as a constant, as illustrated in Example 1, and in encode a sequence of n k (for some k > 0) output symbols from 8 n t
the situation when the channel becomes non-classical as we will see and how B decodes it
later.

81

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
Definition 2. Let t, k > 0 be any fixed number. A (t, k)-encoding Definition 5. The true random number ensemble 10 is the source
of S is a triplet of probabilistic algorithms M = (MA' M B , Me) ensemble 8 1 ,82 , ••• , where 8" is defined to be the probability
satisfying the following properties: distribution Pn(x) = 2- n if Ixl = n, and 0 otherwise.
(a) Given input 0 = (n, Xl, X2, ..., Xnk), where Pn(Xi) > 0 for Theorem 1. For any source ensemble S, He(S; n) ~ H(8,,) +
all i, algorithm M A will halt in time O( n t) and leave some binary O(v(n».
string (3 on the output tape of M A ; let qn( 0) denote the probability
distribution of fJ;
Corollary. He(To;n) = n + O(v(n».
(b) Given stochastically an input pair (n, (3) where (3 is distributed The additive O(v(n» appears in the above theorem, because we
according to q(o), the algorithm M B will halt in time O(n t ) and leave allow O( v( n) probability error in Definition 2. The form of the
the string 0 on the output tape of M B with probability 1- O(v(n»; equality in the Corollary turns out to have a special significance as
will become clear in Section 5.
(c) Let b > 0 be any fixed number. Given n and any string
{3 = {3t{32· •.{3u where each (3i is a possible output from MA for Are there source ensembles with effective entropies much greater
some ai and 'U = O(n b ), the algorithm Me haltsin time O(n b') for than their Shannon entropies? The answer is yes. Let g( n) be any
some fixed b' and output (31{32 •• •fJu correctly with error probability monotonic function that goes to infinity and (log2 n)2 < g(n) < n.
O(v(n».
Example 2. The following source ensemble S = 8 1 ,82, ... can
Define In(a) to be the expected length of (3 over q,,(a).
be shown to have H(8n ) = g(n), while He(S; n) = n + O(v(n)).
Let Pn(a) = Pn(Xt)Pn(X2) ...p,,(Xnk). Let In(M; S) =
Let 017 02, ..• be a sequence of binary strings, where an has length
LaP,,(a)ln(a)fn k , the average number of bits used by .M to encode
n . 2g(n) and is of maximum Kolmogroff-Chaitin information [6][14].
an output symbol X of 8".
Write On as 0nlan2 •••anG(n), where G(n) = 2g (n), with lanil =
Remark. Properties (a) and (b) stipulate that encoding and
n; let 8 n be defined by p(x) = 2- g(n) if x = Oni for some i, and
decoding can be done in polynomial computation time, and with error
o otherwise. It is in fact not hard to modify the above definition
O( v(n». Property (c) roughly states that the code is a uniquely
to have a constructable S, using a relativized version of algorithmic
decipherable code, in the sense that to transmit 'U • n k outputs of the
information (defined by Levin).
source 8 n , one can encode each n k segments seperately and then
concantenate the 'U blocks for transmission.
3. RELIABLE TRANSMISSION
Definition 3. A (t, k)-enlropy sequence for S is a sequence Wt, W2, •••
The centerpiece of information theory is Shannon's Second
such that there exists a (t, k)-encoding M for S with In(M; S) = w".
Theorem, which states that a channel C can reliably transmit in-
Only the asymptotic behavior of W n is of interest, since for any formation at a rate of R bits per channel transition provided R <
fixed n, we can choose .M with enough states to make W n = H(8n ), capacity( C). Further, a rate of R > capacity( C) is impossible to
the Shannon entropy of S". achieve. The natural quesiton facing us is: Ho~ fast can a channel
Definition 4. We say that the effective entropy H e ( S) is less than transmit computational information? In this section, we will study one
g(n), or in symbols He(S) ~ g(n), if there exists t, k > 0 and side of this question, namely: Can C tansmit computational informa-
a (t, k)-entropy sequence (w n ) for S such that W n ~ g(n) for all tion reliably at rate R fbits with R > capacity( C)? (We have coined
sufficiently large n. the term fbit as a unit for effective entropy.)

Similarly, we write He(S) ~ hen) if, for every fixed t, k > 0, Let us first define the above question more precisely. As the
every (t, k)-entropy sequence (w n ) for S satisfies W n ~ h(n) for details are similar to Definiton 2, we will state the definitions infor-
all sufficiently large n. We will also use notations such as H e ( S) = mally. In contrast to the way a code and its rate are defined in the
O(g(n)), flh(n)), 8(f(n», etc. Shannon case, we need to define the concepts of code and rate relative
to a source ensemble.
Thus, we are using the term "effective entropy of a source
Definition 6. Let S = (8n ) be a source ensemble, and let C be
ensemble" in the same spirit as we speak of "the computational
a channel with input-output symbol sets [ and. J. A (t, k )-coding
complexity of a decision problem"; neither is a well-defined quantity,
scheme of S over C is a triplet of probabilistic algorithms M =
but can serve as a useful shordhand. In some cases, however, one
(MA , M B , Me) that always halt in polynomial time q(n t ). For any
has upper and lower bounds tight enough to write equalities such
n and a string 0 ofn k outputs from Sn, the encoder M A stochastically
as He(S; n) = g(n) + O(logn). An important case is the source
computes a string {3 E [*, sends it across channel C; the decoder
ensemble that corresponds to random numbers.
MB takes the resulted output string "'I E J* and computes a string
6. The requirement is that, when averaged over the probabilistic

