Approximating Cumulative Pebbling Cost is Unique Games Hard
Jeremiah Blocki, Seunghoon Lee, Samson Zhou

TL;DR
This paper proves that approximating the cumulative pebbling cost of a directed acyclic graph within any constant factor is computationally hard under the Unique Games conjecture, highlighting fundamental limits in analyzing cryptographic functions.
Contribution
It establishes the first hardness result for approximating cumulative pebbling cost within any constant factor, assuming the Unique Games conjecture.
Findings
Proves Unique Games hardness for approximating cumulative pebbling cost
Shows no efficient constant-factor approximation exists unless UG conjecture fails
Connects pebbling complexity to cryptographic security analysis
Abstract
The cumulative pebbling complexity of a directed acyclic graph is defined as , where the minimum is taken over all legal (parallel) black pebblings of and denotes the number of pebbles on the graph during round . Intuitively, captures the amortized Space-Time complexity of pebbling copies of in parallel. The cumulative pebbling complexity of a graph is of particular interest in the field of cryptography as is tightly related to the amortized Area-Time complexity of the Data-Independent Memory-Hard Function (iMHF) [AS15] defined using a constant indegree directed acyclic graph (DAG) and a random oracle . A secure iMHF should have amortized Space-Time complexity as high as possible, e.g., to deter brute-force password attacker who wants to find such thatā¦
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
\hideLIPIcs
Department of Computer Science, Purdue University, West Lafayette, IN, USA and https://www.cs.purdue.edu/homes/jblocki [email protected]://orcid.org/0000-0002-5542-4674Research supported in part by NSF Award #1755708.Department of Computer Science, Purdue University, West Lafayette, IN, USA and https://www.cs.purdue.edu/homes/lee2856 [email protected]://orcid.org/0000-0003-4475-5686Research supported in part by NSF Award #1755708 and by the Center for Science of Information at Purdue University (NSF CCF-0939370).School of Computer Science, Carnegie Mellon University, Pittsburgh, PA, USA and https://samsonzhou.github.io/ [email protected]://orcid.org/0000-0001-8288-5698\CopyrightJeremiah Blocki and Seunghoon Lee and Samson Zhou{CCSXML} <ccs2012> <concept> <concept_id>10002978.10002979.10002982.10011600</concept_id> <concept_desc>Security and privacyĀ Hash functions and message authentication codes</concept_desc> <concept_significance>500</concept_significance> </concept> <concept> <concept_id>10003752.10003777</concept_id> <concept_desc>Theory of computationĀ Computational complexity and cryptography</concept_desc> <concept_significance>500</concept_significance> </concept> </ccs2012>
\ccsdesc[500]Theory of computationĀ Computational complexity and cryptography\ccsdesc[500]Security and privacyĀ Hash functions and message authentication codes \supplement\fundingThe opinions in this paper are those of the authors and do not necessarily reflect the position of the National Science Foundation.
Acknowledgements.
Part of this work was done while Samson Zhou was a postdoctoral fellow at Indiana University.\EventEditorsThomas Vidick \EventNoEds1 \EventLongTitle11th Innovations in Theoretical Computer Science Conference (ITCS 2020) \EventShortTitleITCS 2020 \EventAcronymITCS \EventYear2020 \EventDateJanuary 12ā14, 2020 \EventLocationSeattle, Washington, USA \EventLogo \SeriesVolume151 \ArticleNo13
Approximating Cumulative Pebbling Cost is Unique Games Hard
Jeremiah Blocki
āā
Seunghoon Lee
āā
Samson Zhou
Abstract
The cumulative pebbling complexity of a directed acyclic graph is defined as , where the minimum is taken over all legal (parallel) black pebblings of and denotes the number of pebbles on the graph during round . Intuitively, captures the amortized Space-Time complexity of pebbling copies of in parallel. The cumulative pebbling complexity of a graph is of particular interest in the field of cryptography as is tightly related to the amortized Area-Time complexity of the Data-Independent Memory-Hard Function (iMHF) Ā [7] defined using a constant indegree directed acyclic graph (DAG) and a random oracle . A secure iMHF should have amortized Space-Time complexity as high as possible, e.g., to deter brute-force password attacker who wants to find such that . Thus, to analyze the (in)security of a candidate iMHF , it is crucial to estimate the value but currently, upper and lower bounds for leading iMHF candidates differ by several orders of magnitude. Blocki and Zhou recently showed that it is NP-Hard to compute , but their techniques do not even rule out an efficient -approximation algorithm for any constant . We show that for any constant , it is Unique Games hard to approximate to within a factor of .
Along the way, we show the hardness of approximation of the DAG Vertex Deletion problem on DAGs of constant indegree. Namely, we show that for any and given a DAG with nodes and constant indegree, it is Unique Games hard to distinguish between the case that is -reducible with and , and the case that is -depth-robust with and , which may be of independent interest. Our result generalizes a result of Svensson who proved an analogous result for DAGs with indegree .
keywords:
Cumulative Pebbling Cost, Approximation Algorithm, Unique Games Conjecture, -Extreme Depth Robust Graph, Superconcentrator, Memory-Hard Function
category:
1 Introduction
The black pebbling game is a powerful abstraction that allows us to analyze the complexity of functions with a static data-dependency graph . In particular, a directed acyclic graph (DAG) can be used to encode data-dependencies between intermediate values produced during computation e.g., if is the intermediate value and then the DAG would include directed edges and indicating that depends on the previously computed values and . A black pebbling of is a sequence of pebbling configurations. Intuitively, a pebbling configuration describes the set of data labels that have been computed and stored in memory at time . The rules of the pebbling game stipulate that we must have for each newly pebbled node i.e., before we can compute a new data value , we must first have the labels of each dependent data value available in memory.
Historically, much of the literature has focused on the sequential black pebbling game where we require that for all round . In recent years, the parallel black pebbling game has seen renewed interest due to the rapid expansion of parallel computing, e.g., GPUs, FPGAs. In the more general parallel black pebbling game, there is no such restriction on the number of new pebbles in each round, i.e., on a parallel architecture, it is possible to determine for each node simultaneously since the dependent data-values are already in memory.
There are several natural ways to measure the cost of a pebbling. The space complexity of a DAG asks for a legal pebbling that minimizes the maximum space usage ā even if the time is exponential in the number of nodes . Space-time complexity asks for a legal pebbling that minimizes the space-time product . Alwen and SerbinenkoĀ [7] observed that in the parallel black pebbling game, the space-time of pebbling , independent copies of a DAG , does not always scale linearly with . In particular, for some DAGs the total space-time cost of pebbling is roughly equal to the space-time cost of pebbling a single instance of for !
