UOWHFs from OWFs: Trading Regularity for Efficiency

Abstract

A universal one-way hash function (UOWHF) is a shrinking function for which finding a second preimage is infeasible. A UOWHF, a fundamental cryptographic primitive from which digital signature can be obtained, can be constructed from any one-way function (OWF). The best known construction from any OWF f:{0,1}ⁿ → {0,1}ⁿ, due to Haitner et. al. [2], has output length Õ(n ⁷) and Õ(n ⁵) for the uniform and non-uniform models, respectively. On the other hand, if the OWF is known to be injective, i.e., maximally regular, the Naor-Yung construction is simple and practical with output length linear in that of the OWF, and making only one query to the underlying OWF.

In this paper, we establish a trade-off between the efficiency of the construction and the assumption about the regularity of the OWF f. Our first result is a construction comparably efficient to the Naor-Yung construction but applicable to any close-to-regular function. A second result shows that if |f ^− 1 f(x)| is concentrated on an interval of size 2^s(n), the construction obtained has output length Õ(n·s(n)⁶) and Õ(n ·s(n)⁴) for the uniform and non-uniform models, respectively.