We ask whether an Identity Based Encryption (IBE) system can be built from simpler public-key primitives. We show that there is no black-box construction of IBE from Trapdoor Permutations (TDP) or even from Chosen Ciphertext Secure Public Key Encryption (CCA-PKE). These black-box separation results are based on an essential property of IBE, namely that an IBE system is able to compress exponentially many public-keys into a short public parameters string.

We consider zero knowledge interactive proofs in a richer, more realistic communication environment. In this setting, one may simultaneously engage in many interactive proofs, and these proofs may take place in an asynchronous fashion. It is known that zero-knowledge is not necessarily preserved in such an environment; we show that for a large class of protocols, it cannot be preserved. Any 4 round (computational) zero-knowledge interactive proof (or argument) for a non-trivial language L is not black-box simulatable in the asynchronous setting.

shuffles", performed on a set of items.

Usually, a proof of a theorem contains more knowledge than the mere fact that the theorem is true. For instance, to prove that a graph is Hamiltonian it suffices to exhibit a Hamiltonian tour in it; however, this seems to contain more knowledge than the single bit Hamiltonian/non-Hamiltonian. In this paper a computational complexity theory of the “knowledge” contained in a proof is developed. Zero-knowledge proofs are defined as those proofs that convey no additional knowledge other than the correctness of the proposition in question. Examples of zero-knowledge proof systems are given for the languages of quadratic residuosity and 'quadratic nonresiduosity. These are the first examples of zero-knowledge proofs for languages not known to be efficiently recognizable.

We show how to efficiently construct a pseudorandom invertible permutation generator from a pseudorandom function generator. Goldreich, Goldwasser and Micali [“How to construct random functions,” Proc. 25th Annual Symposium on Foundations of Computer Science, October 24–26, 1984.] introduce the notion of a pseudorandom function generator and show how to efficiently construct a pseudorandom function generator from a pseudorandom bit generator. We use some of the ideas behind the design of the Data Encryption Standard for our construction. A practical implication of our result is that any pseudorandom bit generator can be used to construct a block private key cryptosystem which is secure against chosen plaintext attack, which is one of the strongest known attacks against a cryptosystem.

Three very different formal definitions of security for public-key cryptosystems have been proposed—two by Goldwasser and Micali and one by Yao. We prove all of them to be equivalent. This equivalence provides evidence that the right formalization of the notion of security has been reached.

GGM] prove that if there is a Pseudo-random number generator, then there is a pseudo-random function generator.We prove here that if there is a pseudo-random function generator, then there is a pseudo-random permutation generator.We also prove that if two permutation generators which are "slightly secure" are cryptographically composed, the result is more secure than either one alone.

How much knowledge should be communicated fir proving a theorem T?Certainly enough to see that T is true, but usually much more.For instance, to prove that a graph is Hamiltonian it suffices to exhibit an Hamiltonian tour.This appears, however, to contain ,much additional knowledge than the single bit "HamiltonianInon-Hamiltonian".We give a computational complexity measure of knowledge and measure tic amount of additional knowlcdgc contained in proofs.

We present a cryptographic protocol allowing two mutually distrusting parties, A and B, each having a secret bit, to "simultaneously" exchange the values of those bits. It is assumed that initially each party presents a correct encryption of his secret bit to the other party. We develop a new tool to implement our protocol: a slightly biased symmetric coin. The key property of this coin is that from each flip A receives a piece of probabilistic information about B's secret bit which is symmetric to the piece of information B receives about A's secret bit.

It is shown that any multivariate polynomial of degree d that can be computed sequentially in C steps can be computed in parallel in $O((\log d)(\log C + \log d))$ steps using only $(Cd)^{O(1)} $ processors.

Let R _ NP be the collecUon of languages L such that for some polynomial-time-computable predicate P(x, y) and constant k, L = (xl3y , lYl = Ix:, P(x, y)) = (x13 at least 2 Ix:-1 values of y, lYl = Ixl k, P(x, y)) Let U _ NP be the collecuon of languages L such that for some polynomial-time-computable predicate P(x, y) and constant k, Z = (xl3y, lYl = Ixl k, e(x, .v))= {xlB umque y, lYl = Ixl', e(x, y)) Let R A, U A, pA, NpA, and CO-NP a be the relatwlzatton of these classes with respect to an oracle A Then for some oracles E and F, (NP E tq CO-NP E) = R e = pE ~ Npe and (NP r tq CO-NP F) ffi U F = pF ~ NpF, while for some other oracle D, CO.NPO=Npo= U o = R o ~ Po

If the time bounds defining two nondeterministic complexity classes are too close for separation by the two known techniques, then they are almost too close for separation by any relativizable technique. Proof of an analogous result for space would be a major breakthrough, implying $\operatorname{NSPACE}(\log n) = \operatorname{DSPACE}(\log n)$.

A restricted model of a Turing machine called a JAG (Jumping Automaton for Graphs) is introduced for solving the maze threadability problem (determining whether there is a path joining two distinguished nodes in an input graph). A JAG accesses its input graph by moving pebbles from a limited supply along the edges of the graph under a finite state control, and detecting when two pebbles coincide. It can also cause one pebble to jump to another. We prove that for every N there is a JAG which can determine threadability of an arbitrary N node input graph in storage $O((\log N)^2 )$, where the storage of a JAG with Ppebbles and N states is defined to be $P\log N + \log Q$. Further, we prove that any JAG which determines threadability requires storage $\Omega ((\log N)^2 /\log \log N)$. Finally, we prove that even when the inputs are restricted to undirected graphs (with no bound on the number of nodes), no single JAG can determine threadability.

@ NP be the collection of languages L such that for some polynomial time computable predicate P(x,y) and constant k, L = {x|

Abstract Mostowski [11] shows that if a structure has a decidable theory, then its weak direct power has one as well; his proof however never produces decision procedures which are elementary recursive. Some very general results are obtained here about the nature of the weak direct power of a structure, which in most cases lead to elementary recursive decision procedures for weak direct powers of structures which themselves have elementary recursive procedures. In particular, it is shown that 〈N*, +〉, the weak direct power of 〈N, +〉, can be decided in space for some constant c. As corollaries, the same upper bound is obtained for the theory of the structure 〈N+, ·〉 of positive integers under multiplication, and for the theory of finite abelian groups. Fischer and Rabin [7] have shown that the theory of 〈N,* +〉 requires time even on nondeterministic Turing machines.

Consider the first order theory of the real numbers with the function + (plus) and the predicate $ < $ (less than). Let S be the set of true sentences of this theory. We first present an elimination of quantifiers decision procedure for S, and then analyze it to show that it takes at most time $2^{2cn} $, where c is a constant, to decide sentences of length n. We next show that a given sentence does not change in truth value when each of the quantifiers is limited to range over an appropriately chosen finite set of rationals. This fact leads to a new decision procedure for S which uses at most space $2^{cn} $. We also remark that our methods lead to a decision procedure for Presburger arithmetic which operates within space $2^{2cn} $. These upper bounds should be compared with the results of Fischer and Rabin [2] that for some constant c, real addition requires time $2^{cn} $ and Presburger arithmetic requires time $2^{2cn} $.

Let N be the set of nonnegative integers and let be the weak direct product of with itself. Mostowski[9] shows that the theory of is decidable, but his decision procedure isn't elementary recursive. We present here a more efficient procedure which operates within space [equation]