## Abstract

We present a cryptographic primitive P satisfying the following properties:Rudich’s seminal impossibility result (PhD thesis ’88) shows that P cannot be used in a black-box manner to construct an injective one-way function.P can be used in a non-black-box manner to construct an injective one-way function assuming the existence of a hitting-set generator that fools deterministic circuits (such a generator is known to exist based on the worst-case assumption that E=DTIME(2O(n)) has a function of deterministic circuit complexity 2 ^{Ω}^{(}^{n}^{)}). The non-black box aspect of our construction only requires a bound on the size of P’s implementation.Augmenting P with a trapdoor algorithm enables a non-black-box construction of an injective trapdoor function (once again, assuming the existence of a hitting-set generator that fools deterministic circuits), while Rudich’s impossibility result still holds. The primitive P and its augmented variant can be constructed based on any injective one-way function and on any injective trapdoor function, respectively, and they are thus unconditionally essential for the existence of such functions. Moreover, P can also be constructed based on various known primitives that are secure against related-key attacks (e.g., pseudorandom functions), thus enabling to base the strong structural guarantees of injective one-way functions on the strong security guarantees of such primitives. Our application of derandomization techniques is inspired mainly by the work of Barak, Ong and Vadhan (CRYPTO ’03), which on one hand relies on any one-way function, but on the other hand only results in a non-interactive perfectly binding commitment scheme (offering significantly weaker structural guarantees compared to injective one-way functions) and does not seem to enable an extension to public-key primitives. The key observation underlying our approach is that Rudich’s impossibility result applies not only to one-way functions as the underlying primitive, but in fact to a variety of “unstructured” primitives. We put forward a condition for identifying such primitives, and then subtly tailor the properties of our primitives such that they are both sufficiently unstructured in order to satisfy this condition, and sufficiently structured in order to yield injective one-way and trapdoor functions. This circumvents the basic approach underlying Rudich’s long-standing evidence for the difficulty of constructing injective one-way functions (and, in particular, injective trapdoor functions) based on seemingly weaker or unstructured assumptions.

Original language | English |
---|---|

Article number | 39 |

Pages (from-to) | 1-34 |

Number of pages | 34 |

Journal | Journal of Cryptology |

Volume | 34 |

Issue number | 4 |

DOIs | |

State | Published - Oct 2021 |

### Bibliographical note

Funding Information:A preliminary version of this work appeared in Proceedings of the 16th Theory of Cryptography Conference (TCC), 2018. L. Rotem, G. Segev: Supported by the European Union’s 7th Framework Program (FP7) via a Marie Curie Career Integration Grant (Grant No. 618094), by the European Union’s Horizon 2020 Framework Program (H2020) via an ERC Grant (Grant No. 714253), by the Israel Science Foundation (Grant No. 483/13), by the Israeli Centers of Research Excellence (I-CORE) Program (Center No. 4/11), by the US-Israel Binational Science Foundation (Grant No. 2014632), and by a Google Faculty Research Award. L. Rotem: Supported by the Adams Fellowship Program of the Israel Academy of Sciences and Humanities.

Publisher Copyright:

© 2021, International Association for Cryptologic Research.