Complexity Theory (fall 2016)
Dominique Unruh
Solution of Exercise Sheet 3
Problem 1: Factoring, NP, and coNP
Consider the factoring decision problem:
FACTORING := {hN, L, U i : ∃ prime p s.t. p | N, L ≤ p ≤ U }.
That is, the factoring decision problem is to decide whether N has a prime factor between
L and U .
The factoring search problem is: Given N ≥ 2, find primes p1 , . . . , pn (not necessarily
distinct) such that p1 · . . . · pn = N .
(a) Assume you have a polynomial-time Turing machine M that solves the factoring search
problem.1 Construct a polynomial-time Turing machine M 0 that solves FACTORING.2
Note: You do not need to describe the Turing machine in detail (giving the list
of states, symbols, transition function). It is sufficient to describe the algorithm
in pseudocode. You do not need to prove that the resulting Turing machine is
polynomial-time (but it should be polynomial-time). You may assume without proof
that there is a polynomial-time algorithm that decides whether a number is a prime.
Solution. M 0 executes the following algorithm:
Input: integers N, L, U .
hp1 , . . . , pn i ← M (N )
for i = 1 to n do
if L ≤ pi ≤ U then
return 1
return 0
.noituloS
(b) Construct an polynomial-time oracle Turing machine M such that M FACTORING solves
the factoring search problem.3
Note: Same as the note in (a).
Hint: Do a binary search for the smallest prime factor first. And then use recursion.
1
That is, for any positive N , we have M (N ) = hp1 , . . . , pn i such that all pi are prime and p1 ·. . .·pn = N .
That is, M 0 (N, L, U ) = 1 iff hN, L, U i ∈ FACTORING.
3
If you were not in the practice session: the definition of an oracle Turing machine is given in
Arora-Barak, Sec. 3.4.
2
Solution. M FACTORING executes the following recursive algorithm:
Input: integer N .
if N is prime then
return N
L := 2, U := N
// Doing binary search for N ’s smallest prime factor
while L < U do // Invariant: N ’s smallest prime factor is in [L, U ]
if hN, L, b(U + L)/2ci ∈ FACTORING then
U := b(U + L)/2c
else
L := b(U + L)/2c + 1
// Now U = L is N ’s smallest prime factor
p1 := L
// Get the remaining prime factors by recursive call
hp2 , . . . , pn i := M FACTORING (N/p1 )
return hp1 , . . . , pn i
In this algorithm, the condition hN, L, b(U +L)/2ci ∈ FACTORING in the if-statement
is evaluated by calling the oracle FACTORING.
.noituloS
(c) Show that FACTORING ∈ NP.
Note: It is sufficient to say what the certificate u is and what the Turing machine
M (hN, L, U i, u) computes. You may assume without proof that there is a polynomialtime algorithm that decides whether a number is a prime.
Solution. A certificate is a prime factor p of N with L ≤ p ≤ U . M (hN, L, U i, u)
checks whether u is prime and whether u | N and whether L ≤ p ≤ U . In that case
M outputs 1.
.noituloS
(d) Show that FACTORING ∈ coNP.
Note: Same as the note in (c).
Hint: Prime factors.
Solution. A certificate is a prime factorization u = hp1 , . . . , pn i of N .
M (hN, L, U i, u) with u = hp1 , . . . , pn i checks whether all pi are prime, and whether
N = p1 · . . . · pn , and whether L ≤ pi ≤ U for no i. In that case M outputs 1.
If N, L, U are not integers, M outputs 1.
We show that this TM is indeed doing what it should (i.e., hN, L, U i ∈
/
FACTORING ⇐⇒ ∃u.M (hN, L, U i, u) = 1). If hN, L, U i ∈
/ FACTORING, then
with u as described, M will output 1 because no prime factor is between L, U . If
2
hN, L, U i ∈ FACTORING, then if u is the prime factorization (which is unique up to
reordering), M will output 0 because there is a pi with L ≤ pi ≤ U . And if u is not
the prime factorization, M will output 0.
Thus M does what it should, hence FACTORING ∈ coNP.
Alternative proof: you could also have shown that FACTORING ∈ NP (with a very
similar TM M ) and then concluded that FACTORING ∈ coNP.
.noituloS
(e) (Bonus points) Show that if FACTORING is NP-complete, then NP = coNP.
Note: For this reason, it is commonly assumed that factoring is not NP-complete.
(Since it is believed that NP 6= coNP.)
Hint: For an L ∈ NP, show that L ≤p FACTORING. Then show L ∈ NP and
L ∈ coNP. Then you will have shown NP ⊆ coNP. For the other direction,
proceed similarly. Recall that L denotes the complement of L.
Solution. Assume that FACTORING is NP-complete.
We first show NP ⊆ coNP. Fix L ∈ NP, we have to show that L ∈ coNP.
Since L ∈ NP and FACTORING is NP-complete, L ≤p FACTORING. The same
reduction f that shows L ≤p FACTORING also shows L ≤p FACTORING. (Because
“x ∈ L ⇐⇒ f (x) ∈ FACTORING” and x ∈ L ⇐⇒ f (x) ∈ FACTORING are logically
equivalent.) Since FACTORING ∈ coNP by (d), we have FACTORING ∈ NP. With
L ≤p FACTORING, it follows that L ∈ NP. By definition of coNP, this means
L ∈ coNP.
We have shown NP ⊆ coNP.
We now show coNP ⊆ NP. Fix L ∈ coNP, we have to show that L ∈ NP. Since
L ∈ coNP, we have L ∈ NP. Since FACTORING is NP-complete, it follows that
L ≤p FACTORING. Thus L ≤p FACTORING. Since FACTORING ∈ NP (see above),
it follows that L ∈ NP.
