Fast Zero-Knowledge Proofs and Post-Quantum Signatures Claudio - PowerPoint PPT Presentation

Fast Zero-Knowledge Proofs and Post-Quantum Signatures Claudio Orlandi – Aarhus University @claudiorlandi

Based on joint work with: • Meliisa Chase (Microsoft) • David Derler (TU Graz) • Tore Frederiksen (BIU) • Irene Giacomelli (UW-Madison) • Steven Goldfeder (Princeton) • Marek Jawurek (SAP) • Florian Kerschbaum (SAP) • Jesper Madsen (AU) • Jesper Buus Nielsen (AU) • Sebastian Ramacher (TU Graz) • Christian Rechberger (TU Graz, DTU) • Daniel Slamanig (TU Graz) • Greg Zaverucha (Microsoft)

Motivation: Authentication P V “I am Claudio” “I know my password” “Here is my Pa55w0rD”

Motivation: Authentication A V P “I am Claudio” “Here is my Pa55w0rD” “I am Claudio” “Here is my Pa55w0rD”

Motivation: Zero-Knoweldge Authentication P V “I am Claudio” q a q a

ZK: Definitions P(x) V “I know x s.t. f(x)=1” q Only P knows x a q P,V know f a

ZK: Definitions P(x) V • Completeness • P,V honest à V accepts “I know x s.t. f(x)=1” q a q a

ZK: Definitions P V • Completeness • P,V honest à V accepts “I know x s.t. f(x)=1” q • Proof-of-Knowledge a* q • If P does not know x à V rejects a*

ZK: Definitions P(x) V • Completeness • P,V honest à V accepts “I know x s.t. f(x)=1” q* • Proof-of-Knowledge a q* • If P does not know x à V rejects a • Zero-Knowledge • V learns nothing about x

What can be proven in ZK? Feasability : NP, even PSPACE! This talk: Can we construct efficient proofs for non- algebraic languages such as Efficiently : algebraic languages (Schnorr, …, Groth-Sahai, …) “I know x such that SHA(x)=y”? Two protocols: SNARKS (generic) • ZKGC (from Garbled Circuits) • Short proofs, efficient verification J • ZKBoo (from MPC) • Slow prover L One application: • Implementations: Pinocchio, libsnark, • Generic (post-quantum) signatures

Example: Schnorr Protocol Go to Example

The Crypto Toolbox Stronger assumption Weaker assumption OTP >> SKE >> PKE >> FHE >> Obfuscation More efficient Less efficient 12

Zero-Knowledge from Garbled Circuits Jawurek, Ferschbaum, Orlandi CCS 2013

Zero-Knowledge vs Secure 2PC f,x f,y f,x f B A V P f(x,y) f(x)=1

Garbled Circuits Values in a box are “garbled” d r [F] y f De Gb [Y] [X] Ev e En x Correct if y=f(x)

Garbled Circuits: Authenticity d r [F] y* f De Gb [y*] [X] Ev e En x y* = f(x) OR y* = ⊥

(HV)ZKGC to prove f(x)=y Prover(x) Verifier( ) ([F],e,d) ß Gb( f,r ) x e OT [X] [F] [Y] ß Ev([F],[X]) [Y] Accept if De(d,[Y])=y

(HV)ZKGC to prove f(x)=y Prover(?) Verifier( ) ([F],e,d) ß Gb( f,r ) x* e OT [X] [F] [Y*] De(d,[Y*])={f(x*), ⊥ } Authenticity!

(HV)ZKGC to prove f(x)=y Prover(x) Verifier( ) ([G],e,d) ß Gb( g,r ) x e OT [X] [G] [Y] [Y] ß Ev([G],[X]) Learn g(x)=De(d,[Y]) Corrupt V can change f with g breaking ZK!

Garbled circuits with active security? How can the verifier prove that f was garbled correctly (without breaking soundness)? • Plenty of (costly) solutions are known for 2PC • Zero-Knowledge • Cut-and-choose • Etc. • Can we do better for ZK?

ZKGC to prove f(x)=y Prover(x) Verifier( ) ([F],e,d) ß Gb( f,r ) x e OT Commitment [X] [F] [Z] ß Ev([F],[X]) Comm([Y]) r If [F]!=Gb(f,r) abort Open([Y]) else Accept if De(d,[Y])=y Active security Using only 1 GC!

