On the Computational Complexity of Minimal Cumulative Cost Graph Pebbling Jeremiah Blocki Samson Zhou Structure of Talk ❖ Background ❖ Graph Pebbling ❖ “Graph Reducibility” ❖ Open Problems Background ❖ Users tend to pick weak passwords Source: SkyHigh Background ❖ Users tend to pick weak passwords ❖ Server attacks are inevitable Background ❖ Users tend to pick weak passwords ❖ Server attacks are inevitable ❖ Try to mitigate offline attacks ❖ Specialized hardware (ASIC) can compute 1012 hashes per second. Hash Function Goals ❖ “Moderately Expensive” to compute ❖ Expensive to compute on ASIC ❖ Fast and cheap on PC iMHFs ❖ Data-independent memory hard functions require comparatively more resources for adversaries to compute iMHFs Hash function: 퐻 iMHFs pwd ℎ1 ℎ1 = 퐻(푝푤푑, 푠푎푙푡) iMHFs pwd ℎ1 ℎ2 ℎ2 = 퐻(ℎ1) iMHFs pwd ℎ1 ℎ2 ℎ3 ℎ4 ℎ3 = 퐻 ℎ1, ℎ2 , ℎ4 = 퐻(ℎ2) iMHFs pwd ℎ1 ℎ2 ℎ3 ℎ5 ℎ4 ℎ5 = 퐻 ℎ3, ℎ4 iMHFs ❖ Data-independent memory hard functions require comparatively more resources for adversaries to compute ❖ Calculating an iMHF can be modeled as graph pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling Graph Pebbling iMHFs ❖ How to evaluate iMHF? ❖ ST-complexity: number of pebbles × number of steps ❖ 2 pebbles × 7 steps = 14 ❖ ST-complexity can scale badly with multiple evaluations [AS15] iMHFs ❖ [AS15] ∃ function f such that: 푆푇 푛 푛푠푡푎푛푐푒푠 표푓 푓 = 푂(푆푇 푓 ) “What’s an anagram of Banach-Tarski?” “Banach-Tarski Banach-Tarksi” Graph Pebbling 푃1 = 1 Graph Pebbling 푃1 + 푃2 = 1 + 2 = 3 Graph Pebbling 푃1 + 푃2 + 푃3 = 3 + 2 = 5 Graph Pebbling 4 ෍ |푃푖| = 5 + 1 = 6 푖=1 Graph Pebbling 5 ෍ |푃푖| = 6 + 2 = 8 푖=1 Graph Pebbling 6 ෍ |푃푖| = 8 + 2 = 10 푖=1 Graph Pebbling 7 푐푐 퐺 = ෍ |푃푖| = 10 + 1 = 11 푖=1 iMHFs ❖ [AS15] CC amortizes well: ❖ 퐶퐶 푛 푐표푝푒푠 표푓 푓 = 푛 × 퐶퐶(푓) iMHFs ❖ Data-independent memory hard functions require comparatively more resources for adversaries to compute ❖ Calculating an iMHF can be modeled as graph pebbling ❖ Cumulative complexity better model than space-time complexity Structure of Talk ✓ Background ❖ Graph Pebbling ❖ “Graph Reducibility” ❖ Open Problems Main Result ❖ Computing 푐푐(퐺) is NP-hard! ❖ Finding the pebbling number of a graph is PSPACE-complete. [GLT79] 3-PARTITION ❖ Given set of 3푛 integers, can we partition them into 푛 sets, each with the same sum? ❖ 1,2,4,5,6,7,8,11,13 ❖ 2,4,13 → 19 1,7,11 → 19 5,6,8 → 19 ❖ {1,2,3,4,6,7,9,10,11} Bounded 2-Linear Covering ❖ Given 푛 variables 푥1, 푥2, … , 푥푛, integers 푚 ≤ 푘, and 푘 equations of the form 푥푖 + 푐 = 푥푗, can we find 푚 assignments so that all equations are satisfied? ❖ 푥1 + 2 = 푥2, 푥2 + 3 = 푥3, 푥1 + 6 = 푥3 ❖ 푥1 + 5 = 푥2, 푥2 + 1 = 푥3, 푥1 + 5 = 푥3 ❖ 푚 = 2 ❖ Assignment 1: 푥1 = 1, 푥2 = 3, 푥3 = 6 ❖ Assignment 2: 푥1 = 1, 푥2 = 6, 푥3 = 7 Reductions ❖ Reducing 3-PARTITION to B2LC ❖ Reducing B2LC to 푐푐(퐺) Reductions 푚 푇 = ෍ 푠푚 푖=1 Reductions 푚 푛 푚 = 3푛 integers in original 3-PARTITION instance Reductions 푚 푛 푚 = 3푛 integers in original 3-PARTITION instance Reductions 푚 푛 푚 = 3푛 integers in original 3-PARTITION