HOME

TheInfoList



OR:

In
computational complexity theory In theoretical computer science and mathematics, computational complexity theory focuses on classifying computational problems according to their resource usage, and relating these classes to each other. A computational problem is a task solved ...
, a computational hardness assumption is the hypothesis that a particular problem cannot be solved efficiently (where ''efficiently'' typically means "in
polynomial time In computer science, the time complexity is the computational complexity that describes the amount of computer time it takes to run an algorithm. Time complexity is commonly estimated by counting the number of elementary operations performed by ...
"). It is not known how to prove (unconditional) hardness for essentially any useful problem. Instead, computer scientists rely on
reductions Reductions ( es, reducciones, also called ; , pl. ) were settlements created by Spanish rulers and Roman Catholic missionaries in Spanish America and the Spanish East Indies (the Philippines). In Portuguese-speaking Latin America, such red ...
to formally relate the hardness of a new or complicated problem to a computational hardness assumption about a problem that is better-understood. Computational hardness assumptions are of particular importance in
cryptography Cryptography, or cryptology (from grc, , translit=kryptós "hidden, secret"; and ''graphein'', "to write", or ''-logia'', "study", respectively), is the practice and study of techniques for secure communication in the presence of adve ...
. A major goal in cryptography is to create cryptographic primitives with provable security. In some cases, cryptographic protocols are found to have information theoretic security; the
one-time pad In cryptography, the one-time pad (OTP) is an encryption technique that cannot be cracked, but requires the use of a single-use pre-shared key that is not smaller than the message being sent. In this technique, a plaintext is paired with a r ...
is a common example. However, information theoretic security cannot always be achieved; in such cases, cryptographers fall back to computational security. Roughly speaking, this means that these systems are secure ''assuming that any adversaries are computationally limited'', as all adversaries are in practice. Computational hardness assumptions are also useful for guiding algorithm designers: a simple algorithm is unlikely to refute a well-studied computational hardness assumption such as P ≠ NP.


Comparing hardness assumptions

Computer scientists have different ways of assessing which hardness assumptions are more reliable.


Strength of hardness assumptions

We say that assumption A is ''stronger'' than assumption B when A implies B (and the converse is false or not known). In other words, even if assumption A were false, assumption B may still be true, and cryptographic protocols based on assumption B may still be safe to use. Thus when devising cryptographic protocols, one hopes to be able to prove security using the ''weakest'' possible assumptions.


Average-case vs. worst-case assumptions

An average-case assumption says that a specific problem is hard on most instances from some explicit distribution, whereas a worst-case assumption only says that the problem is hard on ''some'' instances. For a given problem, average-case hardness implies worst-case hardness, so an average-case hardness assumption is stronger than a worst-case hardness assumption for the same problem. Furthermore, even for incomparable problems, an assumption like the
Exponential Time Hypothesis In computational complexity theory, the exponential time hypothesis is an unproven computational hardness assumption that was formulated by . It states that satisfiability of 3-CNF Boolean formulas cannot be solved more quickly than exponential ...
is often considered preferable to an average-case assumption like the planted clique conjecture. Note, however, that in most cryptographic applications, knowing that a problem has some hard instance (i.e. a problem is hard on the worst-case) is useless because it does not provide us with a way of generating hard instances.J. Katz and Y. Lindell, Introduction to Modern Cryptography (Chapman and Hall/Crc Cryptography and Network Security Series), Chapman and Hall/CRC, 2007. Fortunately, many average-case assumptions used in cryptography (including
RSA RSA may refer to: Organizations Academia and education * Rabbinical Seminary of America, a yeshiva in New York City *Regional Science Association International (formerly the Regional Science Association), a US-based learned society *Renaissance S ...
, discrete log, and some
lattice problems In computer science, lattice problems are a class of optimization problems related to mathematical objects called lattices. The conjectured intractability of such problems is central to the construction of secure lattice-based cryptosystems: La ...
) can be based on worst-case assumptions via worst-case-to-average-case reductions.


Falsifiability

A desired characteristic of a computational hardness assumption is
falsifiability Falsifiability is a standard of evaluation of scientific theories and hypotheses that was introduced by the Philosophy of science, philosopher of science Karl Popper in his book ''The Logic of Scientific Discovery'' (1934). He proposed it as t ...
, i.e. that if the assumption were false, then it would be possible to prove it. In particular, introduced a formal notion of cryptographic falsifiability. Roughly, a computational hardness assumption is said to be falsifiable if it can be formulated in terms of a challenge: an interactive protocol between an adversary and an efficient verifier, where an efficient adversary can convince the verifier to accept if and only if the assumption is false.


