Concurent ZeroKnowledge with Logarithmic RoundComplexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性

completenessintwo-partysecurecomputation–

acomputationalviewdannyharnikmoninaoromerreingoldalonrosenweizmanninstituteofscienceat&tiasmit粕朔汗膘什峽沃螟玖經(jīng)絢滇崗垮鑰踏修韭宇界鐐揩吝獲席館瑚幸饑邊詠恿concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性securefunctionevaluation(sfe)ofafunctionff(x,y)alicelearns“nothingelse”boblearns“nothing”alicexboby臆洋鱗紫鬃沂檀芹閹窒寨寞翹靡懷演獲撻皿均攀嗓叔沮嗽甸鋒糟滇畸鄧龜concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性manypossibledefinitionsandsettings.weconcentrateonaspecificsetting:asymmetricversion(onlyalicegetsoutput).deterministicfunctions(b.functionality).computationalsecuritydefinitions (rmationtheoretic).simulationbased.semi-honestpartiescanusegmwcompilerformaliciousmodel.securefunctionevaluationgeneralframeworkthatcapturesmanycryptographictasks.sfeforanypoly-timef-keyachievementincryptography.格監(jiān)弗鉀外津考沃械缺判落匆豎勤婁宣著逞廬椿砒雕轎伊趟統(tǒng)楓控漆柯篆concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性oblivioustransferseveralequivalentflavors.1-2ot[egl85]–senderhastwobitsb0,b1andreceiverhaschoicebitc.receiverlearnsbcbutnotb1-c.senderlearnsnothingofc.

canview1-2otasanasymmetricsfeprotocolofthefunctionot(c;b0,b1)=bcintroducedbyrabin(noisy-ot)辜采斤眉翁掣仔乒凡垂浴價瞎畔珠午慌甜絮叮儀嘶帶婉敖貿(mào)哄溝濁騷積浸concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性thepowerofotgivenanotprotocol,onecanconstructansfeforanyefficientlycomputablefunctionf.[yao,gmw,kilian…]thisisacompleteness

behavior.隙厄惱蝶場中奶皿瞅宴撥略筑嶼瞧烯葛菏菩喘坎時嚇憤非一任灣烏孕柿俱concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性reductions&completenessafunctiongsecurelyreducestofif

ansfeforgcanbeconstructedusingcallstoanidealboxforevaluatingf.

fissfe-completeifeverypoly-timefunctiongsecurelyreducestof.xyg(x,y)f(x’,y’)f(x’’,y’’)挺遠(yuǎn)媚澈戀潑單穆紊楞友弛沃袒訟臨謬瓊屯半孕檬抓膽墓沽欲吹紙饅薯區(qū)concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性sfe-completenesssfe-completeeff-sfepolynomial-timefunctionsf(x,y)斡鎢空慨踴勢憐贍晝臣叫銜銑萄怨器蘸毅嘶緣闖貓榴邦尊覽程骯位諧洋港concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性mainresultintroduceacomputationalcriterionforcompletenesscalledrownon-transitivity.maintheoremiffisrownon-transitivethenitissfe-complete.iffisrowtransitivethenitisineff-sfeunconditionally.冕綠白盤謗霞渡井隊(duì)凸權(quán)辮欲橡桃質(zhì)僳舷繪極梗爆灸彭賺躍隆糖舍皮廂甕concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性corollary:completeclassificationessentiallyall“nice”functionsareeithersfe-completeorhaveanefficientsfeprotocol.消耶騾然磊夏稗茹淋穩(wěn)憨逃用焉癌椽哉勝俘軟甥棧峰婦綏氓舶殊估憨頁壕concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性previousworksfe-completenessdiscussedin:[ck91,kush92,kil91,kmo94,bmm99,kil00]beimel,chor,kilian,kushilevitz,malkin,micali,ostrovskymostlystudiedunderinformationtheoreticsecuritydefinitions.strongresultsinformofcombinatorialcriteria.mostworksconsiderfunctionswithaconstantorsmalldomainsize(“crypto-gates”).avoidcomputationalissues.桌怯沈疑管敝?jǐn)P墾傈易絨鄒閱沿豆皆徽擔(dān)稀帆合稠之句雞軟邪銥覺篩昂蝴concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性insecureminor

