Conditioning on the output of a function from Universal set, find input that causes collision

19 Views Asked by At

We have a Universal set of functions that map the universe of inputs to $\mathbb{Z_{p}}$ with prime $p$, in the sense that for any two non-equal $x$ and $y$ inputs into a uniformly randomly chosen one, the probability that they collide is less than or equal to $\frac{1}{p}$.

Suppose another person knows all the functions in the Universal set, but doesn't know which one we have sampled. The question is, conditioned on the output of $x$, can they provide a $y$ that has a probability of collision with $x$ larger than $\frac{1}{p}$.

Attempt

Consider permutations of $Z_{p}$, i.e. $H = \{ h(x) = ax$ mod $p\}$ s.t. $a \in \{0, 1, ..., p-1\}$ and $x, y \in \{0, 1, ..., p-1\}$

This set is Universal, since $ax \equiv ay$ mod $p$ $\implies$ $a = 0$, since $x \neq y$, so $x-y$ has an inverse mod $p$. $P(a = 0) = \frac{1}{p}$ since $h$ is sampled from a uniform random distribution.

So, if $h(x=1) = a$ mod $p$ $ = 0$, the probability that $y$ will collide with $x$ is $1$, since we know that $a = 0$. The problem with this logic is that it only works if we are unlucky enough to sample an $h$ where $a = 0$. It is, in a sense, an edge case. The question asks about a general $h$.

Intuition

All functions that map a larger space to a smaller one result in collisions, so it makes intuitive sense that by knowing all the functions in $H$, and knowing where the specific $h$ maps an input $x$, we might hone in on what $h$ actually is (if there are very few $h$ mapping $x$ to $h(x)$), and we might use this information to construct an input that causes a collision. However, I am struggling to construct such an $H$.

1

There are 1 best solutions below

0
On BEST ANSWER

This is indeed possible, assuming that the other person only has to do this for a single value of $x$.

Consider the universe of inputs $\{0, 1, 2\}$ and take $p = 2$. Consider the functions $f_i$ defined by $0 \mapsto 0, 1 \mapsto 1, 2 \mapsto i$ for $i \in \{0, 1\}$. Let $x = 2$. Then conditioned on the output of $f_i(2)$, we know what $i$ is and hence can pick the value of $y$ such that $f_i(y) = f_i(2)$.