Slide 1
Iftach HaitnerBased on joint works with Itay Berman, Eran Omri and Aris TentesCoin Flipping of any Constant Bias Implies One-Way FunctionsTexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAA1Cryptography Implies One-Way FunctionsAlmost all computational cryptography is known to imply one-way functions [c.f. Impagliazzo-Luby 89]One-way functions (OWFs): efficiently computable functions that no efficient algorithm can invert (with more than negligible probability)
These reductions are typically rather straightforward fornon-interactive primitives, or for interactive primitives with single failure point, e.g., commitment schemes Rather complex for some interactive primitivesFull characterization of coin-flipping protocols is not known
Apart from things we cannot prove
Specifically, proving hardness is required might be hard, but then proving OWF is needed is typicall easy2
3
Coin-Flipping ProtocolsParities want to jointly flip a uniform string
3
Blums Coin-Flipping Protocol
4
Negligible biasCommitment obtained using OWF
4
Coin-Flipping Protocols5
Weak Coin-Flipping Protocols6Known Results[Haitner-Omri 11] 88[Berman-Haitner-Tentes 13] Changed the strong to weak.9Rest of the TalkProving The Necessity of OWFsThe Optimal Adversaries 12
Protocols as Binary Trees
14Optimal Attacks on CF Protocols ABA011- 1
The Biased Continuation Attack15
The Biased-Continuation AttackABBAAAA0001 BB1B16Recursions17ABBAAAA0001 BB1B ABA011- 1Conditional ProtocolsA11- BA0119Conditional Protocols cont.A11- A1B0Sequence of Conditional Protocols
22
Transcript Function23
23Hard to Invert Transcripts 24A0A10Large is Balanced A0A1025ABBAAAA0001BB1B01Pruned ProtocolsAAA26.999.2 .3 .5 .001B26AAABThe Pruning Attacker27ABBAAAA0001BB1B01.999.2 .3 .5 .001AAAB27Summary
28