On the Computational Complexity of Minimal Cumulative Cost Graph Pebbling
Jeremiah Blocki Samson Zhou Structure of Talk
❖ Background ❖ Graph Pebbling ❖ “Graph Reducibility” ❖ Open Problems Background
❖ Users tend to pick weak passwords Source: SkyHigh Background
❖ Users tend to pick weak passwords ❖ Server attacks are inevitable
Background
❖ Users tend to pick weak passwords ❖ Server attacks are inevitable ❖ Try to mitigate offline attacks ❖ Specialized hardware (ASIC) can compute 1012 hashes per second. Hash Function Goals
❖ “Moderately Expensive” to compute ❖ Expensive to compute on ASIC ❖ Fast and cheap on PC
iMHFs
❖ Data-independent memory hard functions require comparatively more resources for adversaries to compute iMHFs
Hash function: 퐻 iMHFs
pwd ℎ1
ℎ1 = 퐻(푝푤푑, 푠푎푙푡) iMHFs
pwd ℎ1 ℎ2
ℎ2 = 퐻(ℎ1) iMHFs
pwd ℎ1 ℎ2 ℎ3
ℎ4
ℎ3 = 퐻 ℎ1, ℎ2 , ℎ4 = 퐻(ℎ2) iMHFs
pwd ℎ1 ℎ2 ℎ3 ℎ5
ℎ4
ℎ5 = 퐻 ℎ3, ℎ4 iMHFs
❖ Data-independent memory hard functions require comparatively more resources for adversaries to compute ❖ Calculating an iMHF can be modeled as graph pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling iMHFs
❖ How to evaluate iMHF? ❖ ST-complexity: number of pebbles × number of steps ❖ 2 pebbles × 7 steps = 14 ❖ ST-complexity can scale badly with multiple evaluations [AS15] iMHFs
❖ [AS15] ∃ function f such that: 푆푇 푛 𝑖푛푠푡푎푛푐푒푠 표푓 푓 = 푂(푆푇 푓 )
“What’s an anagram of Banach-Tarski?” “Banach-Tarski Banach-Tarksi” Graph Pebbling
푃1 = 1 Graph Pebbling
푃1 + 푃2 = 1 + 2 = 3 Graph Pebbling
푃1 + 푃2 + 푃3 = 3 + 2 = 5 Graph Pebbling
4
|푃푖| = 5 + 1 = 6 푖=1 Graph Pebbling
5
|푃푖| = 6 + 2 = 8 푖=1 Graph Pebbling
6
|푃푖| = 8 + 2 = 10 푖=1 Graph Pebbling
7
푐푐 퐺 = |푃푖| = 10 + 1 = 11 푖=1 iMHFs
❖ [AS15] CC amortizes well: ❖ 퐶퐶 푛 푐표푝𝑖푒푠 표푓 푓 = 푛 × 퐶퐶(푓) iMHFs
❖ Data-independent memory hard functions require comparatively more resources for adversaries to compute ❖ Calculating an iMHF can be modeled as graph pebbling ❖ Cumulative complexity better model than space-time complexity Structure of Talk
✓ Background ❖ Graph Pebbling ❖ “Graph Reducibility” ❖ Open Problems Main Result
❖ Computing 푐푐(퐺) is NP-hard!
❖ Finding the pebbling number of a graph is PSPACE-complete. [GLT79] 3-PARTITION
❖ Given set of 3푛 integers, can we partition them into 푛 sets, each with the same sum? ❖ 1,2,4,5,6,7,8,11,13 ❖ 2,4,13 → 19 1,7,11 → 19 5,6,8 → 19 ❖ {1,2,3,4,6,7,9,10,11} Bounded 2-Linear Covering
❖ Given 푛 variables 푥1, 푥2, … , 푥푛, integers 푚 ≤ 푘, and 푘 equations of the form 푥푖 + 푐 = 푥푗, can we find 푚 assignments so that all equations are satisfied?