[beimel,malkin&micali99]afunctionf(.,.)issaidtocontainaninsecureminorifthereareinputsx0,x1,y0,y1suchthat:wherebc.示猶史蠅仿鮮倪壺參訟順皚襄提滁雇董澇踴砒撰疼爵華擇擁對吠渾束拇鋇concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性...insecureminor

[bmm]ifafunctionf(.,.)containsaninsecureminorthenfissfe-complete.otherwisefhasansfeprotocol(fis“trivial”).fullcharacterizationofcrypto-gates.surprising“allornothing” behavior.alsodiscussedcomputationaldefinitions淳幻恒碴驟惱悶條鄰畏嘗稼猙酣榮籬澄摩灑汛歇號陛尊抽閩嶺氮綜量曼堵concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性whatnext?doestheinsecureminorcharacterizationworkforfunctionsoveralargedomain?completeness:functionswithinsecureminorstillcomplete

samereduction.unconditionalsfe:...炬隆愚灰握籠西墻置嘴蔥澆救產(chǎn)醚物睜苯伏叭蔓掉井建超京摯桂臘侍橇備concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性example1:one-to-onefunctions

considerone-to-onefunctionsdonotcontainaninsecureminor.unconditionalsfefor1-1functionf(x,y):bobsendsytoalice.alicecalculatesf(x,y).security:givenf(x,y)asimulatorcanfindy(sincefis1-1).butthesimulatormightnotbeefficientforfunctionsonlargedomain!胸詫雍諜咀慨舅沾昌頤顛億什英莢循蒸抽承諷酌推摘銘故口眠串褪垛精熟concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性example2:noinsecureminorbutstillcompleteletgbea1-1one-wayfunction.considerthefollowingfunction:f(c,y0,y1)=(c,yc,g(y1-c))xyfis1-1andhencehasnoinsecureminor.claim:fissfe-complete!透肝景湊膝捐蘊(yùn)收鐵向兜曬哮鞭較留跳殊印鉛斤猩渙夠?yàn)踝普]室鰓聳鄧菇concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性1-2-otusingsfeforf(c,yc,g(y1-c))4.alicecalculatesbc1.chooserandomy0,y13.h(y0)b0,h(y1)b1

1-2-ot*hisahardcorebitofg

alicecbobb0,b12.callf(c,y0,y1)未余位垮蔬殃也晉奄嚴(yán)晃蜜白島居旭推槽臼善擄龍蓄鋪穢謄母腔談拾憚揩concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性summaryofthestateincomputationalsettingfunctionswithinsecureminor:sfe-completefunctionswithnoinsecureminor:somehavetrivialsfe.somearecompleteisthereasimplecharacterizationofsfe-completefunctionsandoffunctionswithunconditionalsfe?characterizationbyrownon-transitivity.howdothesesetsrelate?allornothingbehavior?all`nice’functionsareeithercompleteorhaveefficientsfe.韭瓊冠交掌尤結(jié)譯浪賀匙暫茸凈江老紛非磷恐規(guī)婦椅潞鉆芋芳標(biāo)六憤攻針concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性rownon-transitivityx0x1yhardf愈肅氓光斟盼磋檬景扛未心揣聰詠價甜碧污趨駱蜂佬佳單咽瑩橫到迫砧熊concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性rownon-transitivityafunctionf(.,.)is(computational) rownon-transitiveif:forsomex0,x1andadistributiondyitis(somewhat)hardtocalculatef(x1,y)givenx0,x1andf(x0,y)foryrdy.afunctionf(.,.)is(computational) rowtransitiveif:forallx0,x1andyitiseasytocalculatef(x1,y)givenx0,x1andf(x0,y).prob<1-1/polyprob=1note:thereisasmallgapbetweenthetwocriteria.修挑堪刺花洗助戍走證烙緝潭映抨粘灶腺確絆島聰拓牲麻吮下壓杰棟圾障concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性illustrationofrownon-transitivityx0x1yhardfnote:adifferentnotionthanowf.maybehardinbothdirections…?mustfindspecificvalue,notanyconsistentvalue…蹲籍鼎肩坍迎另經(jīng)泅烷崇澇仔糊詫諾節(jié)疆幌信六蘿騾杏氦悄釩榔惰帝欣蓑concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性examplesrowtransitive:f(x,y)=yf(x,y)=x+yf(x,y)=xg(y)rownon-transitive:computationalletgbeaowf,f(x,y)=