instance Reductions 푚 푛 푚 = 3푛 integers in original 3-PARTITION instance Reductions 푚 푛 푚 = 3푛 integers in original 3-PARTITION instance Reductions ✓ Reducing 3-PARTITION to B2LC ❖ Reducing B2LC to 푐푐(퐺) Reductions 푥2: 푥1: Reductions 푥1 + 2 = 푥2: 푥2: 푥1: Honest Pebbling 푥1 + 2 = 푥2: 푥2: 푥1: Honest Pebbling 푥1 + 2 = 푥2: 푥2: 푥1: Honest Pebbling 푥1 + 2 = 푥2: 푥2: 푥1: Honest Pebbling 푥1 + 2 = 푥2: 푥2: 푥1: Honest Pebbling 푥1 + 2 = 푥2: 푥2: 푥1: Honest Pebbling 푥1 + 2 = 푥2: 푥2: 푥1: Honest Pebbling 푥1 + 2 = 푥2: 푥2: 푥1: Cheater! 푥1 + 2 = 푥2: 푥2: 푥1: Cheater! 푥1 + 2 = 푥2: 푥2: 푥1: Cheater! 푥1 + 2 = 푥2: 푥2: 푥1: Cheater! Reductions Structure of Talk ✓ Background ✓ Graph Pebbling ❖ “Graph Reducibility” ❖ Open Problems Results ❖ Computing 푐푐(퐺) is NP-hard! ❖ Computing (푒, 푑)- reducibility is NP-hard! Graph Reducibility ❖ We say that a directed acyclic graph 퐺 is (푒, 푑)-reducible if there exists a set 푆 of 푒 nodes such that 퐺 − 푆 has depth at most 푑. 1 2 3 4 5 6 7 (1,3) - reducible Graph Reducibility ❖ Can deduce 푐푐(퐺) from (푒, 푑)-reducible! ❖ Depth-robustness is a necessary condition for secure iMHFs (AB16) 3 2 ❖ There exists attack with 퐸푅 퐴 = 푂 푒푛 + 푛 푑 , which is 표(푛 ) for 푒, 푑 = 표(푛). ❖ Depth-robustness is a sufficient condition for secure iMHFs (ABP16) ❖ 푐푐 퐺 ≤ 푒푑 Vertex Cover ❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Vertex Cover ❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Vertex Cover ❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Vertex Cover ❖ Given a graph 퐺(푉, 퐸) and an integer 푘, does there exist a subset of 푉 of size 푘 which intersects all edges of 퐸? Reduction ❖ Arbitrarily label the vertices 1,2, … , 푛, and direct edges in topological ordering. Reduction ❖ Arbitrarily label the vertices 1,2, … , 푛, and direct edges in topological ordering. 1 2 4 5 3 Reduction ❖ Arbitrarily label the vertices 1,2, … , 푛, and direct edges in topological ordering. 1 2 4 5 3 Reduction ❖ For vertex , create an ingoing path of length − 1 and an outgoing path of length 푛 − . 1 2 4 5 3 Reduction 4 3 1 3 1 2 4 5 1 3 2 Path of length 푛 if and only if a blue 4 edge remains! 2 Summary ❖ We show computing 푐푐(퐺) is NP-hard (as is computing 푠푡(퐺)). 푛 ❖ Linear Program for 푐푐(퐺) has Ω integrality gap. log 푛 ❖ We show that given 푒, 푑, it is NP-hard to determine whether a graph is (푒, 푑)-reducible (even for graphs with bounded degree). ❖ Given 푑, it may be NP-hard to: ❖ Approximate 푒 to a factor of 1.3 (minimum Vertex Cover). ❖ Approximate 푒 to a factor of 2 (Unique Games Conjecture). ❖ An optimal cumulative cost pebbling of a graph may take more than 푛 steps. Structure of Talk ✓ Background ✓ Graph Pebbling ✓ “Graph Reducibility” ❖ Open Problems Open Questions ❖ Does there exist an algorithm to approximate 푐푐(퐺)? ❖ Do there exist constants 푐1, 푐2 so that given an (푒, 푑)-reducible graph, we can a set 푆 of c1푒 nodes such that 퐺 − 푆 has depth at most c2푑? 1 2 3 4 5 6 7 (1,3) - reducible 푛2 ❖ Does there exist a graph with 푐푐 퐺 = and space 3? (ADNV17) log 푛 Questions? 85.