❖ 푥1 + 2 = 푥2, 푥2 + 3 = 푥3, 푥1 + 6 = 푥3 ❖ 푥1 + 5 = 푥2, 푥2 + 1 = 푥3, 푥1 + 5 = 푥3 ❖ 푚 = 2
❖ Assignment 1: 푥1 = 1, 푥2 = 3, 푥3 = 6 ❖ Assignment 2: 푥1 = 1, 푥2 = 6, 푥3 = 7 Reductions
❖ Reducing 3-PARTITION to B2LC ❖ Reducing B2LC to 푐푐(퐺) Reductions
푚
푇 = 푠푚 푖=1 Reductions
푚
푛
푚 = 3푛 integers in original 3-PARTITION instance Reductions
푚
푛
푚 = 3푛 integers in original 3-PARTITION instance Reductions
푚
푛
푚 = 3푛 integers in original 3-PARTITION instance Reductions
푚
푛
푚 = 3푛 integers in original 3-PARTITION instance Reductions
푚
푛
푚 = 3푛 integers in original 3-PARTITION instance Reductions
✓ Reducing 3-PARTITION to B2LC ❖ Reducing B2LC to 푐푐(퐺) Reductions
푥2:
푥1: Reductions
푥1 + 2 = 푥2:
푥2:
푥1: Honest Pebbling
푥1 + 2 = 푥2:
푥2:
푥1: Honest Pebbling
푥1 + 2 = 푥2:
푥2:
푥1: Honest Pebbling
푥1 + 2 = 푥2:
푥2:
푥1: Honest Pebbling
푥1 + 2 = 푥2:
푥2:
푥1: Honest Pebbling
푥1 + 2 = 푥2:
푥2:
푥1: Honest Pebbling
푥1 + 2 = 푥2:
푥2:
푥1: Honest Pebbling
푥1 + 2 = 푥2:
푥2:
푥1: Cheater!
푥1 + 2 = 푥2:
푥2:
푥1: Cheater!
푥1 + 2 = 푥2:
푥2:
푥1: Cheater!
푥1 + 2 = 푥2:
푥2:
푥1: Cheater! Reductions Structure of Talk
✓ Background ✓ Graph Pebbling ❖ “Graph Reducibility” ❖ Open Problems Results
❖ Computing 푐푐(퐺) is NP-hard!
❖ Computing (푒, 푑)- reducibility is NP-hard! Graph Reducibility
❖ We say that a directed acyclic graph 퐺 is (푒, 푑)-reducible if there exists a set 푆 of 푒 nodes such that 퐺 − 푆 has depth at most 푑.
1 2 3 4 5 6 7
(1,3) - reducible Graph Reducibility
❖ Can deduce 푐푐(퐺) from (푒, 푑)-reducible! ❖ Depth-robustness is a necessary condition for secure iMHFs (AB16) 3 2 ❖ There exists attack with 퐸푅 퐴 = 푂 푒푛 + 푛 푑 , which is 표(푛 ) for 푒, 푑 = 표(푛). ❖ Depth-robustness is a sufficient condition for secure iMHFs (ABP16) ❖ 푐푐 퐺 ≤ 푒푑 Vertex Cover
❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Vertex Cover
❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Vertex Cover
❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Vertex Cover
❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Reduction
❖ Arbitrarily label the vertices 1,2, … , 푛, and direct edges in topological ordering. Reduction
❖ Arbitrarily label the vertices 1,2, … , 푛, and direct edges in topological ordering.
1 2 4 5
3 Reduction
❖ Arbitrarily label the vertices 1,2, … , 푛, and direct edges in topological ordering.
1 2 4 5
3 Reduction
❖ For vertex 𝑖, create an ingoing path of length 𝑖 − 1 and an outgoing path of length 푛 − 𝑖.
1 2 4 5
3 Reduction 4 3 1
3
1 2 4 5
1 3 2 Path of length 푛 if and only if a blue 4 edge remains! 2
Summary
❖ We show computing 푐푐(퐺) is NP-hard (as is computing 푠푡(퐺)). 푛 ❖ Linear Program for 푐푐(퐺) has Ω integrality gap. log 푛 ❖ We show that given 푒, 푑, it is NP-hard to determine whether a graph is (푒, 푑)-reducible (even for graphs with bounded degree). ❖ Given 푑, it may be NP-hard to: ❖ Approximate 푒 to a factor of 1.3 (minimum Vertex Cover). ❖ Approximate 푒 to a factor of 2 (Unique Games Conjecture). ❖ An optimal cumulative cost pebbling of a graph may take more than 푛 steps. Structure of Talk
✓ Background ✓ Graph Pebbling ✓ “Graph Reducibility” ❖ Open Problems Open Questions
❖ Does there exist an algorithm to approximate 푐푐(퐺)?
❖ Do there exist constants 푐1, 푐2 so that given an (푒, 푑)-reducible graph, we can a set 푆 of c1푒 nodes such that 퐺 − 푆 has depth at most c2푑?
1 2 3 4 5 6 7
(1,3) - reducible 푛2 ❖ Does there exist a graph with 푐푐 퐺 = and space 3? (ADNV17) log 푛
Questions?
85