**Context**: the general question is whether *worst-case* hardness
implies *average-case* hardness, and a particularly interesting
direction is basing cryptography on **NP**-hardness (e.g., assuming
**P** $\neq$ **NP**, can we get one-way functions, public-key
encryption, etc.?)