The One-Wayness of Jacobi Signatures

We show that under a mild number-theoretic conjecture, recovering an integer from its Jacobi signature modulo N = p 2 q, for primes p and q, is as hard as factoring N . This relates, for the first time, the one-wayness of a pseudorandom generator that Damgård proposed in 1988, to a standard number-theoretic problem. In addition, we show breaking the Jacobi pseudorandom function is no harder than factoring.