Alwen and SerbinenkoĀ [7] introduced the notion of the cumulative pebbling cost of a DAG to model the amortized space-time costs in the parallel black pebbling game. Formally, the cumulative pebbling cost of a pebbling is given by and , where the minimum is taken over all legal (parallel) black pebblings of . The cumulative pebbling cost is a fundamental metric that is worth studying. It captures the amortized space-time cost of pebbling copies of in parallel, i.e., in the limit we have where the space-time cost of a pebbling is and the notation denotes a new graph consisting of disjoint copies of .
In this paper, we address the following question:
Given a DAG , can we (approximately) compute ?
This is a natural question in settings where we want to evaluate the function (with data-dependency DAG ) on many distinct inputs ā models the amortized cost of computing . The question is also highly relevant to the cryptanalysis of Data-Independent Memory-Hard Functions (iMHFs). In the context of password hashing we want to find a (constant indegree) DAG with maximum cumulative pebbling complexity, e.g., to maximize the cost of a brute-force attacker who wants to evaluate the function on every input in a password cracking dictionary. Thus, given a DAG one might wish to lower-bound before using in the design of a memory-hard password hashing algorithm.
Cumulative Pebbling Complexity in Cryptography.
In many natural contexts such as password hashing and Proofs of Work, it is desirable to lower bound the amortized space-time cost, e.g., in the random oracle model it is known that the cumulative memory complexity of a (side-channel resistant) iMHF is , where is a labeling function defined in terms of the DAG and a random oracle Ā [7]. Thus, in the field of cryptography there has been a lot of interest in designing constant indegree graphs with cumulative pebbling cost as large as possible and in analyzing the pebbling cost of candidate iMHF constructions , e.g., see [2, 5, 3, 6, 4, 14].
From an asymptotic standpoint many of the open questions have been (nearly) resolved. Alwen and BlockiĀ [2] showed that for any DAG with nodes and constant indegree we have , while Alwen etĀ al.Ā [5, 4] gave constructions with . For Argon2i, the winner of the password hashing competition, we have the upper bound and the lower bound Ā [14].
Most of these upper/lower bounds exploited a relationship between and a combinatorial property called depth-robustness. A DAG is -reducible if we can find a subset with such that any directed path in of length contains at least one node in . On the other hand, if is not -reducible, then we say that is -depth robust. Depth-robustness is known to be both necessaryĀ [2] and sufficientĀ [5] for secure iMHFs. In particular, any -reducible DAG with nodes and indegree has Ā [2] while any -depth robust DAG has Ā [5]. The later observation was used to build a constant indegree graph with by showing that the constructed is -depth robust. The former observation was used to prove that any constant indegree graph has by exploiting the observation that any such DAG is -reducible (simply set in the above [2] bound).
Although many of the open questions have been (nearly) resolved from an asymptotic standpoint, from a concrete security standpoint for all practical iMHF candidates , the best known upper and lower bounds on differ by several orders of magnitude. In fact, Blocki etĀ al.Ā [11] recently found that for practical parameter settings (), Argon2i provides better resistance to known pebbling attacks than DRSampleĀ [4] despite the fact that DRSample () is asymptotically superior to Argon2i (). Of course it is certainly possible that an improved pebbling strategy for Argon2i will reverse this finding tomorrow making it difficult to provide definitive recommendations about which construction is superior in practice.
Given a DAG , one might try to resolve these questions directly by (approximately) computing . Blocki and ZhouĀ [15] previously showed that the problem of computing is NP-Hard. However, their result does not even rule out the existence of a -approximation algorithm for any constant .
1.1 Our Contributions
Our main result is the hardness of any constant factor approximation to the cost of graph pebbling even for DAGs with constant indegree111Each node in a data-dependency DAG model an atomic unit of computation. Thus, in practice we expect to have indegree or . If is a function of previously computed values then we would have generated several additional intermediate data-values while evaluating . These data-values should have been included as nodes in which is supposed to have a node for every intermediate data-value..
Theorem 1.1**.**
Given a DAG with constant indegree, it is Unique Games hard to approximate within any constant factor. (See TheoremĀ 5.5.)
Along the way to proving our main result, we show that for any constant , given a constant indegree graph , it is Unique Games hard to distinguish between the following two cases: (1) is -reducible with and and (2) is -depth-robust with and . This intermediate result (see ) generalizes a result of SvenssonĀ [45], who proved an analogous result for DAGs with arbitrarily large indegree .
may be of independent interest as depth-robust graphs have found many other applications in cryptography including Proofs of Sequential WorkĀ [37], Proofs of SpaceĀ [24], Proofs of ReplicationĀ [39, 25] and (relaxed) locally correctable codes for computationally bounded channelsĀ [10, 12]. Testing the depth-robustness of a DAG is especially relevant to the analysis of (tight) Proofs of Space/Replication ā several constructions rely on (unproven) conjectures about the concrete depth-robustness of particular DAGs e.g., see [16, 25].
1.2 Technical Ingredients
To prove our result we use three technical ingredients. The first ingredient is a reduction of Svensson [45] that it is Unique Games hard to distinguish between a DAG (with ) that is -reducible or -depth-robust. The second technical ingredient is -Extreme Depth-Robust GraphsĀ [6] with bounded indegree. We use -Extreme Depth-Robust Graphs to modify the construction of Svensson [45] and show that the same result holds for graphs with much smaller indegree. Finally, we use low depth superconcentrators to boost the lower bound on to instead of in the case the graph is -depth robust. We prove that this can be done without significantly increasing the pebbling cost in the case the graph is -reducible.
1.2.1 Technical Ingredient 1
Our first technical ingredient is a result of Svensson [45], who proved that for any constant , it is Unique Games hard to distinguish between the following two cases (1) is -reducible with and , or (2) is -depth robust with and . To prove this, Svensson gave a reduction that transforms from any instance of Unique Games to a directed acyclic graph on nodes such that is -reducible for and if is satisfiable. Otherwise, if is unsatisfiable, it can be shown that is -depth robust. This is a potentially useful starting point because the pebbling complexity of a graph is closely related to its depth-robustness. In particular, in the second case, a result of Alwen etĀ al.Ā [5] establishes that and in the first case, a result of Alwen and Blocki shows that Ā [2].
Challenges of Applying Svenssonās Construction.
