## Hardness vs. randomness (1994)

Venue: | Journal of Computer and System Sciences |

Citations: | 289 - 30 self |

### BibTeX

@ARTICLE{Nisan94hardnessvs.,

author = {Noam Nisan},

title = {Hardness vs. randomness},

journal = {Journal of Computer and System Sciences},

year = {1994},

volume = {49},

pages = {149--167}

}

### Years of Citing Articles

### OpenURL

### Abstract

We present a simple new construction of a pseudorandom bit generator, based on the constant depth generators of [N]. It stretches a short string of truly random bits into a long string that looks random to any algorithm from a complexity class C (eg P, NC, PSPACE,...) using an arbitrary function that is hard for C. This construction reveals an equivalence between the problem of proving lower bounds and the problem of generating good pseudorandom sequences. Our construction has many consequences. The most direct one is that efficient deterministic simulation of randomized algorithms is possible under much weaker assumptions than previously known. The efficiency ofthe simulations depends on the strength of the assumptions, and may achieve P =BPP. Webelieve that our results are very strong evidence that the gap between randomized and deterministic complexity is not large. Using the known lower bounds for constant depth circuits, our construction yields an unconditionally proven pseudorandom generator for constant depth circuits. As an application of this generator we characterize the power of NP with a random oracle. 1.

### Citations

1186 |
Probabilistic encryption
- Goldwasser, Micali
- 1984
(Show Context)
Citation Context ...generator then, wlog, for some circuit C, ofsize n, Pr ⎩ ⎧ C (y)=1⎭ ⎫ −Pr ⎩ ⎧ C (G (x))=1⎭ ⎫ > 1/n, where x is chosen uniformly in {0, 1} l ,and y is chosen uniformly in {0, 1} n . Wefirst show, as in=-=[GM]-=- and in [Ya], that this implies that one of the bits of f A(x) can be predicted from the previous ones. For any i, 0≤i≤n,wedefine a distribution E i on {0, 1} n as follows: the first i bits are chosen... |

724 | Pseudo-random generation from one-way functions (extended abstracts
- Impagliazzo, Levin, et al.
- 1989
(Show Context)
Citation Context ...st explicit hardness-randomness trade-off: if no poly-size circuit can invert the one-way perε mutation, then RP⊂∩DTIME (2n ). Yao’s result was recently generalized by Impagliε>0 azzo, Levin and Luby =-=[ILL]-=- who succeeded in constructing a pseudorandom generator based on an arbitrary one-way function. In all these papers, the generator uses the one-way function f essentially as follows: From a random str... |

609 |
How to generate cryptographically strong sequences of pseudo-random bits
- Blum, Micali
- 1984
(Show Context)
Citation Context ...ic analog of P. Babai [Ba] introduced the class AM (Arthur-Merlin games) and proposed it as a probabilistic analog of NP. Wejustify this intuition, answering an open question of Babai and Sipser (see =-=[BM]-=-). Theorem 6: almost −NP = AM. The proof relies on a description of almost −NP as a probabilistic, exponential size, constant-depth circuit, and our generator. Asimilar consideration, together with Si... |

309 |
Arthur-Merlin games: A randomized proof system, and a hierarchy of complexity classes
- Babai, Moran
- 1988
(Show Context)
Citation Context ...omization stage of the computation is called the "Arthur" stage and the second stage, the nondeterministic one is called the "Merlin" stage. For exact definitions as well as motivation refer to [Ba], =-=[BaM]-=-, also see [GS]. [BaM] and [GS] raised the question of whether AM=almost-NP? This would strengthen the feeling that AM is the probabilistic analogue of NP. Our results imply that this is indeed the ca... |

301 | Trading group theory for randomness
- Babai
- 1985
(Show Context)
Citation Context ...BGS]. For acomplexity class C, define almost −C ={L:L∈C A for almost all oracles A}. Baker and Gill [BG] proved that almost −P = BPP, suggesting that BPP is the right probabilistic analog of P. Babai =-=[Ba]-=- introduced the class AM (Arthur-Merlin games) and proposed it as a probabilistic analog of NP. Wejustify this intuition, answering an open question of Babai and Sipser (see [BM]). Theorem 6: almost −... |

182 |
Computational limitations of small-depth circuits
- H˚astad
- 1987
(Show Context)
Citation Context ...rity lower bound, that gav e the first nontrivial simulation result proven without any assumptions: RAC 0 ⊂ ε>0 ∩DSPACE (n ε ). Our construction enables us to use directly the best parity lower bound =-=[Ha]-=- and obtain the stronger result: Theorem 5: RAC 0 ⊂∪DSPACE((logn)c ) c This result is not based on any unproven assumptions. The only other complexity class for which pseudorandom generators are uncon... |