Common cryptographic hardness assumptions

There are many cryptographic hardness assumptions in use. This is a list of some of the most common ones, and some cryptographic protocols that use them.


Integer factorization

Given a
composite number A composite number is a positive integer that can be formed by multiplying two smaller positive integers. Equivalently, it is a positive integer that has at least one divisor other than 1 and itself. Every positive integer is composite, prime, ...
n, and in particular one which is the product of two large primes n = p\cdot q, the integer factorization problem is to find p and q (more generally, find primes p_1,\dots,p_k such that n = \prod_i p_i). It is a major open problem to find an algorithm for integer factorization that runs in time polynomial in the size of representation (\log(n)). The security of many cryptographic protocols rely on the assumption that integer factorization is hard (i.e. cannot be solved in polynomial time). Cryptosystems whose security is equivalent to this assumption include the Rabin cryptosystem and the Okamoto–Uchiyama cryptosystem. Many more cryptosystems rely on stronger assumptions such as
RSA RSA may refer to: Organizations Academia and education * Rabbinical Seminary of America, a yeshiva in New York City *Regional Science Association International (formerly the Regional Science Association), a US-based learned society *Renaissance S ...
, Residuosity problems, and Phi-hiding.


RSA problem

Given a composite number n, exponent e and number c := m^e (\mathrm\; n), the RSA problem is to find m. The problem is conjectured to be hard, but becomes easy given the factorization of n. In the
RSA cryptosystem RSA (Rivest–Shamir–Adleman) is a public-key cryptosystem that is widely used for secure data transmission. It is also one of the oldest. The acronym "RSA" comes from the surnames of Ron Rivest, Adi Shamir and Leonard Adleman, who publi ...
, (n,e) is the
public key Public-key cryptography, or asymmetric cryptography, is the field of cryptographic systems that use pairs of related keys. Each key pair consists of a public key and a corresponding private key. Key pairs are generated with cryptographic a ...
, c is the encryption of message m, and the factorization of n is the secret key used for decryption.


Residuosity problems

Given a composite number n and integers y,d, the residuosity problem is to determine whether there exists (alternatively, find an) x such that : x^d \equiv y \pmod. Important special cases include the
Quadratic residuosity problem The quadratic residuosity problem (QRP) in computational number theory is to decide, given integers a and N, whether a is a quadratic residue modulo N or not. Here N = p_1 p_2 for two unknown primes p_1 and p_2, and a is among the numbers which are ...
and the Decisional composite residuosity problem. As in the case of RSA, this problem (and its special cases) are conjectured to be hard, but become easy given the factorization of n. Some cryptosystems that rely on the hardness of residuousity problems include: *
Goldwasser–Micali cryptosystem The Goldwasser–Micali (GM) cryptosystem is an asymmetric key encryption algorithm developed by Shafi Goldwasser and Silvio Micali in 1982. GM has the distinction of being the first probabilistic public-key encryption scheme which is provably se ...
(quadratic redisduosity problem) * Blum Blum Shub generator (quadratic redisduosity problem) * Paillier cryptosystem (decisional composite residuosity problem) * Benaloh cryptosystem (higher residuosity problem) * Naccache–Stern cryptosystem (higher residuosity problem)


Phi-hiding assumption

For a composite number m, it is not known how to efficiently compute its
Euler's totient function In number theory, Euler's totient function counts the positive integers up to a given integer that are relatively prime to . It is written using the Greek letter phi as \varphi(n) or \phi(n), and may also be called Euler's phi function. In ...
\phi(m). The Phi-hiding assumption postulates that it is hard to compute \phi(m), and furthermore even computing any prime factors of \phi(m) is hard. This assumption is used in the Cachin–Micali–Stadler
PIR Pir or PIR may refer to: Places * Pir, Kerman, a village in Kerman Province, Iran * Pir, Satu Mare, commune in Satu Mare County, Romania Religion * Pir (Alevism), one of the 12 ranks of Imam in Alevism * Pir (Sufism), a Sufi teacher or spiritu ...
protocol.


Discrete log problem (DLP)

Given elements a and b from a group G, the discrete log problem asks for an integer k such that a=b^k. The discrete log problem is not known to be comparable to integer factorization, but their computational complexities are closely related. Most cryptographic protocols related to the discrete log problem actually rely on the stronger Diffie–Hellman assumption: given group elements g, g^a, g^b, where g is a generator and a,b are random integers, it is hard to find g^. Examples of protocols that use this assumption include the original
Diffie–Hellman key exchange Diffie–Hellman key exchangeSynonyms of Diffie–Hellman key exchange include: * Diffie–Hellman–Merkle key exchange * Diffie–Hellman key agreement * Diffie–Hellman key establishment * Diffie–Hellman key negotiation * Exponential key exc ...
, as well as the ElGamal encryption (which relies on the yet stronger Decisional Diffie–Hellman (DDH) variant).