82

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
distribution of Q and over all the stochastic moves of MA' M s and have to accept that, even in simple situations, not all tbits behave
C, the probability of 6 =I Q is of order O( v(n)). The strings "1 alike.
(output from the channel C) are uniquely decipherable by algorithm
The second point is the there is no obvious reason why the
Me (as in Definiton 2), again allowing for failure probability O{v(n)).
Theorem is true. Consider the coding of a source ensemble S with
Definition 2 can be regarded as a special case of Definition 6. A Jlc(S;n) ~.;n. The codewords conceivably can be so sparsely
(t, k)-encoding of S is essentially a (t, k)-coding scheme of 5 over C, populated that if we use the same coding to transmit over a BSe
where C is the binary symmetric channel with crossover probability with small crossover probability q, the displaced codewords after
q=O. channel transmission are still widely apart Thus, there is no purely
Definition 7. In the previous definition, let In( M; 5; C) be the combinatorial obstacle for the encoding to remain a valid one for a
expected value of IPlln k , when the input Q to M A is generated BSe, and retain a rate higher than that allowed by Theorem 2. The
probabilistically by source. 8 ft • fact that a consistent interpretation is obtained in a new environment
after complexity-type reasoning gives us confidence that our definition
Thus, In(M; S; C) is the average number of channel symbols used is on the right track.
by M to transmit reliably over channel C one output symbol of the
source 8 n . To see what "rate", the traditional performance measure
4. INDISTINGUISHABILITY
of a code, corresponds to, let us for the moment assume that Jlc{ 5; n)
Let 8 and 8 ' be two sources with known distinct probability
has a sharp asymptotic behavior (e.g. Jlc{S; n) = .;n + O(n 1 / S ).
distributions p and p' over E+, where E is a fixed alphabet. Suppose
In such a case, the natural definition of the rate of M (for S over C)
a box that simulates one of the sources is given to you, but you are
is
R _ Jle (5;n)n k jbits not told which source. The box will emit upon each request a string
n - in{M; 5; C)n k channel transitions distributed in accordance with the underlying distribution. Can you
Jle (5;n) fb' 'h I .. tell with confidence which source the box is simulating?
in ( M; 5; C) lis / c anne transition.
For the classical sources, the answer is "yes" since one can always
Then, the question of whether it is possible to transmit computational take enough outputs and observe the frequency of occurrance of any
information reliably at a rate higher than the channel capacity becomes particular string v for which p(v) -:rf p(v'). In the non-classical case,
"Do there exist an M and a fixed f > 0 such that Jle{S; n) > however, the question is more complex. Even when p and rI differ
(capacity(C) + f)ln(M; 5; C)1 ft. substantially, say p(v) = IEI-n for all v of length nand rI(v) =

The next theorem says that the answer is "no". (The statement
I/ITI where T ~ En and ITI = IEIv'ft it is not obvious that there is
a way of deciding which alternative is true (an astronomical number
of the theorem is valid even if )(e( 5; n) is not sharply determined.)
of observations will be needed if we use the method mentioned above
Theorem 2. Let M be an encoding scheme for a source ensemble 5 for classical sources). We now define precisely what we mean by two
over a channel C. Then for any fixed f > 0, there exists an entropy indistinguishable sources.
sequence (w n ) for 5 such that Definition 8. Let 5 = (8n ), 5' = (8~) be two source ensembles.
W n < (capacity(C) + f)ln(M; 5; C) A witness algorithm M for (S, 5') is a probabilistic algorithm such
that the following properties are true for some fixed t, k and f > 0:
for all sufficiently large n.
(a) For any input (n,Q), where Q = (Xt,X2, ••• ,Xn k) is a sequence
Corollary. If )(e(5; n) ~ h(n), then of n k outputs of 8 n , the algorithm M halts in time O(n t ) and
h(n) leaves a boolean output M( n, Q); let f n( M, 5) be the probability
in(M; 5;C) > capacll'XC) + E that M(n,o) = I when 0 is generated probabilistically by 8 ft ;

for all sufficiently large n. (b) Similarly, let fn(M, 5') be the corrresponding probability for 5';

The proof of this theorem is quite involved. We will not get into it (c) There exists an infinite sequence of (distinct) values nt, n2,.·.
here. such that

Let us mention two reasons why Theorem 2 is important for our Ifn(M, 5) - fn(M, 5')1 >f
theory from an aesthetical point of view. First, if the theorem were
Definition 9. Two source ensembles 5 and 5' are said to be
false, we would have a channel (say with capacity equal to 2) for
indistinguishable if there exists no witness algorithm for 5 and 5'.
which each channel input symbol can carry at most 2 bits of Shannon
information, but may carry more, say 2.4 fbits, of computational Note that a witness algorithm may not be a suitable algorithm
information. The natural interpretation of Shannon's Second Theorem for deciding if a box is simulating source 5 or 5', since condition
will be lost for transmitting computational informaion. We would also (c) only guarantees that 5 and 5' behave differently for some values

83

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
of n. The definition of witness algorithm is desiped to ensure that Deftnition 10. A source ensemble S = (Pn) is said to be uniform
two indistinguishable sources behave almost identically for any test as if all strings Z with Pn(Z) > 0 have the same length e(n), and
n -+ 00. furthennore e(n) < €(n + 1) for all n. Call €(n) the length jUnction
for S.
There exist indistinguishable source ensembles with very different
underlying probability distributions. In fact , the ensemble S defined For simpliCity, we will assume that the alphabet is {O, I} for the
in Example 2 and the true random number ensemble 10 (Definition rest of this section. Note that by definition, n t1 < €(n) < nt:a for
5) are indistinguishable. The reason will become clear in the next some tl, t2 > o.
section.
Let €(n) be an integral-valued function with €(n) < €(n 1). +
Define Te to be the source ensemble (8ft) where 8ft is the source
5. A THEORY OF PSEUDORANDOM NUNBERS corresponding to the €( n )-bit random numbers.

