ALON ROSEN (IDC) MARGARITA VALD (TAU) EUROCRYPT 2018 - - PowerPoint PPT Presentation

• PAVEL HUBÁČEK (CUNI)
• ALON ROSEN (IDC)
• MARGARITA VALD (TAU)

EUROCRYPT 2018 TEL AVIV, ISRAEL

An Efficiency-Preserving Transformation from Honest-Verifier Statistical Zero-Knowledge to Statistical Zero-Knowledge

Construct Statistical Zero-Knowledge proofs as efficient as the best Honest-Verifier Statistical Zero-Knowledge proofs

New tool: Instance-Dependent statistical zero-knowledge

Statistical Zero-Knowledge

𝑦 ∈ Π𝑍?

Π=(Π𝑍, Π𝑂)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Statistical Zero-Knowledge

𝑦 ∈ Π𝑍?

⋮

Π=(Π𝑍, Π𝑂)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Statistical Zero-Knowledge

𝑦 ∈ Π𝑍?

Outputs: Accept/Reject

⋮

Π=(Π𝑍, Π𝑂)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Statistical Zero-Knowledge

𝑦 ∈ Π𝑍?

Outputs: Accept/Reject

• Completeness (𝑦 ∈ Π𝑍).
• Soundness (𝑦 ∈ Π𝑂):
• Zero-Knowledge (𝑦 ∈ Π𝑍):

Unbounded prover Malicious verifier Statistical efficient simulation

⋮

Π=(Π𝑍, Π𝑂)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

1. minimal interaction 2. minimal prover’s overhead Goal: Efficient statistical zero-knowledge proofs

Via efficient transformation Via direct construction

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Transformation from Honest Verifier SZK to SZK

• Transformations under computational assumptions

[BMO90, OVY93, Oka96]

• Transformations via public-coin with poly number of rounds

[GSV98, Oka96, GV99]

• Transformation to AM – constant round [OngVadhan08]

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Transformation from Honest Verifier SZK to SZK

• Transformations under computational assumptions

[BMO90, OVY93, Oka96]

• Transformations via public-coin with poly number of rounds

[GSV98, Oka96, GV99]

• Transformation to AM – constant round [OngVadhan08]

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Our result (1): ∀Π ∈HVSZK, ∃Statistical Zero-Knowledge proof that is as efficient as the best honest-verifier Statistical Zero-Knowledge proof for Π in terms of:

• prover’s and verifier’s complexity
• round complexity

unconditional

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Concrete Construction for SZK-complete problem

• Honest Verifier constant-round statistical zero-knowledge

proof for Statistical-Difference [SahaiVadhan03] Our result (2): ∃constant-round malicious verifier statistical zero- knowledge proof for Statistical-Difference. unconditional

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Concrete Construction for SZK-complete problem

• Honest Verifier constant-round statistical zero-knowledge

proof for Statistical-Difference [SahaiVadhan03] Our result (2): ∃constant-round malicious verifier statistical zero- knowledge proof for Statistical-Difference.

∀Π ∈ SZK

unconditional

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Efficient Statistical Zero-Knowledge Proofs

High-Level Approach

[HVSZK]

Π ∈HVSZK

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach

[HVSZK]

Π ∈HVSZK

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach

Coin-toss

[HVSZK] Verifier’s coins

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

High-Level Approach

Coin-toss Proof of correct behavior

[HVSZK] Verifier’s coins

P’ V’

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Tossing result is random

and binding.

• Correctness proof is

sound.

High-Level Approach

Coin-toss Proof of correct behavior

[HVSZK] Verifier’s coins

P’ V’

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Coins are statistically

hidden.

• Proof is statistical zero-

knowledge (against unbounded verifier).

High-Level Approach

Coin-toss Proof of correct behavior

[HVSZK] Verifier’s coins

P’ V’

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Tossing result is random

and binding.

• Coins statistically

hidden.

Verifier’s Randomness

Coin-toss

[HVSZK] Verifier’s coins

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Tossing result is random

and binding.

