Kolmogorov One-Way Functions Revisited

Abstract

We study characterizations of one-way functions in terms of time-bounded Kolmogorov complexity. As the main contribution, we propose definitions for strong and weak Kolmogorov one-way functions and show that these are equivalent to classical strong and weak one-way functions, respectively. The new definitions were motivated by the fact that the expected value approach is not able to characterize strong one-way functions as we prove in the paper.

1. Introduction

One-way functions are polynomially computable functions that are hard to invert, meaning that, given a set of images, there should not exist an efficient algorithm to compute its pre-image. One-way functions are not known to exist. However, their existence has major consequences in mathematics, as well as in everyone’s daily life: on one hand, their existence implies that $\mathsf{P}\ne \mathsf{NP}$ (see [1]); on the other hand, if they do not exist, then most cryptographic protocols and pseudo-random generators are not secure since their security is based on the hardness of several one-way function candidates [2,3,4,5,6].

In the literature, it is possible to find three definitions of one-way functions that essentially differ on the power of the polynomial-time algorithm that is used to invert the function and on its probability of success: deterministic, weak and strong (by increasing order of strength). A function f is a deterministic one-way function if all polynomial-time deterministic algorithms fail to invert at least a polynomial fraction of the inputs; f is a weak one-way function if at least a polynomial fraction of the inputs are resilient to polynomial time probabilistic algorithms; and, finally, f is a strong one-way function if any polynomial-time probabilistic algorithm can only invert a negligible fraction of the inputs. Despite the distinctly different hardness assumptions, it is known that weak one-way functions exist if and only if strong one-way functions exist (see [1] for details).

In Algorithmic Information Theory, the central notion is Kolmogorov complexity, $\mathsf{K}\left(x\right)$, proposed independently in [7,8,9], that measures the information contained in a string x by means of the length of its shortest description. The computational hardness is easily encoded in this information measure by considering its time-bounded version, ${\mathsf{K}}^t\left(x\right)$, where the restriction is that the program describing x must run within time $t\left(\right|x\left|\right)$.

Here, we are interested in the connection between Kolmogorov complexity and the study of one-way functions, a line of work first considered in [10,11]. In these works, the Kolmogorov complexity of x given $f\left(x\right)$, ${\mathsf{K}}^t\left(x\right|f\left(x\right))$, is studied as a measure of how hard it is to invert $f\left(x\right)$ to obtain x. From this, several variants of ${\mathsf{K}}^t\left(x\right|f\left(x\right))$ are analyzed, namely ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n),$ where r is a random string $r\in {\Sigma }^{t\left(n\right)}$ used to model access to a random coin and n is the size of x. The authors provided a partial characterization of strong and weak one-way functions based on the expected value of ${\mathsf{K}}_f^{tlogt}\left(x\right|f\left(x\right),r,n)$, i.e., of the time-bounded Kolmogorov complexity of the pre-image x of length n given the value of $f\left(x\right)$ and a random string r. In particular, they prove that if $\mathbb{E}[{\mathsf{K}}_f^{tlogt}\left(x\right|f\left(x\right),r,n)]>c$ for any positive constant c and polynomial t, then f is a weak one-way function, and, if f is a strong one-way function, then $\mathbb{E}[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)]>clogn$ for every constant c and polynomial t. The converse implications were left open. Furthermore, based on the difference between ${\mathsf{K}}_f^t\left(x\right|r,n)$ and ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n),$ they proposed an individual approach characterization to one-way functions. In this paper, we show in Proposition 4 that the expected value approach cannot be used to fully characterize the class of strong one-way functions. Moreover, we provide a sufficient condition under which Kolmogorov one-way functions (as defined in [11]) are weak one-way functions.

Pursuing the idea of having a full classification of classes of one-way functions using Kolmogorov based measures, we give alternative characterizations of one-way functions based on time-bounded Kolmogorov complexity. As the main contribution of this paper, we define several classes of functions, namely Kolmogorov strong and weak one-way functions and show that these are equivalent to the usual notions of strong and weak one-way functions.

The paper is organized as follows: in Section 2, we recall the definitions of one-way functions and some known results, as well as the basics on Kolmogorov complexity; in Section 3.1, we define Kolmogorov weak/strong one-way functions and show that they are equivalent to weak and strong one-way functions, respectively; in Section 3.2, we show that the expected value of ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)$ is not enough to characterize strong one-way functions; in Section 3.3, we define Kolmogorov $\Delta$-functions and establish their relationship with weak one-way functions; finally, in Section 4, we conclude the paper.

