ALON ROSEN (IDC) MARGARITA VALD (TAU) EUROCRYPT 2018 - PowerPoint PPT Presentation

An Efficiency-Preserving Transformation from Honest-Verifier Statistical Zero-Knowledge to Statistical Zero-Knowledge • PAVEL HUBÁČEK (CUNI) • ALON ROSEN (IDC) • MARGARITA VALD (TAU) EUROCRYPT 2018 TEL AVIV, ISRAEL

Construct Statistical Zero-Knowledge proofs as efficient as the best Honest-Verifier Statistical Zero-Knowledge proofs New tool: Instance-Dependent statistical zero-knowledge

Statistical Zero-Knowledge Π=(Π 𝑍 , Π 𝑂 ) 𝑦 ∈ Π 𝑍 ? EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Statistical Zero-Knowledge Π=(Π 𝑍 , Π 𝑂 ) 𝑦 ∈ Π 𝑍 ? ⋮ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Statistical Zero-Knowledge Π=(Π 𝑍 , Π 𝑂 ) 𝑦 ∈ Π 𝑍 ? Outputs: ⋮ Accept/Reject EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Statistical Zero-Knowledge Π=(Π 𝑍 , Π 𝑂 ) 𝑦 ∈ Π 𝑍 ? Outputs: ⋮ Accept/Reject • Completeness ( 𝑦 ∈ Π 𝑍 ). • Soundness ( 𝑦 ∈ Π 𝑂 ): Unbounded prover • Zero-Knowledge ( 𝑦 ∈ Π 𝑍 ): Malicious verifier Statistical efficient simulation EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Goal: Efficient statistical zero-knowledge proofs 1. minimal interaction 2. minimal prover ’ s overhead Via efficient Via direct transformation construction EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Transformation from Honest Verifier SZK to SZK • Transformations under computational assumptions [BMO90, OVY93, Oka96] • Transformations via public-coin with poly number of rounds [GSV98, Oka96, GV99] • Transformation to AM – constant round [OngVadhan08] EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Transformation from Honest Verifier SZK to SZK • Transformations under computational assumptions [BMO90, OVY93, Oka96] • Transformations via public-coin with poly number of rounds [GSV98, Oka96, GV99] • Transformation to AM – constant round [OngVadhan08] EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Our result (1): ∀Π ∈ HVSZK, ∃ Statistical Zero-Knowledge proof that is as efficient as the best honest-verifier Statistical Zero-Knowledge proof for Π in terms of: prover ’ s and verifier ’ s complexity • round complexity • unconditional EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Concrete Construction for SZK-complete problem • Honest Verifier constant-round statistical zero-knowledge proof for Statistical-Difference [SahaiVadhan03] unconditional Our result (2): ∃ constant-round malicious verifier statistical zero- knowledge proof for Statistical-Difference. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Concrete Construction for SZK-complete problem • Honest Verifier constant-round statistical zero-knowledge proof for Statistical-Difference [SahaiVadhan03] unconditional Our result (2): ∃ constant-round malicious verifier statistical zero- ∀ Π ∈ SZK knowledge proof for Statistical-Difference. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Efficient Statistical Zero-Knowledge Proofs