The study of the concept of randomness in strings has received Definition 11. A uniform source ensemble. S with length function
considerable attention (see Knuth [13]). There are two types of results: €(n) is. said to be perfect if Sand Te are indistinguishable.
the first type deals with the question of "what is a random sequence",
We want to stress that a uniform source ensemble does not
and the second type delas with the problem of pserdorandom number
necessarily correspond to a pseudorandom number generator, because
generation. The former question is concerned with properties of a
the underlying distributions may not be generated from a small number
single sequence,· and has been satisfactorily answered through the wort
of random bits. Before turning to the task of defining pseudorandom
of many researchers (e.g., Kolmogroffl14], Chaitin[6], Martin-Lof[lS),
number generator, we want to explore the property of being "perfect"
Levin[27], Meyer and McCreight[16]); we will be interested in the
in more depth.
latter problem.
How does the concept of statistical test fit into the picture? Let
The need for pseudorandom numbers arises on many occasions
us define the teon rigorously.
such as simulation, sampling, cryptography, etc.. How should one
choose a pseudorandom number generator for a particular application? Deftnition 12. A polynomial statistical test is a probabilistic algorithm
In the literature, there are many proposed methods of generating M that takes only inputs of the form (Xl, X2, ••• , XNk), where each
pseudorandom· numbers, and various statistical tests are available for Xi is an N-bit number, halts in time O(N t ), and outputs a binary
measuring the strength of a proposed scheme.· If, in an application, string y) where t and k are some fixed positive integers.
it is possible to isolate some simple randomness properties that
Definition 13. In the above definition, let 1/(N, y) be the probability
can guarantee success, then a statistical test. based on the desired
that y appears as output when the inputs Xi are independent N -bit
randomness properties can be used to screen and select a appropriate
numbers. For any unifonn source exsemble S with length function
generator. This, however, is seldom the case. Furthermore, the
€, let TJ M (N, y; S) be the probability y appears as output when the
performance of a pseudorandom number generator under a particular
inputs Xi are generated by source 8ft where N = €(n). (TJM(N, y; S)
statistical test is usually hard to detennine analytically, and often has is defined only when N = €(n) for some n.)
to rely on empirical evidence.
Infonnally, the test M takes Nt N -bit outputs from source
Wouldn't it be nice if there existed a pseudorandom. number
ensemble S and computes a quantity y. This quantity y is usually
generator that is fit for all applications? In this section, we will set
used to produce a fraction 8 = f(y, N) (either by table look-up or
up a framework for discussing pseudorandom numbers, and introduce
by another calculation), which represents a confidence level that S
the concept of a perfect pseudorandom number generator. In Part II
should be rejected as non-random (see e.g. [13D.
of this paper we will exhibit a class of generators that have strong
theoretical evidence to be perfect Definition 14. Let M be a polynomial statistical test, and S a
unifonn source ensemble. We say that S passes the statistical test M
For our purposes, a pseudorandom number generator is an. al- if TJM(N, y; S) - 1/M(N, y) = O(v{N)) for all y.
gorithm that takes some true random bits and generates determinis-
Theorem 3. A unifonn source ensemble S is perfect if and only if
tically a much longer sequence of bits. For example, one possible
S passes every polynomial statistical test
linear congruential generator is to choose randomly four n-bit num-
bers m, a, c,Xo and generate a n 3 -bit sequence p = X 1 X 2 •• ·Xn 3 by This establishes the link between statistical teste; and our definition
X,.+l = (aX,. + c) mod m. We can regard the probability distribu- of a perfect source ensemble. So far, we have discussed this concept
tion of the final string as a source. The strength of the pseudorandom of "perfect" completely in terms of computational complexity. The
number generator can be studied as a property of the source, without next result shows that we can also express it in terms of computationl
regard to how it is generated. Let us first see how one can formalize infonnation.
this in tenns of sources.

84

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
Theorem 4. A uniform source ensemble S is perfect if and onty if usage of this term in probability theory, i.e., Pr{X = x, Y = y} =
)lc(S; n) = n + O(v(n)). PriX = x} . Pr{Y = y} for all x, 1/.
The significance of the equality in the corollary to Theorem Let us now define the corresponding notions in our theory. As
1 ashhould now become clear: it characterizes the perfect source in defining effective entropy, we begin with an example to illustrate
ensembles. It also follows from Theorem 4 that the S in example 2 the need for different definitions when computational efforts are taken
is a perfect source ensemble, and hence indistinguisahable form 70. into account.

We close this section with by defining pseudorandom number Consider the sample space T of all bipartite graphs G between
geneators in the present setting. two vertex set of 1000 nodes each, and assume that all such graphs
are equally likely to occur. Let X and Y be random variables defined
Definition 15. A pseudorandom number generator G is a probabilistic
by Y(G) = G and X(G) = the number of perfect matehings in G
algorithm such that, given input integers k and n, it
(mod 3). It is clear that, since one can compute the value of X
(a) halts in polynomial time in D, from that of G, H(XIY) = o. Thus, I(X, Y) = H(X); we can
(b) uses O( n) true random bits, and say that Y contains all the Shannon information about X. However,
we do not know any efficient way of computing X from G, and it is
(c) outputs a binary string (} of length n k •
conceivable that no efficient algorithms exist (in an average-case sense).
For each k, the above generator G defines a natural source
If it were the latter case, then we can view the Shannon information
ensemble Wk(G) = (Sn), where Sn is the source that outputs 0 of
which Y contains about X as being inaccessible, at least partly, by
length n k with the same probability as G does (when n is the input).
feasible computations. Thus, a different definition of H(XIY) is
Definition 16. A pseudorandom number generator G is said to be clearly needed to express such possibilities.
perfect if Wk( G) is a perfect source ensemble for every fixed k.
We do not know whether efficient algorithms exist for the par-
ticular problem discussed above (it is NP-hard, see [24]). It is possible
6. MurUAL INFORMATION AND INDEPENDENCE to construct examples where the phenomenon can be rigorously shown
We first review the concepts of mutual information and indepen- to exist
cence in Shannon's theory. Let Q = (T, p) be a probability space, Let us try to capture the notion of effective conditional entropy.
where T is a finite sample space and p is a probability distribution Consider a source ensemble S = {Sn} over alphabet E. A random
on T. For any random variable X : T t-+ Vx , where the number of variable X on S is a sequence (Xn), where X n is a random variable on
possible values IVxl is finite, let the entropy of X be Sn (regarded as a probability space) with values of X in E+. Suppose
1 the source Sn emits a sequence ofn k output symbols 01,02,.'" anAl,
H(X) = E
%EVx
pX(X)1092-(x)'
PX and person A is told the value of X(ai) and Y(Oi) for 1 ~ i ~ n",
where Px( x) = Ex(t)=% p( t) is the probability that X = x. We while person B is only told the value of Y(Oi) for 1 ~ i ~ n t .
can regard H(X) as the average amount of information that a single Now, if A wants to inform B of the value of X(ai) for 1 ~ i ~ nt,
observation of the value of X gives us. The entropy H(S) of a source what is the minimum average number of bits A has to send to B?
S can be obtained as a special case, when S is both the sample space Note that the question reduces to the question one faces in defining
and the random variable. effective entropy, when Y is a constant and X( Oi) = 0i.