2. Preliminaries

2.1. One-Way Functions

We begin by recalling the usual definitions of honest one-way functions that are used in the literature, and by stating some known results relating these classes of functions. Throughout the paper, we assume one-way functions are honest. Furthermore, we only consider injective one-way functions. We denote by $\Sigma$ the set with 0 and 1, thus making ${\Sigma }^{*}$ the alphabet of all finite binary strings and ${\Sigma }^n$ the set of strings of size n. In the next definitions, we use the adapt the definitions presented in [1] and that were considered in [11].

Definition 1

(Weak one-way function (as in [11]). A function $f:{\Sigma }^{*}\to {\Sigma }^{*}$ is aweak one-way function ($\mathsf{wowf}$)if the following conditions hold:

• There is a deterministic polynomial time algorithm $\mathsf{A}$ such that on input x, $\mathsf{A}$ outputs $f\left(x\right)$, i.e., $\mathsf{A}\left(x\right)=f\left(x\right).$
• For any polynomial $t(·)$, there is a polynomial $q(·)$ such that, for any probabilistic t-time bounded algorithm $\mathsf{B}$ and sufficiently large n,

  $${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[f\left(\mathsf{B}\right(f\left(x\right),r,n\left)\right)\ne f\left(x\right)\right]>\frac{1}{q\left(n\right)}·$$

  (1)

Definition 2 

(Strong one-way function (as in [11]). A function $f:{\Sigma }^{*}\to {\Sigma }^{*}$ is astrong one-way function ($\mathsf{sowf}$)if the following conditions hold:

• There is a deterministic polynomial time algorithm $\mathsf{A}$ such that on input x, $\mathsf{A}$ outputs $f\left(x\right)$, i.e., $\mathsf{A}\left(x\right)=f\left(x\right)$.
• For any polynomial $t(·)$, for every positive polynomial $q(·)$, for any probabilistic t-time bounded algorithm $\mathsf{B}$, and for sufficiently large n,

  $${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[f\left(\mathsf{B}\right(f\left(x\right),r,n\left)\right)=f\left(x\right)\right]<\frac{1}{q\left(n\right)}·$$

  (2)

The following results are well known: weak one-way functions exist iff strong one-way functions exist; if f is a strong one-way function, then f is a weak one-way function.

2.2. Kolmogorov Complexity

We start by presenting the basics on Kolmogorov complexity that will be used throughout the paper. We refer the reader to [12] for an extensive overview of the topic. Throughout the paper, we assume a fixed prefix-free Turing machine as a model of computation. It is worthwhile mentioning that the choice of such machine only affects the results by constant terms.

Definition 3 (Kolmogorov complexity of a string).

Given a universal Turing machine U with access to an oracle f, for any strings $x,y\in {\Sigma }^{*}$, we define the Kolmogorov complexity of x given input y as the length of the smallest program that given y outputs x with access to an oracle f, i.e.,

$${\mathsf{K}}_f\left(x\right|y)=\underset{p}{min}\left\{\left|p\right|:U_f(p,y)=x\right\}.$$

(3)

For any time constructible function t, the t-time bounded Kolmogorov complexity of x given y with oracle access to f is

$${\mathsf{K}}_f^t\left(x\right|y)=\underset{p}{min}\left\{\left|p\right|:U_f(p,y)=xinatmostt\left(\right|x\left|\right)steps\right\}.$$

(4)

Intuitively, the larger the term ${\mathsf{K}}_f^t\left(x\right|y)$ is, the harder it is to obtain x given y. This motivates the use of ${\mathsf{K}}_f^{\mathsf{poly}}\left(x\right|f\left(x\right))$ to measure how hard it is to invert $f\left(x\right)$ and obtain x given polynomial time. Furthermore, in this notion, we can easily mimic the behavior of a stronger adversary, say a probabilistic polynomial time machine, by considering ${\mathsf{K}}_f^{\mathsf{poly}}\left(x\right|f\left(x\right),r,n),$ where r is a random string in ${\Sigma }^{t\left(n\right)}$ and n is the size of x.

