DOCSLIB.ORG

Pseudorandomness Oded Goldreich

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Pseudorandomness Oded Goldreich fea-goldreich.qxp 9/23/99 3:56 PM Page 1209 Pseudorandomness Oded Goldreich his essay considers finite objects, en- associated with a unique distribution—the uni- coded by binary finite sequences called form one. In particular, by definition, one cannot strings. When we talk of distributions generate such perfect random strings from shorter we mean discrete probability distribu- random strings. tions having a finite support that is a set The second theory (cf. [11, 12]), due to Tof strings. Of special interest is the uniform dis- Solomonov, Kolmogorov, and Chaitin, is rooted in tribution, which for a length parameter n (explicit computability theory and specifically in the notion or implicit in the discussion), assigns each n-bit of a universal language (equivalently, universal string x ∈{0, 1}n equal probability (i.e., probabil- machine or computing device). It measures the ity 2n). We will colloquially speak of “perfectly ran- complexity of objects in terms of the shortest pro- dom strings”, meaning strings selected according gram (for a fixed universal machine) that generates to such a uniform distribution. the object.2 Like Shannon’s theory, Kolmogorov The second half of this century has witnessed complexity is quantitative, and perfect random the development of three theories of randomness, objects appear as an extreme case. Interestingly, a notion that has been puzzling thinkers over the in this approach one may say that a single object, ages. The first theory (cf. [3]), initiated by Shannon, rather than a distribution over objects, is perfectly is rooted in probability theory and is focused on random. Still, Kolmogorov’s approach is inher- distributions that are not perfectly random. Shan- ently intractable (i.e., Kolmogorov complexity is non’s information theory characterizes perfect uncomputable), and, by definition, one cannot randomness as the extreme case in which the in- generate strings of high Kolmogorov complexity formation content is maximized (and there is no from short random strings. redundancy at all).1 Thus, perfect randomness is The third theory, initiated by Blum, Goldwasser, Micali, and Yao [8, 2, 13], is rooted in complexity Oded Goldreich is professor of computer science at the theory and is the focus of this essay. This ap- Weizmann Institute of Science, Israel. His e-mail address proach is explicitly aimed at providing a theory of is [email protected]. perfect randomness that nevertheless allows for The author is grateful to Anthony Knapp and Susan the efficient generation of perfect random strings Landau for their many useful comments. from shorter random strings. The heart of this ap- 1 proach is the suggestion to view objects as equal In general, the amountP of information in a distribution if they cannot be told apart by any efficient D is defined as x D(x) log2 D(x). Thus, the uniform dis- tribution over strings of length n has information mea- sure n, and any other distribution over n-bit strings has 2For example, the string 1n has Kolmogorov complexity lower information measure. Also, for any function O(1) + log2 n (by virtue of the program “print n ones”, f : {0, 1}n →{0, 1}m with n<m, the distribution obtained which has length dominated by the encoding of n (say, by applying f to a uniformly distributed n-bit string has in binary)). In contrast, a simple counting argument information measure at most n, which is strictly lower than shows that most n-bit strings have Kolmogorov com- the length of the output. plexity at least n. NOVEMBER 1999 NOTICES OF THE AMS 1209 fea-goldreich.qxp 9/23/99 3:56 PM Page 1210 procedure. Consequently a distribution that can- take random steps, where, without loss of gener- not be efficiently distinguished from the uniform ality, a random step consists of selecting which of distribution will be considered as being random (or two predetermined steps to take next so that each rather “random for all practical purposes”, which possible step is taken with probability 1/2. These we call “pseudorandom”). Thus, randomness is choices are called the algorithm’s internal coin not an “inherent” property of objects (or distrib- tosses. utions) but rather is relative to an observer (and its computational abilities). To demonstrate this ap- The Definition of Pseudorandom proach, let us consider the following mental ex- Generators periment. Loosely speaking, a pseudorandom generator is an efficient program (or algorithm) that stretches short Alice and Bob play HEAD OR TAIL in one random strings into long pseudorandom sequences. of the following four ways. In all of We emphasize three fundamental aspects in the no- them Alice flips a coin high in the air, tion of a pseudorandom generator: and Bob is asked to guess its outcome 