Beyond Hellman’s time-memory trade-offs with applications to proofs of space Conference Paper

Author(s): Abusalah, Hamza; Alwen, Joël; Cohen, Bram; Khilko, Danylo; Pietrzak, Krzysztof; Reyzin, Leonid
Title: Beyond Hellman’s time-memory trade-offs with applications to proofs of space
Title Series: LNCS
Affiliation IST Austria
Abstract: Proofs of space (PoS) were suggested as more ecological and economical alternative to proofs of work, which are currently used in blockchain designs like Bitcoin. The existing PoS are based on rather sophisticated graph pebbling lower bounds. Much simpler and in several aspects more efficient schemes based on inverting random functions have been suggested, but they don’t give meaningful security guarantees due to existing time-memory trade-offs. In particular, Hellman showed that any permutation over a domain of size N can be inverted in time T by an algorithm that is given S bits of auxiliary information whenever (Formula presented). For functions Hellman gives a weaker attack with S2· T≈ N2 (e.g., S= T≈ N2/3). To prove lower bounds, one considers an adversary who has access to an oracle f: [ N] → [N] and can make T oracle queries. The best known lower bound is S· T∈ Ω(N) and holds for random functions and permutations. We construct functions that provably require more time and/or space to invert. Specifically, for any constant k we construct a function [N] → [N] that cannot be inverted unless Sk· T∈ Ω(Nk) (in particular, S= T≈ (Formula presented). Our construction does not contradict Hellman’s time-memory trade-off, because it cannot be efficiently evaluated in forward direction. However, its entire function table can be computed in time quasilinear in N, which is sufficient for the PoS application. Our simplest construction is built from a random function oracle g: [N] × [N] → [ N] and a random permutation oracle f: [N] → N] and is defined as h(x) = g(x, x′) where f(x) = π(f(x′)) with π being any involution without a fixed point, e.g. flipping all the bits. For this function we prove that any adversary who gets S bits of auxiliary information, makes at most T oracle queries, and inverts h on an ϵ fraction of outputs must satisfy S2· T∈ Ω(ϵ2N2).
Conference Title: ASIACRYPT: Theory and Applications of Cryptology and Information Security
Volume: 10625
Conference Dates: December 3 - 7, 2017
Conference Location: Hongkong, China
ISBN: 978-331970696-2
Publisher: Springer  
Date Published: 2017-01-01
Start Page: 357
End Page: 379
Sponsor: Hamza Abusalah, Joël Alwen, and Krzysztof Pietrzak were supported by the European Research Council, ERC consolidator grant (682815 - TOC-NeT).
DOI: 10.1007/978-3-319-70697-9_13
Open access: yes (repository)
IST Austria Authors
  1. Joel Alwen
    13 Alwen
Related IST Austria Work