We recall some results from [11] that already establish connections between strong and weak one-way functions and time-bounded Kolmogorov complexity. There, the authors were able to characterize what happens to ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r)$, on average, when f is a sowf.

Theorem 1 ([11]).

Let f be an injective and polynomial time computable function.

If f is a strong one-way function, then for every constant c and polynomial $t(·)$, the expected value of ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)$ over pairs $(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}$ is larger than $clogn$ for every sufficiently large n.

For the other direction, it is only known that if the expected value of ${\mathsf{K}}_f^{tlogt}\left(x\right|f\left(x\right),r,n)$ is greater than c for any constant c, then f is a wowf.

Theorem 2 ([11]).

Let f be an injective and polynomial time computable function. If, for every polynomial $t(·)$ and for every constant c, the expected value of ${\mathsf{K}}_f^{tlogt}\left(x\right|f\left(x\right),r,n)$ over pairs $(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}$ is larger than c for sufficiently large n, then f is a weak one-way function.

These results are summarized in the following diagram, where arrows represent known consequences:

$$\begin{array}{cc}\hfill fis\mathsf{sowf}& \stackrel{}{\to }fis\mathsf{wowf},\hfill \\ \hfill fis\mathsf{sowf}& \stackrel{}{\to }\mathbb{E}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\right]>clogn,\hfill \\ \hfill \mathbb{E}\left[{\mathsf{K}}_f^{tlogt}\left(x\right|f\left(x\right),r,n)\right]>c& \stackrel{}{\to }fis\mathsf{wowf}.\hfill \end{array}$$

It was left open whether one could use the approach of expected value of ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)$ to fully characterize the classes of weak and strong one-way functions. Here, we provide a partial negative answer, and show that if, for all constants c, $\mathbb{E}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\right]>clogn$, then this does not imply that f is a strong one-way function, by providing a wowf that is not a sowf that satisfies this requirement.

Furthermore, we show that this result generalizes and show that if a strong one-way function f has $\mathbb{E}[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)]\in \mathcal{O}\left(p\left(n\right)\right)$, for some function $p(·)$, there exists a weak one-way function g (which is not strong one-way) such that $\mathbb{E}\left[{\mathsf{K}}_g^t\left(x\right|g\left(x\right),r,n)\right]\in \mathcal{O}\left(p\left(n\right)\right)$. These results show that a characterization of strong one-way functions solely based on the expected values should not be possible.

In the sequel, we propose alternative definitions that solve these issues, giving a Kolmogorov complexity characterization of one-way functions. We define Kolmogorov weak and strong one-way functions (Kw and Ks) and Kolmogorov $\Delta$-weak and strong one-way functions ($\mathsf{K}\Delta -\mathsf{w}$ and $\mathsf{K}\Delta -\mathsf{s}$) and show the following equivalences (⟷) and implications (⟶):

$$\begin{array}{cc}fis\mathsf{Ks}⟷fis\mathsf{sowf}\hfill & fis\mathsf{K}\Delta -\mathsf{s}⟶fis\mathsf{K}\Delta -\mathsf{w}\hfill \\ fis\mathsf{Kw}⟷fis\mathsf{wowf}\hfill & fis\mathsf{K}\Delta -\mathsf{w}⟶fis\mathsf{wowf}.\hfill \end{array}$$

3. Results

3.1. Kolmogorov Characterization of One-Way Functions

Here, we propose a definition of classes of functions (Kolmogorov weak and Kolmogorov strong) solely based on the fraction of strings $(x,r)$ for which ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\le c$, for a constant c. This is motivated by the fact that if ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\le c$, then it is enough to run all programs of size up to c for time $t\left(n\right)$ and check (using the oracle for f) which one returns the inverse of $f\left(x\right)$. In the sequel, we will show that these classes coincide with the classical classes of weak and strong one-way functions.

Definition 4 (Kolmogorov weak one-way function).

Let $f:{\Sigma }^{*}\to {\Sigma }^{*}$ be an injective polynomial time computable function. We say that f is a Kolmogorov weak one-way function if for every polynomial $t(·)$, there is a polynomial $q(·)$ such that, for all positive integers c and sufficiently large n, we have

$${\mathbb{P}}_{(x,r)\in {\Sigma }^{n+t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\le c\right]\le 1-\frac{1}{q\left(n\right)}.$$

(5)

This definition is analogous to the one of weak one-way functions, but here we bound the probability that the polynomially time-bounded Kolmogorov complexity of inverting $f\left(x\right)$ is a constant.

