The strength of replacement in weak arithmetic
The replacement (or collection or choice) axiom scheme BB(Gamma) asserts bounded quantifier exchange as follows: for all i  there exists w for all i< vertical bar a vertical bar phi(i, [w](i)), for phi in the class Gamma of formulas. The theory S-2(1) proves the scheme BB(Sigma(b)(1)), and thus in S-2(1) every Sigma(b)(1) formula is equivalent to a strict Sigma(b)(1) formula (in which all non-sharply-bounded quantifiers are in front). Here we prove (sometimes subject to an assumption) that certain theories weaker than S-2(1) do not prove either BB(Sigma(b)(1)) or BB(Sigma(b)(0))(.). We show (unconditionally) that V-0 does not prove BB(Sigma(B)(0)), where V-0 (essentially I Sigma(1,b)(0)) is the two-sorted theory associated with the complexity class AC(0). We show that PV does not prove BB(Sigma(b)(0)), assuming that integer factoring is not possible in probabilistic polynomial time. Johannsen and Pollett introduced the theory C-2(0) associated with the complexity class TC0, and later introduced an apparently weaker theory Delta(b)(1)-CR for the same class. We use our methods to show that Delta(b)(1)-CR is indeed weaker than C-2(0), assuming that RSA is secure against probabilistic polynomial time attack. Our main tool is the KPT witnessing theorem.
theory pv bounded arithmetic cryptography