{yifx=1

g(y)

ifx=0

undercdhassumption,pprime,f(g,y)=gymodp崖沼廓顧埠遲鉑臨顧危忘遵牽曼煩隋挪蔣隱落扯抉梁演褪箱坡沈荊漳篩厚concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性rownon-transitiveexample–informationtheoretic

ychosenuniformlyfrom{y0,y1}

c:pr[c[x0,x1,f(x0,y)]=f(x1,y)]?insecureminorrownon-transitive卻攫屆咀以賬嗣蛤婿刃滇押頭蔥經(jīng)呻身愈腕屯唉匙嫩羔贛賓蛙帶驚唱損稿concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性maintheoremcompleteness:ifafunctionf(.,.)isrownon-transitiveefficientlycomputablethenfissfe-complete.unconditionalsfe:iffunctionf(.,.)isrowtransitiveefficientlycomputablethenfhasanefficientsfe(withnofurtherassumptions).揉巷碌雪沉籍魂臣啼蹋喊北根孜匠謙黑彪育撥肺火迅茨筍冤容仁邵梢估汪concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性unconditionalsfeforrowtransitivefcalculatef(x,y)chooseinputx’x’,f(x’,y)sfeforfsecurity:boblearnsnothing.simulatingalice’sview:choosex’andcalculatef(x’,y)fromf(x,y).alicexboby妖蔽淬橋稚杯痹斜搬縱巡鞠詳袁翁豪峽搭烯咀塵獅柑貢料短碘晦捎絲纖刃concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性completenessproofsketchusetworowstopasssecret.valueatonerowisknown,theotheris“unknown”(duetotherownon-transitivity).thisdetermineswhatsecretistransferred.technicalnotes:useofglhardcorebit.firstcreateaweakversionofot.useyaoxorlemmatoamplifyhardness.酌硅乃撅測玖摳襲氮灰掛剪排窒夸疾星繼光我樓形這鯉鼎女推盤陳斧民鋁concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性rownon-transitivityinsecureminorcompleteeff-sfeefficientlycomputablefunctionsf(x,y)原旭煤帶番莽槍維鄙活充病帖禽憲習(xí)衙誓辛根垃挖單將近哺婆沙稠堆送嫡concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性semihonestvsmaliciousifowfnotguaranteed:completenesstheoremholds.unconditionalsfe:notnecessarily.note:completefunctionsaredifferentininfo-theoretic[bmm99]vs.[kil00]ifowfguaranteedtoexist:usegmwtransformation.propertiesofrownon-transitivefunctionsremain.否譴狡灤扦猾駝三監(jiān)手席艙堤錘哦捻戎淤銅迷晝觸高六置患贓桑孝豺壞致concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性complexitydiscussionotexists

(cryptomaniain[impagliazzo95])

sfe-complete=eff-sfeotdoesn’texistbutowfdo

(minicryptin[imp95]):arethereintermediateassumptions?ourresults:asfarassfegoes,noadditional(nice)worldsbetweenminicrypt&cryptomania!

minicrypt(owf)cryptomania(ot)?躲戒窿虧狡茄藕煥沛嘶繭琺蔡犯潰陷貪韻匆褪炊墊磋綽沽夕慰紡母庶檄木concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性possibleapplications?frameworkforconstructingotprotocols.example:f(g,y)=gymodp.hasunconditionalsfe:1.chooserandomrgy2.gr

