## One-Way Functions, Hard on Average Problems, and Statistical Zero-Knowledge Proofs (Extended Abstract) (1991)

Venue: | IN PROCEEDINGS OF THE 6TH ANNUAL STRUCTURE IN COMPLEXITY THEORY CONFERENCE |

Citations: | 28 - 8 self |

### BibTeX

@INPROCEEDINGS{Ostrovsky91one-wayfunctions,,

author = {Rafail Ostrovsky},

title = {One-Way Functions, Hard on Average Problems, and Statistical Zero-Knowledge Proofs (Extended Abstract)},

booktitle = {IN PROCEEDINGS OF THE 6TH ANNUAL STRUCTURE IN COMPLEXITY THEORY CONFERENCE},

year = {1991},

pages = {133--138},

publisher = {}

}

### Years of Citing Articles

### OpenURL

### Abstract

In this paper, we study connections among one-way functions, hard on the average problems, and statistical zero-knowledge proofs. In particular, we show how these three notions are related and how the third notion can be better characterized, assuming the first one.

### Citations

2716 | New directions in cryptography - Diffie, Hellman - 1976 |

1041 | The knowledge complexity of interactive proof systems
- Goldwasser, Micali, et al.
- 1989
(Show Context)
Citation Context ...raf@theory.lcs.mit.edu tic polynomial-time algorithm to decide if x 2 L with probability bounded away from 1 2 . Also informally, a language L possesses a statistical zero-knowledge interactive proof =-=[8]-=- if an infinitely-powerful prover can convince a probabilistic polynomial-time verifier that x 2 L without releasing to the verifier any additional information. The definition of statistical zero-know... |

726 | A pseudorandom generator from any one-way function
- H˚astad, Impagliazzo, et al.
- 1999
(Show Context)
Citation Context ...ost cryptographic primitives, including pseudo-random generators [2], digital signatures [9], identification schemes and private-key encryption were shown to imply the existence of a one-way function =-=[14, 16, 17, 24]-=-. There are cases, however, when only the existence of a hard on the average problem is required. For example, an NP machine can commit bits to a polynomiallybounded machine, given any hard on the ave... |

366 | A hard-core predicate for all one-way functions - Goldreich, Levin - 1989 |

308 | Algebraic methods for interactive proof systems
- Lund, Fortnow, et al.
- 1992
(Show Context)
Citation Context ... of affairs exists for interactive proofs (i.e., without zeroknowledge constraints) as well. For example, to prove a co-NP statement, the current lower-bound on the power of the prover is at least #P =-=[21]-=- (and, by results of Toda, contains the entire polynomial-time hierarchy [25].) It turns out, however, that the informationtheoretic zero-knowledge property can be utilized to substantially reduce the... |

248 | New directions in cryptography - e, Hellman - 1976 |

200 | Average case complete problems - Levin - 1986 |

196 | One-Way Functions Are Necessary and Sufficient for Digital Signatures
- Rompel
- 1990
(Show Context)
Citation Context ...ost cryptographic primitives, including pseudo-random generators [2], digital signatures [9], identification schemes and private-key encryption were shown to imply the existence of a one-way function =-=[14, 16, 17, 24]-=-. There are cases, however, when only the existence of a hard on the average problem is required. For example, an NP machine can commit bits to a polynomiallybounded machine, given any hard on the ave... |

188 | The NP-completeness column: an ongoing guide
- Johnson
- 1985
(Show Context)
Citation Context ...average problems and one-way functions may not exist even if P6=NP. That is, it could be the case that under sampleable distributions everything is easy, but in the worst (very rare) cases it is hard =-=[13, 19, 20]-=-. If this turns out to be the case, it would be bad news for cryptography since most cryptographic primitives, including pseudo-random generators [2], digital signatures [9], identification schemes an... |

87 | The Complexity of Perfect Zero-Knowledge
- Fortnow
- 1989
(Show Context)
Citation Context ...the simulator to output private coin tosses of the verifier. In addition, many researchers were concerned about providing a better characterization of various properties of statistical zero-knowledge =-=[1, 3, 6, 22]-=-. Its relationship to one-way functions, however, remained unknown. Hence, we consider the following question: does statistical zero knowledge imply a one-way function ? For trivial languages, which d... |

68 |
The Probabilistic Analysis of Some Combinatorial Search Algorithms
- Karp
- 1976
(Show Context)
Citation Context ...average problems and one-way functions may not exist even if P6=NP. That is, it could be the case that under sampleable distributions everything is easy, but in the worst (very rare) cases it is hard =-=[13, 19, 20]-=-. If this turns out to be the case, it would be bad news for cryptography since most cryptographic primitives, including pseudo-random generators [2], digital signatures [9], identification schemes an... |

63 |
No better ways to generate hard NP instances than picking uniformly at random
- Impagliazzo, Levin
- 1990
(Show Context)
Citation Context ...e. 1 Introduction One-way functions, hard on the average problems, and Statistical Zero-Knowledge proofs have received a lot of attention in both complexity theory and cryptography (see, for example, =-=[12, 15, 16, 26]-=-.) We start with informal explanations of all three notions and provide formal definitions in the subsequent sections. Informally, a poly-time computable function f is one-way if when we pick x unifor... |

53 |
Pseudo-random generators under uniform assumptions
- H˚astad
- 1990
(Show Context)
Citation Context ...ost cryptographic primitives, including pseudo-random generators [2], digital signatures [9], identification schemes and private-key encryption were shown to imply the existence of a one-way function =-=[14, 16, 17, 24]-=-. There are cases, however, when only the existence of a hard on the average problem is required. For example, an NP machine can commit bits to a polynomiallybounded machine, given any hard on the ave... |