Proposition 1.

A function f is a Kolmogorov weak one-way function iff f is an injective weak one-way function.

Proof. 

$(\to )$ Suppose by contraposition that f is not a weak one-way function. Then, there is a polynomial t such that, for all polynomials q, there is a probabilistic t-time bounded algorithm $\mathsf{B}$ such that, for infinitely many ns, ${\displaystyle {\mathbb{P}}_{(x,r)\in {\Sigma }^{n+t\left(n\right)}}\left[f\left(\mathsf{B}\right(f\left(x\right),r,n\left)\right)=f\left(x\right)\right]>1-\frac{1}{q\left(n\right)}.}$

Let C be the size of the program $\mathsf{B}$. Then, we know that

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\le C]>1-\frac{1}{q\left(n\right),}$$

(6)

which means f cannot be a Kolmogorov weak one-way function.

$(\leftarrow )$ Suppose by contraposition that f is not a Kolmogorov weak one-way function. Then, there is a polynomial $t(·)$ such that, for all polynomials $q(·),$ there is a constant C such that, for infinitely many ns, we have

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\le C\right]>1-\frac{1}{q\left(n\right)}.$$

(7)

Now, consider the algorithm $\mathsf{A}$ that given the inputs $f\left(x\right)\in {\Sigma }^n$, $r\in {\Sigma }^{t\left(n\right)}$ and $n=\left|x\right|$ constructs all strings (which are seen as programs) of size C, runs them for time $t\left(n\right)$ and then checks using the oracle for f if the obtained result is indeed x. This algorithm runs in time $T\left(n\right)=2^{C}t\left(n\right)$ for inputs of size n (which is a polynomial on n) and for infinitely many ns, inverts a fraction of the inputs larger than $1-1/q\left(n\right)$. Therefore, by construction,

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{T\left(n\right)}}\left[f\left(\mathsf{A}\right(f\left(x\right),r,n\left)\right)=f\left(x\right)\right]>1-\frac{1}{q\left(n\right)},$$

(8)

which means that f is not a weak one-way function. ☐

We now define the class of Kolmogorov strong one-way functions. This class, as we will show, coincides with the class of strong one-way functions.

Definition 5 (Kolmogorov strong one-way function).

Let $f:{\Sigma }^{*}\to {\Sigma }^{*}$ be an injective polynomial time computable function. We say that f is a Kolmogorov strong one-way function if for every polynomials $t(·)$ and $q(·)$, positive integer c and sufficiently large n, we have

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)<c\right]\le \frac{1}{q\left(n\right)}.$$

(9)

Proposition 2.

A function f is a Kolmogorov strong one-way function iff f is a strong one-way function.

Proof. 

$(\to )$ Suppose by contraposition that f is not a strong one-way function. Then, there is a probabilistic t-time bounded algorithm $\mathsf{B}$ and a polynomial q such that

$${\mathbb{P}}_{(x,r)\in {\Sigma }^{n+t\left(n\right)}}\left[f\left(\mathsf{B}\right(f\left(x\right),r,n\left)\right)=f\left(x\right)\right]\ge \frac{1}{q\left(n\right)}.$$

(10)

Thus,

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)<\left|B\right|\right]\ge \frac{1}{q\left(n\right)},$$

(11)

which means f cannot be a Kolmogorov strong one-way function.

$(\leftarrow )$ Suppose by contraposition that f is not a Kolmogorov strong one-way function. Then, there are polynomials $t(·),q(·)$ and a constant C such that

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)<C\right]\ge \frac{1}{q\left(n\right)}.$$

(12)

Now, consider the algorithm $\mathsf{A}$ that given $x\in {\Sigma }^n$ constructs all strings of size C runs them for time $t\left(n\right)$ and then checks using the oracle for f if the obtained result is indeed x. This algorithm runs in time $T\left(n\right)=2^{C}t\left(n\right)$ for inputs of size n and inverts a fraction of the inputs larger than $1/q\left(n\right)$. Thus,

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{T\left(n\right)}}\left[f\left(\mathsf{A}\right(f\left(x\right),r,n\left)\right)=f\left(x\right)\right]\ge \frac{1}{q\left(n\right)},$$

(13)

meaning that f is not a strong one-way function. ☐

3.2. Expected Value Approach

In this section, we show that a characterization of strong one-way functions via the expected value of ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)$ is not possible. In particular, we show that if a strong one-way function f is such that the expected value of ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)$ is of order $\Omega \left(p\right(n\left)\right)$ for some function p, then there is a weak one-way function g (which is not strong one-way function) such that the expected value of ${\mathsf{K}}_g^t\left(x\right|g\left(x\right),r,n)$ is also of order $\Omega \left(p\right(n\left)\right)$.

