Extractability, or "knowledge," assumptions have recently gained popularity in the cryptographic community, leading to the study of primitives such as extractable one-way functions, extractable hash functions, succinct non-interactive arguments of knowledge (SNARKs), and differing-inputs obfuscation (diO), and spurring the development of a wide spectrum of new applications relying on these primitives. For most of these applications, it is required that the extractability assumption holds even in the presence of attackers receiving some auxiliary information that is sampled from some fixed efficiently computable distribution Z. We show that, assuming the existence of collision-resistant hash functions, there exist efficient distributions Z, D such that either • extractable one-way functions w.r.t. auxiliary input Z do not exist, or • diO for a distribution of Turing machines and auxiliary input specified by D does not exist. A corollary of this result shows that assuming existence of fully homomorphic encryption with decryption in N C 1 , there exist efficient distributions Z, D such that either *
Boyle and Pass REF strengthen this result further by showing a pair of (universal) distributions Z,Z' on auxiliary information such that either extractable OWF w.r.t.
Limits of Extractability Assumptions with Distributional Auxiliary Input
ASIACRYPT
Computer Science Mathematics