Elsevier

Theoretical Computer Science

Volume 852, 8 January 2021, Pages 1-17
Theoretical Computer Science

On continuous one-way functions

https://doi.org/10.1016/j.tcs.2020.10.031Get rights and content

Abstract

The existence of one-way functions seems to depend, intuitively, on certain irregular properties of polynomial-time computable functions. Therefore, for functions with continuity properties, it suggests that all such functions are not one-way. It is shown here that in the formal complexity theory of real functions, this nonexistence of continuous one-way functions can be proved for one-to-one one-dimensional real functions, but fails for one-to-one two-dimensional real functions, if certain strong discrete one-way functions exist. Furthermore, for k-to-one functions, we can prove the existence of four-to-one one-dimensional one-way functions under the same assumption of the existence of strong discrete one-way functions. (A function f is k-to-one if for any y there exist at most k distinct values x such that f(x)=y.)

Introduction

The notion of one-way functions has played a central role in several areas of theoretical computer science, including cryptography and pseudorandom number generation. In these areas, certain strong one-way functions are often assumed, without a proof that these one-way functions actually exist. From the complexity-theoretic point of view, it is important to find the necessary and sufficient conditions for the existence of such one-way functions. For a certain weak form of one-way functions, such characterizations by the relations between complexity classes have been known. For example, let us call a function ϕ from finite strings to finite strings a one-way function if ϕ is one-to-one, polynomially honest (i.e., there exists a polynomial function p such that p(l(ϕ(s)))l(s) for all inputs s, where l(t) is the length of t) and polynomial-time computable but is not polynomial-time invertible (i.e., for any function ψ such that ϕ(ψ(t))=t for all tRange(ϕ), ψ is not polynomial-time computable). Then, it is known [2], [3] that such a one-way function exists if and only if PUP, where UP is the class of sets computable in polynomial time by some unambiguous nondeterministic machines (see Section 2 for the formal definition of the class UP). In the above, the requirement that ϕ be polynomially honest is necessary in order to exclude trivial one-way functions whose inverses map some strings to exponentially long strings. In general, however, the requirement of one-to-oneness is not necessary. Let us call a function ϕ a k-to-one function if for any t, there are at most k strings s1,,sk such that ϕ(si)=t, 1ik. The existence of k-to-one one-way functions is often assumed in cryptography. The computational complexity of k-to-one one-way functions has also been studied in literature (see, for example, Watanabe [7]).

Intuitively, the inverse of a polynomial-time computable, polynomially honest function ϕ is difficult to compute because the function ϕ could be irregular in the sense that the values of ϕ(s) and ϕ(t) do not have any obvious relation even if s and t are nicely related. On the other hand, if the function ϕ does show some regularity, then the inverse ϕ1 may be easy to compute. For example, if we know that ϕ is order-preserving in the sense that st implies ϕ(s)ϕ(t) for some natural ordering ≤, then a simple binary search procedure computes the inverse ϕ1 easily. The above observation suggests that if ϕ is a continuous function, in the general sense that ϕ(s) and ϕ(t) satisfy certain relation whenever s and t satisfy some similar relation, then the inverse of ϕ could be easy to compute. For instance, in an informal setting, we can see easily that a one-to-one function f which maps real numbers in a closed interval [a,b] to real numbers must preserve the natural ordering on reals and thus should have a polynomial-time computable inverse. It should be cautioned however that this argument is made in a very informal manner. A formal argument must be based on a formal computational model of real-valued continuous functions. In this paper, we pursue the question of the existence of continuous one-way functions in this direction.

Our model of computation for real functions is based on the oracle Turing machines and is a generalization of the model used in recursive analysis. In this model, a real number x[0,1] is polynomial-time computable if there exists a Turing machine M which computes an approximate value d to x, with error 2n, in time p(n) for some polynomial function p. A real function f:[0,1]R is polynomial-time computable if there exists an oracle Turing machine M which computes an approximate value e to f(x), with error 2n, in time p(n) for some polynomial function p, when an approximate value d to x with error 2p(n) is given to M by the oracle. A polynomial complexity theory of real functions based on this model of computation has been developed by Ko and Friedman [5]. In this theory, the computational complexity of many basic numerical operations is characterized by the discrete complexity classes such as P, NP and PSPACE. (See Section 3 for the formal definitions; and see Ko [4] for a detailed survey of this theory).

Following the direction of this complexity theory, we study the necessary and sufficient conditions for the existence of continuous one-way functions. Before we begin to describe our main results, it is necessary to establish some technical definitions. One of the most basic properties of a polynomial-time computable function f on [0,1] is that f must have a polynomial modulus of continuity: if |xy|2p(n) then |f(x)f(y)|2n, where p is a fixed polynomial function. Thus, in order to exclude trivial one-way functions on [0,1], we require that a one-way function f on [0,1] must have a polynomial inverse modulus of continuity: the inverse function f1 must have a polynomial modulus of continuity.

With this requirement, we can prove that there does not exist a one-way function from [0,1] to R, thus confirming the intuition discussed above. However, when we consider two-dimensional one-way functions, then the property of continuity does not help too much. More precisely, we prove the following:

  • (1)

    If P=NP then there does not exist a one-to-one one-way function f from [0,1]2 to R2.