While the pebbling complexity of is related to depth-robustness, there is still a vast gap between the upper/lower bounds. In particular, in Svenssonās construction we have , so the term could be as large as . Thus, we would need to be able to reduce the indegree significantly to obtain a gap between in the two cases. (In fact, we can show the that pebbling cost is exactly independent of the Unique Games instance ā see LemmaĀ B.3 in the appendix.) We remark that a naĆÆve attempt to reduce indegree in Svenssonās construction by replacing every node (as in [5]) with a path of length would result in a constant indegree graph with nodes that will not be useful for our purposes. The new graph would be -reducible in the first case with and . In the second case, the DAG would be -depth robust with and . We would now have for our upper bound while the lower bound is at most . At the end of the day, the graph is still quite far from what we need.
1.2.2 Technical Ingredient 2: -Extreme Depth-Robust Graphs.
It does not seem to be possible to obtain a suitable graph by applying indegree reduction techniques to Svenssonās Construction in a black-box manner. Instead, we open up the black-box and show how to reduce the indegree using a recent technical result of Alwen etĀ al.Ā [6]. A DAG on nodes is said to be -extreme depth-robust if it is -depth robust for any such that . Alwen etĀ al.Ā [6] showed that for any constant , there exists a family of -extreme depth robust DAGs with maximum indegree . While Alwen etĀ al.Ā [6] were not focused on outdegree, it is not too difficult to see that their construction yields a single family of DAGs with maximum indegree and outdegree .
In Svenssonās construction, the DAG is partitioned into symmetric layers i.e., if (the copy of node in layer ) is connected to (the copy of node in layer ) then for any layers , the directed edge exists. The fact that this edge is ācopiedā times for every pair of layers significantly increases the indegree. However, Svenssonās argument that is depth-robust in the second case relies on the existence of each of these edges. To reduce the indegree we start with a -extreme depth robust DAG on nodes and only keep edges between nodes and in layers and if there is a path of length between nodes and in . The new graph can also be shown to have degree at most . Despite the fact that the indegree is vastly reduced, we are still able to modify Svenssonās argument to prove that (for a suitable constant ) our new graph is still -depth robust with and ā note that the new graph is clearly still -reducible if is satisfiable since we only remove edges from Svenssonās construction.
We can then apply the generic black-box indegree reduction of [5] to reduce the indegree to by replacing every node with a path of length . This established our first technical result that even for constant indegree DAGs, it is Unique Games hard to distinguish between the following two cases: (1) is -reducible with and , and (2) is -depth-robust with and .
1.2.3 Technical Ingredient 3: Superconcentrators
Although indegree reduction is a crucial step toward showing hardness of approximation for graph pebbling complexity, we still cannot apply known results that relate -reducibility and -depth robustness to pebbling complexity, since there is still no gap between the pebbling complexity of the two cases. In particular, we are always stuck with the term in the upper bound of [2] which is already much larger than the lower bound from [6]. To overcome this result we rely on superconcentrators. A superconcentrator is a graph that connects input nodes to output nodes so that any subset of inputs and outputs are connected by vertex disjoint paths. Moreover, the total number of edges in the graph should be .
Blocki etĀ al.ā[11] recently proved that , the superconcentrator overlay of an -depth robust graph, has pebbling cost , which is a significant improvement on the lower bound when and . This allows us to increase the lower-bound in case 2, but we need to be careful that we do not significantly increase the pebbling cost in case 1. To do this we rely on the existence of superconcentrators with depth Ā [40] and we give a significantly improved pebbling attack on the superconcentrator overlay DAG in case 1 when the original graph is -reducible. With the improved pebbling attack, we are able to show that in case 2 and that in case 1. Since is an arbitrary constant, this implies that it is Unique Games hard to approximate to within any constant factor .
2 Related Work
Pebbling games have found a number of applications under various formulations and models (see the survey [38] for a more thorough review). The sequential black pebbling game was introduced by Hewitt and PatersonĀ [29], and by CookĀ [19] and has been particularly useful in exploring space/time trade-offs for various problems like matrix multiplicationĀ [47], fast fourier transformationsĀ [43, 47], integer multiplicationĀ [46] and many othersĀ [17, 44]. In cryptography it has been used to construct/analyze Proofs of Space [24, 41], Proofs of WorkĀ [23, 37] and Memory-Hard FunctionsĀ [26]. Alwen and SerbinenkoĀ [7] argued that the parallel version of the black pebbling game was more appropriate for Memory-Hard Functions and they proved that any iMHF attacker in the parallel random oracle model corresponds to a pebbling strategy with equivalent cumulative memory cost.
The space cost of the black pebbling game is defined to be , which intuitively corresponds to minimizing the maximum space required during computation of the associated function. Gilbert etĀ al.Ā [27] studied the space-complexity of the black-pebbling game and showed that this problem is PSPACE-Complete by reducing from the truly quantified boolean formula (TQBF) problem. In our case, the decision problem is is in because the optimal pebbling strategy cannot last for more than steps since any graph with nodes has .
Red-Blue Pebbling.
Given a DAG , the goal of the red-blue pebbling gameĀ [30] is to place pebbles on all sink nodes of (not necessarily simultaneously) from an empty starting configuration. Intuitively, red pebbles represent values in cache and blue pebbles represent values stored in memory. Blue pebbles must be converted to red pebbles (e.g., loaded into cache) before they can be used in computation, but there is a limit (cache-size) on the number of red-pebbles that can be used. Red-blue pebbling games have been used to study memory-bound functionsĀ [22] (functions that incur many expensive cache-missesĀ [1]).
Ren and Devadas introduced the notion of bandwidth hard functions and used the red-blue pebbling game to analyze the energy cost of a memory hard functionĀ [42]. In their model, red-moves (representing computation performed using data in cache) have a smaller cost than blue-moves (representing data movements to/from memory) and a DAG on nodes is said to be bandwidth hard if any red-blue pebbling has cost . Ren and Devadas showed that the bit reversal graphĀ [35], which forms the core of iMHF candidate Catena-BRGĀ [26], is maximally bandwidth hard. Subsequently, Blocki etĀ al.Ā [13] gave a pebbling reduction showing that any attacker random oracle model () can indeed be viewed as a red-blue pebbling with equivalent cost. They also show that it is NP-Hard to compute the minimum cost red-blue pebbling of a DAG i.e., the decision problem āis the red-blue pebbling cost ?ā is NP-Complete (A result of Demaine and LiuĀ [20, 36] implies that the problem is PSPACE-Hard to compute the red-blue pebbling cost when i.e., computation is free). In general, the red-blue cost of is always lower bounded by and upper-bounded by . The question of a more efficient -approximation algorithm for remains open.
