Efficient Designated-Verifier Non- Interactive Zero-Knowledge Proofs - - PowerPoint PPT Presentation

Efficient Designated-Verifier Non- Interactive Zero-Knowledge Proofs

• f Knowledge

Pyrros Chaidos, Geoffroy Couteau

1 /11

Zero-Knowledge Proof

• Complete: if P knows a solution, V accepts
• Sound: if there is no solution, P cannot convince V
• Zero-Knowledge: V does not learn the solution

verifier prover

2 /11

Non-Interactive Zero- Knowledge Proof

• Complete: if P knows a solution, V accepts
• Sound: if there is no solution, P cannot convince V
• Zero-Knowledge: V does not learn the solution

verifier prover

3 /11

Non-Interactive Zero- Knowledge Proof of Knowledge

• Complete: if P knows a solution, V accepts
• Sound: P must know a solution to convince V
• Zero-Knowledge: V does not learn the solution

verifier prover

4 /11

• Complete: if P knows a solution, V accepts
• Sound: P must know a solution to convince V
• Zero-Knowledge: V does not learn the solution

verifier prover

4 /11

Designated-Verifier NIZKPoK

The NIZK Landscape

Practical Inefficient Provably secure Heuristic

Fiat- Shamir [FS86] Hidden- bit model [BFM88] NIZKs

5 /11

The NIZK Landscape

Practical Inefficient Provably secure Heuristic

Fiat- Shamir [FS86] Hidden- bit model [BFM88] Groth- Sahai [GS07] NIZKs

5 /11

The NIZK Landscape

Practical Inefficient Provably secure Heuristic

Fiat- Shamir [FS86] Hidden- bit model [BFM88]

• nly from pairings

Groth- Sahai [GS07] NIZKs

5 /11

The NIZK Landscape

Practical Inefficient Provably secure Heuristic

Fiat- Shamir [FS86] Hidden- bit model [BFM88] DVNIZK [DFN06] From Σ-protocols + homomorphic encryption Groth- Sahai [GS07] NIZKs

5 /11

The DFN Compiler

verifier prover

e · ~ z0 + ~ z1

e

Σ

commitment c

6 /11

The DFN Compiler

verifier prover

e · ~ z0 + ~ z1

e

Σ

commitment c

6

m

Eval( ,f) = f(m) ,

m ,

Decrypt( ) = m Encrypt(m, ) =

m

/11

The DFN Compiler

verifier prover

e · ~ z0 + ~ z1

c,

DVNIZK CRS:

e

6

m

Eval( ,f) = f(m) ,

m ,

Decrypt( ) = m Encrypt(m, ) =

m

/11

The DFN Compiler

7

Non-standard assumption Not a proof of knowledge Soundness is bounded

/11

The DFN Compiler

7

Non-standard assumption Not a proof of knowledge Soundness is bounded

/11

The DFN Compiler

7

Non-standard assumption Not a proof of knowledge Soundness is bounded

crucial in anonymous authentication

/11

The DFN Compiler

7

Non-standard assumption Not a proof of knowledge Soundness is bounded

crucial in anonymous authentication

/11

The DFN Compiler

7

Non-standard assumption Not a proof of knowledge Soundness is bounded

crucial in anonymous authentication

/11

proof

accepted/refused

The DFN Compiler

7

Non-standard assumption Not a proof of knowledge Soundness is bounded

crucial in anonymous authentication

/11

proof

accepted/refused

proof

Q times

The DFN Compiler

7

Non-standard assumption Not a proof of knowledge Soundness is bounded

crucial in anonymous authentication there is an attack

/11

proof

accepted/refused

proof

Q times

7

Not a proof of knowledge Soundness is bounded

The [CG15] Compiler

Standard assumption

crucial in anonymous authentication there is an attack

/11

7

This work

Proof of knowledge Statistical soundness Unbounded soundness

/11

Our Technique

8

c,

verifier prover CRS:

e · ~ z0 + ~ z1; r

e; re

Eval( ) ,

x 7! x · ~ z0 + ~ z1

,

e; re

, Decrypt( )

e · ~ z0 + ~ z1; r

e · ~ z0 + ~ z1

=

/11

Our Technique

8

c,

verifier prover CRS:

0; e

Eval( ) , ,

0; e

x 7! x~ r + ~ z1

~ z1; −e~ r

=

x 7! ~ r + ~ z0

0; 1

Eval( ) , ,

~ z0;~ r

=

~ z1; −e~ r

~ z0;~ r

Eval( f) , ,

e · ~ z0 + ~ z1; 0

=

(x0, x1) 7! ex0 + x1

f:

Idea: embed e as a random coin need a decodable scheme

~ z1; −e~ r

~ z0;~ r

/11

Our Technique

8

c,

verifier prover CRS:

0; e

Eval( ) , ,

0; e

x 7! x~ r + ~ z1

~ z1; −e~ r

=

x 7! ~ r + ~ z0

0; 1

Eval( ) , ,

~ z0;~ r

=

~ z1; −e~ r

~ z0;~ r

Eval( f) , ,

e · ~ z0 + ~ z1; 0

=

(x0, x1) 7! ex0 + x1

f:

use as extraction trapdoor secret key not needed anymore!

~ z1; −e~ r

~ z0;~ r

/11

e

Why Extraction Works?

• Ext decrypts and
• Knowing does not allow P to cheat:
• Let (M,R) be the plaintext/random coin orders
• Pick a scheme with gcd(M,R) = 1
• leaks only e mod R (statistically)
• Ext can extract e mod M from an incorrect proof

9

~ z0

~ z1

0; e

/11

What’s in the Paper?

• We build a general, Groth-Sahai-like framework of

unbounded DVNIZK proofs of knowledge, for statements over an abelian group.

• A dual variant of our framework handles statements
• ver additively homomorphic cryptosystems.
• A third variant gives up on properties (unbounded,

PoK) for efficiency, beating even Fiat-Shamir.

10 /11

Thank you for your attention

11

Questions?

/11