We will also use the notion of first-bit secure function, which intuitively is a function that inverting, knowing the first-bit of the pre-image, is as hard as inverting the function by itself. In a way, this guarantees that the complexity of inverting strings in the sets $\left\{0\right\}\times {\Sigma }^{n-1}$ and $\left\{1\right\}\times {\Sigma }^{n-1}$ is similar.

Definition 6 (First-bit secure function).

We say that a function f is first-bit secure if for sufficiently large n and $x\in {\Sigma }^{n-1}$

$${\mathsf{K}}_f^t\left(0x\right|f\left(0x\right))={\mathsf{K}}_f^t\left(1x\right|f\left(1x\right)).$$

(14)

We now show that, if we assume the existence of first-bit secure strong one-way functions, there are weak one-way functions that are not strong. To see this, consider the function

$$f=\lambda x.\left\{\begin{array}{c}1g\left(x\right),\mathrm{if} x=1y,\hfill \\ x,\mathrm{if} x=0y,\hfill \end{array}\right.$$

(15)

where g is a strong one-way function that is first-bit secure. Then, f is a weak one-way function but not a strong one-way function since,

• given input x, its output is given either by the identity function or by g, which are both polynomial time computable;
• we can easily deterministically invert half of the inputs and so there is an algorithm, e.g., the first projection $\Pi =\lambda x,y,z.x$ such that,

  $${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[f(\Pi (f\left(x\right),r,n\left)\right)=f\left(x\right)\right]\ge 1/2,$$

  (16)

  and thus f is not a strong one-way function;
• on the other hand, since $g(·)$ is a strong one-way function, for any polynomial $q(·)$ and any algorithm $\mathsf{B}$,

  $${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[f\left(\mathsf{B}\right(g\left(x\right),r,n\left)\right)=g\left(x\right)\right]<\frac{1}{q\left(n\right)},$$

  (17)

  and so the same projection algorithm $\Pi$ is such that

  $${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[f(\Pi (f\left(x\right),r,n\left)\right)=f\left(x\right)\right]<\frac{1}{2}+\frac{1}{2q\left(n\right)},$$

  (18)

  which means that

  $${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[f(\Pi (f\left(x\right),r,n\left)\right)\ne f\left(x\right)\right]>1-\left(\frac{1}{2}+\frac{1}{2q\left(n\right)}\right)=p\left(n\right),$$

  (19)

  and thus, taking $s\left(n\right)=1/p\left(n\right)$, ${\displaystyle {\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[f(\Pi (f\left(x\right),r,n\left)\right)\ne f\left(x\right)\right]>\frac{1}{s\left(n\right)}}$, i.e., f is a weak one-way function.

Having this construction in mind, we can show the following result:

Proposition 3.

Assuming the existence of one-way functions, there exists a weak one-way function f (which is not a strong one-way function) such that for any constant c and sufficiently large n, $\mathbb{E}\left[{\mathsf{K}}_f^t\left(x\left|f\right(x),r,n\right)\right]>clogn.$

Proof. 

Consider the function f defined above in Label (15). Furthermore, recall from Theorem 1 that, if g is a strong one-way function, then, for any positive integer c and for any sufficiently large n, $\mathbb{E}\left[{\mathsf{K}}_f^t\left(x\right|g\left(x\right),r,n)\right]>clogn$, where n is the size of x. In addition, notice that since g in the definition of f is a first-bit secure function, it also holds that $\mathbb{E}\left[{\mathsf{K}}_f^t\left(1y\right|g\left(1y\right),r,n)\right]>clogn$ for y of size $n-1$ for sufficiently large ns. Then,

$$\begin{array}{ccc}\hfill \mathbb{E}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\right]& =& \sum _{x\in {\Sigma }^n}p\left(x\right){\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\hfill \end{array}$$