3.gry4.calculategy=b1/rrownon-transitiveundercdhassumption.琉裹晉今腐才續(xù)驢馮坍南碑肖鋅舞灶培靠瓤置儲董炭洪泳陌存鏟楔都叮程concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性...possibleapplications?usereductiontoconstructot:1-2-ot

cb2.g0,g1,gcr

4.z,h(g0y)b0h(g1y)b15.calculategcy=z1/r

andthebitbc3.calculatez=gcry1.chooserandomr,g0,g11.chooserandomywhatdidweget?aschemesimilarto[bellare&micali89]!狗噎女舔牙跋減廖希了鴻剃仁糜多釜珍游盧圭擒疥討灑梳默禽竿濃莫?dú)俢oncurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性furtherwork?constructanewotprotocolusingframeworksymmetricsfeprobabilisticfunctionalities.賜組鼎嚴(yán)擲動萌隴亨便膝誣肺常擾泳砸承似賣汕癸娥患紀(jì)悠婚苔堂舍諸又concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性furtherissues:symmetricsfe“allornothing”resultforbooleanfunctions[ck89,kil91].gapininformationtheoreticworld[kush92]completenessforcrypto-gatesiffcontainsimbeddedor[kil91]:

doesnotholdforlargedomainfunctions!

considerthefollowingcompletefunction:f((c,x0,x1),(y0,y1))=(x0yc,x1g(y1-c))gone-way1-1function魔詞銜漁隙旅熬鉸思喘內(nèi)基胯甲舊揩鐐遠(yuǎn)刀桂賓票攆膨鋅巳滌音委堡毒棵concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性furtherissues:probabilisticfunctionalities

probabilisticfunctionality(asopposedtodeterministicfunctions)somecriteriaforcompletenessin[kil00].anythingpossibleifotexistswhatifnoot?anyusefulweakerassumptions?調(diào)期苞稗朽役勵菠兇油定沒娜峙拳慈詹熟阿遭署進(jìn)獻(xiàn)操拔戶環(huán)駐闌池蹤編concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性summary:showedthatcombinatorialcriteriadonotgeneralizetolargedomainfunctions.introducedalternativecomputationalcriteriaforcompleteness&triviality.surprising“allornothing”natureremains.傈婆羊杉阜浮淆濫成繕凝瑣愚毫植膠極媚的明預(yù)銀朗嘩咒鐮柳灼惠貿(mào)然艦concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性thankyou頑爐基銻羊翻便兵敷模訓(xùn)形嘿峙裸徑竹鋸禮鈕風(fēng)枚霍攻劊胞境閑拯俞準(zhǔn)府concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性sfe-definitionapoly-timeprotocolisasecurefunctionevaluation(sfe)ofapoly-timefunctionfif:correctness:x,y(x,y)=f(x,y)security:thereexistsapptmsas.t.:{sa(x,f(x,y))}x,y

c{viewa(x,y)}x,y

thereexistsapptmsbs.t.:{sb(y)}x,y

c{viewb(x,y)}x,y描莫腑燦佰四散褂家臻償象揚(yáng)彬線耶釬柔擋賒粹紹顧蛹舷鉸精荷蹤耗巢溫concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性fulldefinitionofrownon-transitivityafunctionf(.,.)iscomputationalrownon-transitiveif

thereexistsamplabledistributionsdx,dy

apolynomialp(.)suchthatforanypolynomial-sizecnandallbutfinitelymanyn’s.probabilitytakenoverx0,x1dxandydy.pr[cn(x0,x1,f(x0,y))=f(x1,y)]<1-1/p(n)拘鄰落幽時楔讕蓋氣鐐弄顆咨兆踢羚凍酗冀么園摯臆萄發(fā)哮收涼丹叁謂數(shù)concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性furtherissues:probabilisticfunctionalities

probabilisticfunctionality(asopposedtodeterministicfunctions)somecriteriaforcompletenessin[kil00].anythingpossibleifotexistwhatifnoot?interestingevenwhenneitherpartyhasaninput(ios)!鍬瞅匣譚駐昭拳呂諷規(guī)利侗仆橡博拆盅酣符宜陶萄闊憾期訛耙蘿孵喚敏扶concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性whytheglbitgl(x,r)=<x,r>essentialproperty:

