Mahaney 1982 proved that if P != NP then there are no sparse
NP-complete sets. Sparse means that the number of strings of length n
is bounded by n**k for some k:
http://weblog.fortnow.com/2006/04/favorite-theorems-small-sets.html
Consider a block cipher like AES-128, where the key size is equal to
the block size. The known-plaintext cryptanalysis problem is: given a
set of plaintext/ciphertext pairs (P1,C1),(P2,C2),...(PN,CN), find a
set of keys K so that for any k in K, E(P1,k)=C1, E(P2,k)=C2, etc.
Obviously there will almost always be just one such K, but maybe
there's occasionally two or three, etc. Still, one would hope that
for a generalized family of block ciphers (for arbitrary sized blocks)
based on reasonable principles, one can prove some polynomial upper
bound. That means that the set K is sparse under the stated
definition.
We might like to imagine that cryptanalysis is NP-hard because we can
draw a boolean circuit for these ciphers that's a big mess, so it
looks like a general SAT instance. Am I missing something, or does
Mahaney's theorem make this reasoning over-optimistic? Where is the
complexity of cryptanalysis likely to really live?