Trapdoor functions that depends only on NP-hard?

Question

As far as I can tell, there are no examples of trapdoor functions which hardness assumptions is merely hardness of some NP-hard problem in worst case. That is, a trapdoor function in which, it is proved that, if there is an PPT algorithm that can invert it with non-negligible probability, then there is a PT algorithm which can solve the worst case of some NP-hard problem.

If I am wrong on the above, can you show me an example of such function?

If I am not, why is it so hard to make such a trapdoor function? Is there a concrete reason why it's hard to develop such function (beside "we haven't figure it out yet")?

This supposedly "duplicate" question (Why hasn't there been an encryption algorithm that is based on the known NP-Hard problems?) doesn't actually answer this question. That question isn't why worst case NP-hard isn't enough to make an encryption out of it. This question is essentially about why there had been no successful attempt at reducing average-case hardness down to worst-case NP-hard, for the purpose of making trapdoor function. There had been problems where average-case is just as hard as worst-case, so the fact that not all problems has worst-case=average-case doesn't mean you can't use different problems where that is true.

Answer 1

The crux of the problem lies in worst to average case reductions. The standard construction of a function which is average case hard is taking a function which is worst case hard and applying all kinds of fancy error correcting codes on its truth table. See Ta-Shma's notes sketching the STV construction. As far as I know, we don't know how to do that for NP (STV starts with a PSPACE hard function).

Even worse, we believe this can't be done for NP. See Bogdanov Trevisan, where it is shown that if an NP complete problem has a worst to average case reduction then the hierarchy collapses. Your problem is not exactly worst to average case reduction, but reducing an NP hard problem to inverting a one way function. However, these are related and Trevisan's paper also rules out such non-adaptive reductions.

More directly related to your question is AGGM, which also rules out adaptive reductions for the case where the size of the inverse image is easy to compute. You might also want to check out this paper. These results are 10-15 years old (STV is around 20), I have no idea if anything stronger was proven since.