TY - JOUR

T1 - On the existence of extractable one-way functions

AU - Bitansky, Nir

AU - Canetti, Ran

AU - Paneth, Omer

AU - Rosen, Alon

N1 - Publisher Copyright:
Copyright © by SIAM.

PY - 2016

Y1 - 2016

N2 - A function f is extractable if it is possible to algorithmically "extract," from any adversarial program that outputs a value y in the image of f, a preimage of y. When combined with hardness properties such as one-wayness or collision-resistance, extractability has proven to be a powerful tool. However, so far, extractability has not been explicitly shown. Instead, it has only been considered as a nonstandard knowledge assumption on certain functions. We make headway in the study of the existence of extractable one-way functions (EOWFs) along two directions. On the negative side, we show that if there exist indistinguishability obfuscators for circuits, then there do not exist EOWFs where extraction works for any adversarial program with auxiliary input of unbounded polynomial length. On the positive side, for adversarial programs with bounded auxiliary input (and unbounded polynomial running time), we give the first construction of EOWFs with an explicit extraction procedure, based on relatively standard assumptions (such as subexponential hardness of learning with errors). We then use these functions to construct the first 2-message zero-knowledge arguments and 3-message zero-knowledge arguments of knowledge, against verifiers in the same class of adversarial programs, from essentially the same assumptions.

AB - A function f is extractable if it is possible to algorithmically "extract," from any adversarial program that outputs a value y in the image of f, a preimage of y. When combined with hardness properties such as one-wayness or collision-resistance, extractability has proven to be a powerful tool. However, so far, extractability has not been explicitly shown. Instead, it has only been considered as a nonstandard knowledge assumption on certain functions. We make headway in the study of the existence of extractable one-way functions (EOWFs) along two directions. On the negative side, we show that if there exist indistinguishability obfuscators for circuits, then there do not exist EOWFs where extraction works for any adversarial program with auxiliary input of unbounded polynomial length. On the positive side, for adversarial programs with bounded auxiliary input (and unbounded polynomial running time), we give the first construction of EOWFs with an explicit extraction procedure, based on relatively standard assumptions (such as subexponential hardness of learning with errors). We then use these functions to construct the first 2-message zero-knowledge arguments and 3-message zero-knowledge arguments of knowledge, against verifiers in the same class of adversarial programs, from essentially the same assumptions.

KW - Extraction

KW - Knowledge

KW - Obfuscation

KW - Zero knowledge

UR - http://www.scopus.com/inward/record.url?scp=85010651037&partnerID=8YFLogxK

U2 - 10.1137/140975048

DO - 10.1137/140975048

M3 - ???researchoutput.researchoutputtypes.contributiontojournal.article???

AN - SCOPUS:85010651037

SN - 0097-5397

VL - 45

SP - 1910

EP - 1952

JO - SIAM Journal on Computing

JF - SIAM Journal on Computing

IS - 5

ER -