Let Y be another random variable on Q. The conditional entropy We will just state these definitions informally, as the details are
of X given Y is defined as similar to those in Definitions 2-4. A (t, k)-encoding of X relative 10
H(XIY) = = (MA , Ms, Me), where
Y is a triplet of probabilistic algorithms M
1 the encoder M A takes input a = (n, Xl, X2, ••• , Xnk, Yl, Y2,.··, Yn Al )
yEVy
E py(y) E PriX = x I Y = y}log PriX =
%EVx
x IY = y}' and computes some binary string f3, which if input together with n and
Le., the average amount of information an observation of X gives us, Yb Y2, ... ,Yn" to the decoder M s , will enable Ms to recover the

when the value of Y is already known. The mutual in/onnation of string Xl, X2,' •• , X n " with .error probability O( v(n)); furthermore
Y about X is I(X, Y) = H(X) - H(XIY). One interesting fact is the codewords f3 are uniquely decipherable by algorithm Me; the
that the mutual information is symmetric, Le., I(X, Y) = I(Y, X). algorithms MA,Ms,Me all halt in O(nt ) time. Let In(.M;XIY)
Quantitatively, it means that if knowing the value of Y tells you some denote the average value of 1f3l1nk, that is, the average number of
information about the value of X, then knowing the value of X tells bits used by M to encode a value x of X. A (t, k )-condilional-entropy
you roughly the same amount of information about Y. sequence for XIY is a sequence {w n } such that there exists a (t, k)-
encoding of X relative to Y with In(M;XIY) = W n . We use the
Two random variables X and Yare said to be independent if
I(X, Y) = O. It can be shown that this agrees with the traditional
abbreviations Hc(XnIYn ) ~ g(n), He(XnIYn ) = g(n) + O(h(n»

85

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
etc. in the same way as in Definition 4. We will use the tcoo effective eavesdropper taps the line and obtains a ciphertext J = E(K, M).
conditional-entropy of XIY for Hc{XIY). How much can he find out about the plaintext M?

We now tum to the question of mutual information. Shannon discussed this situation in [23]. Consider K, M, J as

Definition 11. Let g( n) and h(n) be any functions. We will write random variables. Then I(M, J) = H(M) - H(MIJ) will be the
Ie(XnIYn ) ~ g(n) if the following is true: For any conditional- amount of information about M which the eavesdropper obtains. An
entropy sequence (w n ) for XIY, there exists an entropy sequence unconditionally secure system is one in which H(M) = H{MIJ).
(w~) for X such that w~ ~ W n +
g(n) for all sufficiently large n. It was pointed out that unconditional security cannot be achieved
Expressions such as Ic(XnIYn ) = O(g(n», Ic(XnIYn) 2 h(n), etc. if H(K) < H( M). Thus, if we have 200-bit long keys and 108 -
can be similarly defined. bit messages, then most likely we cannot have an unconditionally
secure system. However, Shannon pointed out that the computational
In general, Ie(XnIYn) is not symmetric, in contrast to the case
complexity aspect should be taken into account. Let us see how we
of classical mutual information. In fact, this asymmetry property is
can approach this problem.
essential for the possibility of public key cryptography (see § 5 Part
2). In one important special case, however, Ie is nearly symmetric. As our theory deals with asymptotic behavior, it only applies
to cryptographic systems that can be scaled up or down easily. For
Theorem 5. Ie(XnIYn) = O(v(n» if and only if Ic(YnIX,,) =
definiteness, assume that for each n, the system has n . . bit keys K",
O(v(n».
n 4-bit messages M n and a pair of encription-decription functions
Definition 18. X and Y are said to be effectively independent if
En(Kn, M n ), Dn(Kn , I n). The key K n and the message M n are
Ie(XnJYn ) = O(v(n»
distributed according to some probability distributions Pn and qn. Let
In the classical case, there is an alternative description of inde... us consider the probability spaceQn defined as follows: The sample
pendence, namely, PriX = x, Y =y} = Pr{X =
x}· Pr{Y = space is the set of all possible values of (Kn , M n , En (K,u M n )), and
y}. Is there an analogue? Let us define two new source ensembles Pn(Kn = k) . qn(Mn = m) is the probability assigned to the point
5' = (S~) and 5" = (S~) for given X and Y. The source S~
(k,m,En{k,m)). Let Q = (Qn), then K, M and J = E(K,M)
probabilistically outputs a string (x, y) by the following process: Let
become random variables on the source ensemble Q. We define
8 n generate probabilistically an output 0, then define x = X(a),
the computational security of the system by the requirement that
y = Y(o). The source S~ outputs (x, y) by the following process:
Let 8 n generate independently two output strings a1, 02 and define
Hc(M) ~ Hc(MIJ), or Ic(MnIJn ) = O(v(n)). That is, a system
is· said to be computationally secure if the random variables M and
+
x = X(at}, y = Y(a2). Let us write 5' as 5(X Y), and 5" as
J are computationally independent. By the discussions at the end of
S{X X Y).
last section, an eavesdropper on a secure system cannot learn anything
Theorem 6. Let X and Y be random variables ('n a source ensemble about M from the ciphertext when n is large.
S. Then X and Yare effectively independent if and only if S(X Y) +
and S(X X Y) are indistinguishable.
Part 2: Trapdoor Functions and Applications
Theorem 6 implies that any polynomial-time test must fail to
detect any correlation between effectively independent X, Y for all 1. INTRODUcnON
sufficiently large n. It also implies that observing Yt, Y2, .•• , Ynk will The concept of one-way functions and trapdoor functions have
tend no noticeable advantage to predicting the value of any function been suggested by Diffie and Hellman [7] as the foundation for a
of xl, X2, ••• , Xnk. new type of cryptography. Since then many implementations and
applications have been found. However, the, question "what is a
7. A THEORY FOR CRYPTOGRAPHY trapdoor function'!" has so far not been answered satisfactorily.

In [23] Shannon dcvelped a mathematical theory for cryptography The purpose of Part 2 is to propose precise definitions for one--

based on information theory. With the tools we have develped, we way and trapdoor functions, based on the computational infonnation

are ready to give an alternative foundation based on computational theory developed in 'Part 1, and to present improved results and new
complexity theory. applications. Concretely, we will show that any trapdoor function can
be used to produce a secure encryption scheme as defined in Part
For lack of space, we will give in this abstract only one elementary
1, and perhaps more surprisingly, can be used to generate "perfect"
i1lustraion. Consider a conventional cryptographic system where two
pseudorandom numbers that will pass any feasible statistical tests.
users A and B share a secret key K form a large key space K. Let
We also give a new function that is a trapdoor function, assuming
E(K, M) be the encryption algorithm and D(K, M) the decryption
factorization of large integers is computationally infeasible. Finally
algorithm, i.e., D(K , E(K , M») = M. Let p and 9 be the probability
an interesting implication of the existence of one-way functions on
distributions for message M and key K, respectively. Suppose a
abstract complexity theory will be presented.