1. Efficiency. The generator has to be efficient. before the coin hits the floor. The al- As we associate efficient computations with ternative ways differ by the knowledge polynomial-time ones, we postulate that the Bob has before making his guess. In generator has to be implementable by a de- the first alternative, Bob has to an- terministic polynomial-time algorithm. nounce his guess before Alice flips the This algorithm takes as input a string, called coin. Clearly, in this case Bob wins with its seed. The seed captures a bounded amount probability 1/2. In the second alterna- of randomness used by a device that “gener- tive, Bob has to announce his guess ates pseudorandom sequences”. The formu- while the coin is spinning in the air. Al- lation views any such device as consisting of though the outcome is determined in a deterministic procedure applied to a ran- principle by the motion of the coin, Bob dom seed. does not have accurate information on 2. Stretching. The generator is required to stretch the motion and thus we believe that its input seed to a longer output sequence. also in this case Bob wins with proba- Specifically, it stretches n-bit long seeds into bility 1/2. The third alternative is `(n) -bit long outputs, where `(n) >n. The similar to the second, except that Bob function ` is called the stretching measure has at his disposal sophisticated equip- (or stretching function) of the generator. ment capable of providing accurate in- 3. Pseudorandomness. The generator’s output formation on the coin’s motion as well has to look random to any efficient observer. as on the environment affecting the That is, any efficient procedure should fail to outcome. However, Bob cannot process distinguish the output of a generator (on a this information in time to improve his random seed) from a truly random sequence guess. In the fourth alternative, Bob’s of the same length. The formulation of the recording equipment is directly con- last sentence refers to a general notion of com- nected to a powerful computer pro- putational indistinguishability that is the heart grammed to solve the motion equa- of the entire approach. tions and output a prediction. It is To demonstrate the above, consider the fol- conceivable that in such a case Bob can lowing suggestion for a pseudorandom generator. improve substantially his guess of the The seed consists of a pair of 32-bit integers, x and outcome of the coin. N, and the 100,000-bit output is obtained by re- We conclude that the randomness of an event is peatedly squaring the current x modulo N and relative to the information and computing re- emitting the least significant bit of each interme- 2 sources at our disposal. Thus, a natural concept diate result (i.e., let xi xi1 mod N , for 5 of pseudorandomness arises: a distribution is i =1,...,10 , and output b1,b2,...,b105 , where def pseudorandom if no efficient procedure can dis- x0 = x and bi is the least significant bit of xi). This tinguish it from the uniform distribution, where process may be generalized to seeds of length n efficient procedures are associated with (proba- (here we used n =64) and outputs of length `(n) bilistic) polynomial-time algorithms. (here l(n)=105). Such a process certainly satisfies An algorithm is called polynomial-time if there items (1) and (2) above, whereas the question exists a polynomial p so that for any possible whether item (3) holds is debatable (once a rigor- input x, the algorithm runs in time bounded by ous definition is provided). Anticipating some of p(|x|), where |x| denotes the length of the string the discussion below, we mention that, under the x. Thus, the running time of such an algorithm assumption that it is difficult to factor large inte- grows moderately as a function of the length of its gers, a slight variant of the above process is indeed input. A probabilistic algorithm is one that can a pseudorandom generator. 1210 NOTICES OF THE AMS VOLUME 46, NUMBER 10 fea-goldreich.qxp 9/23/99 3:56 PM Page 1211 Computational Indistinguishability random generator (as defined next): such distrib- Intuitively, two objects are called computationally utions are computationally indistinguishable from indistinguishable if no efficient procedure can tell uniform but are not statistically indistinguishable them apart. As usual in complexity theory, an el- from uniform. egant formulation requires asymptotic analysis Definition 2. (pseudorandom generators [2, 13]). (or rather a functional treatment of the running A deterministic polynomial-time algorithm G is time of algorithms in terms of the length of their called a pseudorandom generator if there exists a input).3 Thus, the objects in question are infinite stretching function, `:N → N, so that the following sequences of distributions, where each distribution two probability ensembles, denoted {G } ∈N and has a finite support.