Multilinear maps

A
multilinear map In linear algebra, a multilinear map is a function of several variables that is linear separately in each variable. More precisely, a multilinear map is a function :f\colon V_1 \times \cdots \times V_n \to W\text where V_1,\ldots,V_n and W ar ...
is a function e: G_1 ,\dots,G_n \rightarrow G_T (where G_1 ,\dots,G_n,G_T are groups) such that for any g_1, \dots, g_n \in G_1, \dots G_n and a_1, \dots, a_n, :e(g_1^,\dots,g_n^) = e(g_1,\dots,g_n)^. For cryptographic applications, one would like to construct groups G_1 ,\dots,G_n,G_T and a map e such that the map and the group operations on G_1 ,\dots,G_n,G_T can be computed efficiently, but the discrete log problem on G_1 ,\dots,G_n is still hard. Some applications require stronger assumptions, e.g. multilinear analogs of Diffie-Hellman assumptions. For the special case of n=2, bilinear maps with believable security have been constructed using Weil pairing and Tate pairing. For n>2 many constructions have been proposed in recent years, but many of them have also been broken, and currently there is no consensus about a safe candidate. Some cryptosystems that rely on multilinear hardness assumptions include: * Boneh-Franklin scheme (blinear Diffie-Hellman) *
Boneh–Lynn–Shacham A BLS digital signature—also known as Boneh–Lynn–Shacham (BLS)—is a cryptographic signature scheme which allows a user to verify that a signer is ''authentic''. The scheme uses a bilinear pairing for verification, and signatures ...
(blinear Diffie-Hellman) * Garg-Gentry-Halevi-Raykova-Sahai-Waters candidate for indistinguishability obfuscation and functional encryption (multilinear jigsaw puzzles)


Lattice problems

The most fundamental computational problem on lattices is the Shortest vector problem (SVP): given a lattice L, find the shortest non-zero vector v \in L. Most cryptosystems require stronger assumptions on variants of SVP, such as Shortest independent vectors problem (SIVP), GapSVP, or Unique-SVP. The most useful lattice hardness assumption in cryptography is for the Learning with errors (LWE) problem: Given samples to (x,y), where y=f(x) for some linear function f(\cdot), it is easy to learn f(\cdot) using linear algebra. In the LWE problem, the input to the algorithm has errors, i.e. for each pair y\neq f(x) with some small probability. The errors are believed to make the problem intractable (for appropriate parameters); in particular, there are known worst-case to average-case reductions from variants of SVP. For quantum computers, Factoring and Discrete Log problems are easy, but lattice problems are conjectured to be hard. This makes some lattice-based cryptosystems candidates for post-quantum cryptography. Some cryptosystems that rely on hardness of lattice problems include: * NTRU (both NTRUEncrypt and
NTRUSign NTRUSign, also known as the NTRU Signature Algorithm, is an NTRU public-key cryptography digital signature algorithm based on the GGH signature scheme. The original version of NTRUSign was Polynomial Authentication and Signature Scheme (PASS), an ...
) * Most candidates for fully homomorphic encryption


Non-cryptographic hardness assumptions

As well as their cryptographic applications, hardness assumptions are used in
computational complexity theory In theoretical computer science and mathematics, computational complexity theory focuses on classifying computational problems according to their resource usage, and relating these classes to each other. A computational problem is a task solved ...
to provide evidence for mathematical statements that are difficult to prove unconditionally. In these applications, one proves that the hardness assumption implies some desired complexity-theoretic statement, instead of proving that the statement is itself true. The best-known assumption of this type is the assumption that P ≠ NP, but others include the
exponential time hypothesis In computational complexity theory, the exponential time hypothesis is an unproven computational hardness assumption that was formulated by . It states that satisfiability of 3-CNF Boolean formulas cannot be solved more quickly than exponential ...
, the planted clique conjecture, and the
unique games conjecture In computational complexity theory, the unique games conjecture (often referred to as UGC) is a conjecture made by Subhash Khot in 2002. The conjecture postulates that the problem of determining the approximate ''value'' of a certain type of ga ...
..


''C''-hard problems

Many worst-case computational problems are known to be hard or even complete for some
complexity class In computational complexity theory, a complexity class is a set of computational problems of related resource-based complexity. The two most commonly analyzed resources are time and memory. In general, a complexity class is defined in terms ...
C, in particular
NP-hard In computational complexity theory, NP-hardness ( non-deterministic polynomial-time hardness) is the defining property of a class of problems that are informally "at least as hard as the hardest problems in NP". A simple example of an NP-hard pr ...
(but often also PSPACE-hard, PPAD-hard, etc.). This means that they are at least as hard as any problem in the class C. If a problem is C-hard (with respect to polynomial time reductions), then it cannot be solved by a polynomial-time algorithm unless the computational hardness assumption P \neq C is false.


