Goldreich’s One-Way Function Candidate and Myopic Backtracking Algorithms

Abstract

Abstract. Goldreich (ECCC 2000) proposed a candidate one-way function construction which is parameterized by the choice of a small predicate (over d = O(1) variables) and of a bipartite expanding graph of right-degree d. The function is computed by labeling the n vertices on the left with the bits of the input, labeling each of the n vertices on the right with the value of the predicate applied to the neighbors, and outputting the n-bit string of labels of the vertices on the right.Inverting Goldreich's one-way function is equivalent to finding solutions to a certain constraint satisfaction problem (which easily reduces to SAT) having a "planted solution," and so the use of SAT solvers constitutes a natural class of attacks.We perform an experimental analysis using MiniSat, which is one of the best publicly available algorithms for SAT. Our experiment shows that the running time required to invert the function grows exponentially with the length of the input, and that such an attack becomes infeasible already with small input length (a few hundred bits).Motivated by these encouraging experiments, we initiate a rigorous study of the limitations of back-tracking based SAT solvers as attacks against Goldreich's function. Results by Alekhnovich, Hirsch and Itsykson imply that Goldreich's function is secure against "myopic" backtracking algorithms (an interesting subclass) if the 3-ary parity predicate P (x1, x2, x3) = x1 ⊕ x2 ⊕ x3 is used. One must, however, use non-linear predicates in the construction, which otherwise succumbs to a trivial attack via Gaussian elimination.We generalized the work of Alekhnovich et al. to handle a more general class of predicates, and we present a lower bound for the construction that uses the predicate P d (x1, . . . , x d ) := x1 ⊕x2 ⊕· · ·⊕x d−2 ⊕(x d−1 ∧x d ) and a random graph.

Graph Expansion, Tseitin Formulas and Resolution Proofs for CSP

“…The strongest known lower bounds were proved using the methods introduced by Ben-Sasson and Wigderson in [BSW01]. From practical point of view it is more interesting to have lower bound for backtracking algorithms on satisfiable formulas; there are several lower bounds on satisfiable formulas [AHI05], [CEMT09], [Its10], [IS12] under various restrictions on heuristics that choose a variable for splitting and a value that would be investigated at first. However all known lower bounds on satisfiable formulas are proved by reduction to lower bounds on unsatisfiable ones.…”

The Complexity of Inversion of Explicit Goldreich’s Function by DPLL Algorithms

“…This work continues [AHI05,CEMT09,Its10] and is devoted to lower bounds of DPLL algorithms on satisfiable formulas. The behaivior of DPLL algorithms on unsatisfiable formulas is equivalent to tree-like resolution proofs.…”

“…The paper [CEMT09] gives a cryptographic view on [AHI05]. Namely it was noted in [CEMT09] that the lower bound for myopic algorithms [AHI05] was proved on the formulas that code the problem of inversion of Goldreich's function based on linear predicate.…”

“…Namely it was noted in [CEMT09] that the lower bound for myopic algorithms [AHI05] was proved on the formulas that code the problem of inversion of Goldreich's function based on linear predicate. Goldreich's function [Gol00] has n binary inputs and n binary outputs.…”

On the Security of Goldreich’s One-Way Function

“…Cook et al (2009) showed that a restricted class of algorithms called "myopic algorithms" take exponential time to invert Goldreich's construction. The kinds of algorithms used in this work are not myopic.…”