On the impossibility of approximate obfuscation and applications to resettable cryptography

The traditional notion of program obfuscation requires that an obfuscation ~Prog of a program Prog computes the exact same function as Prog, but beyond that, the code of ~Prog should not leak any information about Prog. This strong notion of virtual black-box security was shown by Barak et al. (CRYPTO 2001) to be impossible to achieve, for certain unobfuscatable function families. The same work raised the question of approximate obfuscation, where the obfuscated ~Prog is only required to approximate Prog; that is, ~Prog only agrees with Prog with high enough probability on some input distribution. We show that, assuming trapdoor permutations, there exist families of robust unobfuscatable functions for which even approximate obfuscation is impossible. Specifically, obfuscation is impossible even if the obfuscated ~Prog is only required to agree with Prog with probability slightly more than 1/2, on a uniformly sampled input (below 1/2-agreement, the function obfuscated by ~Prog is not uniquely defined). Additionally, assuming only one-way functions, we rule out approximate obfuscation where ~Prog may output bot with probability close to $1$, but otherwise must agree with Prog. We demonstrate the power of robust unobfuscatable functions by exhibiting new implications to resettable protocols. Concretely, we reduce the assumptions required for resettably-sound zero-knowledge to one-way functions, as well as reduce round-complexity. We also present a new simplified construction of a simultaneously-resettable zero-knowledge protocol. Finally, we construct a three-message simultaneously-resettable witness-indistinguishable argument of knowledge (with a non-black-box knowledge extractor). Our constructions use a new non-black-box simulation technique that is based on a special kind of "resettable slots". These slots are useful for a non-black-box simulator, but not for a resetting prover.