Unique Games.
Recently, the Unique Games Conjecture and related conjectures have received a lot of attention for their applications in proving hardness of approximation. Khot etĀ al.Ā [32] showed that the Goemans-Williamson approximation algorithm for Max-CutĀ [28] is optimal, assuming the Unique Games Conjecture. Khot and RegevĀ [34] showed that Minimum Vertex Cover problem is Unique Games hard to solve within a factor of , which is nearly tight from the guarantee that a simple greedy algorithm gives. The Unique Games Conjecture also leads to tighter approximation hardness for other problems including Max 2-SATĀ [32] and BetweennessĀ [18]. Although a previous stronger version of the conjecture asked whether Unique Games instances required exponential time algorithms in the worst case, Arora etĀ al.Ā [8] gave a subexponential time algorithm for Unique Games. Lately, focus has also been drawn toward studying the related Label Cover Problem, such as the -Prover--Round Games, i.e. the 2-to-1 Games Conjecture [21] and the 2-to-2 Games Conjecture [33].
3 Preliminaries
We use the notation to denote the set . Given a directed acyclic graph and a node , we use (resp. ) to denote the parents (resp. children) of node . We use (resp. ) to denote the number of incoming (resp. outgoing) edges into (resp. out of) the vertex . We also define and . Given a set of nodes, we use to refer to the graph obtained by deleting all nodes in and all edges incident to . We also use to refer to the subgraph induced by the nodes , i.e., deleting every other node in . Given a node , we use to refer to the longest directed path in ending at node and we use to refer to the longest directed path in . Given a subset , we will also use to refer to the maximum number of nodes in the set contained in any directed path in that ends at node . We define analogously.
Definition 3.1** (Unique Games).**
An instance of Unique Games consists of a regular bipartite graph and a set of labels. Each edge has a constraint given by a permutation . The goal is to output a labeling that maximizes the number of satisfied edges, where an edge is satisfied if .
Conjecture 3.2** (Unique Games Conjecture).**
[31]** For any constants , there exists a sufficiently large integer (as a function of ) such that for Unique Games instances with label set , no polynomial time algorithm can distinguish whether: (1) the maximum fraction of satisfied edges of any labeling is at least , or (2) the maximum fraction of satisfied edges of any labeling is less than .
Graph Pebbling.
The goal of the (black) pebbling game is to place pebbles on all sink nodes of some input directed acyclic graph (DAG) . The game proceeds in rounds, and each round consists of a number of pebbles placed on a subset of the vertices. Initially, the graph is unpebbled, , and in each round , we may place a pebble on if either all parents of contained pebbles in the previous round () or if already contained a pebble in the previous round (). In the sequential pebbling game, at most one new pebble can be placed on the graph in any round (i.e., , but this restriction does not apply in the parallel pebbling game.
We use to denote the set of all valid parallel pebblings of . The cumulative cost of a pebbling is the quantity that represents the sum of the number of pebbles on the graph during every round. The (parallel) cumulative pebbling cost of , denoted , is the cumulative cost of the best legal pebbling of .
A DAG is -reducible if there exists a subset of size such that . That is, there are no directed paths containing vertices remaining, once the vertices in the set are removed from . If is not -reducible, we say that it is -depth robust.
4 Reduction
Svensson [45] showed that for any constant it is Unique Games hard to distinguish between whether a DAG is -reducible for and or is -depth robust with and . To prove this, Svensson showed how to transform a Unique Games instance into a graph such that is -reducible if it is possible to satisfy fraction of the edges and is -depth robust if it is not possible to satisfy -fraction of the edges. To obtain inapproximability results for , it is crucial to substantially reduce the indegree of this construction.
4.1 Review of Svenssonās Construction
To construct , Svensson first constructs a layered bipartite DAG , which encodes the unique games instance and later transforms into the required DAG . For completeness, we provide a full description of the DAG in the appendix. We will focus our discussion here on the essential properties of the DAG .
The graph has a number of bit-vertices partitioned into bit-layers , where is the set of bit-vertices in bit-layer . Each can be partitioned into sets for . Similarly, has a number of test-vertices partitioned into test-layers , where is the set of test-vertices in test-layer . Outgoing edges for test-layer must be directed into a bit vertex in layer with . Similarly, outgoing edges from must be directed into a test vertex in layer with . Each can be partitioned into sets for . The constraints in our Unique Games instance are encoded as edges between the bit vertices and test vertices. We use to denote the total number of test nodes and remark that the parameter is set such that .
also displays symmetry between the layers in the sense that and , so that the number of bit-vertices in each bit-layer is the same and the number of test-vertices in each test-layer is the same.
Symmetry.
In Svenssonās construction, we have exactly bit vertices in every layer and exactly test vertices in every layer . The edges between and (resp. and ) encode the edge constraints in the unique games instance . Furthermore, the construction is symmetric so that directed edge exists if and only if for every the edge exists. Thus for any , the edges between and encode the constraints in . Similarly, the directed edge exists if and only if any the edge exists. We remark that this means that the indegree of the graph is at least (and can be as large as in general).
Robustness of .
Svensson argues that if it is possible to satisfy a fraction of the constraints in , then there exists a subset of at most test-vertices such that . Similarly, if it is not possible to satisfy a -fraction of the constraints, then for any subset of at most test-vertices, we have . This does not directly show that is depth-robust since we are not allowed to delete bit-vertices. However, one can easily transform into a graph on the test nodes such that is -depth robust if and only if for all subsets of test vertices in , we have . It is worth mentioning that we can view these guarantees as a form of weighted depth-robustness where all test-vertices have weight and all bit-vertices have weight , i.e., if fraction of the constraints in , then we can find a subset of nodes with weight such that , and if it is not possible to satisfy -fraction of the constraints, then for any subset with we have .
Graph Coloring and Robustness.
An equivalent way to view the problem of weighted reducibility (resp. depth-robustness) is in terms of graph coloring. This view is central to Svenssonās argument. In particular, if we can find a depth reducing set of size such that , then we can define a -coloring of each of the bit-vertices such that the coloring is consistent with every remaining test node . Here, consistency means that . In fact, it is not too difficult to see that there is a subset of test-vertices such that if and only if there is a -coloring such that , i.e., given a -coloring of the bit vertices, we can simply select of inconsistent test-vertices and then for every we can inductively show that .
Brief Overview of Svenssonās Proof.
