Editing Trapdoor function (section)

{{Short description|One-way cryptographic tool}}
{{about|the mathematical cryptography function|the method of bypassing security|Backdoor (computing)}}
{{refimprove|date=July 2013}}
[[File:Trapdoor permutation.svg|300px|thumb|The idea of trapdoor function. A trapdoor function ''f'' with its trapdoor ''t'' can be generated by an algorithm '''Gen'''. ''f'' can be efficiently computed, i.e., in probabilistic [[polynomial time]]. However, the computation of the inverse of ''f'' is generally hard, unless the trapdoor ''t'' is given.<ref>Ostrovsky, pp. 6–9</ref>]]

In [[theoretical computer science]] and [[cryptography]], a '''trapdoor function''' is a [[function (mathematics)|function]] that is easy to compute in one direction, yet difficult to compute in the opposite direction (finding its [[Inverse function|inverse]]) without special information, called the "trapdoor". Trapdoor functions are a special case of [[one-way function]]s and are widely used in [[public-key cryptography]].<ref>{{Cite book|last=Bellare|first=M|title=Advances in Cryptology — CRYPTO '98|chapter=Many-to-one trapdoor functions and their relation to public-key cryptosystems|series=Lecture Notes in Computer Science|date=June 1998|volume=1462|pages=283–298|doi=10.1007/bfb0055735 |isbn=978-3-540-64892-5|s2cid=215825522}}</ref>

In mathematical terms, if ''f'' is a trapdoor function, then there exists some secret information ''t'', such that given ''f''(''x'') and ''t'', it is easy to compute ''x''. Consider a [[padlock]] and its key. It is trivial to change the padlock from open to closed without using the key, by pushing the shackle into the lock mechanism. Opening the padlock easily, however, requires the key to be used. Here the key ''t'' is the trapdoor and the padlock is the trapdoor function.

An example of a simple mathematical trapdoor is "6895601 is the product of two prime numbers.  What are those numbers?" A typical "[[Brute-force attack|brute-force]]" solution would be to try dividing 6895601 by many prime numbers until finding the answer. However, if one is told that 1931 is one of the numbers, one can find the answer by entering "6895601 ÷ 1931" into any calculator. This example is not a sturdy trapdoor function – modern computers can guess all of the possible answers within a second – but this sample problem could be improved by [[Integer factorization|using the product of two much larger primes]].

Trapdoor functions came to prominence in [[cryptography]] in the mid-1970s with the publication of [[Asymmetric key algorithm|asymmetric (or public-key) encryption]] techniques by [[Whitfield Diffie|Diffie]], [[Martin Hellman|Hellman]], and [[Ralph Merkle|Merkle]]. Indeed, {{harvtxt|Diffie|Hellman|1976}} coined the term. Several function classes had been proposed, and it soon became obvious that trapdoor functions are harder to find than was initially thought. For example, an early suggestion was to use schemes based on the [[subset sum problem]]. This turned out rather quickly to be unsuitable.

{{As of|2004}}, the best known trapdoor function (family) candidates are the [[RSA (algorithm)|RSA]] and [[Rabin cryptosystem|Rabin]] families of functions.  Both are written as exponentiation modulo a composite number, and both are related to the problem of [[prime factorization]].

Functions related to the hardness of the [[discrete logarithm problem]] (either modulo a prime or in a group defined over an [[Elliptic curve cryptography|elliptic curve]]) are ''not'' known to be trapdoor functions, because there is no known "trapdoor" information about the group that enables the efficient computation of discrete logarithms.

A trapdoor in cryptography has the very specific aforementioned meaning and is not to be confused with a [[Backdoor (computing)|backdoor]] (these are frequently used interchangeably, which is incorrect). A backdoor is a deliberate mechanism that is added to a cryptographic algorithm (e.g., a key pair generation algorithm, digital signing algorithm, etc.) or operating system, for example, that permits one or more unauthorized parties to bypass or subvert the security of the system in some fashion.