Slide 1

Iftach HaitnerBased on joint works with Itay Berman, Eran Omri and Aris TentesCoin Flipping of any Constant Bias Implies One-Way FunctionsTexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAA1Cryptography Implies One-Way FunctionsAlmost all computational cryptography is known to imply one-way functions [c.f. Impagliazzo-Luby 89]One-way functions (OWFs): efficiently computable functions that no efficient algorithm can invert (with more than negligible probability)

These reductions are typically rather straightforward fornon-interactive primitives, or for interactive primitives with single failure point, e.g., commitment schemes Rather complex for some interactive primitivesFull characterization of coin-flipping protocols is not known

Apart from things we cannot prove

Specifically, proving hardness is required might be hard, but then proving OWF is needed is typicall easy2

3

Coin-Flipping ProtocolsParities want to jointly flip a uniform string

3

Blums Coin-Flipping Protocol

4

Negligible biasCommitment obtained using OWF

4

Coin-Flipping Protocols5

Weak Coin-Flipping Protocols6Known Results[Haitner-Omri 11] 88[Berman-Haitner-Tentes 13] Changed the strong to weak.9Rest of the TalkProving The Necessity of OWFsThe Optimal Adversaries 12

Protocols as Binary Trees

14Optimal Attacks on CF Protocols ABA011- 1

The Biased Continuation Attack15

The Biased-Continuation AttackABBAAAA0001 BB1B16Recursions17ABBAAAA0001 BB1B ABA011- 1Conditional ProtocolsA11- BA0119Conditional Protocols cont.A11- A1B0Sequence of Conditional Protocols

22

Transcript Function23

23Hard to Invert Transcripts 24A0A10Large is Balanced A0A1025ABBAAAA0001BB1B01Pruned ProtocolsAAA26.999.2 .3 .5 .001B26AAABThe Pruning Attacker27ABBAAAA0001BB1B01.999.2 .3 .5 .001AAAB27Summary

28