Svensson defines to denote the largest color that is smaller than the colors of at least fraction of the bit-vertices in , i.e., Suppose that it is not possible to satisfy a -fraction of the constraints in for tunable parameters that are part of Svenssonās construction. The core piece of Svenssonās proof is demonstrating that if the set of inconsistent test-vertices has size , then we can find some such that for some constant that depends on various parameters of the construction. Svensson notes that by symmetry of the construction , we can assume without loss of generality that for any . We remark that this will not necessarily be the case after our indegree reduction step. Thus, it immediately follows that uses more than colors, i.e., .
4.2 Reducing the Indegree
As previously discussed, Svenssonās construction has indegree that is too large for the purposes of bounding the pebbling complexity by finding a gap between known results implied by -reducibility and -depth robustness. To perform indegree reduction, we use a -extreme depth-robust graph with vertices in a procedure to decide which edges in to keep and which edges to discard. Intuitively, we will keep the edge from a bit vertex on layer to test vertex on layer if and only if or contains the edge . Similarly, we will keep the edge from a test vertex on layer to bit vertex on layer if and only if . The result is a new DAG with substantially smaller indegree and outdegree instead of .
Transformation
Input: An instance of the Svenssonās construction, whose vertices are partitioned into bit-layers and test-layers , a -extreme depth robust graph .
Let be a copy of .
If is an edge in , where and , delete from if and .
If is an edge in , where and , delete from if .
Output:
We remark that we only delete edges from . Thus for any subset of test vertices, we have . Hence, is certainly not more depth-robust than . The harder argument is showing that the graph is still depth-robust when our unique games instance has no assignment satisfying a fraction of the edges.
Assuming that the Unique Games instance is unsatisfiable, LemmaĀ 4.1 implies that as long as test-vertices are consistent with our coloring, we can find some such that is locally consistent on at least layers, i.e., is locally consistent on layer if we have .
The parameters in LemmaĀ 4.1 are tunable parameters of the reduction.
Lemma 4.1**.**
Let be any coloring of . If the Unique Games instance has no labeling that satisfies a fraction of the constraints and at least test vertices are consistent with , then there exists with
[TABLE]
We remark that the proof of LemmaĀ 4.1 closely follows Svenssonās argument with a few modifications. While the modifications are relatively minor, specifying these modifications requires a complete description of Svenssonās construction. We refer an interested reader to AppendixĀ B for details and for the formal proof of LemmaĀ 4.1.
LemmaĀ 4.2 now shows that is still depth-robust in case 2. The main challenge is that after we sparsify the graph, we can no longer assume that without loss of generality, e.g., even if there are many ās for which we could have a sequence like . We rely on the fact that is extremely depth-robust to show that for any sufficiently large subset of layers for which is locally consistent, there must be a subsequence of length over which is strictly increasing.
Lemma 4.2**.**
If the Unique Games instance has no labeling that satisfies a fraction of the constraints and , then for every set of at most test-vertices the graph has a path of length .
Proof 4.3**.**
Suppose the Unique Games instance has no labeling that satisfies a fraction of the constraints. Let contain at most and define the labeling . By LemmaĀ 4.1, there exists with
[TABLE]
Let denote the subset of layers over which is locally consistent. We remark that each corresponds to a node in and that contains a path of length . We also note that for each . Hence, , which means that as long as .
TheoremĀ 4.4, our main technical result in this section, states that it is Unique Games hard to distinguish between -reducible and -depth robust graphs even for a DAG with vertices and .
Theorem 4.4**.**
For any integer and constant , given a DAG with vertices and , it is Unique Games hard to distinguish between the following cases: (1) (Completeness): is -reducible, and (2) (Soundness): is -depth robust.
Proof 4.5**.**
Recall that we can transform into an unweighted graph over the test-vertices. In particular, we add the edge to if and only if there was a path of length from to in . We remark that the indegree is and that for any , we have . Completeness now follows immediately fromĀ TheoremĀ C.3 under the observation that we only removed edges from Svenssonās construction. Soundness follows immediately from TheoremĀ C.3 and LemmaĀ 4.2.
Obtaining DAGs with Constant Degree.
We can now apply a second indegree reduction procedure . For a graph , the procedure replaces each node with a path , where is the indegree of . For each edge , we add the edge whenever is the incoming edge of , according to some fixed ordering. [5] give parameters and so that is -depth robust if is -depth robust. For a formal description of , see AppendixĀ B. We complete the reduction by giving parameters and so that is -reducible if is -reducible.
Lemma 4.6**.**
There exists a polynomial time procedure that takes as input a DAG with vertices and and outputs a graph with vertices and . Moreover, the following properties hold: (1) If is -reducible, then is -reducible, and (2) If is -depth robust, then is -depth robust.
Corollary 4.7**.**
For any integer and constant , given a DAG with vertices and maximum indegree , it is Unique Games hard to decide whether is -reducible or -depth robust for (Completeness): and , and (Soundness): and .
5 Putting the Pieces Together
We would now like to apply TheoremĀ C.1 and TheoremĀ C.2. However, the upper bound on that we obtain from TheoremĀ C.1 will not be better than , while the lower bound we obtain from TheoremĀ C.2 is just , so we do not get our desirable gap between the upper and lower bounds. We therefore discard TheoremĀ C.1 and TheoremĀ C.2 altogether and instead apply a graph transformation with explicit bounds on pebbling complexity.
Definition 5.1** (Superconcentrator).**
A graph with vertices is called a superconcentrator if there exists input vertices, denoted , and output vertices, denoted , such that for all with , there are vertex disjoint paths from to .
Pippenger gives a superconcentrator construction with depth .
Lemma 5.2** ([40]).**
There exists a superconcentrator with at most vertices, containing input vertices and output vertices, such that and .
Now we define the overlay of a superconcentrator on a graph (see FigureĀ 1).
Definition 5.3** (Superconcentrator Overlay).**
Let be a fixed DAG with vertices and be a (priori fixed) superconcentrator with input vertices and output vertices . We call a graph a superconcentrator overlay where and and denote as .
We will denote the interior nodes as where and . We remark that when using Pippengerās construction of superconcentrators, it is easy to show that is
-reducible whenever is -reducible, which implies that
[TABLE]
For more details, we refer an interested reader to LemmaĀ D.3 and in AppendixĀ D. However, these results are not quite as strong as we would like. By comparison, we have the following lower bound on the pebbling complexity from [11]:
[TABLE]
In LemmaĀ 5.4 we obtain a significantly tighter upper bound on with an improved pebbling strategy described at the end of this section.
