Talk:One-way function

message: I'd like some extra clarification introducing the topic. If a one-way-function means a function that is not reversible, it could be as simple as IsEven(int)->bool - you cannot recreate the input integer from it's output. Could someone please clarify how a one-way function differs from this? --198.160.96.7 (talk) 21:15, 11 April 2013 (UTC)
replies: text: It is actually reversible but prohibitively so. It's an important detail because it means it can be used in cryptography as opposed to basically destroying the input but zero-ing it. Utopiah (talk) 08:01, 18 May 2023 (UTC)
replies: text: See https://en.wikipedia.org/wiki/Trapdoor_function Utopiah (talk) 08:02, 18 May 2023 (UTC)
thread_title: Clarification

message: The formal definition of "strong one-way function" is incomplete, because it refers to a "probabilistic polynomial-time algorithm" A' without defining what this is, so that when A' gets used in the expression
:A'(f(U_n),1^n)
it's not clear what's going on.  I tried to partially cure this by adding a link to "random algorithm" (since this is where a query about "probabilistic algorithm" got redirected).   Alas, it's not a complete cure, since that article does not give a formal definition of probabilistic algorithm.
Since I've studied this subject a wee bit, I can guess that a probabilistic algorithm takes two inputs: the "actual" input and also an auxiliary random string.  So, I can guess that these are the two arguments of A' above.  But the discussion after the definition seems to be saying that the role of 1^n is just to tell A' the length of the string it's trying to compute.  So maybe the auxiliary random string is completely implicit in the above expression??
A clear definition of "probabilistic algorithm", or a link to one, would not have made me guess so much.  
The worst thing is, I really need to know the definition TODAY!  :-)
John Baez 09:47, 10 February 2006 (UTC)
replies: text: See Probabilistic Turing machine. Could be better named. Deco 11:59, 10 February 2006 (UTC)

text: The auxiliary string isn't so much to inform the algorithm, it's simply to enforce a minimum length on the input. This is important because we defined the algorithm as working in polynomial time (implicitly tied to input length), but we actually just want the full f∘A'∘f to work in polynomial time, and the size of the input to f can dominate the size of the input to A'. I've removed the auxiliary string from the definition and added language instead, to reduce confusion. 88.115.207.64 (talk) 17:48, 29 October 2015 (UTC)
thread_title:  The formal definition is incomplete 

message: This article needs an early explanation about whether it is the same as a trapdoor function or not, and whether it can in theory be inverted at all (i.e. whether it is an injective function) - the hash function function suggests no, but this article seems to suggest yes. --Henrygb 23:07, 6 March 2006 (UTC)
thread_title: Other types of function

message: I'm not sure if it's appropriate to ask a question like this on a wikipedia talk page (rather than a discussion forum), but: If I understand correctly, f^-1(f(x)) = x for all x. If, for example, we have f(x) = x mod 5, surely there's no possible f^-1? f(5), f(10), f(15) etc. all = 0, so how can it be possible to construct an inverse function that can correctly return either of these original values for the input 0? In other words: what's the difference between a one-way function and a non one-to-one function? I assume that there must in fact be some difference, because of the assertion in the article that mathematicians aren't sure whether true one-way functions exist (so either I'm wrong about what one-way functions are, the article is wrong about what mathematicians think, or I've somehow made a groundbreaking discovery (ha, ha)). - SoulSkorpion 08:05, 11 June 2006 (UTC)
replies: text: You're reading too much into the definition. g(f(x))=x only says that g is a left inverse of f (not a total inverse since f may not be 1-to-1). That is, given y it returns some value z such that y=f(z). If f maps two values to y, g should return one of these two values, but we don't care which. In your example, the identity function g(x)=x is a left inverse of f(x)=x%5 Blokhead 13:50, 12 June 2006 (UTC)

text: Bah, I should check the definitions before I post... anyway, the idea is the same, but notice how f^{-1}(f(x)) is used as a set of values in the definitions, not a single-valued thing. f^{-1}(y) is the set of all x's that f maps to y. Again, the algorithm could return any one of these, we don't care which. Forget what I said about left inverses.. Blokhead 13:54, 12 June 2006 (UTC)

text: To say that "surely there's no possible f^-1" is where you went wrong. No one ever said that f was invertable, more precicely no one ever said that f had to be injective. The classes of injective and one-way functions are distinct; for a one-way function it is computationally hard to find a preimage, for a injective function preimages are unique. 129.94.6.30 00:04, 18 September 2006 (UTC)
thread_title:  Question... 

