Zeta Functions, One–Way Functions, and Pseudorandom Number Generators
Total Page:16
File Type:pdf, Size:1020Kb
ZETA FUNCTIONS, ONE{WAY FUNCTIONS, AND PSEUDORANDOM NUMBER GENERATORS Michael Anshel Department of Computer Sciences, City College of New York, New York, NY 10031 Dorian Goldfeld Department of Mathematics, Columbia University New York, NY 10027 Abstract. New candidate one{way functions which arise from the intractable problem of determining a zeta function from its initial Dirichlet coefficients are presented. This in- tractable problem appears to be totally unrelated to the well known intractable problems of integer factorization and the computation of discrete logarithms. We introduce the feasible Selberg class of zeta functions and focus on three special subclasses: ZKronecker = Dirich- let L-functions with real characters, ZElliptic = L{functions of elliptic curves, and ZArtin = Artin L-functions. It is shown that the reduction (mod 2) map on the Dirichlet coefficients of ZElliptic induces a map ZElliptic !ZArtin. The assumption that it is not feasible (in polyno- mial time) to determine an Artin L{function from its initial Dirichlet coefficients leads to a new pseudorandom number generator. These results are interpreted in various cryptographic settings by employing the Eisenstein{Jacobi law of cubic reciprocity. Key Words: Zeta function, One{way function, Pseudorandom number generator, Elliptic curve, Frobenius element, Cubic reciprocity law, Feasible Selberg class. x1. Introduction: A central problem in cryptography is to establish the existence of one{way functions. Such a function would have the property that while it is computable in polynomial time, its inverse is not. One approach to this problem is to construct candidate one{way functions from seemingly intractable problems in number theory. We introduce a new intractable problem arising from the theory of zeta functions which leads to a new class of one{way functions based on the arithmetic theory of zeta functions. Moreover, there appears to be no relation between this problem and other intractable problems such as integer factor- ization and the computation of discrete logarithms where known attacks have emerged in recent years (see [22, 26]). At present the authors are unaware of any methods at all that would provide an attack on our candidate one{way functions. Typeset by AMS-TEX 1 It is a consequence of the main theorem of [12] that a 1{1 one{way function implies the existence of a pseudorandom number generator. The construction of such pseudoran- dom number generators, however, is computationally intensive. In our case we explicitly construct from a given elliptic curve a pseudorandom number generator PNGElliptic which can be computed very efficiently and at low computational cost. Under the assumption that two different classes of zeta functions (the elliptic class and the Artin class, to be defined below) give rise to one{way functions, we prove that an elliptic curve satisfying certain hypotheses implies the existence of such a pseudorandom number generator. In this regard, the second author would like to take this opportunity to thank Fred Diamond for many helpful discussions concerning `{adic representations. x2. One{way Functions and the Feasible Selberg Class Let n ≥ 0 be an integer and define blog2 nc + 1; if n > 0 d2(n) = 1; if n = 0: where for an arbitrary real number x ≥ 0, bxc denotes the greatest integer less than or equal to x. We refer to d2(n) as the bit size of n. We extend this notion to non{negative t integral vectors by defining the norm jj(n1; n2; : : : ; nt)jj of a vector (n1; n2; : : : ; nt) 2 N as t X jj(n1; n2; : : : ; nt)jj = d2(ni): i=1 Fix positive rational integers r; s. A function r s f : N −! N is a one{way function provided the following three conditions hold. (2.1) There exists an integer k > 0 such that 1 k jj~njj k ≤ jjf(~n)jj ≤ jj~njj r for ~n = (n1; n2; : : : ; nr) 2 N : (2.2) f(~n) can be computed in polynomial time in jj~njj: (2.3) Given m 2 Ns, there does not exist a polynomial time algorithm which either computes a vector ~n 2 Nr such that f(~n) = ~m or indicates that no such value exists. Condition (2.1) says that f(~n) is neither polynomially longer or shorter than ~n. Cur- rently, there is no guarantee that one{way functions exist even if P 6= NP . Certain can- didate one{way functions associated with factorization, exponentiation modulo a prime, and discrete logarithms, etc. have been proposed. We introduce new candidate one{way functions based on a seemingly intractable problem in the theory of zeta functions. Our 