PROGRAM CHECKERS FOR NP

AND BLACK-BOX SEPARATIONSMohammad Mahmoody

School on Black-Box ImpossibilitiesJuly 2014

MAIN MESSAGE Open for 25 years: Do all NP languages have “program checkers”?[ Manuel Blum, Sampath Kannan: Designing Programs That Check Their Work. STOC 1989 ]

Message: If NP not checkable black-box impossibly results follow

Examples: No NP-hard one-way function [HoMX10] No NP-hard hash functions [HaMX10] No black-box -round ZK for NP from OWPs with negligible soundness error [GWXY] No black-box 3-round ZK for NP from OWFs with -bit verifier messages [MP12]

PLAN

Part I: Short intro to program checkers

Part II: Applications to separations

PLAN

Part I: Short intro to program checkers

Part II: Applications to separations

DEFINITION Program claims to solve language A program checker gets and as input and runs “safely” : If P correct : If P buggy: or “I found a bug”.

Both need to hold with “high” probability.

Example: graph isomorphism (or non-isomorphism)

CHECKING SAT ?

Is SAT is checkable? Open since [BK89,FRS89].

If P(x) says “x satisfiable” make sure by self-reducibility

What if P(x) = “x not satisfiable”? should still convince the checker…

would be a PCP for Moreover: each query efficiently computable using NP oracle

PCP TWO PROVERS [FRS89]: SAT is checkable iff coNP is provable with two provers in

Proof: on board!

So: proving coNP with a single prover in is a stronger tasklets call it : strong program checkers for NP.

Known proof systems for coNP require #P –complex provers…

RECALLING THE RESULTS

NP-hard one-way function NP checkable

NP-hard hash functions NP strongly checkable

black-box -round ZK for NP from OWPs with negligible soundness error

No black-box 3-round ZK for NP from OWFs with -bit verifier messages

NP has strongprogram checker

PLAN

Part I: Short intro to program checkers

Part II: Applications [Just OWF]

RULING OUT P NP CRYPTO

10

Prior works: [FF 91, BT 04]: non-adaptive reduction [Brassard 79]: general reduction, but for one-way

permutations

[BL 13]: general reduction, but for homomorphic encryption

Open question: Ruling out black-box reductions that prove “NP BPP OWF exists”(under complexity assumptions)

Potentially easier to rule out stronger primitives (e.g. public-key)

NP-HARD OWF SAT CHECKABLE Theorem: If R solves NP given any weakly inverting oracle for f

There is two prover proof system for coNP with prover complexity

Proof: Prover 1: emulates the reduction Prover 2 either: re-answer one of P1’s answers or invert

VER

P2

P1rand of R

Simulation : (ym,a1),…(ym,am)

yi

ai

/ f(u) / u’

x

PROOF INTUITION

1) Only one query from P2 it is an “oracle”.

2) If P2 inverts with prob caught with prob

3) P1 should match oracle P2 (or gets caught with prob )

3) Soundness error is high?Use sequential repetition!

VER

P2

P1rand of R

Simulation : (ym,a1),…(ym,am)

yi

ai

/ f(u) / u’

x

DIRECT PROOF USING PCPS On the board!