86

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
2. BACKGOUND User A generates a random n-bit composite integer N = TJ • q
2.1 ENCRYPTION of two prim~ and puts N together with a non-residue II E AN in
the public file. Suppose B wants to send a bit bto A. Then B will
Diffie and Hellman [7] invented the concept of public key encryp-
randomly generate an x E Ziv and send x 2 mod N if b = 0, and
tion for sending secret messages. In this scheme, every user A puts a
public key KA to an encryption function EKA on the public file, and
yx 2 mod N if b = 1. Thus, A can decide if b = 0 or 1 by finding
out whether the number received is a quadratic residue or not An
keeps a private key K~ to a decryption function D K~ as private inifor-
eavesdropper not knowing the factorization of N will have difficulty
mation. The pair (KA, K~) has the property that D K~ (EKA (x)) =
deciding what b is.
x for any x in the domain of EKA. Anyone wishing to send a message
x to A can encrypt it as EKA(X), and A then recovers x'by applying Schemes like this produce stochastically a ciphertext for a given
DK~ to EKA(X). For the scheme to work properly, the following message, and are called probabilistic encryptions [10].
properties should be satisfied: Goldwasser and Micali [10] showed that under Assumption GM
(a) Given KA and x, the value of EKA(X) should be easy to compute; below, for any fixed 0 < f < 1, an adversary will not be able to
given K~ and y, the value of DK~ (y) should be easy to compute; +
guess correctly the value of b with probability 1/2 f or more.

(b) Given E KA (x), it is computationally difficult to find x; D.lnition 19. Let Cn,E be the minimum size of any cirtUit that
decides correctly quadratic residuosity mod N for a fraction f of all
(c) A random pair of (KA , K~J should be easy to generate.
n-bit integers N with two prime factors.
Since these functions EKA (x) are easy to compute but hard to invert,
they are called trapdoor functions.
Assumption GM: C",E > Q(n) asymptotically for any fixed polyno-
mial Q and any fixed 0 < f < 1.
A concrete implementation was suggested by Rivest, Shamir and
Adleman (the RSA scheme (20)). In their scheme, user A generates two
2.2 PsEUDORANOOM NUMBER GENERATION
random primes p and q, and an integer s such that gcd(s, </>(N)) = 1,
where N = p . q and </>( n) is the Euler totient function. Let N be The use of pseudorandom number generators as an approximate
the public key KA, and r = 8- 1 mod 4>(N) be the private key K~. one-time pad is a common mode of secret communication. Shamir [21]
The function EKA(X) = XS mod N serves as the encryption function, considered the following problem. Suppose two persons A and B share
while D KA (x) = xr mod N serves as the decryption function. a common secret seed 8~ and use a common pseudorandom number
generator. For A to send blocks of plainatext Yl, Y2, • •• to B, A can
A variation of the RSA scheme was suggested by Rabin [19].
use s to generate a sequence of.pseudorandom numbers Xl, X2, ••• ,
Instead of using X S mod N, he defines E KA (x) = x2 mod N, and
and send ciphertext Xl EaYl, X2E9Y2, ••• to B. These can be decoded
decryption is easy for user A who knows the factorization of N. An
easily by B since B can generate the sequence Xl, x2, • ••• Now
interesting fact is that a successful inversion of EKA (x) for any f
imagine the situation when an adversary has some side information
fraction of the x's will enable one to factor N in random polynomial
on the plaintext which enables him to find out a few initial values
time. of X17 X2, ••• • Based on these values, the adversary may be able to
Two potential problems with the above schemes were raised in generate the rest of the x-sequence, and thus break the· ciphertext
Goldwasser and Micali [10]: Shamir asked the question: Can one design a pseudorandom number

(a) Even though EKA(X) is hard to invert in general, it may be easy

generator with the property that, even knowing xl, X2, ••• , x,,,
it is
still hard to compute Xk+l? Based on the assumption that the RSA
when x is of a special form;
scheme is secure, Shamir gave a pseudorandom number generator that
(b) One may be able to infer some partial information about x from satisfies this requirement
EKA(X).
Shamir's scheme does not guarantee that the next bit is difficult to
They proposed a scheme which is free from these difficulties. The compute (even though the next word is). Blum and Micali [5] recently
scheme encrypts the entire message bit by bit, where the encryption constructed a stronger pseudorandom number generator based on the
of a single bit is based upon the complexity of deciding whether an discrete logarithm problem. (They also gave a criterion on one-way
integer y is a quadratic residue modN or not. We will outline the functions under which this construction will work.) Let k > 0 be any
method here. integer. The generator takes O( n) true random bits and generates a
Let N = p.q be the product of two n-bit primes. Denote by Ziv sequence Xl, X2, ••• , X"k that, under Assumption BM below, has the
the set {x 11 ~ x ~ N, gcd(x, N)= 1}, and let AN ~ ZN be the following property: Let G",i,E be the minimum size of any circuit
subset consisting of those x' 8 with Jacobi symbol (x/ N) = 1. Half of with j boolean inputs that can output the value of X,+1 correctly
the members of AN are quadratic residues, and half are non-residues. +
with probability 1 f or more, when the values of Xl, x2, ••• , Xi are