• Coins statistically

hidden.

Verifier’s Randomness

Coin-toss

[HVSZK]

𝑠2 𝐷𝑃𝑁(𝑠

1)

𝑠

𝑤 = 𝑠 1⨁𝑠 2

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• COM is binding.
• COM statistically hiding.

Verifier’s Randomness

𝑠2 𝐷𝑃𝑁(𝑠

1)

[HVSZK] 𝑠

𝑤 = 𝑠 1⨁𝑠 2

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• COM is binding.
• COM statistically hiding.

Verifier’s Randomness

𝑠2 𝐷𝑃𝑁(𝑠

1)

[HVSZK] 𝑠

𝑤 = 𝑠 1⨁𝑠 2

Unconditional?

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• COM is binding.
• COM statistically hiding.

Verifier’s Randomness

𝑠2 𝐷𝑃𝑁(𝑠

1)

[HVSZK] 𝑠

𝑤 = 𝑠 1⨁𝑠 2

Unconditional?

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• COM statistically hiding.

Verifier’s Randomness

𝑠2 𝐷𝑃𝑁(𝑠

1)

[HVSZK] 𝑠

𝑤 = 𝑠 1⨁𝑠 2

Unconditional?

𝑦 ∈ Π𝑂

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• COM is binding.

Verifier’s Randomness

𝑠2 𝐷𝑃𝑁(𝑠

1)

[HVSZK] 𝑠

𝑤 = 𝑠 1⨁𝑠 2

Unconditional?

𝑦 ∈ Π𝑍

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Verifier’s Randomness

𝑠2 𝐷𝑃𝑁(𝑠

1)

[HVSZK] 𝑠

𝑤 = 𝑠 1⨁𝑠 2

Unconditional?

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Instance-Dependent Commitments [BMO90,IOS97]

Definition: For a promise problem Π = (Π𝑍, Π𝑂), an Instance- Dependent commitment scheme is a family {COM𝑦}𝑦∈Π of commitment schemes such that:

• if x ∈ Π𝑂 then COM𝑦 is statistically hiding.
• if x ∈ Π𝑍 then COM𝑦 is statistically binding.

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Constructing Instance-Dependent Commitments

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Constructing Instance-Dependent Commitments

• For specific problems in HVSZK [BMO90, IOS97]
• For all HVSZK with inefficient committer [Vadhan03]
• For all HVSZK with relaxed binding [NguyenVadhan06]

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Constructing Instance-Dependent Commitments

Theorem**[OngVadhan08]: ∀Π ∈ HVSZK, ∃Instance-Dependent commitment scheme that is public-coin and constant-round.

• For specific problems in HVSZK [BMO90, IOS97]
• For all HVSZK with inefficient committer [Vadhan03]
• For all HVSZK with relaxed binding [NguyenVadhan06]

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Correctness proof is

sound.

• Proof is statistical zero-

knowledge (against unbounded verifier).

Proof of Correct Behavior

Coin-toss Proof of correct behavior

[HVSZK]

P’ V’

Verifier’s coins

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Correctness proof is

sound.

• Proof is statistical zero-

knowledge (against unbounded verifier).

Proof of Correct Behavior

Coin-toss Proof of correct behavior

[HVSZK]

P’ V’

Verifier’s coins Unconditional??

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Proof is statistical zero-

knowledge (against unbounded verifier).

Proof of Correct Behavior

Coin-toss Proof of correct behavior

[HVSZK]

P’ V’

Verifier’s coins Unconditional??

𝑦 ∈ Π𝑂

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

• Correctness proof is

sound.

Proof of Correct Behavior

Coin-toss Proof of correct behavior

[HVSZK]

P’ V’

Verifier’s coins Unconditional??

𝑦 ∈ Π𝑍

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Proof of Correct Behavior

Coin-toss Proof of correct behavior

[HVSZK]

P’ V’

Verifier’s coins Unconditional??

