The complexity of promise problems with applications to public-key cryptography

Reviewer: Harold P. Edmundson

The authors investigate several complexity issues about a certain kind of partial decision problem, called a promise problem, which can be formally described as a pair ( Q, R) of predicates of input instances, where predicate Q is called the promise and predicate R stipulates a property. Complexity issues about promise problems arise from considerations about the cracking problem for public-key cryptosystems. The cracking problem for public-key cryptosystems is defined as the problem of computing the message M (if it exists) such that applying the encryption algorithm E to the public encryption key K 1 and the message M yields the given cryptogram C. A fundamental issue is whether or not there exist public-key cryptosystems with a hard cracking problem. It is known that the cracking problem for public-key cryptosystems is describable as a promise problem. After defining a certain notion of Turing reducibility between promise problems, the authors disprove a conjecture made by Even and Yacobi [1], that would imply the nonexistence of public-key cryptosystems with an NP-hard cracking problem. However, the authors present another conjecture and show that it has the same consequence. Moreover, they show that this new conjecture implies that no NP-complete set can be accepted by a Turing machine that has, at most, one accepting computation for each imput string.