Saving Private Randomness in One-Way Functions and Pseudorandom Generators

Can a one-way function f on n input bits be used with fewer than n bits while retaining comparable hardness of inversion? We show that the answer to this fundamental question is negative, if one is limited black-box reductions. Instead, we ask whether one can save on secret random bits at the expense of more public random bits. Using a shorter secret input is highly desirable, not only because it saves resources, but also because it can yield tighter reductions from higher-level primitives to one-way functions. Our first main result shows that if the number of output elements of f is at most 2, then a simple construction using pairwiseindependent hash functions results in a new one-way function that uses only k secret bits. We also demonstrate that it is not the knowledge of security of f , but rather of its structure, that enables the savings: a black-box reduction cannot, for a general f , reduce the secret-input length, even given the knowledge that security of f is only 2; nor can a black-box reduction use fewer than k secret input bits when f has 2 distinct outputs. Our second main result is an application of the public-randomness approach: we show a construction of a pseudorandom generator based on any regular one-way function with output range of known size 2. The construction requires a seed of only 2n+O(k log k) bits (as opposed to O(n logn) in previous constructions); the savings come from the reusability of public randomness. The secret part of the seed is of length only k (as opposed to n in previous constructions), less than the length of the one-way function input. Boston University, Department of Computer Science, 111 Cummington St., Boston, MA 02215. http://www.cs.bu. edu/∼reyzin. IBM Research, Haifa, Israel. [email protected]. Research conducted while at the Technion, Haifa, Israel. Google, Inc., 76 9th Ave, 6th Floor, New York, NY 1001, http://cs-people.bu.edu/nenad/ Research conducted, in part, at the Institute for Pure and Applied Mathematics at UCLA, whose hospitality the authors gratefully acknowledge.