Recap: ZK based on GC • The main idea: • In ZK the verifier (Bob) has no secrets! • After the protocol, Bob can reveal all his randomness. • Alice can simply check that Bob behaved honestly by redoing his entire computation .

Privacy-Free Garbled Circuits Frederiksen, Nielsen, Orlandi EUROCRYPT 2015

Main idea • In 2PC the garbler has secret input • GC privacy à privacy of input • In ZK V has no input to protect • Can we get more efficient GC without privacy? Yes!

Example: Privacy Free Garbling Go to PFGC

Runtime (rough estimates) • Proof of “c=AES(k,m)” for secret k and public (c,m) • AES: 35k gates (7k ANDs/28k XORs) • Communication : 204kB (98% GC) • Runtime : • OT : 29.4ms (Using Chou-Orlandi OT) (|w|=128) • Garbling : 721µs (Using JustGarble GaXR) • Eval : 273 µs • Total (Garble+OT+Eval+Garble) ~ 31.2ms (+network)

Applications Hu, Mohassel, Rosulek • Sublinear ZK (via ORAM) , Crypto 2015 Chase, Ganesh, Mohassel, • Privacy-Preserving Credentials , Crypto 2016 Kolesnikov, Krawczyk, Lindell, Malozemoff, Rabin, • Attribute-Based KE with General Policies , CCS 2016 Baum; Katz, Malozemoff, Wang; Afshar, Mohassel, Rosulek, • Input validity in 2PC , SCN 2016; ePrint; ePrint …

ZKBoo: Faster Zero-Knowledge for Boolean Circuits Giacomelli, Madsen, Orlandi USENIX Security 2016

From ZKGC to ZKBoo • ZKGC is inherently interactive ( private coin, cannot use Fiat-Shamir) • IKOS ( Ishai, Kushilevitz, Ostrovsky, Sahai ) proposed in 2007 a method to get ZK from MPC. Plugging the right MPC protocol one can get ZK with very good asymptotic complexity. • ZKBoo can be seen as a generalization, simplification and implementation of IKOS with the sole goal of practical efficiency.

To build ZKBoo, we need to find a suitable Instead of MPC protocol, we speak about (2 , 3) -decomposition for C : { Share , Output 1 , Output 2 , Output 3 , Rec } ∪ { f ( j ) 1 , f ( j ) 2 , f ( j ) 3 } j =1 ,..., N 12 / 19

x Share To build ZKBoo, we need to find a suitable w 0 w 0 w 0 Instead of MPC protocol, we speak about 1 2 3 (2 , 3) -decomposition for C : { Share , Output 1 , Output 2 , Output 3 , Rec } ∪ { f ( j ) 1 , f ( j ) 2 , f ( j ) 3 } j =1 ,..., N 12 / 19

x Share To build ZKBoo, we need to find a suitable w 0 w 0 w 0 Instead of MPC protocol, we speak about 1 2 3 (2 , 3) -decomposition for C : f 1 f 1 f 1 1 2 3 { Share , Output 1 , Output 2 , Output 3 , Rec } w 1 w 1 w 1 1 2 3 ∪ { f ( j ) 1 , f ( j ) 2 , f ( j ) 3 } j =1 ,..., N 12 / 19

x Share To build ZKBoo, we need to find a suitable w 0 w 0 w 0 Instead of MPC protocol, we speak about 1 2 3 (2 , 3) -decomposition for C : f 1 f 1 f 1 1 2 3 { Share , Output 1 , Output 2 , Output 3 , Rec } w 1 w 1 w 1 1 2 3 ∪ { f ( j ) 1 , f ( j ) 2 , f ( j ) 3 } j =1 ,..., N f 2 f 2 f 2 1 2 3 . . . . . . . . . w N w N w N 1 2 3 12 / 19

To build ZKBoo, we need to find a suitable w 0 w 0 w 0 Instead of MPC protocol, we speak about 1 2 3 (2 , 3) -decomposition for C : { Share , Output 1 , Output 2 , Output 3 , Rec } w 1 w 1 w 1 1 2 3 ∪ { f ( j ) 1 , f ( j ) 2 , f ( j ) . . . 3 } j =1 ,..., N . . . . . . . . . . . . . . . w N w N w N 1 2 3 Output 1 Output 2 Output 3 12 / 19