message: I'm a bit perplexed why the asymptotic time cited here is for elliptic curve factoring, rather than the number field sieve. Generally the sort of worst-case numbers used in cryptography are most efficiently factored with NFS, right? Deco 20:07, 11 June 2006 (UTC)
thread_title:  Choice of factoring algorithm? 

message: The definitions on this page of strong and weak one-way functions (and most of the text surrounding them) were clearly plagiarized (with minor modifications) from Oded Goldreich's book Foundations of Cryptography I (see pp.33-35).  Please remove them.  --- Tom Roeder, Cornell University
I've removed the text for now. I presume it is a near word-for-word copying, and not just a re-expression of the same definition? (I don't have access to Goldreich's book). — Matt Crypto 17:03, 15 September 2006 (UTC)
replies: text: A link to Goldreichs book is given at the end of the article. The definitions of strong and weak one-way functions go back to at least 1982 (e.g. an paper by Yao includes them). So the definitions can safely be inserted in the article again. Thus it seems that only the additional explanations between the definitions need to be discussed. There is nothing new there either. Just some well written text. Maybe the explanations can be left away or rewritten. I wouldn't even call the old version plagiarism, rather a case of fair use. 67.84.116.166 01:04, 17 September 2006 (UTC)
thread_title:  Plagiarized 

message: The article states that "One-way functions exist implies P \neq NP, but it's not clear if P \neq NP implies the existence of one way function." However the other direction has already been proved. See Chapter 2 of 
The Complexity Theory Companion.
-- Pku_leehsin
: Don't have that book, but if your book says "P\neqNP implies one way functions", then it's certainly talking about complexity (worst-case) one way functions, not cryptographic (average-case) one-way functions. It can get confusing, but no one really does anything with worst-case OWFs these days. Blokhead 03:09, 30 October 2006 (UTC)
replies: text: Reading the pseudocode for SHA-256, I can tell you with absolute confidence that it would.  In fact, if that code is accurate, I could write a program right now that could decrypt it in time polynomial in the length of the data and the computation time of kSAT's implementation, and I don't think I'd even need to open a book.  Twin Bird (talk) 07:28, 18 June 2011 (UTC)

text: Where?  It says "Existence of a proof that P and NP are not equal would not imply the existence of one-way functions" right in the article as it stands.  It contradicts Pku_leehsin, but not the article.  Are you confusing the assertion with its converse?  Because a proof that one-way functions exist would imply P \neq NP, and a proof that P = NP (which is about as likely as the Riemann hypothesis being false) would imply their nonexistence.  However, a proof that P \neq NP would not imply the existence of one-way functions, nor would their nonexistence imply P = NP.  Twin Bird (talk) 05:32, 18 June 2011 (UTC)
thread_title:  False statement? 

message: This article says that the existence of a one-way function implies the existence of a private-key encryption scheme.  Isn't this trivially true, due to the existence of the one-time pad?  71.194.163.223 13:50, 24 July 2007 (UTC)
replies: text: I have clarified this in the article. OWF implies private-key encryption that is secure against chosen-plaintext and chosen-ciphertext attacks. One-time pad certainly doesn't meet this, as you need a fresh key for each new message sent. Blokhead 14:53, 24 July 2007 (UTC)
thread_title:  One-Time Pad? 