Load more

Recommended publications
  • On the Randomness Complexity of Interactive Proofs and Statistical Zero-Knowledge Proofs*
    On the Randomness Complexity of Interactive Proofs and Statistical Zero-Knowledge Proofs* Benny Applebaum† Eyal Golombek* Abstract We study the randomness complexity of interactive proofs and zero-knowledge proofs. In particular, we ask whether it is possible to reduce the randomness complexity, R, of the verifier to be comparable with the number of bits, CV , that the verifier sends during the interaction. We show that such randomness sparsification is possible in several settings. Specifically, unconditional sparsification can be obtained in the non-uniform setting (where the verifier is modelled as a circuit), and in the uniform setting where the parties have access to a (reusable) common-random-string (CRS). We further show that constant-round uniform protocols can be sparsified without a CRS under a plausible worst-case complexity-theoretic assumption that was used previously in the context of derandomization. All the above sparsification results preserve statistical-zero knowledge provided that this property holds against a cheating verifier. We further show that randomness sparsification can be applied to honest-verifier statistical zero-knowledge (HVSZK) proofs at the expense of increasing the communica- tion from the prover by R−F bits, or, in the case of honest-verifier perfect zero-knowledge (HVPZK) by slowing down the simulation by a factor of 2R−F . Here F is a new measure of accessible bit complexity of an HVZK proof system that ranges from 0 to R, where a maximal grade of R is achieved when zero- knowledge holds against a “semi-malicious” verifier that maliciously selects its random tape and then plays honestly.
    [Show full text]
  • LINEAR ALGEBRA METHODS in COMBINATORICS László Babai
    LINEAR ALGEBRA METHODS IN COMBINATORICS L´aszl´oBabai and P´eterFrankl Version 2.1∗ March 2020 ||||| ∗ Slight update of Version 2, 1992. ||||||||||||||||||||||| 1 c L´aszl´oBabai and P´eterFrankl. 1988, 1992, 2020. Preface Due perhaps to a recognition of the wide applicability of their elementary concepts and techniques, both combinatorics and linear algebra have gained increased representation in college mathematics curricula in recent decades. The combinatorial nature of the determinant expansion (and the related difficulty in teaching it) may hint at the plausibility of some link between the two areas. A more profound connection, the use of determinants in combinatorial enumeration goes back at least to the work of Kirchhoff in the middle of the 19th century on counting spanning trees in an electrical network. It is much less known, however, that quite apart from the theory of determinants, the elements of the theory of linear spaces has found striking applications to the theory of families of finite sets. With a mere knowledge of the concept of linear independence, unexpected connections can be made between algebra and combinatorics, thus greatly enhancing the impact of each subject on the student's perception of beauty and sense of coherence in mathematics. If these adjectives seem inflated, the reader is kindly invited to open the first chapter of the book, read the first page to the point where the first result is stated (\No more than 32 clubs can be formed in Oddtown"), and try to prove it before reading on. (The effect would, of course, be magnified if the title of this volume did not give away where to look for clues.) What we have said so far may suggest that the best place to present this material is a mathematics enhancement program for motivated high school students.