To build ZKBoo, we need to find a suitable w 0 w 0 w 0 Instead of MPC protocol, we speak about 1 2 3 (2 , 3) -decomposition for C : { Share , Output 1 , Output 2 , Output 3 , Rec } w 1 w 1 w 1 1 2 3 ∪ { f ( j ) 1 , f ( j ) 2 , f ( j ) . . . 3 } j =1 ,..., N . . . . . . . . . . . . . . . w N w N w N • correct: y = C ( x ) 1 2 3 • 2-private: ∀ e ∈ [3] ∃ a PPT simulator S e that perfectly simulate the Output 1 Output 2 Output 3 y 1 y 2 distribution of ( { w i } i ∈ { e , e +1 } , y e +2 ) y 3 Rec y 12 / 19

Example: the linear decomposition • Computation in a ring (R,+,·) • Add(x 1 ,x 2 ,x 3 ,y 1 ,y 2 ,y 3 ) • z 1 = x 1 + y 1 • z 2 = x 2 + y 2 • Share(x) • z 3 = z 3 + y 3 • Get random x 1 , x 2 ß R • Let x 3 = x - x 1 - x 2 • Mul(x 1 ,x 2 ,x 3 ,y 1 ,y 2 ,y 3 ) • z 1 = x 1 y 1 + x 1 y 2 + x 2 y 1 + r 1 - r 2 • Rec(y 1 ,y 2 ,y 3 ) • z 2 = x 2 y 2 + x 2 y 3 + x 3 y 2 + r 2 - r 3 • y = y 1 + y 2 + y 3 • z 3 = x 3 y 3 + x 3 y 1 + x 1 y 3 + r 3 - r 1

Example: the linear decomposition Correctness: z 1 +z 2 +z 3 = • Computation in a ring (R,+,·) • Add(x 1 ,x 2 ,x 3 ,y 1 ,y 2 ,y 3 ) (x 1 +x 2 +x 3 ) (y 1 +y 2 +y 3 ) • z 1 = x 1 + y 1 • z 2 = x 2 + y 2 • Share(x) • z 3 = z 3 + y 3 • Get random x 1 , x 2 ß R 2-privacy: • Let x 3 = x - x 1 - x 2 • Mul(x 1 ,x 2 ,x 3 ,y 1 ,y 2 ,y 3 ) Any pair (z i ,z i+1 ) is • z 1 = x 1 y 1 + x 1 y 2 + x 2 y 1 + r 1 - r 2 uniform random • Rec(y 1 ,y 2 ,y 3 ) • z 2 = x 2 y 2 + x 2 y 3 + x 3 y 2 + r 2 - r 3 (thanks to r 1 ,r 2 ,r 3 ) • y = y 1 + y 2 + y 3 • z 3 = x 3 y 3 + x 3 y 1 + x 1 y 3 + r 3 - r 1

Public data: C : { 0 , 1 } n → { 0 , 1 } m (boolean circuit) and y ∈ { 0 , 1 } m Input: x s.t. C ( x ) = y 13 / 19

Public data: C : { 0 , 1 } n → { 0 , 1 } m (boolean circuit) and y ∈ { 0 , 1 } m Input: x s.t. C ( x ) = y x w 0 w 0 w 0 1 2 3 f 1 f 1 f 1 1 2 3 w 1 w 1 w 1 1 2 3 f 2 f 2 f 2 1 2 3 . . . . . . . . . w N w N w N 1 2 3 y 1 y 2 y 3 y 13 / 19

Public data: C : { 0 , 1 } n → { 0 , 1 } m (boolean circuit) and y ∈ { 0 , 1 } m Input: x s.t. C ( x ) = y x w 0 w 0 w 0 1 2 3 w 0 w 0 w 0 1 2 3 f 1 f 1 f 1 1 2 3 w 1 w 1 w 1 1 2 3 w 1 w 1 w 1 1 2 3 . . . . . . . . . . . . . . . . . . f 2 f 2 f 2 1 2 3 w 1 w 1 w 1 1 2 3 . . . . . . . . . y 1 y 2 y 3 w N w N w N 1 2 3 y 1 y 2 y 3 y 13 / 19