87

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
input to the circuit Then G",i,E > Q(n) asymptotically for any fixed function ! will be one-way if we end up asking for help a fraction of
polynomial Q. the time.
To describe the assumption needed, let p be a prime and , a Deftnition 20. Let P = (p,,) be a sequence of probability distribu-
generator of the cyclic multiplicative group A, = {I, 2, ... ,1' -I}. tions on E+, where the support of p" (i.e., the set {x I 1',,(x) .:;i: O})
FOTY E ~, let f(1', g,!I) be the value x E A p such that gS mod p = consists of only strings of length I(n). We will call P a polynom/QI-
JI. A boolean circuit with three n-bit inputs a, b and c is said to solve time distribution ensemble if there exists a probabilistic algorithm· M
the discrete logarithm problem fOr p if, for all g and !I its output is which, given input n, will halt in time polynomial in n, and output an
equal to f(1', g, 1/) when II = 1', b = 9 and C = !I. Let 1",. be the x with a probability distribution h( x) satisfying II h - p" II = D( tI(n».
minimum size of any circuit that solves the discrete logarithm problem
it Notation. Ilk - p,,11 = I:zlk(x) - p,..(z)l.
for E fraction of all n-bit prime numbers 1'.
Definition 21. Let f be a 1-1 function from V to E*, where V ~
Assumption BM: 1",. > Q(n) asymptotically for any fixed polynomial
E*. Let P = (p,,) be a polynomial-time distribution ensemble such
Q and any fixed 0 < E < 1. that the support of every p" is a subset of V. Define the con-e/alion
ensemble of f under P to be the source ensemble QI,P = (Q,,),
2.3 DISCUSSIONS where soun:eQ" = (T, q,,) has sample space T = {(x, f(x)) I x e
In the context of the preceding review, there are several questions =
V}, and distribution q,,(T) = p,,(x) for T (x, f(x»). Let xl,P ==
that seem to merit further consideration. (Xn ) and yl,P = (y,,) be two random variables on QI,P defined
by X,,{T) = x and Y,,(T) = f(x) for'T = (x, f(x)) E Q".
<a> The probabilistic encryption scheme in [10] and the pseudorandom
sequence generation in [5] both utilize special properties of the one- Deftnition 22. A 1-1 function I is said to be one-way if there exists
way functions employed. Are there general procedures that can utilize a polynomial-time distribution ensemble P such that Hc(X!,P I
any trapdoor functions for the purpose of encryption and generating y!,P) = O(l/nt ) for some fixed t.
pseurandom numbers? The gist of the definition is that, some tbits of information are
(b) The pseudorandom number sequence in [5] is bitwise unbiased needed in order to recover x from I(x) under the distribution p".
for any fixed E > 0, and thus solves the question posed by Shamir. The next theorem gives an alternative description directly in tenns of
However, a cryptanalyst may adopt a different procedure to analyze complexity.
the pseudorandom number generator. For example, he may work Deflnition 23. Let f and P be as in Definition 21. Define pI =
backwards, examining the last few bits in an attempt· to reconstnlct
(1'!), where ~(f/) = 1'n(f- 1 b/».
the preceding bits. (Indeed, it is still open .whether the sequence
generated by the scheme in [5] enjoys the same unbiased property if Theorem 7. A 1-1 function f is one-way if and only if there exists
read in reverse.) Can one construct a pseudorandom sequence that can a polynomial-time distribution ensemble P such that the following is
withstand any attempt by the cryptanalyst to break the pseudorandom true: For any probabilistic algorithm which, on input n and y, with
sequence? In a broader context, can one construct pseudorandom y distributed according to p!(y), halts in time polynomial in n and
sequence that can be used for applications other than cryptography? outputs x, the probability of x =1= ,-1(1/) is O(l/n t ) for some t.
(c) Can one weaken the assumptions in Assumption BM and Assumption One-way functions become more interesting when they possess
OM such that, instead of requiring that no algorithm can solve E frac- some additional properties. For example, if a one-way function has a
tion of the instances for any fixed f, we require only that no algorithm certain invariance property, then it can be used to construct a perfect
can solve say, 1/2 of the instances? pseudorandom number generator, and hence a secure conventional
cryptosystem; if it possesses a key plus an inverse key, then it becomes
We will give positive answers to all the above questions in the
a trapdoor function and can be used to build a probabilistic public-key
next two sections.
cryptosystem.

3. ONE-WAY FUNCflONS ONE-WAY FuNcnONS WITII INVARIANCE PROPERTIES

In this section we formalize the notion of one-way functions, and Deftnition 24. If in Definition 22, we also have pI = p. then we
show how they can be used to construct perfect pseudorandom number call f a stable one-way function.
generators and to implement secure conventional cryptosystems.
Theorem 8. Any stable one-way function' can be used to construct
It is helpful to think of a one-way function I as a 1-1 function a perfect pseudorandom number generator G f.
used in a puzzle Z. In each game, Z picks a random n-bit number
Remark. The construction is explicit in the sense that, if the descrip-
x according to some distribution Pn(x), and shows us the value of
tions of all the relevant probabilistic algorithms for f and P are given.
f(x). We are challenged to find x, with a button to ask for help. The then the description of Gf is immediate.

88"

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
Corol...., to Theorem I. Any stable one-way function I can be band K to compute probabilistica1ly a string x and send it to A. The
used to construct a computationally secure cryptosystem. (See § 7 of keys are generated in such away that, with the knowledge of K ' , A
Part 1) can uniquely recover b.
Remark. A seed for the pseudorandom number generator is used as Let us call a PPKC secure if, for b with bias p ~ ·1/2, an
the common private key. This is the computationally-secure realization adversary cannot guess from K and x in polynomial time the value
of the one-time pad of b correctly with probability more than p + O( 1I(n»).

ONE-WAY FUNCIlONS WITH KEYs Theorem 9. Any trapdoor function can be used to construct a secure
We will use the discrete logarithms problem as an example to PPKC.
illlustrate our result Factoring large composite numbers is a problem which has a long
Example 3. Discrete Logarithm Function history of resisting efficient solutions. It would therefore be a most
appropriate basis for constructing PPKC or pseudorandom number
Let Gn = {(p, g, m) I p is an n-bit prime, 9 a generator of A p , and m E
generators. Below we present a new trapdoor function, which is also a
A,}. Define V = Un G n, and I: V 1-+ V by f(x) = (p,g,gmmod
stable one-way function, assuming factoring is hard in the proper sense
p) if x = (p,g,m).
to be described below. Let Tn be the set of all integers N = p. q,
We regard (p, g), the part of x that remains unchanged under I, where p and q are n-bit primes with p == q == 3 mod 4.
as the key. It is useful to consider those distributions P that generate
The Intractability Assumption of Factoring:
x in two steps: first the key (p, g), and then the remaining part m.
For any polynomial-time probabilistic algorithm M that tries to
One such P is given by (Pn) defined below. Let
factor integers, there exists an no such that M will fail to factor at

P',,(K) = (no. of n-bit primes) · (~o. of generators in Ap) least l/n lO of the members of Tn for all n ~ no.
Remark. One can replace l/n lO by any lint with any predetermined
if K =
(p, g) is a possible key, and p~ (K) = 0 otherwise. Let
t.
P'~,K = l/(p - 1) if m E .Ap, and 0 otherwise. Finally, define
Pn(x) = p~(K)· p'~,k(m) for x = (K,m). A FACfORING TRAPDOOR

Notation. We will extend Definition 20 and say that the sequence We generate a pair of keys (K, K') by generating two random
(P~,K (m)) is a polynomial·time distribution ensemble if P'~,K (m) :1= 0 n-bit primes p, q with p == q == 3 mod 4, and setting K = N (=
implies m = fJ( n), and if there exists a probabilistic algorithm which, p · q) and K' = {p, q}. The trapdoor function f is defined by
given nand K, halts in polynomial time in n and outputs a string z f(N, z) = z2 mod N if z is even, and f(N, z) = -z2 mod N if z
whose probability distribution h(z) satisfies IIh - P'~,kll = O(lI(n)). is odd, for z E AN.