  • (2)

    If P=UP then there exists a one-to-one one-way function from [0,1]2 to R2.

  • (3)

    If P1UP1coUP1, then there exists a one-to-one one-way function from [0,1]2 to R2 such that f1(1,1) is not a polynomial time compatible real number.

In the above condition P1UP1coUP1, the subscription 1 indicates the complexity classes restricted to tally sets (sets over a singleton alphabet {0}). This condition P1UP1coUP1 is equivalent to the existence of certain strong discrete one-way functions. See Section 2 for more discussions.

The above results seem to suggest that in the one-dimensional case, the reason that a one-way function does not exist is really due to the order-preserving property of the continuous function rather than the continuity property of the function. To further investigate this observation, we consider k-to-one continuous one-way functions. With a reasonable extension of the notion of polynomial inverse modulus of continuity (for the formal definition see Section 5), we define a k-to-one continuous one-way function to be a polynomial-time computable function f which has a polynomial inverse modulus of continuity and yet there exists some non-polynomial-time computable point x whose image f(x) is polynomial-time computable. (Note that for k>1, f does not have a continuous inverse function, so one-way functions are defined in such a way that a single inverse point is difficult to compute.)

Based on this definition, we show that for one-dimensional functions, if k=3, then k-to-one functions still have a certain order-preserving property and hence they cannot be one-way functions. For k=4, however, we can show a similar result as items (1) and (3):

  • 1.

    If P=NP then, for all k4, there does not exist a k-to-one one-way function f from [0,1] to R.

  • 2.

    If P1UP1coUP1, then there exists a four-to-one strong one-way function from [0,1] to R.

In addition, we consider two-dimensional k-to-one one-way functions. Recall that in the study of discrete one-way functions, it is often observed that the complexity of the inverse function is closely related to the complexity of the range of the function. In the case of one-dimensional functions, the range of a function on a compact interval must be a compact interval, and so there is no such relation. In the case of two-dimensional functions, we observe that the function f constructed above in result (3) does have an irregular range. In fact, the question of whether we can find a one-to-one two-dimensional one-way function whose range is exactly [0,1]2 is left open. Our last result shows that such a one-way function exists if we allow the function to be three-to-one.

  • 1.

    If P1UP1coUP1, then there exists a three-to-one strong one-way function from [0,1]2 onto [0,1]2.

We review, in Section 2, the notions of one-way functions and the sufficient conditions for their existence in terms of relations on complexity classes. In Section 3 we present our formal model of computation for real numbers and real functions. The main results (1)-(6) are proved in Sections 4, 5 and 6.

Section snippets

Discrete one-way functions

In this section we review the definitions and basic characterizations of some discrete one-way functions. We assume that the reader is familiar with (deterministic and non-deterministic) Turing machines (TMs) and their complexity measures. We will use the alphabet Σ={0,1}. Let sΣ, we let l(s) denote its length. (In the next three sections, we will write |x| to denote the absolute value of a real number x, and so we use the nonstandard notation l(s) for the length of a string.)

We first define

Model of computation for continuous functions

In this section, we present the formal model of computation for real functions on [0,1] or [0,1]2. The computational complexity theory of real functions based on this model has been developed in Ko and Friedman [4], [5]. Here we will only give a short review.

First we consider the representation of real numbers. Let D be the set of all dyadic rational numbers, i.e., D={m/2n|n,mN,n0}. A dyadic rational dD is represented by a string of the form±dnd1d0.e1em

with each di and each ej in {0,1},

A two-dimensional one-way function

Following the notion of discrete one-way functions, we define continuous one-way functions as follows. Let S be either the interval [0,1] or the unit square [0,1]2, and let T be either the set R or R2. A function f:ST is a weak one-way function if f is a one-to-one, polynomial-time computable function such that f1 has a polynomial modulus of continuity on Range(f) but f1 is not polynomial-time computable; f is a strong one-way function if, in addition, there exists a point y in Range(f) such

Many-to-one one-way functions

In this and the next sections, we consider continuous one-way functions which are not necessarily one-to-one. In the case of discrete functions, we have seen in Section 2 that a k-to-one one-way function exists if and only if a one-to-one one-way function exists. In the case of continuous functions, we will see quite different results. In particular, we will show, under the assumption P1UP1coUP1, the existence of one-dimensional four-to-one one-way functions (in contrast to Theorem 4.1) and,

Two-dimensional onto one-way functions

Following the discussion of Section 5, we define two-dimensional k-to-one one-way functions as follows.

Definition 6.1

A function f:[0,1]2R2 is said to have a polynomial inverse modulus of continuity if there exists a polynomial function q such that f and q satisfy the following conditions:

  • (1)

    for any point x1,x2[0,1]2 and for any n>0, there exists a point z1,z2 such that |z1,z2x1,x2|2n and |f(z1,z2)f(x1,x2)|>2q(n), and

  • (2)

    for any point x1,x2[0,1], there exists δ>0 such that for any x1,x2[0,1

Declaration of Competing Interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Acknowledgements

The author would like to thank Professor Osamu Watanabe for interesting discussions on one-way functions.

References (7)

There are more references available in the full text version of this article.

Cited by (0)

View full text