122 |
Monte-Carlo algorithms for enumeration and reliability problems
- Karp, Luby, et al.
- 1989
(Show Context)
Citation Context ...ich is within afactor of 2 (or even 1+n −k )from the correct value. Clearly #DNF is #P complete. However, our results imply that: Corollary 3.1: Approx-#DNF ∈ DTIME (2 (logn)14 ) Proof: Karp and Luby =-=[KLu]-=- give a probabilistic algorithm for Approx-#DNF that with high probability outputs a number which is within a factor of 2 of the the number of satisfying assignments. It is not difficult to see that t... |

78 |
On the Generation of Cryptographically Strong Pseudorandom Sequences
- Shamir
- 1983
(Show Context)
Citation Context ...tant depth circuits. As an application of this generator we characterize the power of NP with a random oracle. 1. Introduction The fundamental idea of trading hardness for randomness is due to Shamir =-=[Sh]-=-, who suggested that the RSA function can be used to construct good pseudo-random sequences. The first secure pseudo-random bit-generator was built by Blum and Micali 1This work was done while the fir... |

68 |
Pseudorandom bits for constant depth circuits
- Nisan
- 1991
(Show Context)
Citation Context ...gderson 2 Institute of Computer Science Hebrew University of Jerusalem, Israel ABSTRACT We present a simple new construction of a pseudorandom bit generator, based on the constant depth generators of =-=[N]-=-. It stretches a short string of truly random bits into a long string that looks random to any algorithm from a complexity class C (eg P, NC, PSPACE,...) using an arbitrary function that is hard for C... |

23 |
Pseudo-random generators and complexity classes
- Boppana, Hirschfeld
- 1989
(Show Context)
Citation Context ... < ε/2, where x is chosen uniformly at random in {0, 1} n . Yao[Ya]shows how the closeness of approximation can be amplified by xor-ing multiple copies of f. Afull proof of this lemma may be found in =-=[BH]-=-. Lemma 2.2 (Yao) : Let f 1, ... ,f k all be (ε,S)-hard. Then for any δ>0, the function f (x 1 ... xk)defined by is (ε k +δ,δ 2 (1−ε) 2 S)-hard. f (x 1 ... xk)= i=1 Σk f i(x i)(mod 2) The kind of hard... |

22 |
Deterministic Simulation of Probabilistic Constant Depth Circuits
- Ajtai, Wigderson
- 1985
(Show Context)
Citation Context ... (n ε ). As our construction is parallel, we can obtain: Theorem 3: If PSPACE cannot be approximated by NC circuits then RNC⊂ ε>0 ∩DSPACE (n ε ) Randomized Constant Depth Circuits Ajtai and Wigderson =-=[AW]-=- studied the simulation of probabilistic constant- depth circuits, since for them lower bounds exist. They devised a complicated generator, based on the proof methods of the parity lower bound, that g... |

10 |
Theory and Applications of Trapdoor Functions", 23rd FOCS
- Yao
- 1982
(Show Context)
Citation Context ... Academy of Science grant No. 328071, by the Alon Fellowship, and by NSF grant CCR8612563.s-2[BlM], who used the intractability of the Discrete Logarithm function. These ideas were generalized by Yao =-=[Ya]-=-, who showed that any one-way permutation can be used to construct generators that fool every polynomial time computation. This result gav e the first explicit hardness-randomness trade-off: if no pol... |

8 |
Private coins vs. public coins in interactive proof systems," STOC
- Goldwasser, Sipser
- 1986
(Show Context)
Citation Context ...of the computation is called the "Arthur" stage and the second stage, the nondeterministic one is called the "Merlin" stage. For exact definitions as well as motivation refer to [Ba], [BaM], also see =-=[GS]-=-. [BaM] and [GS] raised the question of whether AM=almost-NP? This would strengthen the feeling that AM is the probabilistic analogue of NP. Our results imply that this is indeed the case. Theorem 6: ... |

4 |
A note on randomized polynomial time
- KURTZ
- 1983
(Show Context)
Citation Context ...L such that: Pr ⎩ ⎧ L ∈C A ⎭ ⎫ =1 where A is an oracle chosen at random. The class almost −C can be thought of as a natural probabilistic analogue of the class C. The following theorem is well known (=-=[Ku]-=-, [BG]), and underscores the importance of BPP as the random analogue of P: Theorem: BPP=almost-P Babai [Ba] introduced the class AM. An AM Turing machine is a machine that may use both randomization ... |

4 |
A complexity theoretic approach to randomness," STOC
- Sipser
- 1983
(Show Context)
Citation Context ... AM. The proof relies on a description of almost −NP as a probabilistic, exponential size, constant-depth circuit, and our generator. Asimilar consideration, together with Sipser’s result that BPP⊂PH =-=[Si1]-=-, implies the surprising fact that random oracles do not help the polynomial time hierarchy. Theorem 7: almost −PH = PH. BPP and the Polynomial Time Hierarchy In [Si1] Sipser showed that BPP is contai... |

