Unprovability of Leakage-Resilient Cryptography Beyond the Information-Theoretic Limit

Abstract

In recent years, leakage-resilient cryptography—the design of cryptographic protocols resilient to bounded leakage of honest players’ secrets—has received significant attention. A major limitation of known provably-secure constructions (based on polynomial hardness assumptions) is that they require the secrets to have sufficient actual (i.e., information-theoretic), as opposed to comptutational, min-entropy even after the leakage.

In this work, we present barriers to provably-secure constructions beyond the “information-theoretic barrier”: Assume the existence of collision-resistant hash functions. Then, no $\mathcal{NP}$ search problem with $(2^{n^{\epsilon }})$-bounded number of witnesses can be proven (even worst-case) hard in the presence of $O(n^{\epsilon })$ bits of computationally-efficient leakage of the witness, using a black-box reduction to any O(1)-round assumption. In particular, this implies that $O(n^{\epsilon })$-leakage resilient injective one-way functions, and more generally, one-way functions with at most $2^{n^{\epsilon }}$ pre-images, cannot be based on any “standard” complexity assumption using a black-box reduction.

R. Pass—Supported in part by a JP Morgan Faculty Award, NSF Award SATC-1704788, NSF Award RI-1703846, and AFOSR Award FA9550-18-1-0267. This research is based upon work supported in part by the Office of the Director of National Intelligence (ODNI), Intelligence Advanced Research Projects Activity (IARPA), via 2019-19-020700006. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies, either expressed or implied, of ODNI, IARPA, or the U.S. Government. The U.S. Government is authorized to reproduce and distribute reprints for governmental purposes notwithstanding any copyright annotation therein.