A trapdoor function is a function that is easy to compute in one direction, yet difficult to compute in the opposite direction without special information, called the "trapdoor". Trapdoor functions are widely used in cryptography. In mathematical terms, if f is a trapdoor function, then there exists some secret information t, such that given f and t, it is easy to compute x. Consider a padlock and its key. It is trivial to change the padlock from open to closed without using the key, by pushing the shackle into the lock mechanism. Opening the padlock easily, however, requires the key to be used. Here the key is the trapdoor and the padlock is the trapdoor function. An example of a simple mathematical trapdoor is "6895601 is the product of two prime numbers. What are those numbers?" A typical solution would be to try dividing 6895601 by several prime numbers until finding the answer. However, if one is told that 1931 is one of the numbers, one can find the answer by entering "6895601 ÷ 1931" into any calculator. This example is not a sturdy trapdoor function – modern computers can guess all of the possible answers within a second – but this sample problem could be improved by using the product of two much larger primes. Trapdoor functions came to prominence in cryptography in the mid-1970s with the publication of asymmetric encryption techniques by Diffie, Hellman, and Merkle. Indeed, coined the term. Several function classes had been proposed, and it soon became obvious that trapdoor functions are harder to find than was initially thought. For example, an early suggestion was to use schemes based on the subset sum problem. This turned out – rather quickly – to be unsuitable. , the best known trapdoor function candidates are the RSA and Rabin families of functions. Both are written as exponentiation modulo a composite number, and both are related to the problem of prime factorization. Functions related to the hardness of the discrete logarithm problem are not known to be trapdoor functions, because there is no known "trapdoor" information about the group that enables the efficient computation of discrete logarithms. A trapdoor in cryptography has the very specific aforementioned meaning and is not to be confused with a backdoor. A backdoor is a deliberate mechanism that is added to a cryptographic algorithm or operating system, for example, that permits one or more unauthorized parties to bypass or subvert the security of the system in some fashion.
Definition
A trapdoor function is a collection of one-way functions , in which all of K, Dk, Rk are subsets of binary strings *, satisfying the following conditions:
There exists a probabilistic polynomial timesampling algorithm Gen s.t. Gen = with k ∈ K ∩ n and tk ∈ * satisfies | tk | < p, in which p is some polynomial. Each tk is called the trapdoor corresponding to k. Each trapdoor can be efficiently sampled.
Given input k, there also exists a PPT algorithm that outputs x ∈ Dk. That is, each Dk can be efficiently sampled.
For any k ∈ K, there exists a PPT algorithm that correctly computes fk.
For any k ∈ K, there exists a PPT algorithm A s.t. for any x ∈ Dk, let y = A, and then we have fk = fk. That is, given trapdoor, it is easy to invert.
For any k ∈ K, without trapdoor tk, for any PPT algorithm, the probability to correctly invert fk, find a pre-image x' such that fk = fk) is negligible.
If each function in the collection above is a one-way permutation, then the collection is also called a trapdoor permutation.
Examples
In the following two examples, we always assume it is difficult to factorize a large composite number.
RSA Assumption
In this example, having the inverse of e modulo φ, the Euler's totient function of n, is the trapdoor: If the factorization is known, φ can be computed, so then the inverse of can be computed = e−1 mod φ, and then given y = f we can find x = yd mod n = xed mod n = x mod n. Its hardness follows from RSA assumption.
Let n be a large composite number such that n = pq, where p and q are large primes such that p ≡ 3 mod 4, q ≡ 3 mod 4, and kept confidential to adversarial. The problem is to compute z given a such that a ≡ z2 mod n. The trapdoor is the factorization of n. With trapdoor, the solutions of z can be given as cx + dy, cx - dy, - cx + dy, - cx - dy, where a ≡ x2 mod p, a ≡ y2 mod q, c ≡ 1 mod p, c ≡ 0 mod q, d ≡ 0 mod p, d ≡ 1 mod q. See Chinese remainder theorem for more details. Note that given primes p and q, we can find x ≡ a/4 mod p and y ≡ a/4 mod q. Here the conditions p ≡ 3 mod 4 and q ≡ 3 mod 4 guarantee that the solutions x and y can be well defined.