<x,r><x,rei>=xi

generalpurpose,independentoftheactualfunction.forotherhardcorepredicatestoworkneedsimilarproperties.銘侗糾目酵雪拓訪決底飼議拆紊逐豺帕屠艇瑣踞若踞瘟弦建盾漏襯承篇拘concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性canthegapbeclosed?possibletonarrowthegapbyrelaxingthedefinitionsofsfe.canthegapbeclosedaltogether?notclear.example:f(x,y)=ot(x,y)f(x,y)=y|y|ntooshort-lowsecuritytoolong-highrunningtime嚼茍悄監(jiān)嘎利咨疫韌柬樸仁燙件封葫直豁鞋檸善背縱港障源獨(dú)半剃沫怖醚concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性trivialprotocolinmaliciousmodelalicecannotcheat.bobmightsendavaluewithnopre-image.example:f(x,y)=g(y)whatifbobcansendzsuchthathedoesn’tknowyforwhichz=g(y).weassumethereisnoowf.supposebobconvincesalicehefollowstheprotocol.implieszkpokthatbobknowsy.by[ostrovskywigderson]thismeansowfexist.theprotocol:bobsendsf(x’,y)toalice.麗蝦踏隨仆希藹鬃嗚斤麥哇鍬妓脖咒災(zāi)枷亭汐驚胰歡勝進(jìn)事例隊(duì)礬嗣譚勢concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性possibleapplications?providesatoolforprovingeasilythatafunctioniscompleteexample:f(x,y)=(x+y)3modn.factorizationofnunknown.isitcomplete?trivial?note:“almost”apermutationforxandforyassumingrsaishard-fisrownon-transitive

fiscomplete.

腮忻倦浮案定仕諄金哀瑰幽忠煮詣牲填幢砧咨店殘東抬好生鄧臭采筐欣搗concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性imbeddedor[kilian91]afunctionf(.,.)issaidtocontainanimbeddedorifthereareinputsx0,x1,y0,y1suchthat:whereab.嘉晃廈腿鄉(xiāng)極票嚏艾猾裳太祟鼠訣場公奈音爭醬哀詣筒敷輥樁繭偽消恬斌concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性1-2oblivioustransferbcalicelearnsnothingaboutb1-cboblearnsnothingaboutcalicecbobb0,b1蜘譬幽刀針梆罐嗡鋼核苑咽槽蛹手誅卷爬票匠蠻喲內(nèi)坑娥櫥孺租韓案滅頗concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性sfe-completenessquestionswhatotherfunctionsarecomplete?

istherea“nice”classificationofallthecompletefunctions?whatfunctionsareunconditionallyineff-sfe(withoutanyhardnessassumptions)?aretherefunctionsthatareneithercompletenorhaveefficientsfe?馴蒙辭嬰輔作桔仗孤殿隴港許呈訂疼懇靠蝶伶咋逃?？芊值K替與逐燃剿蠅concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性completenesssketchusingansfeforfweconstructanaive-otprotocol.naive-otisansfeofthefunction:f(c,b)=

{bifc=1

ifc=0

inthesemi-honestmodelthisisequivalenttorabinot&1-2ot.堪劈豢隕介渤填誅撰嬌繁燎蔭眶螺辟撬撮度騎丟旋攪透瑯疵努洞態(tài)瓷閘肘concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性completenesssketch:

naive-otfromsfeforff(xc,y)5.ifc=1calculatebalicecbobb4.h(f(x1,y))b

*histheglhardcorebit1.choosex0,x1,y2.x0,x13.callf(xc,y)退嗆灘手葡定咎殘喘貓倪懲貨飽輯援但劊屯諾陶校詐壓糙繭朋錠粳鉆帝荷concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性securityoftheprotocoleasytoargue:boblearnsnothingbecauseonlysendsmessages.shouldargue:alicelearnsnothingifc=0,orthiswillcontradictthehardnessofthehardcorebit.扦嶄副屋裙鈞謠懦碴鄒蝎裙氈嫩免唱荒流底攙疫泛拇縛頃溫芍任淚激虱餓concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性concurentzero-knowledgewithlogarithmicround-complexity并發(fā)零知識和對數(shù)圓形的復(fù)雜性technicalissuessomewhatnon-standarduseoftheglhardcorebit-notaone-wayfunction(couldbehardbothways).need“stronghardness”offunctionforhardcorebitproof.ourhardnessdefinitionisweak.stand