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

New Primitive: ID Statistical Zero-Knowledge

Definition: An Instance-Dependent statistical zero-knowledge proof for language L with respect to a promise problem Π=(Π𝑍, Π𝑂), is a family of protocols {(P

𝑦, V𝑦)}𝑦∈Π such that:

• If 𝑦 ∈ Π𝑍 ∪ Π𝑂 then (P𝑦, V𝑦) is complete for L.
• If 𝑦 ∈ Π𝑍 then (P𝑦, V𝑦) is sound for L.
• If 𝑦 ∈ Π𝑂 then (P𝑦, V𝑦) is statistical zero-knowledge for L.

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Constructing ID Statistical Zero-Knowledge

Theorem**: ∀L ∈ NP and ∀Π ∈ HVSZK, ∃ID statistical zero- knowledge proof for L with respect to Π that is:

• constant-round
• Proof of Knowledge (efficient witness extractor)
• statistical zero-knowledge even if the verifier is unbounded

Proof: Blum’s Hamiltonicity protocol in parallel with mutual coin-tossing to generate the challenge.

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

1 ← 𝑉𝑜

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

1 ← 𝑉𝑜

𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

1 ← 𝑉𝑜

𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

1 ← 𝑉𝑜

𝑠2 ← 𝑉𝑜 𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

1 ← 𝑉𝑜

𝑠2 ← 𝑉𝑜 𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑠2

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

𝑤 = 𝑠 1⨁𝑠 2

𝑠

1 ← 𝑉𝑜

𝑠2 ← 𝑉𝑜 𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑠2

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

𝑤 = 𝑠 1⨁𝑠 2

𝑠

1 ← 𝑉𝑜

𝑠2 ← 𝑉𝑜 𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

𝑤 = 𝑠 1⨁𝑠 2

𝑠

1 ← 𝑉𝑜

𝑠2 ← 𝑉𝑜 𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Putting Things Together

𝑦 ∈ Π𝑍? Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑠

𝑤 = 𝑠 1⨁𝑠 2

𝑠

1 ← 𝑉𝑜

𝑠2 ← 𝑉𝑜 𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Proof Idea

Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Proof Idea

Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

• 𝐷𝑃𝑁𝑦 is statistically

hiding.

• All Proofs are statistical

zero-knowledge (against unbounded verifier). 𝑦 ∈ Π𝑂

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Proof Idea

Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

• 𝐷𝑃𝑁𝑦 is statistically

hiding.

• All Proofs are statistical

zero-knowledge (against unbounded verifier). 𝑦 ∈ Π𝑂 Indistinguishable from:

• 𝐷𝑃𝑁𝑦(0).
• simulated proofs.

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Proof Idea

Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Proof Idea

Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

• 𝐷𝑃𝑁𝑦 is binding.
• All Proofs are sound.

𝑦 ∈ Π𝑍

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Proof Idea

Π=(Π𝑍, Π𝑂) ∈ HVSZK

𝑇𝑎𝐿𝑄𝑝𝐿𝑦 for 𝐷𝑦 𝐷𝑦 = 𝐷𝑃𝑁𝑦(𝑠

1)

𝑇𝑎𝐿𝑄

𝑦 for 𝜚

𝑠2 𝜚=(𝑄𝐼, 𝑊

𝐼(𝑠 𝑤))(𝑦)

• 𝐷𝑃𝑁𝑦 is binding.
• All Proofs are sound.

𝑦 ∈ Π𝑍 Simulator:

• Sample honest transcript.
• Extract 𝑠

1.

• Force honest transcript on ෰

𝑊 wrt to 𝑠

1.

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Conclusion & Open Problems

• Additional applications of ID SZK?
• Better concrete efficiency?

Can we use weaker ID commitments? Our transformation allows to focus on constructing efficient Honest Verifier SZK protocols.

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

Conclusion & Open Problems

• Additional applications of ID SZK?
• Better concrete efficiency?

Can we use weaker ID commitments? Our transformation allows to focus on constructing efficient Honest Verifier SZK protocols.

EFFICIENT STATISTICAL ZERO-KNOWLEDGE

• P. HUBÁČEK, A. ROSEN, M. VALD

THANK YOU!