On continuous one-way functions
Introduction
The notion of one-way functions has played a central role in several areas of theoretical computer science, including cryptography and pseudorandom number generation. In these areas, certain strong one-way functions are often assumed, without a proof that these one-way functions actually exist. From the complexity-theoretic point of view, it is important to find the necessary and sufficient conditions for the existence of such one-way functions. For a certain weak form of one-way functions, such characterizations by the relations between complexity classes have been known. For example, let us call a function ϕ from finite strings to finite strings a one-way function if ϕ is one-to-one, polynomially honest (i.e., there exists a polynomial function p such that for all inputs s, where is the length of t) and polynomial-time computable but is not polynomial-time invertible (i.e., for any function ψ such that for all , ψ is not polynomial-time computable). Then, it is known [2], [3] that such a one-way function exists if and only if , where UP is the class of sets computable in polynomial time by some unambiguous nondeterministic machines (see Section 2 for the formal definition of the class UP). In the above, the requirement that ϕ be polynomially honest is necessary in order to exclude trivial one-way functions whose inverses map some strings to exponentially long strings. In general, however, the requirement of one-to-oneness is not necessary. Let us call a function ϕ a k-to-one function if for any t, there are at most k strings such that , . The existence of k-to-one one-way functions is often assumed in cryptography. The computational complexity of k-to-one one-way functions has also been studied in literature (see, for example, Watanabe [7]).
Intuitively, the inverse of a polynomial-time computable, polynomially honest function ϕ is difficult to compute because the function ϕ could be irregular in the sense that the values of and do not have any obvious relation even if s and t are nicely related. On the other hand, if the function ϕ does show some regularity, then the inverse may be easy to compute. For example, if we know that ϕ is order-preserving in the sense that implies for some natural ordering ≤, then a simple binary search procedure computes the inverse easily. The above observation suggests that if ϕ is a function, in the general sense that and satisfy certain relation whenever s and t satisfy some similar relation, then the inverse of ϕ could be easy to compute. For instance, in an informal setting, we can see easily that a one-to-one function f which maps real numbers in a closed interval [] to real numbers must preserve the natural ordering on reals and thus should have a polynomial-time computable inverse. It should be cautioned however that this argument is made in a very informal manner. A formal argument must be based on a formal computational model of real-valued continuous functions. In this paper, we pursue the question of the existence of continuous one-way functions in this direction.
Our model of computation for real functions is based on the oracle Turing machines and is a generalization of the model used in recursive analysis. In this model, a real number is polynomial-time computable if there exists a Turing machine M which computes an approximate value d to x, with error , in time for some polynomial function p. A real function is polynomial-time computable if there exists an oracle Turing machine M which computes an approximate value e to , with error , in time for some polynomial function p, when an approximate value d to x with error is given to M by the oracle. A polynomial complexity theory of real functions based on this model of computation has been developed by Ko and Friedman [5]. In this theory, the computational complexity of many basic numerical operations is characterized by the discrete complexity classes such as P, NP and PSPACE. (See Section 3 for the formal definitions; and see Ko [4] for a detailed survey of this theory).
Following the direction of this complexity theory, we study the necessary and sufficient conditions for the existence of continuous one-way functions. Before we begin to describe our main results, it is necessary to establish some technical definitions. One of the most basic properties of a polynomial-time computable function f on is that f must have a polynomial modulus of continuity: if then , where p is a fixed polynomial function. Thus, in order to exclude trivial one-way functions on , we require that a one-way function f on must have a polynomial inverse modulus of continuity: the inverse function must have a polynomial modulus of continuity.
With this requirement, we can prove that there does not exist a one-way function from to R, thus confirming the intuition discussed above. However, when we consider two-dimensional one-way functions, then the property of continuity does not help too much. More precisely, we prove the following:
- (1)
If then there does not exist a one-to-one one-way function f from to .
- (2)
If then there exists a one-to-one one-way function from to .
- (3)
If , then there exists a one-to-one one-way function from to such that is not a polynomial time compatible real number.
In the above condition , the subscription 1 indicates the complexity classes restricted to tally sets (sets over a singleton alphabet {0}). This condition is equivalent to the existence of certain strong discrete one-way functions. See Section 2 for more discussions.
