The study of fine-grained cryptography has proliferated in recent years due to its allure of potentially relying on weaker assumptions compared to standard cryptography. As fine-grained cryptography only requires polynomial gaps between the adversary and honest parties, it seems plausible to build primitives relying upon popular hardness assumptions about problems in \(\textbf{P}\) such as \(k\text {-}\textsf{SUM}\) or \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) . The ultimate hope is that fine-grained cryptography could still be viable even if all current cryptographic assumptions are false, such as if \(\textbf{P} = \textbf{NP}\) or if we live in Pessiland where one-way functions do not exist. In our work, we consider whether this approach is viable by studying fine-grained complexity when all standard cryptographic assumptions are false. As our main result, we show that many popular fine-grained complexity problems are easy to solve in the average-case when one-way functions do not exist. In other words, many candidate hardness assumptions for building fine-grained cryptography are no longer options in Pessiland. As an example, we prove that the average-case \(k\text {-}\textsf{SUM}\) and \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) conjectures are false for sufficiently large constant k when no one-way functions exist. The average-case \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) assumption was used to build fine-grained key-exchange by Lavigne et al. [CRYPTO’19]. One can also view the contrapositive of our result as providing an explicit construction of one-way functions assuming \(n^{\omega _k(1)}\) average-case hardness of \(k\text {-}\textsf{SUM}\) or \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) for all constant k. We also show that barriers for reductions in fine-grained complexity may be explained by problems in cryptography. First, we show that finding faster algorithms for computing discrete logarithms is equivalent to designing average-case equivalence between \(k\text {-}\textsf{SUM}\) and \(k\text {-}\textsf{CYC}\) (an extension of \(k\text {-}\textsf{SUM}\) to cyclic groups). In particular, finding such a reduction from \(k\text {-}\textsf{CYC}\) to \(k\text {-}\textsf{SUM}\) could potentially lead to breakthrough algorithms for the discrete logarithm, factoring, RSA and quadratic residuosity problems. Finally, we show that discrete logarithms with preprocessing may be reduced to the \(k\text {-}\textsf{CYC}\mathsf {\text {-}Index}\) problem, and we present faster algorithms for average-case \(k\text {-}\textsf{SUM}\mathsf {\text {-}Index}\) and \(k\text {-}\textsf{CYC}\mathsf {\text {-}Index}\) .

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Fine-Grained Complexity in a World Without Cryptography

  • Josh Alman,
  • Yizhi Huang,
  • Kevin Yeo

摘要

The study of fine-grained cryptography has proliferated in recent years due to its allure of potentially relying on weaker assumptions compared to standard cryptography. As fine-grained cryptography only requires polynomial gaps between the adversary and honest parties, it seems plausible to build primitives relying upon popular hardness assumptions about problems in \(\textbf{P}\) such as \(k\text {-}\textsf{SUM}\) or \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) . The ultimate hope is that fine-grained cryptography could still be viable even if all current cryptographic assumptions are false, such as if \(\textbf{P} = \textbf{NP}\) or if we live in Pessiland where one-way functions do not exist. In our work, we consider whether this approach is viable by studying fine-grained complexity when all standard cryptographic assumptions are false. As our main result, we show that many popular fine-grained complexity problems are easy to solve in the average-case when one-way functions do not exist. In other words, many candidate hardness assumptions for building fine-grained cryptography are no longer options in Pessiland. As an example, we prove that the average-case \(k\text {-}\textsf{SUM}\) and \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) conjectures are false for sufficiently large constant k when no one-way functions exist. The average-case \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) assumption was used to build fine-grained key-exchange by Lavigne et al. [CRYPTO’19]. One can also view the contrapositive of our result as providing an explicit construction of one-way functions assuming \(n^{\omega _k(1)}\) average-case hardness of \(k\text {-}\textsf{SUM}\) or \(\textsf{Zero}\text {-}k\text {-}\textsf{Clique}\) for all constant k. We also show that barriers for reductions in fine-grained complexity may be explained by problems in cryptography. First, we show that finding faster algorithms for computing discrete logarithms is equivalent to designing average-case equivalence between \(k\text {-}\textsf{SUM}\) and \(k\text {-}\textsf{CYC}\) (an extension of \(k\text {-}\textsf{SUM}\) to cyclic groups). In particular, finding such a reduction from \(k\text {-}\textsf{CYC}\) to \(k\text {-}\textsf{SUM}\) could potentially lead to breakthrough algorithms for the discrete logarithm, factoring, RSA and quadratic residuosity problems. Finally, we show that discrete logarithms with preprocessing may be reduced to the \(k\text {-}\textsf{CYC}\mathsf {\text {-}Index}\) problem, and we present faster algorithms for average-case \(k\text {-}\textsf{SUM}\mathsf {\text {-}Index}\) and \(k\text {-}\textsf{CYC}\mathsf {\text {-}Index}\) .