    [Show full text]
  • Lecture 8: Key Derivation, Protecting Passwords, Slow Hashes, Merkle Trees
    Lecture 8: Key derivation, protecting passwords, slow hashes, Merkle trees Boaz Barak Last lecture we saw the notion of cryptographic hash functions which are functions that behave like a random function, even in settings (unlike that of standard PRFs) where the adversary has access to the key that allows them to evaluate the hash function. Hash functions have found a variety of uses in cryptography, and in this lecture we survey some of their other applications. In some of these cases, we only need the relatively mild and well-defined property of collision resistance while in others we only know how to analyze security under the stronger (and not precisely well defined) random oracle heuristic. Keys from passwords We have seen great cryptographic tools, including PRFs, MACs, and CCA secure encryptions, that Alice and Bob can use when they share a cryptographic key of 128 bits or so. But unfortunately, many of the current users of cryptography are humans which, generally speaking, have extremely faulty memory capacity for storing large numbers. There are 628 ≈ 248 ways to select a password of 8 upper and lower case letters + numbers, but some letter/numbers combinations end up being chosen much more frequently than others. Due to several large scale hacks, very large databases of passwords have been made public, and one estimate is that the most frequent 10, 000 ≈ 214 passwords account for more than 90% of the passwords chosen. If we choose a password at random from some set D then the entropy of the password is simply log |D|. Estimating the entropy of real life passwords is rather difficult.
    [Show full text]
  • Foundations of Cryptography – a Primer Oded Goldreich
    Foundations of Cryptography –APrimer Foundations of Cryptography –APrimer Oded Goldreich Department of Computer Science Weizmann Institute of Science Rehovot Israel [email protected] Boston – Delft Foundations and TrendsR in Theoretical Computer Science Published, sold and distributed by: now Publishers Inc. PO Box 1024 Hanover, MA 02339 USA Tel. +1 781 871 0245 www.nowpublishers.com [email protected] Outside North America: now Publishers Inc. PO Box 179 2600 AD Delft The Netherlands Tel. +31-6-51115274 A Cataloging-in-Publication record is available from the Library of Congress Printed on acid-free paper ISBN: 1-933019-02-6; ISSNs: Paper version 1551-305X; Electronic version 1551-3068 c 2005 O. Goldreich All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, mechanical, photocopying, recording or otherwise, without prior written permission of the publishers. now Publishers Inc. has an exclusive license to publish this mate- rial worldwide. Permission to use this content must be obtained from the copyright license holder. Please apply to now Publishers, PO Box 179, 2600 AD Delft, The Netherlands, www.nowpublishers.com; e-mail: [email protected] Contents 1 Introduction and Preliminaries 1 1.1 Introduction 1 1.2 Preliminaries 7 IBasicTools 10 2 Computational Difficulty and One-way Functions 13 2.1 One-way functions 14 2.2 Hard-core predicates 18 3 Pseudorandomness 23 3.1 Computational indistinguishability 24 3.2 Pseudorandom generators
    [Show full text]
  • Pseudorandomness and Computational Difficulty
    PSEUDORANDOMNESS AND COMPUTATIONAL DIFFICULTY RESEARCH THESIS SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF DOCTOR OF SCIENCE HUGO KRAWCZYK SUBMITTED TOTHE SENATEOFTHE TECHNION —ISRAEL INSTITUTE OF TECHNOLOGY SHVAT 5750 HAIFAFEBRUARY 1990 Amis padres, AurorayBernardo, aquienes debo mi camino. ALeonor,compan˜era inseparable. ALiat, dulzuraycontinuidad. This research was carried out in the Computer Science Department under the supervision of Pro- fessor Oded Goldreich. To Oded, my deep gratitude for being both teacher and friend. Forthe innumerable hoursofstimulating conversations. Forhis invaluable encouragement and support. Iamgrateful to all the people who have contributed to this research and given me their support and help throughout these years. Special thanks to Benny Chor,Shafi Goldwasser,Eyal Kushilevitz, Jacob Ukel- son and Avi Wigderson. ToMikeLuby thanks for his collaboration in the work presented in chapter 2. Ialso wish to thank the Wolf Foundation for their generous financial support. Finally,thanks to Leonor,without whom all this would not have been possible. Table of Contents Abstract ............................. 1 1. Introduction ........................... 3 1.1 Sufficient Conditions for the Existence of Pseudorandom Generators ........ 4 1.2 The Existence of Sparse Pseudorandom Distributions . ............ 5 1.3 The Predictability of Congruential Generators ............... 6 1.4 The Composition of Zero-Knowledge Interactive-Proofs . ........... 8 2. On the Existence of Pseudorandom Generators ............... 10 2.1. Introduction .......................... 10 2.2. The Construction of Pseudorandom Generators .............. 13 2.3. Applications: Pseudorandom Generators based on Particular Intractability Assump- tions . ............................ 22 3. Sparse Pseudorandom Distributions ................... 25 3.1. Introduction .......................... 25 3.2. Preliminaries ......................... 25 3.3. The Existence of Sparse Pseudorandom Ensembles ............. 27 3.4.