3 |
A.: BP P has weak subexponential simulations unless EXP T IME has publishable proofs
- Babai, Fortnow, et al.
- 1990
(Show Context)
Citation Context ... Paul and Valiant [HPV]). We use our generator to give a completely different proof of a slightly weaker relation, but using no unproven assumption. Note: Since this manuscript was originally written =-=[BFNW]-=- have strengthened some of the results appearing here. 2. The generator In this section we state and prove our results for pseudorandom generators that look random to small circuits, and thus also to ... |

3 |
Multiparty protocols and logspace hard pseudorandom sequences
- Babai, Nisan, et al.
- 1988
(Show Context)
Citation Context ...em 5: RAC 0 ⊂∪DSPACE((logn)c ) c This result is not based on any unproven assumptions. The only other complexity class for which pseudorandom generators are unconditionally proven toexist is Logspace =-=[BNS]-=-. Random Oracles The power of random oracles is an old subject of interest [BG, BGS]. For acomplexity class C, define almost −C ={L:L∈C A for almost all oracles A}. Baker and Gill [BG] proved that alm... |

3 |
Turing machines that take advice", Enseign
- Karp, Lipton
- 1982
(Show Context)
Citation Context ...strue for some ε>0 and all sufficiently large n then for some constants C>1 and ε′>0, and for every function T (n)=Ω(C n ), DTIME (T (n))⊂DSPACE (T 1−ε′ (n)).s-18(This result is similar to results in =-=[KLi]-=- "translating" non-uniform upper bounds to uniform ones.) Lemma 3.3: Iffor every ε>0, Hypothesis H 1(ε,n) isfalse for all sufficiently large n, then for every ε>0 and every c>0, there exists a polynom... |

2 |
Expanders, Randomness or Time vs Space", Structure in Complexity Theory (proceedings
- Sipser
- 1986
(Show Context)
Citation Context ...mproved onthis and showed that BPP is actually contained in Σ 2∩ Π 2. Using our generator, wegiv e acompletely different, simple proof of this fact. Time vs. Space and Randomness vs. Determinisms-5In =-=[Si2]-=- Sipser made the striking observation that efficient deterministic simulation of probabilistic algorithms is intimately related to efficient simulation of time by space (in a certain weak sense). Assu... |

2 |
The Polynomial - Time Hierarchy", Theoretical Computer Science 3
- Stockmeyer
- 1977
(Show Context)
Citation Context ...ation will accept with approximately the same probability that M accepts on a random oracle. Exactly the same technique suffices to show that for any computation in PH, the polynomial time hierarchy (=-=[St]-=-, [CKS]), a random oracle can be substituted by an "Arthur" phase. Applying to this the fact that BPP⊂Σ 2∩ Π 2 (see next subsection) allows simulation of the "Arthur" phase by one more alternation and... |

1 |
Relative to arandom oracle A, P A ≠NP A ≠Co −NP A with probability 1
- Bennett, Gill
- 1981
(Show Context)
Citation Context ...st is Logspace [BNS]. Random Oracles The power of random oracles is an old subject of interest [BG, BGS]. For acomplexity class C, define almost −C ={L:L∈C A for almost all oracles A}. Baker and Gill =-=[BG]-=- proved that almost −P = BPP, suggesting that BPP is the right probabilistic analog of P. Babai [Ba] introduced the class AM (Arthur-Merlin games) and proposed it as a probabilistic analog of NP. Weju... |

1 | Pseudo random number generation and space complexity - Furst, Lipton, et al. - 1985 |

1 |
On time versus space and related problems", 16th FOCS
- Hopcroft, Paul, et al.
- 1975
(Show Context)
Citation Context ...efficient simulation of timebounded Turing machines is possible. (A space simulation which is significantly better than the best unconditional bound of t (n) / log t (n) of Hopcroft, Paul and Valiant =-=[HPV]-=-). We use our generator to give a completely different proof of a slightly weaker relation, but using no unproven assumption. Note: Since this manuscript was originally written [BFNW] have strengthene... |

1 |
To wards a theory of parallel randomized computation", TR-07-84, Aiken computation lab
- Reif, Tygar
- 1984
(Show Context)
Citation Context ...of a one-way function, an assumption which is even stronger than P≠NP) (2) They are sequential, and can not be applied to an arbitrary complexity class. The only known parallel pseudorandom generator =-=[RT]-=- is based on a very specific function. There is no known construction of pseudorandom generators for NC that is based on a general complexity assumption about NC. We propose here a new construction of... |