Definition 26. A one-way function f is said to have a key if the It is of interest that the factoring trapdoor function defined above
domain V of f has the form V ~ E 1 * X E2 * and there exists a also leads to a simple pseudorandom number generator. It is pOssible
polynomial-time distribution ensemble P = (Pn) with the following to prove that this generator is perfect if the quadratic residuosity

properties: problem is hard.

(a) P makes f a one-way function as in Definition 22, A QUADRATIC-RESIDUE PsEUOORANOOM NUMBER GENERATOR
(b) Pn(x) = p~(K) . P~,K(Z) if x = (K, z), where (P'n) and (P'~,K) Let n > 0 and k > o. We will describe how to generate a
are polynomial-time distribution ensembles, sequence (j of n k bits using O(n(log n)2) true random bits.

(c) f(x) can be written in the form (K, flc(z)) for x = (K, z). We first describe a procedure that generates a quasi-random
sequence Q as follows: Pick a random N from Tn, and a random
m with 1 ~ m ~ N - 1, then compute the following sequence
4. TRAPDOOR FuNCTIONS AND ENCRYFfION
of number Zt,Z2, ••• ,Znk by ZI = m, Zi+l = f(N,Zi). Let a =
A trapdoor jUnction is basically a one-way function with a key K al Q 2·· ·Qnk where Qi is just the parity of Zi.
such that an inverse key K' can be easily created at the same time,
but K' cannot be inferred form K. We will not give the formal
To obtain {j, we repeat the above procedure to obtain t =
(1012 n)2 quasi-random strings a(I), a(2), ••• , Q(t). Now let (j =
definition in this abstract
Q(I) €a a(2) E9 ··· €a Q(t) where €a denotes bitwise XOR. For fixed
A probabilistic public-key cyrptosystem (PPKC) is a cryptosystem k and large n, the pseudorandom sequence P so generated will be
in which user A has an n-bit key K in the public file. while keeping indistinguishable from a true random sequence assuming that quadratic
a key K' as private information. To send a bit bE {O, I}, B will use residuosity is hard.

89

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
5. WHAT MAKES TIlE TRAPOOOR WORK?
It is also of interest to follow in detail the information accounting
It is of interest to give an in-depth view of the results in in pseudorandom number generations; we will leave that to the full
the previous two sections. As we will see, these results can be paper.
deduced naturally, if one keeps track of the computational information
contained in the various strings and considers how the infonnation can
6. A THEOREM IN ABSTRACf COMPLEXITY THEoRY
be manipulated. In this abstract, we will give such an analysis to the
encryption by using a trapdoor function. Let R be the class of decision problems solvable in random
polynomial time, as defined in Adleman [1]. The relationship between
For definiteness, consider a one-way function f that maps n-bit
R and the detenninistic complexity hierarchy has been a subject of
strings to n-bit strings for each n, and let (p,,) be the distribution
considerable interest (Adleman [1], Aleliunas, et ale [3], Bennett and
ensemble that makes f one-way. For a given n, f can be viewed as
Gill [4], Gill [9]). Two of the well-known results are that, any decision
a channel with large alphabets, in fact with 2" input symbols and 2 ft
problem in R can be computed by a polynomial-size boolean circuit
output symbols. Thus, f is a non-classical channel, and we have to
[1], and that the obvious relation R ~ UE>o DTIME(2""f) holds.
consider accessible infonnation instead of the Shannon information.
where DTIME(g(n)) is the class of problems slovable in detenninistic
Let (X,,, Y,,) denote the pair of random variables corresponding
time g(n). In this section, we will prove a stronger fonn of the
to (x, f(x)) where x is distributed according to p". Let us dramatize
latter relation under the assumption that one-way functions exist
the situation by assuming that party A is on the input side of the
(The definition of one-way functions in this section will be somewhat
channel f sending string x with probability p"( x) across the channel to
different from that of the previous sections.)
pany B, who receives the string f( x). Clearly, the Shannon conditional
entropies H(Y"IXn) and H(X"IYn ) are both 0, and classically f is a Let f be a 1-1, onto function defined on a subset of {O, 1}· .
noiseless channel. However, when we consider accessible information, . Suppose P = (p",,) is a polynomial-time distribution ensemble in-
we find the Hc(YnIX,,) is still 0, but Hc(XnIYn) is n(l/nt ). That variant under f. A boolean circuit C is said to invert f under Pn if
is, A has no uncertainty about what B receives, but B has at least EyET Pn(Y) > 1/2, where T is the set of input strings y for which
some uncertaity about what A has sent, admittedly the uncertainty C gives the output f-l(y). Let Bn(f,P) be the size of the smallest
may be as small as 1/ n t fbit. Thus, from B' 8 standpoint, he is on circuit that inverts f under I'ft.
the receiving end of a noisy channel with a noise at least l/n t ,a
non-neglible quantity in polynomial-time calculatioDS. Definition 26. f is said to be a strong one- way jUnction jf there exists
Let us now visualize the above picture in a slightly different way. a P such that B n (I, P) > Q( n} asymptotically for any polynomial
Assume that f is in fact a trapdoor function, and a third party G is Q.
the owner of the secret key, while A is really transmitting x to G as The main theorem of this section is the following.
f(x). It is a clear channel to G, since he has the secret key to decode
Theorem 10. If there exists any strong one-way function, then
f( x). The role of B now is an eavesdropper, wh<.', without the secret
key, is trying to wiretap the line with a low-grade equipment But
this situation has an exact analogue in the classical information theory,
R ~ n
e>O
DTIME(2
nE
).

known as the Wyner wiretap channel [25]. Wyner showed that even This formula means that, for any decision problem in R and
when the noise in B's channel is small, A can magnify the noise by any € > 0, there is a deterministic Turing machine solving it in time
properly encoding his messages. For example, suppose B has a binary 0(2 n £). It is of interest to note that this is a case where a lower bound
symmetric channel with crossover probability 10 -4, and A encodes a on non-uniform complexity has consequences on the upper bound of
bit b as a random l06-bit string Q such that Q has an even number unifonn complexity (cf. Karp and Lipton[], Pippenger [17], Pippenger
of 1's if and only if b = o. Then, of the transmitted bits, B can and Fischer [18]).
guess the value of each individual bit with high confidence, yet B The hypothesis of Theorem 10 will be satisfied if either the
knows that he is going to be wrong in the values of about 100 bits. It factoring of integers is hard or the discrete logarithm problem is hard
becomes difficult to estimate whether he has missed an even number in the appropriate sense. Let F(n) be the minimum size of any
of bits or an odd number. Indeed it was shown that schemes of the boolean circuit that can factor 4/5 of the 2n-bit composite numbers
kind indeed will completely baffle B about the true value of b. N with two n-bit prime factors.