Exponential Time Hypothesis (ETH) and variants

The Exponential Time Hypothesis (ETH) is a
strengthening Chinese food therapy (, also called nutrition therapy and dietary therapy) is a mode of dieting rooted in Chinese beliefs concerning the effects of food on the human organism, and centered on concepts such as eating in moderation. Its basic pr ...
of P \neq NP hardness assumption, which conjectures that not only does the
Boolean satisfiability problem In logic and computer science, the Boolean satisfiability problem (sometimes called propositional satisfiability problem and abbreviated SATISFIABILITY, SAT or B-SAT) is the problem of determining if there exists an interpretation that satisfies ...
not have a polynomial time algorithm, it furthermore requires exponential time (2^). An even stronger assumption, known as the
Strong Exponential Time Hypothesis In computational complexity theory, the exponential time hypothesis is an unproven computational hardness assumption that was formulated by . It states that satisfiability of 3-CNF Boolean formulas cannot be solved more quickly than exponential t ...
(SETH) conjectures that k-SAT requires 2^ time, where \lim_ \varepsilon_k = 0. ETH, SETH, and related computational hardness assumptions allow for deducing fine-grained complexity results, e.g. results that distinguish polynomial time and quasi-polynomial time, or even n^ versus n^2. Such assumptions are also useful in parametrized complexity.


Average-case hardness assumptions

Some computational problems are assumed to be hard on average over a particular distribution of instances. For example, in the planted clique problem, the input is a random graph sampled, by sampling an Erdős–Rényi random graph and then "planting" a random k-clique, i.e. connecting k uniformly random nodes (where 2\log_2 n \ll k \ll \sqrt n), and the goal is to find the planted k-clique (which is unique w.h.p.).. Another important example is Feige's Hypothesis, which is a computational hardness assumption about random instances of 3-SAT (sampled to maintain a specific ratio of clauses to variables). Average-case computational hardness assumptions are useful for proving average-case hardness in applications like statistics, where there is a natural distribution over inputs. Additionally, the planted clique hardness assumption has also been used to distinguish between polynomial and quasi-polynomial worst-case time complexity of other problems, similarly to the
Exponential Time Hypothesis In computational complexity theory, the exponential time hypothesis is an unproven computational hardness assumption that was formulated by . It states that satisfiability of 3-CNF Boolean formulas cannot be solved more quickly than exponential ...
.


Unique Games

The Unique Label Cover problem is a constraint satisfaction problem, where each constraint C involves two variables x,y, and for each value of x there is a ''unique'' value of y that satisfies C. Determining whether all the constraints can be satisfied is easy, but the Unique Game Conjecture (UGC) postulates that determining whether almost all the constraints ((1-\varepsilon)-fraction, for any constant \varepsilon>0) can be satisfied or almost none of them (\varepsilon-fraction) can be satisfied is NP-hard. Approximation problems are often known to be NP-hard assuming UGC; such problems are referred to as UG-hard. In particular, assuming UGC there is a semidefinite programming algorithm that achieves optimal approximation guarantees for many important problems.


Small Set Expansion

Closely related to the Unique Label Cover problem is the Small Set Expansion (SSE) problem: Given a graph G = (V,E), find a small set of vertices (of size n/\log(n)) whose edge expansion is minimal. It is known that if SSE is hard to approximate, then so is Unique Label Cover. Hence, the ''Small Set Expansion Hypothesis'', which postulates that SSE is hard to approximate, is a stronger (but closely related) assumption than the Unique Game Conjecture. Some approximation problems are known to be SSE-hard (i.e. at least as hard as approximating SSE).


The 3SUM Conjecture

Given a set of n numbers, the 3SUM problem asks whether there is a triplet of numbers whose sum is zero. There is an quadratic-time algorithm for 3SUM, and it has been conjectured that no algorithm can solve 3SUM in "truly sub-quadratic time": the 3SUM Conjecture is the computational hardness assumption that there are no O(n^)-time algorithms for 3SUM (for any constant \varepsilon > 0). This conjecture is useful for proving near-quadratic lower bounds for several problems, mostly from computational geometry.


See also

*
Security level In cryptography, security level is a measure of the strength that a cryptographic primitive — such as a cipher or hash function — achieves. Security level is usually expressed as a number of "bits of security" (also security strength ...


References

{{Computational hardness assumptions Theory of cryptography Computational number theory Computational hardness assumptions