The Generalized Randomized Iterate and Its Application to New Efficient Constructions of UOWHFs from Regular One-Way Functions

Abstract

This paper presents the Generalized Randomized Iterate of a (regular) one-way function f and show that it can be used to build Universal One-Way Hash Function (UOWHF) families with O(n 2) key length. We then show that Shoup's technique for UOWHF domain extension can be used to improve the efficiency of the previous construction. We present the Reusable Generalized Randomized Iterate which consists of k ≥ n + 1 iterations of a regular one-way function composed at each iteration with a pairwise independent hash function, where we only use log k such hash functions, and we "schedule" them according to the same scheduling of Shoup's domain extension technique. The end result is a UOWHF construction from regular one-way functions with an O(n log n) key. These are the first such efficient constructions of UOWHF from regular one-way functions of unknown regularity. Finally we show that the Shoup's domain extension technique can also be used in lieu of derandomization techniques to improve the efficiency of PRGs and of hardness amplification constructions for regular one-way functions.

A Cookbook for Black-Box Separations and a Recipe for UOWHFs

“…Note that the bound given in [5] does not say anything for the mere construction of a UOWHF (e.g., for a function which compresses one bit), and prior to our work it would have been possible to conjecture that there exists a construction of a UOWHF from a general one-way function that makes only one call to the underlying one-way function. Our bound matches exactly and up to a log-factor the number of calls made by the constructions of [4] and [1], respectively.…”

“…Set F ⊂ R n,i (P, I) to be the set of all functions for which (2) holds. It follows that |F | ≥ 1 6 · 2 i , as |R n,i (P, I)| = |P i |. We next show that for the class of functions R n,i (P, I) the oracle can be implemented such that it is stable.…”

“…In the case p(g) ≤ 1 2 we show that when f is chosen uniformly at random from a set of regular degenerate functions, it is often the case that the construction g (f ) is not injective, and therefore there exists an oracle which breaks the pseudoinjectivity of g (f ) . The challenge is to find a breaker oracle that is t-stable.…”

“…In case that p(g) > 1 2 we set the oracle O def = BreakOW g def = {BreakOW g,f } f ∈{0,1} n →{0,1} n , where we use the oracle BreakOW g from [9], which is described next. In [9] it is implicitly proved that there exists a set F ⊂ P n of size |F | > |Pn| 5 , such that BreakOW g,f (OWF, 1 4 )-breaks g f for all f ∈ F, and that BreakOW g is 2 n 5 -stable for F , in which case condition (2) in Theorem 1 is satisfied.…”

Untitled

“…A succeeds if x, x ∈ {0, 1} n(k) , x = x , and F z (x) = F z (x ). 1 It turns out that this weaker security property suffices for many applications. The most immediate application given in [23] is secure fingerprinting, whereby the pair ( f , f (x)) can be taken as a compact "fingerprint" of a large file x, such that it is infeasible for an adversary, seeing the fingerprint, to change the file x to x without being detected.…”