The above results seem to suggest that in the one-dimensional case, the reason that a one-way function does not exist is really due to the order-preserving property of the continuous function rather than the continuity property of the function. To further investigate this observation, we consider k-to-one continuous one-way functions. With a reasonable extension of the notion of polynomial inverse modulus of continuity (for the formal definition see Section 5), we define a k-to-one continuous one-way function to be a polynomial-time computable function f which has a polynomial inverse modulus of continuity and yet there exists some non-polynomial-time computable point x whose image is polynomial-time computable. (Note that for , f does not have a continuous inverse function, so one-way functions are defined in such a way that a single inverse point is difficult to compute.)
Based on this definition, we show that for one-dimensional functions, if , then k-to-one functions still have a certain order-preserving property and hence they cannot be one-way functions. For , however, we can show a similar result as items (1) and (3):
- 1.
If then, for all , there does not exist a k-to-one one-way function f from to R.
- 2.
If , then there exists a four-to-one strong one-way function from to R.
In addition, we consider two-dimensional k-to-one one-way functions. Recall that in the study of discrete one-way functions, it is often observed that the complexity of the inverse function is closely related to the complexity of the range of the function. In the case of one-dimensional functions, the range of a function on a compact interval must be a compact interval, and so there is no such relation. In the case of two-dimensional functions, we observe that the function f constructed above in result (3) does have an irregular range. In fact, the question of whether we can find a one-to-one two-dimensional one-way function whose range is exactly is left open. Our last result shows that such a one-way function exists if we allow the function to be three-to-one.
- 1.
If , then there exists a three-to-one strong one-way function from onto .
We review, in Section 2, the notions of one-way functions and the sufficient conditions for their existence in terms of relations on complexity classes. In Section 3 we present our formal model of computation for real numbers and real functions. The main results (1)-(6) are proved in Sections 4, 5 and 6.
Section snippets
Discrete one-way functions
In this section we review the definitions and basic characterizations of some discrete one-way functions. We assume that the reader is familiar with (deterministic and non-deterministic) Turing machines (TMs) and their complexity measures. We will use the alphabet . Let , we let denote its length. (In the next three sections, we will write to denote the absolute value of a real number x, and so we use the nonstandard notation for the length of a string.)
We first define
Model of computation for continuous functions
In this section, we present the formal model of computation for real functions on or . The computational complexity theory of real functions based on this model has been developed in Ko and Friedman [4], [5]. Here we will only give a short review.
First we consider the representation of real numbers. Let D be the set of all dyadic rational numbers, i.e., . A dyadic rational is represented by a string of the form
with each and each in ,
A two-dimensional one-way function
Following the notion of discrete one-way functions, we define continuous one-way functions as follows. Let S be either the interval or the unit square , and let T be either the set R or . A function is a weak one-way function if f is a one-to-one, polynomial-time computable function such that has a polynomial modulus of continuity on but is not polynomial-time computable; f is a strong one-way function if, in addition, there exists a point y in such
Many-to-one one-way functions
In this and the next sections, we consider continuous one-way functions which are not necessarily one-to-one. In the case of discrete functions, we have seen in Section 2 that a k-to-one one-way function exists if and only if a one-to-one one-way function exists. In the case of continuous functions, we will see quite different results. In particular, we will show, under the assumption , the existence of one-dimensional four-to-one one-way functions (in contrast to Theorem 4.1) and,
Two-dimensional onto one-way functions
Following the discussion of Section 5, we define two-dimensional k-to-one one-way functions as follows.
Definition 6.1 A function is said to have a polynomial inverse modulus of continuity if there exists a polynomial function q such that f and q satisfy the following conditions: for any point and for any , there exists a point such that and , and for any point , there exists such that for any
Declaration of Competing Interest
The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.
Acknowledgements
The author would like to thank Professor Osamu Watanabe for interesting discussions on one-way functions.
References (7)
On some natural complete operators
Theor. Comput. Sci.
(1985)- et al.
Computational complexity of real functions
Theor. Comput. Sci.
(1982) Relative complexity of checking and evaluating
Inf. Process. Lett.
(1976)