(20)

$$\begin{array}{cc}=& \sum _{x\in \left\{0\right\}\times {\Sigma }^{n-1}}p\left(x\right){\mathsf{K}}_f^t\left(x\left|f\right(x),r,n\right)+\sum _{x\in \left\{1\right\}\times {\Sigma }^{n-1}}p\left(x\right){\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\hfill \end{array}$$

(21)

$$\begin{array}{cc}=& \sum _{x\in \left\{0\right\}\times {\Sigma }^{n-1}}p\left(x\right){\mathsf{K}}_f^t\left(x\right|x,r,n)+\sum _{x\in \left\{1\right\}\times {\Sigma }^{n-1}}p\left(x\right){\mathsf{K}}_f^t\left(x\right|g\left(x\right),r,n)\hfill \end{array}$$

(22)

$$\begin{array}{cc}>& c+\frac{1}{2}{c}^{\prime }logn\hfill \end{array}$$

(23)

$$\begin{array}{cc}>& (c+1)logn.\hfill \end{array}$$

(24)

 ☐

From the discussion above, we derive the following corollary.

Corollary 1.

Let f be such that $\mathbb{E}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\right]>clogn$. Then, f is not necessarily a strong one-way function.

It is worthwhile mentioning that the proof of Proposition 3 can be generalized to a possible characterization of a sowf given by $\mathbb{E}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\right]\in \Omega \left(p\left(n\right)\right)$:

Proposition 4.

If f is a strong one-way function that is first-bit secure and $\mathbb{E}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\right]\in \Omega \left(p\left(n\right)\right)$ for some function $p(·),$ then there exists a weak one-way function g that is not a strong one-way function such that $\mathbb{E}\left[{\mathsf{K}}_g^t\left(x\right|g\left(x\right),r,n)\right]\in \Omega \left(p\left(n\right)\right).$

This result implies that the expected value of ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)$ is not enough to fully characterize strong one-way functions that are not weak one-way functions.

3.3. Kolmogorov $\Delta$-Characterization of One-Way Functions

In this section, we provide new results regarding the characterization of one-way functions using the complexity of x versus the complexity of x given $f\left(x\right)$. If these terms are very close to each other (i.e., their difference is small), we can conclude that $f\left(x\right)$ does not reveal much information about its pre-image x, as one would expect from one-way functions. Results about this notion were proved in [11] where Kolmogorov one-way functions were introduced. We begin by providing a condition under which Kolmogorov one-way functions are weak one-way functions. Following this, we introduce the classes of Kolmogorov $\Delta$-strong and $\Delta$-weak one-way functions and relate them with weak one-way functions.

Recall the following notions introduced in [11].

Definition 7

($(t,\epsilon ,\delta )$-secure Kolmogorov one-way function, [11]). Let $t(·)$ be a polynomial, $f:{\Sigma }^n\to {\Sigma }^m$ an injective and polynomial time computable function and $\delta (·)$ a positive function. We say that an instance $x\in {\Sigma }^n$ is $(t,\delta )$-secure relative to a random string $r\in {\Sigma }^{t\left(n\right)}$ and f if

$${\mathsf{K}}_f^t\left(x\right|r,n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\le \delta \left(n\right).$$

(25)

Let $\epsilon (·)$ be a function. We say that f is a $(t,\epsilon ,\delta )$- secure Kolmogorov one-way function if, for sufficiently large n,

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|r,n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)>\delta \left(n\right)\right]\le \epsilon \left(n\right).$$

(26)

In due course, we will use the following result from [11].

Corollary 2 

([11]). Let $t(·)$ be a polynomial. If f is a $(t,\epsilon ,\delta )$-secure Kolmogorov one-way function such that

$${\displaystyle \underset{n\to \infty }{lim}\left((1-\epsilon (n\left)\right)·(n-logn-\delta (n\left)\right)-2\right)=+\infty ,}$$

then f is a weak one-way function.

We also recall the notion of Kolmogorov one-way function from [11].