message: :Note that, by this definition, the function must be "hard to invert" in the average-case, rather than worst-case sense; while in most of complexity theory (e.g., NP-hardness) the term "hard" is meant in the worst-case.
This is just confusing concepts.
"Average case", as in taking mean time across all valid inputs, as in ZPP class, is not what we want. We want something much stronger - we want inverting to be hard for overwhelming majority of cases.
For example, if we had a function f(x) which always took 4^(number of bits in x) time (under P!=NP and whatever other assumptions we need), then the function g(x) = 2*f(x) if x prime, g(x) = 2*x+1 otherwise, would still take exponential time on average to reverse (sum 4^log2(x)/ln(x)/N = sum x^2/ln(x)/N \in O(x)), but vast majority of cases would be trivially invertible, making such function useless as a one-way function. Taw (talk) 11:02, 16 September 2009 (UTC)
thread_title:  Worst case vs average case 

message: It's very hard to understand... I get the general sense from this section that there exists a function that if proved to be one way, would prove that functions can be one way. But it doesn't explain much else...  — Preceding unsigned comment added by 69.117.26.39 (talk) 00:33, 20 February 2013 (UTC)
replies: text: I have edited the section to clarify its meaning, which is that there exists a function f such that if any function is one-way, then so is f. --Joshua Issac (talk) 13:04, 29 August 2013 (UTC)
replies: text:  Still is probably the vaguest statement I have ever read on wikipedia. 128.54.162.174 (talk) 07:29, 11 December 2013 (UTC)
thread_title:  Universal one-way function section makes almost no sense 

message: Here is a one-way function that is impossible to derive its input based on outputs:  f(x)=0.  What is this article or definition missing? Average64 (talk) 19:51, 27 May 2014 (UTC)
replies: text: This example is discussed in the section "Theoretical definition". f(x)=0 is not a one-way function. Hence nothing is missing here. 92.106.209.242 (talk) 11:10, 29 May 2014 (UTC)
thread_title:  One way function proven: 

message: AFAIK, it's not O(n^2) as stated in the article.
See Fürer's algorithm, it can reach O(n\log n2^{3\log^* n}) Willrazen (talk) 19:27, 2 February 2016 (UTC)
thread_title:  Wrong integer multiplication upper bound 

message: I think it'd be a good idea to add one sentence to the header explaining that people often use the term "one-way function" to apply to functions that, while currently difficult to invert, may or may not be one-way functions under the formal definition of the term. (In fact, the articles for hash functions and cryptographic hash functions both describe them as being one-way functions.) There already is the section on "Candidates for one-way functions" but it's much further down and common alternate (albeit imprecise) usages of the term probably warrants some mention in the header. Thoughts? Jwuthe2 (talk) 11:45, 2 November 2017 (UTC)
thread_title:  Explanation/Mention of Common Imprecise Usage of "One-Way Function" 

message: The "Rabin function" (squaring modulo some two-factor integer N) is one-way only if the factorization of N is not known. For any such N, that function is easy to invert.  Thus it is not a "one-way function" but rather a "trapdoor function" (when N is included as the parameter of f and p,q as parameters of the inverse).  It should be removed and discussed only in the trapdoor function article.  --Jorge Stolfi (talk) 21:33, 15 August 2018 (UTC)
thread_title:  Rabin function is "trapdoor" not "one way" 

message: On the one hand, the article states "[...] their existence would prove that the complexity classes P and NP are not equal [..]", but on the other hand also in an other section "The existence of one-way functions also implies that there is no natural proof for P≠NP".
Are both implications true? If yes, what is the point of ever presenting the second one without the first one?  — Preceding unsigned comment added by 2A02:8070:8798:4000:80E4:FDE0:A138:9EB6 (talk) 22:46, 7 February 2020 (UTC)
replies: text: I have removed the latter ("The existence of one-way functions also implies that there is no natural proof for P≠NP") because it is ambiguous. The existence of OWF implies that P≠NP directly which is stronger than saying no natural proof exists (the statement is relying on the fact that OWF implies the existence of PRF which in turn implies that no natural proof exists). PolyCreator (talk) 02:12, 10 April 2022 (UTC)
thread_title:  Existence of one-way functions and implications to P and NP 

message: In the section Candidates for one way functions, it is stated "...because the probability that an arbitrary p is odd is 1/2, and likewise for q(...)". But since 2 is the only even prime, that seems not correct? 89.99.34.48 (talk) 07:11, 24 July 2022 (UTC)
thread_title:  Half probability that prime is even? 

message: This statement implies P != NP and is therefore currently unknown. It should therefore be removed. (If P = NP, then P != NP is false and thus trivially implies anything.) --fiesh 91.43.222.42 (talk) 23:21, 15 November 2022 (UTC)
thread_title:  "However, P≠NP does not imply the existence of one-way functions."