Distributed Point Functions and Their Applications.

For x, y is an element of {0, 1}*, the point function P-x,P-y is defined by P-x,P-y(x) = y and P-x,P-y(x') = 0(vertical bar y vertical bar) for all x' not equal x. We introduce the notion of a distributed point function (DPF), which is a keyed function family F-k with the following property. Given x, y specifying a point function, one can efficiently generate a key pair (k(0), k(1)) such that: (1) Fk(0) circle plus Fk(1) = P-x,P-y, and (2) each of k(0) and k(1) hides x and y. Our main result is an efficient construction of a DPF under the (minimal) assumption that a one-way function exists. Distributed point functions have applications to private information retrieval (PIR) and related problems, as well as to worst-case to averagecase reductions. Concretely, assuming the existence of a strong one-way function, we obtain the following applications. Polylogarithmic 2-server binary PIR. We present the first 2server computational PIR protocol in which the length of each query is polylogarithmic in the database size n and the answers consist of a single bit each. This improves over the 2(O(root log n)) query length of the protocol of Chor and Gilboa (STOC '97). Similarly, we get a polylogarithmic "PIR writing" scheme, allowing secure non-interactive updates of a database shared between two servers. Assuming just a standard one-way function, we get the first 2-server private keyword search protocol in which the query length is polynomial in the keyword size, the answers consist of a single bit, and there is no error probability. In all these protocols, the computational cost on the server side is comparable to applying a symmetric encryption scheme to the entire database. Worst-case to average-case reductions. We present the first worst-case to average-case reductions for PSPACE and EXPTIME complete languages that require only a constant number of oracle queries. These reductions complement a recent negative result of Watson (TOTC '12).