High-Level Approach Π ∈ HVSZK [HVSZK] EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach Π ∈ HVSZK [HVSZK] EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach Coin-toss Verifier ’ s coins [HVSZK] EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach Coin-toss Verifier ’ s coins [HVSZK] Proof of correct behavior V ’ P ’ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach Coin-toss Verifier ’ s coins [HVSZK] • Tossing result is random Proof of and binding. correct behavior • Correctness proof is sound. V ’ P ’ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach Coin-toss Verifier ’ s coins [HVSZK] • Coins are statistically hidden. Proof of correct • Proof is statistical zero- behavior knowledge (against V ’ P ’ unbounded verifier). EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness Coin-toss Verifier ’ s coins [HVSZK] • • Coins statistically Tossing result is random hidden. and binding. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness 𝐷𝑃𝑁(𝑠 1 ) Coin-toss 𝑠 2 𝑠 𝑤 = 𝑠 1 ⨁𝑠 2 [HVSZK] • • Coins statistically Tossing result is random hidden. and binding. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness 𝐷𝑃𝑁(𝑠 1 ) 𝑠 2 𝑠 𝑤 = 𝑠 1 ⨁𝑠 2 [HVSZK] • • COM statistically hiding. COM is binding. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness 𝐷𝑃𝑁(𝑠 1 ) Unconditional? 𝑠 2 𝑠 𝑤 = 𝑠 1 ⨁𝑠 2 [HVSZK] • • COM statistically hiding. COM is binding. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness 𝐷𝑃𝑁(𝑠 1 ) Unconditional? 𝑠 2 𝑠 𝑤 = 𝑠 1 ⨁𝑠 2 [HVSZK] • • COM statistically hiding. COM is binding. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness 𝐷𝑃𝑁(𝑠 1 ) Unconditional? 𝑠 2 𝑠 𝑤 = 𝑠 1 ⨁𝑠 2 [HVSZK] 𝑦 ∈ Π 𝑂 • COM statistically hiding. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness 𝐷𝑃𝑁(𝑠 1 ) Unconditional? 𝑠 2 𝑠 𝑤 = 𝑠 1 ⨁𝑠 2 [HVSZK] 𝑦 ∈ Π 𝑍 • COM is binding. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Verifier ’ s Randomness 𝐷𝑃𝑁(𝑠 1 ) Unconditional? 𝑠 2 𝑠 𝑤 = 𝑠 1 ⨁𝑠 2 [HVSZK] EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Instance-Dependent Commitments [BMO90,IOS97] Definition: For a promise problem Π = (Π 𝑍 , Π 𝑂 ) , an Instance- Dependent commitment scheme is a family { COM 𝑦 } 𝑦∈Π of commitment schemes such that: if x ∈ Π 𝑂 then COM 𝑦 is statistically hiding. • if x ∈ Π 𝑍 then COM 𝑦 is statistically binding. • EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Constructing Instance-Dependent Commitments EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Constructing Instance-Dependent Commitments • For specific problems in HVSZK [BMO90, IOS97] • For all HVSZK with inefficient committer [Vadhan03] • For all HVSZK with relaxed binding [NguyenVadhan06] EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Constructing Instance-Dependent Commitments • For specific problems in HVSZK [BMO90, IOS97] • For all HVSZK with inefficient committer [Vadhan03] • For all HVSZK with relaxed binding [NguyenVadhan06] Theorem**[OngVadhan08]: ∀Π ∈ HVSZK, ∃ Instance-Dependent commitment scheme that is public-coin and constant-round. EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Proof of Correct Behavior Coin-toss Verifier ’ s coins [HVSZK] Proof of correct • Proof is statistical zero- behavior • knowledge (against Correctness proof is unbounded verifier). sound. V ’ P ’ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Proof of Correct Behavior Unconditional?? Coin-toss Verifier ’ s coins [HVSZK] Proof of correct • Proof is statistical zero- behavior • knowledge (against Correctness proof is unbounded verifier). sound. V ’ P ’ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Proof of Correct Behavior Unconditional?? Coin-toss Verifier ’ s coins [HVSZK] 𝑦 ∈ Π 𝑂 Proof of correct • Proof is statistical zero- behavior knowledge (against unbounded verifier). V ’ P ’ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Proof of Correct Behavior Unconditional?? Coin-toss Verifier ’ s coins [HVSZK] 𝑦 ∈ Π 𝑍 Proof of correct behavior • Correctness proof is sound. V ’ P ’ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

Proof of Correct Behavior Unconditional?? Coin-toss Verifier ’ s coins [HVSZK] Proof of correct behavior V ’ P ’ EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD

New Primitive: ID Statistical Zero-Knowledge Definition: An Instance-Dependent statistical zero-knowledge proof for language L with respect to a promise problem Π=(Π 𝑍 , Π 𝑂 ) , is a family of protocols {(P 𝑦 , V 𝑦 )} 𝑦∈Π such that: If 𝑦 ∈ Π 𝑍 ∪ Π 𝑂 then (P 𝑦 , V 𝑦 ) is complete for L . • If 𝑦 ∈ Π 𝑍 then (P 𝑦 , V 𝑦 ) is sound for L. • If 𝑦 ∈ Π 𝑂 then (P 𝑦 , V 𝑦 ) is statistical zero-knowledge for L. • EFFICIENT STATISTICAL ZERO-KNOWLEDGE P. HUBÁČEK, A. ROSEN, M. VALD