    [Show full text]
  • A Note on Perfect Correctness by Derandomization⋆
    A Note on Perfect Correctness by Derandomization? Nir Bitansky and Vinod Vaikuntanathan MIT Abstract. We show a general compiler that transforms a large class of erroneous cryptographic schemes (such as public-key encryption, indis- tinguishability obfuscation, and secure multiparty computation schemes) into perfectly correct ones. The transformation works for schemes that are correct on all inputs with probability noticeably larger than half, and are secure under parallel repetition. We assume the existence of one-way functions and of functions with deterministic (uniform) time complexity 2O(n) and non-deterministic circuit complexity 2Ω(n). Our transformation complements previous results that showed how public- key encryption and indistinguishability obfuscation that err on a notice- able fraction of inputs can be turned into ones that for all inputs are often correct. The technique relies on the idea of \reverse randomization" [Naor, Crypto 1989] and on Nisan-Wigderson style derandomization, previously used in cryptography to remove interaction from witness-indistinguishable proofs and commitment schemes [Barak, Ong and Vadhan, Crypto 2003]. 1 Introduction Randomized algorithms are often faster and simpler than their state-of-the-art deterministic counterparts, yet, by their very nature, they are error-prone. This gap has motivated a rich study of derandomization, where a central avenue has been the design of pseudo-random generators [BM84, Yao82a, NW94] that could offer one universal solution for the problem. This has led to surprising results, intertwining cryptography and complexity theory, and culminating in a deran- domization of BPP under worst-case complexity assumptions, namely, the ex- istence of functions in E = Dtime(2O(n)) with worst-case circuit complexity 2Ω(n) [NW94, IW97].
    [Show full text]
  • Counting T-Cliques: Worst-Case to Average-Case Reductions and Direct Interactive Proof Systems
    2018 IEEE 59th Annual Symposium on Foundations of Computer Science Counting t-Cliques: Worst-Case to Average-Case Reductions and Direct Interactive Proof Systems Oded Goldreich Guy N. Rothblum Department of Computer Science Department of Computer Science Weizmann Institute of Science Weizmann Institute of Science Rehovot, Israel Rehovot, Israel [email protected] [email protected] Abstract—We study two aspects of the complexity of counting 3) Counting t-cliques has an appealing combinatorial the number of t-cliques in a graph: structure (which is indeed capitalized upon in our 1) Worst-case to average-case reductions: Our main result work). reduces counting t-cliques in any n-vertex graph to counting t-cliques in typical n-vertex graphs that are In Sections I-A and I-B we discuss each study seperately, 2 drawn from a simple distribution of min-entropy Ω(n ). whereas Section I-C reveals the common themes that lead 2 For any constant t, the reduction runs in O(n )-time, us to present these two studies in one paper. We direct the and yields a correct answer (w.h.p.) even when the reader to the full version of this work [18] for full details. “average-case solver” only succeeds with probability / n 1 poly(log ). A. Worst-case to average-case reductions 2) Direct interactive proof systems: We present a direct and simple interactive proof system for counting t-cliques in 1) Background: While most research in the theory of n-vertex graphs. The proof system uses t − 2 rounds, 2 2 computation refers to worst-case complexity, the impor- the verifier runs in O(t n )-time, and the prover can O(1) 2 tance of average-case complexity is widely recognized (cf., be implemented in O(t · n )-time when given oracle O(1) e.g., [13, Chap.