Lemma 5.4**.**
Let be an -reducible graph with vertices with . Then
With the improved attack in LemmaĀ 5.4, we can tune parameters appropriately to obtain our main result, TheoremĀ 5.5.
Theorem 5.5**.**
Given a DAG , it is Unique Games hard to approximate within any constant factor.
Proof 5.6**.**
Let be an integer that we shall later fix and similarly, let be a constant that we will later fix. Given a DAG with vertices, then it follows by that it is Unique Games hard to decide whether is -reducible or -depth robust for , and and . If is -reducible, then by LemmaĀ 5.4, Observe that , whereas for and sufficiently large , Hence for sufficiently large ,
[TABLE]
On the other hand, if is -depth robust, then by LemmaĀ C.6, Specifically,
[TABLE]
Let be any constant. Setting and , we get that if is -reducible, then but if is -reducible, then . Hence, it is Unique Games hard to approximate with a factor of .
Proof 5.7** (Proof of LemmaĀ 5.4).**
We will examine the pebbling cost of for each step shown in FigureĀ 2.
- ā¢
Step 1:* We need to place pebbles on all input nodes in . By TheoremĀ C.1, the pebbling cost of will be upper bounded by*222Note that TheoremĀ C.1 shows the upper bound of the pebbling cost to pebble the last node of . Here, the difference is that we have to pebble all nodes in , not the last node of only. However, [2] says that we can recover all nodes concurrently by running one more balloon phase and such cost is already contained in the term . Therefore, we have the same upper bound for .**
[TABLE]
- ā¢
Step 2:* Start with a configuration with pebbles on every node in . We have that . Therefore, in time , we can place pebbles on every node in . Hence, the total pebbling cost in Step 2 will be at most .*
- ā¢
Step 3:* The goal for step 3 is to walk a pebble across the output nodes starting from to . To save cost during this step, we should alternate light phases and balloon phases repeatedly times in total since we walk pebble across the interval of length in in each phase. Let be a -depth reducing set for . In each light phase, to walk a pebble across the interval , we should keep pebbles on and . Since each node in has two parents outside the interval and we keep one pebble in (the current node) for each step, the maximum number of pebbles to keep would be for each step. Hence, the maximum pebbling cost to walk pebble across in light phase is . In each balloon phase, we recover the pebbles in for the next light phase. Since is a -depth reducing set, we have that . Therefore, recovering the pebbles will cost at most for each balloon phase. Hence, the total pebbling cost for Step 3 will be at most .*
*Taken together, we have that
[TABLE]
as desired.
Appendix A Svenssonās Construction
In this section, we review Svenssonās Construction. Given an instance of Unique Games, Svensson first constructs a weighted instance of the DAG reducibility problem. Recall that in the weighted DAG reducibility problem, we are given a DAG with weights on each node and a target depth and the goal is to find a minimum weight subset such that contains no path of length . Given and with and a weaker goal is simply to distinguish between the following cases: (1) there is a set of weight at most s.t. contains no path of length , and (2) for all sets of weight at most the graph contains a path of length . Svensson constructs s.t. distinguishing between these cases allows us to solve the original Unique Games instance .
A.1 Notation
We first review some notation that is used to describe Svenssonās initial construction. For and a subset of not necessarily distinct indices of , let
[TABLE]
denote the sub-cube whose coordinates not in are fixed according to . Let
[TABLE]
denote the image of the sub-cube under . Similarly, let
[TABLE]
where denotes addition modulo and denotes an -dimensional vector with all elements 1, and let
[TABLE]
A.2 Construction
In Svenssonās initial construction, nodes are divided into two sets: bit-vertices and test-vertices. Bit-vertices are assigned weight infinity to guarantee that these nodes are not deleted. Test-vertices are assigned weight one. Here, we focus on the construction of though the graph is later transformed into an instance of the unweighted DAG reducibility problem, i.e., distinguishing between the cases that is -reducible and -depth robust is sufficient to solve the original Unique Games instance . See FigureĀ 3 for a simple example of along with the transformation to the unweighted instance . The DAG is defined formally as follows:
- ā¢
For some to be fixed, there are layers of bit-vertices. Each bit-layer with the DAG contains bit-vertices for each and . Each bit-vertex is assigned weight .
- ā¢
There are layers of test-vertices. For each , the DAG contains test-vertices for every , every sequence of indices , every and every sequence of not necessarily distinct neighbors of . Each test-vertex is assigned weight .
- ā¢
If and , then there is an edge from bit-vertex to test-vertex for each .
- ā¢
If and , then there is an edge from test-vertex to bit-vertex for each .
- ā¢
If is the total number of test-vertices, then is selected so that .
A.3 Transformation
As mentioned before, in the Svenssonās construction, the bit-vertices are given weight so that they are never deleted, and the graph can be simplified in the following manner without altering the reduction. The transformation to is defined formally as follows:
- ā¢
For each , there exists a vertex for every , every sequence of indices , every and every sequence of not necessarily distinct neighbors of .
- ā¢
If is the number of vertices in each layer, then is selected so that .
- ā¢
There exists an edge between and if and only if and there exist such that is nonempty.
Example A.1**.**
In this example, we will illustrate how to reduce from a Unique Games instance to a Svenssonās construction , and a simplification procedure from to by examining a simple toy example.
Consider the following Unique Games instance with , a labeling such that , and with the parameters and . Then we have the following observations when constructing :
- ā¢
Each bit-layer with contains bit-vertices for each and . Hence, the number of bit-vertices in each layer is . That is, for each layer , we have the following bit-vertices:
[TABLE]
- ā¢
Each test-layer with contains test-vertices for every , every sequence of indices , every and every sequence of not necessarily distinct neighbors of . Since and has only one neighbor , the number of test-vertices in each layer is , where denotes the set of neighbors of in a graph . That is, for each layer , we have the following test-vertices (from now on, we omit the subscript in this example since there is only one such case for each test-vertex):
[TABLE]
- ā¢
There exists an edge from bit vertex to test-vertex if and . We recall that . Now it is easy to see that if , if and only if , and if , if and only if . Therefore, we have an edge from to , and for all , and so on.
- ā¢
There exists an edge from test-vertex to bit-vertex if and , where denotes addition modulo and . Hence, for example, if there is an edge from to then there should be an edge from to for all since .
When transforming into , we can observe that is nonempty if and only if there is a path between two test-vertices through one bit-vertex. Taken together, we have the following structure of graphs reduced from a Unique Games instance , as shown in FigureĀ 3.
