Can PPAD Hardness be Based on Standard Cryptographic Assumptions?

Alon Rosen, Gil Segev, Ido Shahaf*

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

4 Scopus citations


We consider the question of whether PPAD hardness can be based on standard cryptographic assumptions, such as the existence of one-way functions or public-key encryption. This question is particularly well-motivated in light of new devastating attacks on obfuscation candidates and their underlying building blocks, which are currently the only known source for PPAD hardness. Central in the study of obfuscation-based PPAD hardness is the sink-of-verifiable-line (SVL) problem, an intermediate step in constructing instances of the PPAD-complete problem source-or-sink. Within the framework of black-box reductions, we prove the following results: (i) average-case PPAD hardness (and even SVL hardness) does not imply any form of cryptographic hardness (not even one-way functions). Moreover, even when assuming the existence of one-way functions, average-case PPAD hardness (and, again, even SVL hardness) does not imply any public-key primitive. Thus, strong cryptographic assumptions (such as obfuscation-related ones) are not essential for average-case PPAD hardness. (ii) Average-case SVL hardness cannot be based either on standard cryptographic assumptions or on average-case PPAD hardness. In particular, average-case SVL hardness is not essential for average-case PPAD hardness. (iii) Any attempt for basing the average-case hardness of the PPAD-complete problem source-or-sink on standard cryptographic assumptions must result in instances with a nearly exponential number of solutions. This stands in striking contrast to the obfuscation-based approach, which results in instances having a unique solution. Taken together, our results imply that it may still be possible to base PPAD hardness on standard cryptographic assumptions, but any such black-box attempt must significantly deviate from the obfuscation-based approach: It cannot go through the SVL problem, and it must result in source-or-sink instances with a nearly exponential number of solutions.

Original languageAmerican English
Article number8
Pages (from-to)1-65
Number of pages65
JournalJournal of Cryptology
Issue number1
StatePublished - Jan 2021

Bibliographical note

Funding Information:
Alon Rosen: Supported by ISF Grant No. 1399/17 and via Project PROMETHEUS (Grant No. 780701). Gil Segev: Supported by the European Union’s 7th Framework Program (FP7) via a Marie Curie Career Integration Grant (Grant No. 618094), by the European Union’s Horizon 2020 Framework Program (H2020) via an ERC Grant (Grant No. 714253), by the Israel Science Foundation (Grant No. 483/13), by the Israeli Centers of Research Excellence (I-CORE) Program (Center No. 4/11), by the US-Israel Binational Science Foundation (Grant No. 2014632), and by a Google Faculty Research Award. Ido Shahaf: Supported by the Clore Israel Foundation via the Clore Scholars Programme.

Publisher Copyright:
© 2021, International Association for Cryptologic Research.


  • Average-case complexity
  • Theory of cryptography
  • Total search problems


Dive into the research topics of 'Can PPAD Hardness be Based on Standard Cryptographic Assumptions?'. Together they form a unique fingerprint.

Cite this