We explain and advance Levin's theory of average case completeness. In particular, we exhibit examples of problems complete in the average case and prove a limitation on the power of deterministic reductions.

ABSTRACT Being NP-complete has been widely interpreted as being computationally intractable. But NP-completeness is a worst-case concept. Some NP-complete problems are \easy on average", but some may not be. How is one to know whether an NP-complete problem is \di cult on average"? The theory of average-case computational complexity, initiated by Levin about ten years ago, is devoted to studying this problem. This paper is an attempt to provide an overview of the main ideas and results in this important new sub-area of complexity theory. 1

In this paper, we study connections among one-way functions, hard on the average problems, and statistical zero-knowledge proofs. In particular, we show how these three notions are related and how the third notion can be better characterized, assuming the first one.

We demonstrate how a well studied combinatorial optimization problem may be introduced as a new cryptographic function. The problem in question is that of finding a "large" clique in a random graph. While the largest clique in a random graph is very likely to be of size about 2 log 2 n, it is widely conjectured that no polynomial-time algorithm exists which finds a clique of size (1 + ffl) log 2 n with significant probability for any constant ffl ? 0. We present a very simple method of exploiting this conjecture by "hiding" large cliques in random graphs. In particular, we show that if the conjecture is true, then when a large clique -- of size, say, (1+2ffl) log 2 n -- is randomly inserted ("hidden") in a random graph, finding a clique of size (1 + ffl) log 2 n remains hard. Our result suggests several cryptographic applications, such as a simple one-way function. 1 Introduction Many hard graph problems involve finding a subgraph of an input graph G = (V; E) with a certain propert...

Von Neumann’s Min-Max Theorem guarantees that each player of a zero-sum matrix game hss an optimal mixed strategy. We show that each player has a near-optimal mixed strategy that chooses uniformly from a multiset of pure strategies of size logarithmic in the number of pure strategies available to the opponent. Thus, for exponentially large games, for which even representing an optimal mixed strategy can require exponential space, there are nearoptimal, linear-size strategies. These strategies are eaay to play and serve as small witnesses to the approximate value of the game. Because of the fundamental role of games, we expect this theorem to have many applications in complexity theory and cryptography. We use it to strengthen the connection estab-lished by Yao between randomized and distributional complexity and to obtain the following results: (1) Every language has anti-checkers — small hard multisets of inputs certifying that small circuits can’t decide the language. (2) Circuits of a given size can generate random instances that are hard for all circuits of linearly smaller size. (3) Given an oracle M for any exponentially large game, the approximate value of the game and near-optimal strategies for it can be computed in I&‘(M). (4) For any NP-complete lan-guage L, the problems of (a) computing a hard distribution of instances of L and (b) estimating the circuit complexity of L are both in Z;.

In the theory of worst case complexity, NP completeness is used to establish that, for all practical purposes, the given NP problem is not decidable in polynomial time. In the theory of average case complexity, average case completeness is supposed to play the role of NP completeness. However, the average case reduction theory is still at an early stage, and only a few average case complete problems are known. We present the first algebraic problem complete for the average case under a natural probability distribution. The problem is this: Given a unimodular matrix X of integers, a set S of linear transformations of such unimodular matrices and a natural number n, decide if there is a product of n (not necessarily different) members of S that takes X to the identity matrix. 1 Introduction The theory of NP completeness is very useful. It allows one to establish that certain NP problems are NP complete and therefore, for all practical purposes, not decidable in polynomial time (PTime)....

We prove that if NP 6t, BPP, i.e., if some NP-complete language is worst-case hard, then for every probabilistic algorithm trying to decide the language,there exists some polynomially samplable distribution that is hard for it. That is, the algorithm often errson inputs from this distribution. This is the first worstcase to average-case reduction for NP of any kind.We stress however, that this does not mean that there exists one fixed samplable distribution that is hard for all probabilistic polynomial time algorithms, which isa pre-requisite assumption needed for OWF and cryptography (even if not a sufficient assumption). Never-theless, we do show that there is a fixed distribution on instances of NP-complete languages, that is samplable in quasi-polynomial time and is hard for all probabilistic polynomial time algorithms (unless NP is easy in the worst-case). Our results are based on the following lemma that may be of independent interest: Given the description of an efficient (probabilistic) algorithm that failsto solve SAT in the worst-case, we can efficiently generate at most three Boolean formulas (of increasing

Abstract. In 1984, Leonid Levin initiated a theory of average-case complexity. We provide an exposition of the basic definitions suggested by Levin, and discuss some of the considerations underlying these definitions. Keywords: Average-case complexity, reductions. This survey is rooted in the author’s (exposition and exploration) work [4], which was partially reproduded in [1]. An early version of this survey appeared as TR97-058 of ECCC. Some of the perspective and conclusions were revised in light of a relatively recent work of Livne [21], but an attempt was made to preserve the spirit of the original survey. The author’s current perspective is better reflected in [7, Sec. 10.2] and [8], which advocate somewhat different definitional choices (e.g., focusing on typical rather than average performace of algorithms). 1

Secure commitment is a primitive enabling information hiding, which is one of the most basic tools in cryptography. Specifically, it is a two-party partial-information game between a "committer" and a "receiver", in which a secure envelope is first implemented and later opened. The committer has a bit in mind which he commits to by putting it in a "secure envelope". The receiver cannot guess what the value is until the opening stage and the committer can not change his mind once committed. In this paper, we investigate the feasibility of bit commitment when one of the participants (either committer or receiver) has an unfair computational advantage. That is, we consider commitment to a strong receiver with a To appear in Symposium on Theoretical Aspects of Computer Science (STACS) 92, February 13-15, Paris, France. y MIT Laboratory for Computer Science, 545 Technology Square, Cambridge MA 02139, USA. Supported by IBM Graduate Fellowship. Part of this work done while at IBM T.J. W...

We show that 2-tag systems efficiently simulate Turing machines. As a corollary we find that the small universal Turing machines of Rogozhin, Minsky and others simulate Turing machines in polynomial time. This is an exponential improvement on the previously known simulation time overhead and improves a forty year old result in the area of small universal Turing machines. 1