Definition 8 

(Kolmogorov one-way function, [11]). Let $f:{\Sigma }^{*}\to {\Sigma }^{*}$ be an injective polynomial time computable function. We say that f is a Kolmogorov one-way function if for every polynomial $t(·)$, positive integer c, sufficiently large n, and x of length n,

$${\mathsf{K}}_f^t\left(x\right|n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),n)\le clogn.$$

In [11], it was shown that, if f is a Kolmogorov one-way function, then it is a deterministic one-way function (which is a weak one-way function where the adversary only has deterministic computational power and is not probabilistic). However, relating this notion to weak or strong one-way functions seems a hard task given that, in the definition of Kolmogorov one-way functions, there is not any randomness parameter.

However, we now show that Kolmogorov one-way functions are indeed weak one-way functions when a condition on the amount of information given by randomness is fulfilled.

Proposition 5.

Let f be a Kolmogorov one-way function. If there is a constant ε with $0<\epsilon <1$ and a positive function $\gamma (·)$ such that, for sufficiently large n,

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)>n^{\epsilon }\right]\le \gamma \left(n\right),$$

where ${\displaystyle \underset{n\to \infty }{lim}\gamma \left(n\right)=\ell <1}$, then f is a weak one-way function.

Proof. 

Let f be a Kolmogorov one-way function. Then,

$$\begin{array}{cc}\hfill {\mathsf{K}}_f^t\left(x\right|r,n)-& {\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\le {\mathsf{K}}_f^t\left(x\right|n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\hfill \\ \hfill \le & {\mathsf{K}}_f^t\left(x\right|n)+\left({\mathsf{K}}_f^t\left(x\right|f\left(x\right),n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),n)\right)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\hfill \\ \hfill \le & clogn+{\mathsf{K}}_f^t\left(x\right|f\left(x\right),n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)\hfill \\ \hfill \le & clogn+n^{\epsilon }\mathrm{with} \mathrm{probability} \mathrm{greater} \mathrm{than}1-\gamma \left(n\right).\hfill \end{array}$$

This means that

$$\begin{array}{cc}\hfill {\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}& \left[{\mathsf{K}}_f^t\left(x\right|r,n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)>clogn+n^{\epsilon }\right]\le \gamma \left(n\right),\hfill \end{array}$$

and so we conclude that f is a $(t,\gamma \left(n\right),clogn+n^{\epsilon })$-secure Kolmogorov one-way function.

Using Corollary 2, consider the limit

$$\begin{array}{c}\hfill {\displaystyle \underset{n\to \infty }{lim}(\underset{\mathrm{goes}\mathrm{to}1-\ell >0}{\underbrace{(1-\gamma (n\left)\right)}}·\underset{\mathrm{goes}\mathrm{to}\infty }{\underbrace{(n-logn-clogn-n^{\epsilon })}}-2),}\end{array}$$

which goes to infinity. Thus, f is a weak one-way function. ☐

Corollary 3.

Let f be a Kolmogorov one-way function. If there is a polynomial $q(·)$ and a constant c such that, for sufficiently large n, we have

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[{\mathsf{K}}_f^t\left(x\right|f\left(x\right),n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)>clogn\right]\le \frac{1}{q\left(n\right)},$$

then f is a weak one-way function.

As we have seen, the notion of Kolmogorov one-way function proposed in [11] lacks the link with the probabilistic features of weak and strong one-way functions, and thus we had to impose a condition relative to how much a random input helps when inverting a function.

We now consider Kolmogorov $\Delta$-weak one-way functions, which already include probabilistic notions in their definition. For this, let

$$\Delta \left(x\right|f\left(x\right),r,n):={\mathsf{K}}_f^t\left(x\right|n)-{\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n).$$

Definition 9 (Kolmogorov Δ-weak one-way function).

Let $f:{\Sigma }^{*}\to {\Sigma }^{*}$ be an injective polynomial time computable function. We say that f is aKolmogorov $\Delta$-weak one-way function if, for every polynomial $t(·)$, there is a function $\gamma \left(n\right)$ and a positive ε with $0<\epsilon <1$ such that, for sufficiently large n,

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[\Delta \left(x\right|f\left(x\right),r,n)>n^{\epsilon }\right]\le \gamma \left(n\right),$$

where ${\displaystyle \underset{n\to \infty }{lim}\gamma \left(n\right)<1.}$

With this notion, we are able to prove unconditionally that Kolmogorov $\Delta$-weak one-way functions are indeed weak one-way functions. This is a direct consequence of Proposition 5.

Proposition 6.

If f is a Kolmogorov Δ-weak one-way function, then f is a weak one-way function.