    [Show full text]
  • A Mathematical Formulation of the Monte Carlo Method∗
    A Mathematical formulation of the Monte Carlo method∗ Hiroshi SUGITA Department of Mathematics, Graduate School of Science, Osaka University 1 Introduction Although admitting that the Monte Carlo method has been producing practical results in many fields, a number of researchers have the following serious suspicion about it. The Monte Carlo method needs random numbers. But since no computer program can generate them, we execute a Monte Carlo method using a pseu- dorandom number generated by a computer program. Of course, such an expedient can never have any mathematical justification. As a matter of fact, this suspicion is a misunderstanding caused by prejudice. In this article, we propose a proper mathematical formulation of the Monte Carlo method, which resolves this suspicion. The mathematical definitions of the notions of random number and pseudorandom number have been known for quite some time. Indeed, the notion of random number was defined in terms of computational complexity by Kolmogorov and others in 1960’s ([3, 4, 6]), while the notion of pseudorandom number was defined in the context of cryptography by Blum and others in 1980’s ([1, 2, 14]). But unfortunately, those definitions have been thought to be useless until now in understanding and executing the Monte Carlo method. It is not because their definitions are improper, but because our way of thinking about the Monte Carlo method has been improper. In this article, we propose a mathematical formulation of the Monte Carlo method which is based on and theoretically compatible with those definitions of random number and pseudorandom number. Under our formulation, as a result, we see the following.
    [Show full text]
  • Measures of Pseudorandomness
    Katalin Gyarmati Measures of Pseudorandomness Abstract: In the second half of the 1990s Christian Mauduit and András Sárközy [86] introduced a new quantitative theory of pseudorandomness of binary sequences. Since then numerous papers have been written on this subject and the original theory has been generalized in several directions. Here I give a survey of some of the most important results involving the new quantitative pseudorandom measures of finite bi- nary sequences. This area has strong connections to finite fields, in particular, some of the best known constructions are defined using characters of finite fields and their pseudorandom measures are estimated via character sums. Keywords: Pseudorandomness, Well Distribution, Correlation, Normality 2010 Mathematics Subject Classifications: 11K45 Katalin Gyarmati: Department of Algebra and Number Theory, Eötvös Loránd University, Budapest, Hungary, e-mail: [email protected] 1Introduction In the twentieth and twenty-first centuries various pseudorandom objects have been studied in cryptography and number theory since these objects are widely used in modern cryptography, in applications of the Monte Carlo method and in wireless communication (see [39]). Different approaches and definitions of pseudorandom- ness can be found in several papers and books. Menezes, Oorschot and Vanstone [95] have written an excellent monograph about these approaches. The most frequent- ly used interpretation of pseudorandomness is based on complexity theory; Gold- wasser [38] has written a survey paper about this approach. However, recently the complexity theory approach has been widely criticized. One problem is that in this approach usually infinite sequences are tested while in the applications only finite sequences are used. Another problem is that most results are based on certain un- proved hypotheses (such as the difficulty of factorization of integers).
    [Show full text]
  • Pseudorandomness
    ~ MathDefs ~ CS 127: Cryptography / Boaz Barak Pseudorandomness Reading: Katz-Lindell Section 3.3, Boneh-Shoup Chapter 3 The nature of randomness has troubled philosophers, scientists, statisticians and laypeople for many years.1 Over the years people have given different answers to the question of what does it mean for data to be random, and what is the nature of probability. The movements of the planets initially looked random and arbitrary, but then the early astronomers managed to find order and make some predictions on them. Similarly we have made great advances in predicting the weather, and probably will continue to do so in the future. So, while these days it seems as if the event of whether or not it will rain a week from today is random, we could imagine that in some future we will be able to perfectly predict it. Even the canonical notion of a random experiment- tossing a coin - turns out that it might not be as random as you’d think, with about a 51% chance that the second toss will have the same result as the first one. (Though see also this experiment.) It is conceivable that at some point someone would discover some function F that given the first 100 coin tosses by any given person can predict the value of the 101th.2 Note that in all these examples, the physics underlying the event, whether it’s the planets’ movement, the weather, or coin tosses, did not change but only our powers to predict them. So to a large extent, randomness is a function of the observer, or in other words If a quantity is hard to compute, it might as well be random.
