Almost Optimal Bounds for Direct Product Threshold Theorem

Abstract

Abstract. We consider weakly-verifiable puzzles which are challengeresponse puzzles such that the responder may not be able to verify for itself whether it answered the challenge correctly. We consider k-wise direct product of such puzzles, where now the responder has to solve k puzzles chosen independently in parallel. Canetti et al have earlier shown that such direct product puzzles have a hardness which rises exponentially with k. In the threshold case addressed in Impagliazzo et al, the responder is required to answer correctly a fraction of challenges above a threshold. The bound on hardness of this threshold parallel version was shown to be similar to Chernoff bound, but the constants in the exponent are rather weak. Namely, Impagliazzo et al show that for a puzzle for which probability of failure is δ, the probability of failing on less than (1 − γ)δk out of k puzzles, for any parallel strategy, is at most e −γ 2 δk/40 .In this paper, we develop new techniques to bound this probability, and show that it is arbitrarily close to Chernoff bound. To be precise, the bound is e −γ 2 (1−γ)δk/2 . We show that given any responder that solves k parallel puzzles with a good threshold, there is a uniformized parallel solver who has the same threshold of solving k parallel puzzles, while being oblivious to the permutation of the puzzles. This enhances the analysis considerably, and may be of independent interest.

On Securing Communication from Profilers

“…For this kind of puzzles, it has been proved [6] that if it is difficult for an attacker to solve a weakly-verifiable puzzle P, then trying to solve multiple instances of a puzzle in parallel is harder. Most recently, Jutla found a better bound to show how hard it is for an attacker to solve multiple instances of weakly-verifiable puzzles [8]. The next theorem is based on the main theorem proposed by Jutla, but it has been adapted to CAPTCHAS, which are of our interest in this work.…”

Constructive Proofs of Concentration Bounds

“…The earlier bounds of [IJK09b,Jut10] do not make such an assumption, but they are not optimal. Using conditioning in the reductions (cf.…”

“…1 DPTs for puzzles are known [BIN97,CHS05], with [CHS05] giving an optimal DPT. Also TDPTs are known [IJK09b,Jut10], but they are not optimal. Here we immediately get an optimal TDPT for puzzles, using the optimal DPT of [CHS05], when the success probabilities of the legitimate user and the attacker are constant.…”

Efficient String-Commitment from Weak Bit-Commitment

“…However, since a solver can correlate his answers to different puzzles, the events are not independent and the hardness bound may not hold. In the literature, there are various (parallel) repetition theorems for aforementioned puzzle systems saying that the hardness bounds match that of independent events and/or that the hardness is amplified in an exponential rate, which are useful to deduce security amplification results [CHS05,IJK07,DIJK09,Jut10]. In general, hardness amplification results for one puzzle systems do not imply the same results for another puzzle systems.…”

“…For weakly-verifiable puzzle systems, Canetti, Halevi, and Steiner [CHS05] prove a tight Direct Product Theorem, saying that solving n puzzles is δ n -hard 2 if solving a single puzzle is δ-hard, and Impagliazzo, Jaiswal, and Kabanets [IJK07] prove a more general Chernoff-type Theorem, saying that solving at least (1.1) · δ · n out of n puzzles is 2 −Ω(δ·n) -hard if solving a single puzzle is δ-hard. The bound of [IJK07] was recently improved by Jutla [Jut10] to nearly optimal. Dodis, Impagliazzo, Jaiswal, and Kabanets [DIJK09] extend the Chernofftype Theorem to dynamic weakly-verifiable puzzle systems, and use it to achieve security amplification for MACs, digital signatures, and PRFs.…”