: We consider the problem of computing with encrypted data. Player A wishes to know the value f(x) for some x but lacks the power to compute it. Player B has the power to compute f and is willing to send f(y) to A if she sends him y, for any y. Informally, an encryption scheme for the problem f is a method by which A, using her inferior resources, can transform the cleartext instance x into an encrypted instance y, obtain f(y) from B, and infer f(x) from f(y) in such a way that B cannot infer x from y. When such an encryption scheme exists, we say that f is encryptable. The framework defined in this paper enables us to prove precise statements about what an encrypted instance hides and what it leaks, in an information-theoretic sense. Our definitions are cast in the language of probability theory and do not involve assumptions such as the intractability of factoring or the existence of one-way functions. We use our framework to describe encryption schemes for some well-known function...

This paper comprises a systematic comparison of several complexity classes of functions that are computed nondeterministically in polynomial time or with an oracle in NP. There are three components to this work. ffl A taxonomy is presented that demonstrates all known inclusion relations of these classes. For (nearly) each inclusion that is not shown to hold, evidence is presented to indicate that the inclusion is false. As an example, consider FewPF, the class of multivalued functions that are nondeterministically computable in polynomial time such that for each x, there is a polynomial bound on the number of distinct output values of f(x). We show that FewPF ` PF NP tt . However, we show PF NP tt ` FewPF if and only if NP = co-NP, and thus PF NP tt ` FewPF is likely to be false. ffl Whereas it is known that P NP (O(log n)) = P NP tt ` P NP [Hem87, Wagb, BH88], we show that PF NP (O(log n)) = PF NP tt implies P = FewP and R = NP. Also, we show that PF NP tt = PF ...

This paper is dedicated to the memory of Ronald V. Book, 1937-1997.

We obtain several results that distinguish self-reducibility of a language L with the question of whether search reduces to decision for L. These include: (i) If NE 6= E, then there exists a set L in NP \Gamma P such that search reduces to decision for L, search does not nonadaptively reduces to decision for L, and L is not self-reducible. Funding for this research was provided by the National Science Foundation under grant CCR9002292. y Department of Computer Science, State University of New York at Buffalo, 226 Bell Hall, Buffalo, NY 14260 z Department of Computer Science, State University of New York at Buffalo, 226 Bell Hall, Buffalo, NY 14260 x Research performed while visiting the Department of Computer Science, State University of New York at Buffalo, Jan. 1992--Dec. 1992. Current address: Department of Computer Science, University of Electro-Communications, Chofu-shi, Tokyo 182, Japan. -- Department of Computer Science, State University of New York at Buffalo, 226...

Is there a single-valued NP function that, when given a satisfiable formula as input, outputs a satisfying assignment? That is, can a nondeterministic function cull just one satisfying assignment from a possibly exponentially large collection of assignments? We show that if there is such a nondeterministic function, then the polynomial hierarchy collapses to its second level. As the existence of such a function is known to be equivalent to the statement "every multivalued NP function has a single-valued NP refinement," our result provides the strongest evidence yet that multivalued NP functions cannot be refined. We prove our result via theorems of independent interest. We say that a set A is NPSV-selective (NPMV-selective) if there is a 2-ary partial function in NPSV (NPMV, respectively) that decides which of its inputs (if any) is "more likely" to belong to A; this is a nondeterministic analog of the recursion-theoretic notion of the semi-recursive sets and the extant complexity-the...

We look at the hypothesis that all honest onto polynomial-time computable functions have a polynomial-time computable inverse. We show this hypothesis equivalent to several other complexity conjectures including ffl In polynomial time, one can find accepting paths of nondeterministic polynomial-time Turing machines that accept \Sigma . ffl Every total multivalued nondeterministic function has a polynomial-time computable refinement. ffl In polynomial time, one can compute satisfying assignments for any polynomial-time computable set of satisfiable formulae. ffl In polynomial time, one can convert the accepting computations of any nondeterministic Turing machine that accepts SAT to satisfying assignments. We compare these hypotheses with several other important complexity statements. We also examine the complexity of these statements where we only require a single bit instead of the entire inverse. 1 Introduction Understanding the power of nondeterminism has been one of the pri...

