Threshold computation and cryptographic security

Abstract

Threshold machines [21] are Turing machines whose acceptance is determined by what portion of the machine's computation paths are accepting paths. Probabilistic machines [11] are Turing machines whose acceptance is determined by the probability weight of the machine's accepting computation paths. Simon [21] proved that for unbounded-error polynomial-time machines these two notions yield the same class, PP. Perhaps because Simon's result seemed to collapse the threshold and probabilistic modes of computation, the relationship between threshold and probabilistic computing for the case of bounded error has remained unexplored.

In this paper, we compare the bounded-error probabilistic class BPP with the analogous threshold class, BPP_path, and, more generally, we study the structural properties of BPP_path. We prove that BPP_path contains both NP^BPP and P^NP[log], and that BPP_path is contained in $P^{\Sigma _2^p [\log ]}$, BPP^NP, and PP. We conclude that, unless the polynomial hierarchy collapses, bounded-error threshold computation is strictly more powerful than bounded-error probabilistic computation.

We also consider the natural notion of secure access to a database: an adversary who watches the queries should gain no information about the input other than perhaps its length [5]. We show, for both BPP and BPP_path, that if there is any database for which this formalization of security differs from the security given by oblivious [9] database access, then BPP≠PP. It follows that if any set lacking small circuits can be securely accepted, then BPP≠PP.

Research supported in part by grants NSF-CCR-8957604, NSF-CCR-9057486, and NSF-INT-9116781/JSPS-ENG-207, and by DFG Postdoctoral Stipend Th 472/1-1.

Work done while visiting the University of Rochester and Princeton University.