Appendix B Modified Construction
Given an instance of the Svenssonās construction and a -extreme depth-robust graph , we formally define our modified instance in the following manner.
Transformation
Input: An instance of the Svenssonās construction, whose vertices are partitioned into bit-layers and test-layers , a -extreme depth robust graph .
Let be a copy of .
If is an edge in , where and , delete from if and .
If is an edge in , where and , delete from if .
Output:
We give an illustration of the procedure in FigureĀ 4.
Correspondingly, our modified instance can also be simplified in the following manner without altering the reduction.
- ā¢
For a input parameter , let be an -extreme depth robust graph with vertices, which we use to represent.
- ā¢
For each , there exists a vertex for every , every sequence of indices , every and every sequence of not necessarily distinct neighbors of .
- ā¢
If is the number of vertices in each layer, then is selected so that .
- ā¢
There exists an edge between and if and only if , the edge is in , and there exist such that is nonempty.
We first recall the following definition of influence of the coordinate:
[TABLE]
We now reference the key theorem used in Svenssonās analysis.
Theorem B.1**.**
For every and integer , there exists and integers such that any collection of functions that satisfies*
- ā¢
**
- ā¢
, :
has
[TABLE]
We now show that the transformed graph maintains similar properties as Svenssonās construction, given an instance of Unique Games. The following statement is analogous to Lemma 4.7 in [45].
Ā **Reminder of LemmaĀ 4.1. ***
Let be any coloring of . If the Unique Games instance has no labeling that satisfies a fraction of the constraints and at least test vertices are consistent with , then there exists with*
[TABLE]
Proof B.2** (Proof of LemmaĀ 4.1).**
As in [45], an equivalent formulation of the problem is finding a coloring in to each bit-vertex to minimize the number of unsatisfied test-vertices. Unlike in [45], we say a test-vertex is satisfied if
[TABLE]
for all with , so that all the predecessors of are assigned lower colors than the successors of .
We also define the color for and as the maximum color that satisfies
[TABLE]
For and , define the indicator function by
[TABLE]
We call a test-vertex good in test-layer if for for every edge of the form in the -extreme depth-robust graph .
Claim 1**.**
If the Unique Games instance has no labeling satisfying a fraction of the constraints and a fraction of the vertices of test-layer are satisfied, then at least a fraction of the vertices are good in test-layer .
{claimproof}
Let be the set of satisfied vertices of test-layer so that for all with , it follows that
[TABLE]
since at least fraction of the vertices in are satisfied. We call a tuple good if
[TABLE]
for all with . Observe that at least fraction of the tuples are good.
From the definition of , we have that . Hence for a good tuple, it follows that
[TABLE]
for all with .
Therefore by TheoremĀ B.1, at least one of the following cases holds:
more than of the functions have so that for every edge of the form in , or 2. 2.
there exist and such that , where
[TABLE]
If ConditionĀ 1 holds for at least of the good tuples, or equivalently a fraction of all tuples, then at least a fraction of the test-vertices are good in test-layer because we can pick a vertex uniformly at random by picking a tuple and then taking one of the vertices at random. Conditioned on the (at least) probability that the tuple is good and satisfies ConditionĀ 1, the probability that for every edge of the form in for the sampled vertex is at least . Therefore, , so that at least fraction of the test-vertices are good in test-layer .
By way of contradiction, we can show that if ConditionĀ 2 were to hold for more than half of the good tuples, the assumption that the Unique Games instance has no labeling satisfying a fraction of the constraints is violated. The argument holds exactly as Claim 4.8 in [45], but we repeat it here for completeness.
For every , let be a random label from . For every , let be a random neighbor of and let . If ConditionĀ 2 holds for half of the good tuples, then a random tuple has this property with at least probability . Thus with probability at least , and for randomly picked from the set . Moreover, [45, 9] observes that with probability at least , the labeling procedure defines and . Hence if ConditionĀ 2 holds for half of the good tuples,
[TABLE]
so that over the randomness of the labeling procedure,
[TABLE]
which contradicts the assumption that the Unique Games instance has no labeling satisfying a fraction of the constraints is violated.
Consider a subgraph induced by all bit-vertices and a fraction of the test-vertices and consider the minimum number of colors required for a coloring to satisfy the fraction of the test-vertices. Since at least fraction of the test-vertices are good in at least fraction of the test-layers, then by ClaimĀ 1,
[TABLE]
Therefore, there exists with .
Interestingly, we can exactly compute the pebbling complexity of the simplified Svenssonās construction, when the graph is only represented with the test-vertices.
Lemma B.3**.**
Given a (simplified) Svenssonās construction that consists of vertices partitioned across layers, .
Proof B.4**.**
We first show that the pebbling complexity of is at least . Observe that the Svenssonās construction contains vertices in each layer and furthermore, for each pair of layers and , there is a perfect matching between vertices of layer and vertices of layer among the edges connecting layers and . Let be the subset of edges between and that is perfect matching.
For a given pebble in layer , let be the vertex in layer matched to by . To pebble a vertex in layer , all of its parents must contain pebbles in the previous round. Namely, there must be a pebble on for all in the previous round. Since each is a perfect matching, there must be pebbles on the graph solely for the purpose of pebbling node in layer . Thus pebbling each node in layer induces a pebbling cost of at least . Since there are pebbles in each layer and layers, then the total pebbling cost is at least , which lower bounds .
On the other hand, consider the natural pebbling where all the pebbles in layer are pebbled in round , and no pebble is ever removed. Then the graph is completely pebbled in rounds, since layer is pebbled in round . Moreover, the cost of pebbling round is . Hence, the pebbling cost is , which upper bounds .
Finally, we give a formal description of the procedure . Recall that for a graph replaces each vertex with a path , where is the indegree of . For each edge , we add the edge whenever is the incoming edge of , according to some fixed ordering. [5] give parameters and so that is -depth robust if is -depth robust. We complete the reduction by giving parameters and so that is -reducible if is -reducible.
Transformation
Input: An DAG with indegree , parameter .
Let the vertices of be .
Initialize to be a graph with vertices and let these vertices be
If for some integer , add edge to .
If is the incoming edge of by some fixed predetermined ordering, then add to .
Output:
We given an illustration of the transformation in FigureĀ 5.
Appendix C Useful Theorems
We rely on the following results in our constructions and proofs.
Theorem C.1** ([2]).**
Let be a DAG with vertices and indegree . If is -reducible, then .
Theorem C.2** ([5]).**
Let be a DAG with vertices and indegree . If is -depth robust, then .