2 candidate one{way functions arise from a very general class of zeta functions, the feasible Selberg class, which we now define. In order to specify our intractable problem we axiomatically define a class, Z, of zeta functions; the feasible Selberg class (defined from [23]). Every zeta function Z(s) 2 Z is given by a Dirichlet series 1 X a(n) Z(s) = ; a(n) 2 ns C n=1 which is absolutely convergent in some half-plane Re(s) 1: We further assume that Z(s) is a meromorphic function of a single complex variable s which satisfies the following hypotheses: (2.4) a(n) = O(nC ) for some constant C > 0 independent of n. P −s r (2.5) log Z(s) = n b(n) · n , where b(n) = 0 unless n = p , a positive prime power. (2.6) Given a prime power pr, 9 an algorithm to compute b(pr) in polynomial time. (2.7) There exist A; k; bi > 0; w 2 C with jwj = 1, and a polynomial P (s) such that Z(s) satisfies a functional equation of type: ! s Y Λ(s) = A P (s) Γ(bis + di) Z(s) = w · Λ(k − s¯): i Selberg [23] introduced the class of zeta functions (now called the Selberg class) satisfy- ing (2.4), (2.5), (2.7). The axiom (2.6) is new and justifies the term feasible Selberg class. It is precisely the axiom (2.6) which makes this class so interesting for cryptography. Note that axiom (2.6) is quite restrictive; zeta functions with transcendental coefficients cannot be in the feasible Selberg class. The constant A in the functional equation is called the conductor of the zeta function. The Riemann hypothesis for any subfamily Z0 ⊂ Z is the statement that all zeros of Λ(s) (corresponding to Z(s) 2 Z0) have Re(s) = k=2: There are numerous well known special subfamilies of Z: These include, Dedekind zeta functions of number fields [15] (among which is the famous Riemann zeta function), Dirich- let L-functions [8], and zeta functions associated to modular forms [20]. In contrast, the Hasse{Weil zeta function for algebraic varieties over a finite field may not satisfy axiom (2.6) (see [10]). Definition: We say a subfamily Z0 of Z is abundant provided: for every > 0; the number of distinct zeta functions in the subfamily for which the conductor A lies in an interval of length B is greater than B1− as B ! 1: With this definition, we introduce the motivating problem for this paper: 3 0 Problem[1]: Let Z be a fixed abundant subfamily of Z: Given a list fα1; α2; : : : ; αkg of complex numbers, how difficult is it to determine whether or not there exists 1 X Z(s) = a(n) · n−s 2 Z0 n=1 such that a(n) = αn for n = 1; 2; : : : k, and the conductor of Z(s) lies in a given bounded interval. If such a zeta function exists, how difficult is it to construct one such zeta func- tion? The most general class of zeta functions which satisfy (2.4), (2.5), (2.6), (2.7), and for which there is a comprehensive arithmetic theory is the class of L-functions associated to automorphic representations of reductive groups in the sense of Jacquet{Langlands (see [14], [3]). We conjecture that problem[1] is intractable for abundant subfamilies of Z consisting of L{functions associated to cuspidal automorphic representations of reductive groups, and that this intractable problem provides the basis for constructing new one{ way functions. As evidence for this conjecture, we will focus on three specific subclasses, ZKronecker; ZElliptic and ZArtin. x3. The classes ZKronecker; ZElliptic and ZArtin We define ZKronecker [8] to be the class of all Dirichlet L-series of the form 1 X d L (s) = · n−s; d n n=1 d where n denotes the Kronecker symbol and d is any product of relatively prime factors of the form 1 (p−1) −4; 8; −8; (−1) 2 p (p a positive odd prime): Such integers d are called fundamental discriminants. A simple example of Problem[1] is the following: Problem[2]: Let B denote a large number. Set b = (log(B))κ where κ > 2: Suppose we are given a list f1; 2; : : : ; bg where each j = ±1 for j = 1; 2; : : : ; b: How difficult is it d to decide if an L{function, Ld(s) 2 ZKronecker, with B ≤ jdj ≤ 2B, satisfies n = n for n = 1; 2; : : : ; b? If such Ld(s) exists, how difficult is it to construct one such fundamental discriminant d? Remarks: If we assume the Riemann hypothesis for the class ZKronecker then it can be shown (see [11]) there will be at most one such d: Problem[2] was first stated by Damg˚ard [7] who was the first to suggest that the genuine hardness of this problem could be directly used to construct a cryptographically strong bit generator. We now define the class ZElliptic: An elliptic curve E over Q is specified by a pair of 3 2 elements a; b 2 Q for which the discriminant ∆E = 4a + 27b 6= 0.