In our case, the noise is somewhat like n - t , and the approximate The Strong Intractability Assumption of Factoring: F(n) > Q(n)
estimate on the length of a is about n t ,which is large but can be asymptotically for any fixed polynomial Q.
accomplished in polynomial time.

90

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.
Corolle,., to Theorem 10. Under the strong intractability assump- [4J C. H. Bennett and J. Gill, "Relative to a random oracle, PA = NPA
tion of factoring, = co-NPA with probability 1," SIAM J. on Computing 10 (1981),
R ~ n
DTIME(2 ).
E>O
ftc
96-113.
[5] M. Blum and S. Micali, "How to generate cryptographically stron
sequences of pseudo random bits," this proceedings.
It is clear that Theorem 10 is also true if the discrete logarithm [6] G. Chaitin, "A theory of program size fonnally identical to
problem is hard in the sense of Assumption BM. However, a much infonnation theory," Journal of ACM 22 (1975), 329-340.
weaker assumption suffices in this case. We will state that result below [7] W. Diffie and M. E. Hellman, "New directions in cryptography,"
as Theorem 11. IEEE Trans. on Infonn. Theory IT-22, 6 (1976), 644-654.
[8] R. Gallager, Infonnation Theory and Reliable Communication,
Definition 27. Let p be an n-bit prime number, and let 9 be any Wiley, New York, 1968.
generator of A p • The discrete logarithm problem Dp,g is: Given input [9] J. Gill, "Computational complexity of probabilistic Turing machines,"
y E A p , find x such that g% modp = y. SIAM 1. om Computing 6 (1977), 675-695.
[10] S. Goldwasser and S. Micali, "Probabilistic encryption and how to
Let l(Dp,g) be the minimum boolean circuit size for solving Dp,g. play mental poker keeping secret all partial infonnation," Proc. 14th
Define L(n) to be max{l(Dp,g) Ilog2{p + 1) ~ n}. We make the ACM Symp. on Theory of Computing, San Francisco, May 1982.
following assumption: [11] 1. E. Hopcroft and 1. D. Ullman, Introduction -to Automata Theory,
Languages, and Computation, Addison-Wesley, Reading, Mass., 1979.
The Intractability Assumption of Discrete Logarithm: L{n) > Q(n)
[12] R. M. Karp and R. 1. Lipton, "Some connections between
asymptotically for any fixed polynomial Q. nonunifonn and unifonn complexity classes," Prac. 12th ACM Symp.
on Theory of Computing, Los Angeles, April 1980, 302-309.
Note that this assumption is weaker than Assmuption BM. In
[13] D. E. Knuth, The Art of Computer Programming, Vol.. 2,
fact, it is not concerned with average-case complexity, unlike the rest Addison-Wesley, Reading, Mass., second edition, 1981.
of this paper. [14] A. N. Kolmogorov, ''Three approaches to the concept of the
amount of infonnation," Probl. Pered. Inf. (Probl. of Int: Transm.)
Theorem 11. Under the intractability assumption of discrete logari~ 1/1 (1965).
we have
R ~ n
E>O
DTIMEl. 2ft c).
[15] P. Martin-Lot: "The definition of random sequences," Information
and Control 9 (1966), 602-619.
(16) A. R. Meyer and E. M. McCreight, "Computability complex and
pseudorandom zero-one valued functions," in Theory of Machines and
The discrete logarithm problem is a classical number-theoretic Computations, Z. Kohavi and A. Paz, eds., Academic Press, New York
problem, for which no effcient algorithm is known. The intractability 1971, 19-42.
assumption of this problem, in one form or another, has been the basis [17] N. Pippenger, "On simultaneous resource bounds," Prac. 20th
IEEE Symp. on Foundations of Computer Science, Puerto Rico, Oct
of several cryptographic protocols (Diffie and Hellman [7], Blum and
1979, 307-31l.
Micali [5]). So far the best algorithm known [2] runs in time roughly
[18] N. Pippenger and M.. 1. Fischer, "Relations among complexity
2Vft . If the discrete logarithm problem has in fact a complexity measures," Journal of ACM 26 (1979), 361-38l.
much higher than polynomial, then we· can obtain results stronger [19] M. O. Rabin, "Digitalized signatures and public-key functions as
than Theorem 2. For example, one has: intractable as factorization," MITILCSITR-212, 1979.
[20] R. L. Rivest, A. Shamir, and L. Adleman, "A method for obtaining
Theorem 12'. If L(n) > 2n ( for some fixed f > 0 and for all n, digital signatures and public-key cryptosystems," Communications of
then R ~ DTIME(2(1ogn)C) for some constant c > o. ACM 21 (1978), 120-126.
[21] A. Shamir, presented at Crypto-81, Santa Barbara, 1981.
REFERENCES [22] C. E. Shannon, "A mathematica theory of communication," Bell
System Technical Journal, 27 (1948), Part I, 479-523, Part II, 623-656.
[23] C. E. Shannon, "Communicatin theory of secrecy systems," Bell
[1] L. Adleman, ''Two theorems on random polyn~mial time," Prac.
System Technical Journal 28 (1949), 656-715,
19th IEEE Symp. on Foundations of Computer SCIence, Ann Arbor,
Michigan, Oct 1978, 75-83. [24] L. Valiant, "The complexity ofcomputing the permanent," Theoretical
Computer Science 8 (1979), 189-20l.
[2] L. Adleman, A subexponential algorithm for the discrete logarithm
tt

problem with applications to cIJ:ptography," Pr~. 20th IEEE Symp. [25] A. D. Wyner, "The wire-tap channel," Bell System Technical
on Foundations of Computer Science, Puerto RICO, Oct 1979, 55-60. Journal 54 (1975), 1355-1387.
[3] R. Aleliunas, R. M. Karp, R. 1. Lipton, L. Lovasz, .C. Rachoff, [26] 1. Ziv, IEEE Transaction on Information (1965).
"Random walks, universal sequences, and the compleXIty of maze [27] A. K. Zvonkin and L. A. Levin, "The complexity of finite objects
proble~" Proc. 20th IEEE Symp. on Foundations of Computer and the algorithmic concepts of information and randomness," Uspekhi
Science, Puerto Rico, Oct 1979, 218-223. Mat Nauk (Russian Math. Surveys 25/6 (1970), 83-124.

91

Authorized licensed use limited to: Tsinghua University. Downloaded on May 17,2023 at 02:10:56 UTC from IEEE Xplore. Restrictions apply.