While TheoremĀ C.1 and TheoremĀ C.2 are nice results that relate the pebbling complexities of -reducible and -depth robust graphs, these statements are ultimately misleading in that and thus there will never be a gap between the pebbling complexities of the graphs.
Theorem C.3** ([45]).**
For any integer and constant , given a DAG with vertices, it is Unique Games hard to distinguish between the following cases:
- ā¢
(Completeness): is -reducible.
- ā¢
(Soundness): is -depth robust.
Definition C.4**.**
Given a parameter , a DAG is -extreme depth-robust if is -depth robust for any such that .
Theorem C.5** ([6]).**
For any fixed , there exists a constant such that for all integers , there exists an -extreme depth robust graph with vertices and .
Lemma C.6** ([11]).**
Let be an -depth robust graph with vertices. Then
[TABLE]
Appendix D Missing Proofs
Ā *Reminder of LemmaĀ 4.6. *** There exists a polynomial time procedure that takes as input a DAG with vertices and and outputs a graph with vertices and . Moreover, the following properties hold: (1) If is -reducible, then is -reducible, and (2) If is -depth robust, then is -depth robust.
Proof D.1** (Proof of LemmaĀ 4.6.).**
Alwen etĀ al.ā[5] show that is -depth robust if is -depth robust. It remains to show that is -reducible if is -reducible.
Given an -reducible graph of vertices, we use to represent the vertices of and let so that the vertices of can be associated with . Let be a set of vertices in such that . Let be a set of vertices in so that for each vertex .
Suppose, by way of contradiction, that there exists a path of length in . Observe that if such that and for integers , then cannot be connected to unless . Hence that if contains vertex such that and is not one of the final vertices of , then . Thus by a simple Pigeonhole argument, there exists at least integers such that for and moreover there exists an edge in from each vertex to some vertex such that for . However, this implies that is a path in by construction of . Moreover, since for each vertex , this implies that is a path of length in , which contradicts the assumption that .
Ā *Reminder of . *** For any integer and constant , given a DAG with vertices and maximum indegree , it is Unique Games hard to decide whether is -reducible or -depth robust for (Completeness): and , and (Soundness): and .
Proof D.2** (Proof of .).**
Suppose is a graph with vertices. By applying LemmaĀ 4.6 to TheoremĀ 4.4 and setting and , then we start from a graph with vertices and end with a graph with vertices or equivalently, . Thus, is -reducible for and . Since , it is clearly the case that is -reducible for and as we delete more nodes and the depth reducibility guarantees the same upper bound of the remaining depth. On the other hand, is -depth robust for , while . By TheoremĀ 4.4, so that for sufficiently large , .
Lemma D.3**.**
If is -reducible, then is -reducible, where is the number of vertices in .
Proof D.4**.**
Let be a -reducible DAG with vertices. Let and suppose has vertices, which we designate . Thus, there exists a set such that and . Let be the set of vertices , so that . We claim .
Suppose by way of contradiction that there exists a path in of length at least . By LemmaĀ 5.2, the depth of any path from an input node to an output vertex is at most . Moreover, all edges added in the superconcentrator overlay are either between input vertices or two output vertices. Hence, then at least vertices of have to lie in either the first vertices or the last vertices of . Because does not contain vertices of , there is no path of length of length in the last vertices of , so there must be a path of length in the first vertices of , which contradicts .
Therefore, is -reducible.
From LemmaĀ D.3 we immediately obtain an upper bound on the pebbling complexity of by applying TheoremĀ C.1 to LemmaĀ D.3. However, the upper bound is not as strong as we would like.
Corollary D.5**.**
Let be an -reducible graph with vertices. Then
[TABLE]
The reference list from the paper itself. Each links out to its DOI / PubMed record.
- 1[1] MartĆn Abadi, Michael Burrows, and Ted Wobber. Moderately hard, memory-bound functions. In Proceedings of the Network and Distributed System Security Symposium, NDSS 2003, San Diego, California, USA , 2003.
- 2[2] JoĆ«l Alwen and Jeremiah Blocki. Efficiently computing data-independent memory-hard functions. In Matthew Robshaw and Jonathan Katz, editors, CRYPTO 2016, Part II , volume 9815 of LNCS , pages 241ā271. Springer, Heidelberg, August 2016. doi:10.1007/978-3-662-53008-5_9 . Ā· doiĀ ā
- 3[3] JoĆ«l Alwen and Jeremiah Blocki. Towards practical attacks on argon 2i and balloon hashing. In Security and Privacy (Euro S&P), 2017 IEEE European Symposium on , pages 142ā157. IEEE, 2017.
- 4[4] JoĆ«l Alwen, Jeremiah Blocki, and Ben Harsha. Practical graphs for optimal side-channel resistant memory-hard functions. In Bhavani M. Thuraisingham, David Evans, Tal Malkin, and Dongyan Xu, editors, ACM CCS 2017 , pages 1001ā1017. ACM Press, October / November 2017. doi:10.1145/3133956.3134031 . Ā· doiĀ ā
- 5[5] JoĆ«l Alwen, Jeremiah Blocki, and Krzysztof Pietrzak. Depth-robust graphs and their cumulative memory complexity. In Jean-SĆ©bastien Coron and Jesper Buus Nielsen, editors, EUROCRYPT 2017, Part III , volume 10212 of LNCS , pages 3ā32. Springer, Heidelberg, April / May 2017. doi:10.1007/978-3-319-56617-7_1 . Ā· doiĀ ā
- 6[6] JoĆ«l Alwen, Jeremiah Blocki, and Krzysztof Pietrzak. Sustained space complexity. In Jesper Buus Nielsen and Vincent Rijmen, editors, EUROCRYPT 2018, Part II , volume 10821 of LNCS , pages 99ā130. Springer, Heidelberg, April / May 2018. doi:10.1007/978-3-319-78375-8_4 . Ā· doiĀ ā
- 7[7] JoĆ«l Alwen and Vladimir Serbinenko. High parallel complexity graphs and memory-hard functions. In Rocco A. Servedio and Ronitt Rubinfeld, editors, 47th ACM STOC , pages 595ā603. ACM Press, June 2015. doi:10.1145/2746539.2746622 . Ā· doiĀ ā
- 8[8] Sanjeev Arora, Boaz Barak, and David Steurer. Subexponential algorithms for unique games and related problems. In 51st FOCS , pages 563ā572. IEEE Computer Society Press, October 2010. doi:10.1109/FOCS.2010.59 . Ā· doiĀ ā