42 | The (True) Complexity of Statistical Zero-Knowledge
- Bellare, Micali, et al.
- 1990
(Show Context)
Citation Context ...the simulator to output private coin tosses of the verifier. In addition, many researchers were concerned about providing a better characterization of various properties of statistical zero-knowledge =-=[1, 3, 6, 22]-=-. Its relationship to one-way functions, however, remained unknown. Hence, we consider the following question: does statistical zero knowledge imply a one-way function ? For trivial languages, which d... |

40 |
Random Instances of a Graph Coloring Problem are
- Venkatesan, Levin
- 1988
(Show Context)
Citation Context ...e. 1 Introduction One-way functions, hard on the average problems, and Statistical Zero-Knowledge proofs have received a lot of attention in both complexity theory and cryptography (see, for example, =-=[12, 15, 16, 26]-=-.) We start with informal explanations of all three notions and provide formal definitions in the subsequent sections. Informally, a poly-time computable function f is one-way if when we pick x unifor... |

35 | One-way functions are necessary and su cient for secure signatures, STOC - Rompel - 1990 |

31 |
On the Cunning Power of Cheating Verifiers: Some Observations about Zero Knowledge Proofs (Extended Abstract
- Oren
- 1987
(Show Context)
Citation Context ...the simulator to output private coin tosses of the verifier. In addition, many researchers were concerned about providing a better characterization of various properties of statistical zero-knowledge =-=[1, 3, 6, 22]-=-. Its relationship to one-way functions, however, remained unknown. Hence, we consider the following question: does statistical zero knowledge imply a one-way function ? For trivial languages, which d... |

29 |
One-Way Functions are Essential for Complexity-Based Cryptography
- Impagliazzo, Luby
- 1989
(Show Context)
Citation Context ...e. 1 Introduction One-way functions, hard on the average problems, and Statistical Zero-Knowledge proofs have received a lot of attention in both complexity theory and cryptography (see, for example, =-=[12, 15, 16, 26]-=-.) We start with informal explanations of all three notions and provide formal definitions in the subsequent sections. Informally, a poly-time computable function f is one-way if when we pick x unifor... |

25 | On the Existence of Bit Commitment Schemes and Zero-Knowledge Proofs
- Damg˚ard
- 1989
(Show Context)
Citation Context ...y known that a computational MA-type (single round) zeroknowledge proof of possession of information for a hard on the average problem does imply a bitcommitment scheme and, hence, a one-way function =-=[5, 7]-=-. In general, however, the question is open. 5 Announcement of a New Result Jointly with Avi wigderson, the second question posed above have been resolved. That is, we consider a very general definiti... |

24 | The knowledge complexity ofinteractive proofs - Goldwasser, Micali, et al. - 1989 |

20 |
A secure digital signature scheme
- Goldwasser, Micali, et al.
- 1988
(Show Context)
Citation Context ... cases it is hard [13, 19, 20]. If this turns out to be the case, it would be bad news for cryptography since most cryptographic primitives, including pseudo-random generators [2], digital signatures =-=[9]-=-, identification schemes and private-key encryption were shown to imply the existence of a one-way function [14, 16, 17, 24]. There are cases, however, when only the existence of a hard on the average... |

14 |
On the computational power of
- Toda
- 1989
(Show Context)
Citation Context ...aints) as well. For example, to prove a co-NP statement, the current lower-bound on the power of the prover is at least #P [21] (and, by results of Toda, contains the entire polynomial-time hierarchy =-=[25]-=-.) It turns out, however, that the informationtheoretic zero-knowledge property can be utilized to substantially reduce the power of the prover. In fact, we show that the prover need not be more power... |

8 |
Perfect Zero-Knowledge can be Recognized in Two Rounds
- Aiello, Hastad
- 1987
(Show Context)
Citation Context |

7 | Proofs that Yield Nothing but their Validity", FOCS 86 - Goldreich, Micali, et al. |

7 | On the cunning power of cheating veri ers: some observations about zero knowledge proofs - Oren - 1987 |

5 |
A Completeness Theorem for Protocols with Honest Majority," STOC 87
- Goldreich, Micali, et al.
(Show Context)
Citation Context |

3 | How to Generate and Exchange Secrets" FOCS 86 - Yao |

2 |
Zero Knowledge
- Feige, Shamir
(Show Context)
Citation Context ...y known that a computational MA-type (single round) zeroknowledge proof of possession of information for a hard on the average problem does imply a bitcommitment scheme and, hence, a one-way function =-=[5, 7]-=-. In general, however, the question is open. 5 Announcement of a New Result Jointly with Avi wigderson, the second question posed above have been resolved. That is, we consider a very general definiti... |

2 | The ComplexityofPerfect Zero-Knowledge - Fortnow - 1989 |

1 |
How to Generate Cryptographycally Strong Sequences Of Pseudo-Random Bits
- Blum, Micali
- 1984
(Show Context)
Citation Context ...in the worst (very rare) cases it is hard [13, 19, 20]. If this turns out to be the case, it would be bad news for cryptography since most cryptographic primitives, including pseudo-random generators =-=[2]-=-, digital signatures [9], identification schemes and private-key encryption were shown to imply the existence of a one-way function [14, 16, 17, 24]. There are cases, however, when only the existence ... |

1 |
The Challenger-Solver Game
- Gurevich
(Show Context)
Citation Context ...average problems and one-way functions may not exist even if P6=NP. That is, it could be the case that under sampleable distributions everything is easy, but in the worst (very rare) cases it is hard =-=[13, 19, 20]-=-. If this turns out to be the case, it would be bad news for cryptography since most cryptographic primitives, including pseudo-random generators [2], digital signatures [9], identification schemes an... |

1 | On the existence of bit commitmentschemes and zero-knowledge proofs - Damgard |