    [Show full text]
  • Computational Complexity
    Computational Complexity The Harvard community has made this article openly available. Please share how this access benefits you. Your story matters Citation Vadhan, Salil P. 2011. Computational complexity. In Encyclopedia of Cryptography and Security, second edition, ed. Henk C.A. van Tilborg and Sushil Jajodia. New York: Springer. Published Version http://refworks.springer.com/mrw/index.php?id=2703 Citable link http://nrs.harvard.edu/urn-3:HUL.InstRepos:33907951 Terms of Use This article was downloaded from Harvard University’s DASH repository, and is made available under the terms and conditions applicable to Open Access Policy Articles, as set forth at http:// nrs.harvard.edu/urn-3:HUL.InstRepos:dash.current.terms-of- use#OAP Computational Complexity Salil Vadhan School of Engineering & Applied Sciences Harvard University Synonyms Complexity theory Related concepts and keywords Exponential time; O-notation; One-way function; Polynomial time; Security (Computational, Unconditional); Sub-exponential time; Definition Computational complexity theory is the study of the minimal resources needed to solve computational problems. In particular, it aims to distinguish be- tween those problems that possess efficient algorithms (the \easy" problems) and those that are inherently intractable (the \hard" problems). Thus com- putational complexity provides a foundation for most of modern cryptogra- phy, where the aim is to design cryptosystems that are \easy to use" but \hard to break". (See security (computational, unconditional).) Theory Running Time. The most basic resource studied in computational com- plexity is running time | the number of basic \steps" taken by an algorithm. (Other resources, such as space (i.e., memory usage), are also studied, but they will not be discussed them here.) To make this precise, one needs to fix a model of computation (such as the Turing machine), but here it suffices to informally think of it as the number of \bit operations" when the input is given as a string of 0's and 1's.
    [Show full text]
  • Complexity Theory and Cryptography Understanding the Foundations of Cryptography Is Understanding the Foundations of Hardness
    Manuel Sabin Research Statement Page 1 / 4 I view research as a social endeavor. This takes two forms: 1) Research is a fun social activity. 2) Research is done within a larger sociotechnical environment and should be for society's betterment. While I try to fit all of my research into both of these categories, I have also taken two major research directions to fulfill each intention. 1) Complexity Theory asks profound philosophical questions and has compelling narratives about the nature of computation and about which problems' solutions may be provably beyond our reach during our planet's lifetime. Researching, teaching, and mentoring on this field’s stories is one my favorite social activities. 2) Algorithmic Fairness' questioning of how algorithms further cement and codify systems of oppression in the world has impacts that are enormously far-reaching both in current global problems and in the nature of future ones. This field is in its infancy and deciding its future and impact with intention is simultaneously exciting and frightening but, above all, of absolute necessity. Complexity Theory and Cryptography Understanding the foundations of Cryptography is understanding the foundations of Hardness. Complexity Theory studies the nature of computational hardness { i.e. lower bounds on the time required in solving computational problems { not only to understand what is difficult, but to understand the utility hardness offers. By hiding secrets within `structured hardness,' Complexity Theory, only as recently as the 1970s, transformed the ancient ad-hoc field of Cryptography into a science with rigorous theoretical foundations. But which computational hardness can we feel comfortable basing Cryptography on? My research studies a question foundational to Complexity Theory and Cryptography: Does Cryptography's existence follow from P 6= NP? P is the class of problems computable in polynomial time and is qualitatively considered the set of `easy' problems, while NP is the class of problems whose solutions, when obtained, can be checked as correct in polynomial time.
    [Show full text]