PPPcompleteness with Connections to Cryptography Katerina Sotiraki MIT

PPP-completeness with Connections to Cryptography Katerina Sotiraki MIT Manolis Zampetakis MIT LATCA@Bi. Ci 2018 Giorgos Zirdelis Northeastern U.

Universal Cryptographic Objects Assumptions Natural Universal Objects? “Explicit constructions that implements P under the sole assumption that P exists. ” Primitives For instance, universal one-way functions [Levin 87], but very “unnatural” and “inefficient”.

Universal CRHF �CRHF family �A finds collision in h ←H H is CRHF for all H’ �A’ finds collision in h’ ← H’ Open problem: Natural Universal CRHF?

Our result There exists a natural hash function: 1. worst-case universal CRHF, 2. “strong evidence” of average-case hardness. w-c universal CRHF family H : �A finds collision in all h ϵH �A’ finds a collision in any compressing function. Hash function from a generalization of SIS (weak-c. SIS)

TFNP FNP: class of search problems whose decision version is in NP. TFNP: class of total search problems of FNP, i. e. a solution always exist [MP 91]. Many applications in game theory, economics, social choice, (discrete / continuous) optimization, e. g. [JYP 88], [BCE+98], [EGG 06], [CDDT 09], [DP 11], [R 15], [R 16], [BIQ+17], [GP 17], [DTZ 18], [FG 18] … Most celebrated result: NASH PPAD-complete [DGP 06], [CDT 06] Connections to Cryptography: [Bur 06], [BPR 15], [Jer 16], [GPS 16], [HY 17], [RSS 17], [HNY 17], [KNY 17]

PPP and PWPP “Total search problems should be classified in terms of the profound mathematical principles that are invoked to establish their totality. ” Papadimitriou ‘ 94 PPP, PWPP Pigeonhole principle

PPP/PWPP and Cryptography

PPP/PWPP-completeness A longstanding open problem since [Pap 94]. Our contribution: We identify the first PPP/PWPP-complete problems. This talk: PWPP. A PWPP-complete problem defines a w-c universal CRHF. Main Theorem: weak-c. SIS is PWPP-complete.

Short Integer Solution Problem

Short Integer Solution Problem Hash function family: • Key: A • Hash: If SIS is hard on average, then H is collision-resistant.

weak-c. SIS Problem

weak-c. SIS is PWPP-hard weak-c. SIS: Input: matrices A and G Output: vectors x and y PWPP: Input: circuit C Output: vectors x and y Some of the main ideas: - There exists a linear modular equation for NAND gates. - For any circuit C: 1. Use G to constrain x to encode C’s evaluation gate by gate. 2. Ax = C(xinput).

Binary invertible matrix

weak-c. SIS ϵ PWPP

Hash function family: • Key: A • Hash(x):

Lattices and PPP [BJPPR 15] [KNY 17]

Open Problems worst-to-average case reduction for weak-c. SIS? universal CRHF based on weak-c. SIS MINKOWSKI ? PPP SIS ? PWPP

Open Problems (Gap)SVP NP-complete PPP P PPP-hard/complete? (Gap)CVP NP-complete PPP-hard/complete? PPP P PPP? Thank you!

weak-c. SIS is PWPP-hard (sketch) q=4

weak-c. SIS is PWPP-hard (sketch) q=4

weak-c. SIS is PWPP-hard (sketch) q=4 It needs more work to make it homogenous…