A Remark on One-Wayness versus Pseudorandomness

Abstract

Every pseudorandom generator is in particular a one-way function. If we only consider part of the output of the pseudorandom generator is this still one-way? Here is a general setting formalizing this question. Suppose G:{0,1}ⁿ → {0,1}^ℓ(n) is a pseudorandom generator with stretch ℓ(n). Let M _R  ∈ {0,1}^m(n)×ℓ(n) be a linear operator computable in polynomial time given randomness R. Consider the function

$$F(x,R)=\big(M_R G(x), R \big)$$

We obtain the following results.

• There exists a pseudorandom generator s.t. for every positive constant μ < 1 and for an arbitrary polynomial time computable M _R  ∈ {0,1}^{(1 − μ)n×ℓ(n)}, F is not one-way.

  Furthermore, our construction yields a tradeoff between the hardness of the pseudorandom generator and the output length m(n). For example, given α = α(n) and a 2^cn-hard pseudorandom generator we construct a 2^αcn-hard pseudorandom generator such that F is not one-way, where m(n) ≤ βn and α + β = 1 − o(1).

• We show this tradeoff to be tight for 1-1 pseudorandom generators. That is, for any G which is a 2^αn-hard 1-1 pseudorandom generator, if α + β = 1 + ε then there is M _R  ∈ {0,1}^βn×ℓ(n) such that F is a Ω(2^εn)-hard one-way function.

This work was supported in part by the National Basic Research Program of China Grant 2011CBA00300, 2011CBA00301, the National Natural Science Foundation of China Grant 61033001, 61061130540, 61073174, 61150110582.