Abstract

Abstract. Many cryptographic primitives begin with parameter generation, which picks a primitive from a family. Such generation can use public coins (e.g., in the discrete-logarithm-based case) or secret coins (e.g., in the factoring-based case). We study the relationship between publiccoin and secret-coin collision-resistant hash function families (CRHFs). Specifically, we demonstrate that: – there is a lack ofattention to the distinction between secret-coin and public-coin definitions in the literature, which has led to some problems in the case ofCRHFs; – in some cases, public-coin CRHFs can be built out ofsecret-coin CRHFs; – the distinction between the two notions is meaningful, because in general secret-coin CRHFs are unlikely to imply public-coin CRHFs. The last statement above is our main result, which states that there is no black-box reduction from public-coin CRHFs to secret-coin CRHFs. Our prooffor this result, while employing oracle separations, uses a novel approach, which demonstrates that there is no black-box reduction without demonstrating that there is no relativizing reduction.

Citations