Leo Reyzin. Notes for BU CAS CS 538.
1
6
General OneWay and Trapdoor Functions
In this section, we will try to generalize what we’ve seen so far. For example, we know how to build a secure
encryption out of RSA, but what exactly is RSA itself?
In modern terms, it is a trapdoor permutation
family, which we define below.
6.1
OneWay Functions
Let us first introduce oneway functions. We’ve actually seen concrete examples of them before; this is just
a generalization, so we can talk of a oneway function
f
independent of its particular implementation.
Definition 1.
A function
f
:
{
0
,
1
}
*
→
{
0
,
1
}
*
is oneway if
1. it is polynomialtime computable;
2. it is hard to invert, i.e., for all probabilistic polynomialtime
A
there exists a negligible function
η
such
that, for all
k
, Pr[
f
(
A
(
f
(
x
)
,
1
k
)) =
f
(
x
)]
≤
η
(
k
), where the probability is taken over a random choice
of
k
bit string
x
and coin tosses of
A
.
Note that it’s important that we are not requiring
A
to find
x
; rather, any inverse of
f
(
x
) is fine. Of course,
if
f
is a permutation (i.e., a bijective function), then it would be equivalent to require
A
to find
x
, because
x
is the only inverse of
f
(
x
).
Note also the importance of selecting the input to
A
: the input is not selected uniformly at random;
rather,
x
is selected uniformly at random, and the input is
f
(
x
). Of course, again, if
f
is a permutation,
then the two are equivalent.
An example is the following
f
: split the
k
bit input into strings
a
of length
k/
2
and
b
of length
k/
2 ,
and output
c
=
ab
. The inverter
A
would have to find two
large
factors of
c
, which is believed to be hard.
Note that the input
c
of
A
is not a uniformly selected integer; in particular, we know that it has two factors
of (nearly) the same length.
This preview has intentionally blurred sections. Sign up to view the full version.
View Full Document
This is the end of the preview.
Sign up
to
access the rest of the document.
 Spring '09
 Cryptography, Bijection, oneway function, OneWay Functions, pseudorandom generator, Leonid A. Levin

Click to edit the document details