Threshold machines are Turing machines whose acceptance is determined by what portion of the machine's computation paths are accepting paths. Probabilistic machines are Turing machines whose acceptance is determined by the probability weight of the machine's accepting computation paths. In 1975, Simon proved that for unboundederror polynomial-time machines these two notions yield the same class, PP. Perhaps because Simon's result seemed to collapse the threshold and probabilistic modes of computation, the relationship between threshold and probabilistic computing for the case of bounded error has remained unexplored. In this paper, we compare the bounded-error probabilistic class BPP with the analogous threshold class, BPP path , and, more generally, we study the structural properties of BPP path . We prove that BPP path contains both NP BPP and P NP[log] , and that BPP path is contained in P \Sigma p 2 [log] , BPP NP , and PP. We conclude that, unless the polynomial hierarchy collapses, bounded-error threshold computation is strictly more powerful than bounded-error probabilistic computation. We also consider the natural notion of secure access to a database: an adversary who watches the queries should gain no information about the input other than perhaps its length. We show, for both BPP and BPP path , that if there is any database for which this formalization of security differs from the security given by oblivious database access, then P 6= PSPACE. It follows that if any set lacking small circuits can be securely accepted, then P 6= PSPACE.

this paper we study two different ways to restrict the power of NP: We consider languages accepted by nondeterministic polynomial time machines with a small number of accepting paths in case of acceptance, and also investigate subclasses of NP that are low for complexity classes not known to be in the polynomial time hierarchy. The first complexity class defined following the idea of bounding the number of accepting paths was Valiant's class UP (unique P) [Va76] of languages accepted by nondeterministic Turing machines that have exactly one accepting computation path for strings in the language, and none for strings not in the language. This class plays an important role in the areas of one-way functions and cryptography, for example in [GrSe84] it is shown that P6=UP if and only if one-way functions exist. The class UP can be generalized in a natural way by allowing a polynomial number of accepting paths. This gives rise to the class FewP defined by Allender [Al85] in connection with the notion of P-printable sets. We study complexity classes defined by such path-restricted nondeterministic polynomial time machines, and show results that exploit the fact that the machines for these classes have a bounded number of accepting computation paths. We will not only consider these subclasses of NP, namely UP and FewP, but also the class Few, an extension of FewP defined by Cai and Hemachandra [CaHe89], in which the accepting mechanism of the machine is more flexible. 1 The three classes UP, FewP and Few are all defined in terms of nondeterministic machines with a bounded number of accepting paths for every input string, but for the last two classes this number is not known beforehand, and can range over a space of polynomial size. We show in Section 3 that a polynomial numb...

A set A is p-terse (p-superterse) if, for all q, it is not possible to answer q queries to A by making only q \Gamma 1 queries to A (any set X). Formally, let PF A q-tt be the class of functions reducible to A via a polynomial-time truthtable reduction of norm q, and let PF A q-T be the class of functions reducible to A via a polynomial-time Turing reduction that makes at most q queries. A set A is p-terse if PF A q-tt 6` PF A (q\Gamma1)-T for all constants q. A is p-superterse if PF A q-tt 6` PF X q-T for all constants q and sets X . We show that all NP-hard sets (under p tt -reductions) are p-superterse, unless it is possible to distinguish uniquely satisfiable formulas from satisfiable formulas in polynomial time. Consequently, all NP-complete sets are psuperterse unless P = UP (one-way functions fail to exist), R = NP (there exist randomized polynomial-time algorithms for all problems in NP), and the polynomial-time hierarchy collapses. This mostly solves the main open...

For lack of general algorithmic methods that apply to wide classes of logics, establishing a complexity bound for a given modal logic is often a laborious task. The present work is a step towards a general theory of the complexity of modal logics. Our main result is that all rank-1 logics enjoy a shallow model property and thus are, under mild assumptions on the format of their axiomatisation, in PSPACE. This leads to a unified derivation of tight PSPACE-bounds for a number of logics including K, KD, coalition logic, graded modal logic, majority logic, and probabilistic modal logic. Our generic algorithm moreover finds tableau proofs that witness pleasant prooftheoretic properties including a weak subformula property. This generality is made possible by a coalgebraic semantics, which conveniently abstracts from the details of a given model class and thus allows covering a broad range of logics in a uniform way.