We can then strengthen this notion by considering a logarithmic bound on the $\Delta$ term. The choice of parameters for the $\Delta$-weak one-way function was an immediate consequence of Proposition 5 where we analyzed the minimum probability that the help of randomness could provide describing x from $f\left(x\right)$ in order to still have a Kolmogorov weak-one-way function (and therefore a weak-one function). Since any strong one-way function is a weak one-way function, then the condition for $\Delta$-strong one-way function must be stronger and therefore we have to consider reasonable tighter parameter functions.

Definition 10 (Kolmogorov Δ-strong one-way function).

Let $f:{\Sigma }^{*}\to {\Sigma }^{*}$ be an injective polynomial time computable function. We say that f is aKolmogorov $\Delta$-strong one-way function if, for every polynomial $t(·),$ there is a function $\gamma \left(n\right)$ and a constant c such that, for sufficiently large n,

$${\mathbb{P}}_{(x,r)\in {\Sigma }^n\times {\Sigma }^{t\left(n\right)}}\left[\Delta \left(x\right|f\left(x\right),r,n)>clogn\right]\le \gamma \left(n\right),$$

(27)

where ${\displaystyle \underset{n\to \infty }{lim}\gamma \left(n\right)<1.}$

We can easily see that a Kolmogorov $\Delta$-strong one-way function is a Kolmogorov $\Delta$-weak one-way function since

$${\mathbb{P}}_{(x,r)}\left[\Delta \left(x\right|f\left(x\right),r)>n^{\epsilon }\right]<{\mathbb{P}}_{(x,r)}\left[\Delta \left(x\right|f\left(x\right),r)>clogn\right]\le \gamma \left(n\right).$$

(28)

Corollary 4.

If f is a Kolmogorov Δ-strong one-way function, then f is a weak one-way function.

Despite showing that Kolmogorov $\Delta$-strong one-way functions are indeed stronger than Kolmogorov $\Delta$-weak one-way functions, and that Kolmogorov $\Delta$-weak one-way functions are weak one-way functions, the relationship between Kolmogorov $\Delta$-strong one-way functions and strong one-way functions is not clear.

4. Conclusions

The aim of this work was to use Kolmogorov complexity based measures in order to understand the classes of strong and weak one-way functions. For this, we introduced alternative characterizations of one-way functions based on time-bounded Kolmogorov complexity. In particular, we introduced Kolmogorov $\Delta$-functions and Kolmogorov weak and strong functions. The latter were shown to be equivalent to the class of weak and strong one-way functions, respectively. Furthermore, we showed that we cannot characterize strong one-way functions with the average value of ${\mathsf{K}}_f^t\left(x\right|f\left(x\right),r,n)$. We also provided a sufficient condition under which Kolmogorov one-way functions are weak one-way functions. From this, we proposed Kolmogorov $\Delta$-strong and $\Delta$-weak one-way functions that already encompass this condition. We were, however, not able to establish relations between Kolmogorov $\Delta$ functions and strong one-way functions, which we find would be an interesting problem to solve as future work.

In [13], the author proposed a unified approach to one-way function and conjectured that, given any one-way function f, the function $g(x,x)=(a,f(x)+ax)$ is also a one way function. In particular, if f is defined over a finite field, then g is a one-way permutation and therefore suitable to be used in the quantum realm. Capitalizing on this approach, de Castro [14] considered for one-way function the function $x^2\mathsf{xor}x\mathsf{xor}1$ and exploited the quantum properties of such a construction proving that if such function is indeed a one-way function then quantum one-way functions also exist. With this two papers in mind, as a future work, it is interesting to:

• Develop a specialized Kolmogorov complexity approximation (similar to a zip compressor) that allows the analysis of this function towards the definition proposed in this paper. This would allow to give, not just for this particular function, but also to any other possible proposal for a one-way function, a practical security analysis regarding its one-wayness.
• The analyses driven in [14] proves that quantum one-way functions exist if and only if classical one-way functions exist and the techniques used to derive the (quantum) security of such functions are different form the classical ones. In the literature, there are several definitions of (bounded) quantum Kolmogorov complexity [15,16,17,18,19,20] . One can study the adaptation of the results presented in this paper to address directly the characterization of one way-functions that are quantum resilient and provide insight regarding some (quantum) one-way function candidates such as the one presented in [14].