# Polynomials and efficient computability

In public key crypto, the popular definitions of security (CPA, CCA1,2) depend on PPT adversaries. I'm trying to understand why adversaries should be PPT.

It's clear that adversaries should be at most probabilistic sub-exponential, because otherwise they could exhaust the message space. It's also clear that adversaries should be at least PPT, because any computer can run low-order polynomial algorithms (barring unusual cases) and there's no good way to distinguish low-order polynomials from very high-order (and practically inefficient) polynomials.

So why not allow the adversaries to be probabilistic quasi-polynomials? Where quasi-polynomial means its time complexity is larger than all polynomials and smaller than all exponentials, like $n^{log(n)}$. Is there some example showing why it would not make sense for an adversary to be probabilitic quasi-polynomial?

The reason I was taught why poly-time is the conventional way to define "efficient" algorithms is that it's the smallest notion closed under various forms of composition.

If we have an algorithm for deciding whether some input is in some language and we let $N$ be the length of the input, then we'd like to call all the following operations efficient:

• Returning "yes" or "no" all the time costs one (or constant) time.
• Reading the input costs $N$ time.
• Calling one efficient algorithm taking time $A(N)$, then passing the result through an efficient algorithm taking time $B(N)$ gives a total time of $A(N) + B(N)$, so our class of "efficient running times" should be closed under addition.
• If an algorithm taking $A(N)$ time on its own is efficient, and you have an algorithm with $A(N)$ steps where each step is a call to another efficient algorithm taking $B(N)$ time, then you end up with $A(N)B(N)$ time, so "efficiency" should be closed under multiplication.

Plug all that together and you get "polynomial in $N$" as the smallest possible "efficiency notion" - which does not of course exclude other, larger notions such as the ones mentioned above.

This is not so much a cryptography as a general complexity theory/theoretical CS point, which cryptographers have borrowed for their notions of security.

• Even better, polynomial time is preserved by pretty much any modification of the computation model you can think of. For Turing machines you can have a RAM machine, or an alphabet as large as you want, or as many tapes as you want, and also make them as many-dimensional as you want. Then there's boolean circuits, lambda calculus, or just (suitably defined) good old pseudocode... Apr 29 '16 at 14:13

There is nothing stopping you from doing this. I don't know of any cryptosystem that is in use today that would be considered unsecure against a quasi-polynomial time adversary. RSA is probably the closest. It is super-polynomial (thanks to GNFS), so it would still be secure in a quasi-poly time adversarial model.

The only argument I see against quasi-polynomial time adversary models is that it obviously does not reflect reality as well as the PT adversary (otherwise we would see much larger RSA keys in use).

• "otherwise we would see much larger RSA keys in use" I wouldn't conclude that. Those definitions are asymptotic and don't say anything about concrete key sizes. Dec 13 '12 at 8:04
• Thank you, but it's not obvious to me why quasi-poly doesn't reflect reality as well as PT? If there's nothing stopping us from taking this definition, then someone would have taken it as it's more general, so I'd like to know why quasi-poly doesn't work in our security definitions. Dec 13 '12 at 9:35

An example: low outcome, or expectation in terms of game theory, can be the reason for a class of adversaries that are neither probabilistic quasi-polynomial nor PPT, and would only go after polynomial-logarithmic-time targets.