We have shown coNP ⊆ NP.
.noituloS
Problem 2: The Turing Hierarchy
(a) Show that for any language L, the Halting problem
HALTL := {hx, αi : MαL (x) halts}
is undecidable given oracle access to L. (Here Mα is the oracle Turing machine with
description α.) That is, for no oracle Turing machine M , we have that M L (x, α) =
1 ⇐⇒ hx, αi ∈ HALTL .
3
Hint: The proof is almost the same as the proof that HALT is undecidable by a
normal Turing machine (without oracle access to L). A proof at the level of detail as
done in the lecture is sufficient.
Note: What you are essentially asked to do here is to show that the proof of the
undecidability of the Halting problem relativizes.
Solution. Assume HALTL can be decided by some oracle Turing machine M L with
access to L. Then we can construct an OTM M̂ L that does:
(
halts
if MαL (α) does not halt
M̂ (α)
does not halt if MαL (α) halts.
M̂ L (α) can be easily constructed: it just calls M L (α, α), and if M L returns 1, M̂ L
enters an infinite loop, else M̂ L halts.
Since every OTM has a description, there is a β such that M̂ L is MβL . Thus for all
α, MβL (α) halts iff MαL (α) does not halt. With α := β this is a contradiction. Thus
our assumption that M L decides HALT was wrong. Hence HALTL is not decidable
by OTMs with access to L.
.noituloS
(b) Show that there is an infinite sequence of languages L1 , L2 , . . . , such that:
• Li ≤p Li+1 . (That is, Li+1 is at least as hard as Li .)
• Given oracle access to Li , no Turing machine can decide Li+1 . (Not even an
unlimited Turing machine. This in particular implies that Li+1 6≤p Li .)
Note: If you don’t manage both properties, the second one is more important.
Hint: Assume you have constructed L1 , . . . , Ln , then construct Ln+1 . Use (a). Also
the following construction may turn out to be useful: If L, M are languages, then
L + M := {0kx : x ∈ L} ∪ {1kx : x ∈ M } encodes a language that contains both L
and M .
Solution. Let L1 := ∅. Let Li+1 := HALTLi + Li .
We have Li ≤p Li+1 very easily: f (x) := 1kx is polynomial-time computable and
x ∈ Li ⇐⇒ f (x) = 1kx ∈ {0kx : x ∈ HALTLi } ∪ {1kx : x ∈ Li }
= HALTLi + Li = Li+1 .
Thus f is a Karp reduction from Li to Li+1 .
We show that Li+1 cannot be decided with oracle access to Li . Assume that M Li
decides Li+1 . Let M̂ Li (x) return M Li (0kx). Since M Li decides Li+1 = HALTLi + Li ,
M̂ Li decides HALTLi . But by (a), no Turing machine with Li -oracle can decide
HALTLi . We have a contradiction. Thus Li+1 cannot be decided with oracle access
to Li .
.noituloS
4
Problem 3: Polynomial identity testing and SAT (bonus problem)
In this problem I will present a (wrong) proof that there is a polynomial-time algorithm
for deciding SAT. (This would imply that NP ⊆ BPP.4 )
(i) If we interpret Boolean operations as functions on 0, 1, then we can represent A ∧ B
as A · B, and A ∨ B as 1 − (1 − A) · (1 − B), and ¬A as 1 − A.
(ii) Thus we can translate a Boolean formula ϕ (in particular a CNF formula) into a
formula p containing only ·, +, −. We then have that for all x1 , . . . , xn ∈ {0, 1},
ϕ(x1 , . . . , xn ) = p(x1 , . . . , xn ).
(iii) Deciding whether ϕ is satisfiable is equivalent to deciding whether ϕ 6= 0 for some
input.
(iv) To decide whether ϕ 6= 0 for some input, we just check whether p 6= 0 for some
input.
(v) Whether p 6= 0 for some input can be tested probabilistically using the algorithm
for polynomial identity testing from the practice.5
(vi) Concluding, we have shown that we can decide whether ϕ is satisfiable in polynomialtime (up to a small error probability ε).
In fact, no probabilistic algorithm for deciding SAT in polynomial time is known.
Where is the mistake in the above proof? Why is it wrong?
For bonus points: Give a formula ϕ on which the algorithm will give the wrong answer.
Solution. Step (iv) is wrong. The following would be true: “To decide whether
ϕ(x1 , . . . , xn ) 6= 0 for some input x1 , . . . , xn ∈ {0, 1}, we just check whether
p(x1 , . . . , xn ) 6= 0 for some input x1 , . . . , xn ∈ {0, 1}.”
However, p takes arbitrary integers as inputs. So if we say “p 6= 0 for some input”
that means “p(x1 , . . . , xn ) 6= 0 for some input x1 , . . . , xn ∈ Z”.
It could be that ϕ = 0 for all inputs, and thus p = 0 for all inputs x1 , . . . , xn ∈ {0, 1},
but still p =
6 0 for some x1 , . . . , xn ∈
/ {0, 1}. Then the polynomial identity testing algorithm
will return p 6= 0, and our algorithm would incorrectly claim that p is satisfiable.
Actually, the problem occurs already with extremely simple formulas. E.g., ϕ := x∧¬x.
ϕ is not satisfiable. But if we use the translation from above we get p = x · (1 − x). We
have that p = x − x2 6= 0. (But p(0) = p(1) = 0.)
.noituloS
4
BPP is the class of problems that can be decided in probabilistic polynomial-time. We have not
defined it yet. You do not need to understand the comment about NP ⊆ BPP for solving this problem.
5
Reminder: Given a polynomial p, that algorithm decides in polynomial-time with small error ε
whether p = 0. The polynomial is encoded as an algebraic circuit which in particular allows us to encode
formulas containing only ·, +, −.
5