Groth-Sahai proof system Olivier Blazy Ecole normale sup erieure - - PowerPoint PPT Presentation

▶
groth sahai proof system
SMART_READER_LITE
LIVE PREVIEW

Groth-Sahai proof system Olivier Blazy Ecole normale sup erieure - - PowerPoint PPT Presentation

Apr 06, 2023 138 likes •882 views

Groth-Sahai proof system Olivier Blazy Ecole normale sup erieure Jan. 21st 2011 O. Blazy (ENS) Groth-Sahai proof system Jan. 21st 2011 1 / 38 Contents Introduction 1 Groth-Sahai proof system 2 Non-Interactive Zero-Knowledge

slide-1
SLIDE 1

Groth-Sahai proof system

Olivier Blazy

´ Ecole normale sup´ erieure

  • Jan. 21st 2011
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

1 / 38

slide-2
SLIDE 2

Contents

1

Introduction

2

Groth-Sahai proof system Non-Interactive Zero-Knowledge proofs Bilinear maps Groth-Ostrovsky-Sahai Groth-Sahai (2008)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

2 / 38

slide-3
SLIDE 3

Zero-Knowledge Proof Systems

Introduced in 1985 by Goldwasser, Micali and Rackoff. Reveal nothing other than the validity of assertion being proven Used in many cryptographic protocols

Anonymous credentials Anonymous signatures Online voting . . .

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

3 / 38

slide-4
SLIDE 4

Zero-Knowledge Proof Systems

Introduced in 1985 by Goldwasser, Micali and Rackoff. Reveal nothing other than the validity of assertion being proven Used in many cryptographic protocols

Anonymous credentials Anonymous signatures Online voting . . .

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

3 / 38

slide-5
SLIDE 5

Zero-Knowledge Proof Systems

Introduced in 1985 by Goldwasser, Micali and Rackoff. Reveal nothing other than the validity of assertion being proven Used in many cryptographic protocols

Anonymous credentials Anonymous signatures Online voting . . .

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

3 / 38

slide-6
SLIDE 6

Zero-Knowledge Interactive Proof

Alice Bob interactive method for one party to prove to another that a statement S is true, without revealing anything other than the veracity of S.

1

Completeness: if S is true, the honest verifier will be convinced of this fact

2

Soundness: if S is false, no cheating prover can convince the honest verifier that it is true

3

Zero-knowledge: if S is true, no cheating verifier learns anything other than this fact.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

4 / 38

slide-7
SLIDE 7

Zero-Knowledge Interactive Proof

Alice Bob interactive method for one party to prove to another that a statement S is true, without revealing anything other than the veracity of S.

1

Completeness: if S is true, the honest verifier will be convinced of this fact

2

Soundness: if S is false, no cheating prover can convince the honest verifier that it is true

3

Zero-knowledge: if S is true, no cheating verifier learns anything other than this fact.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

4 / 38

slide-8
SLIDE 8

Non-Interactive Zero-Knowledge Proof

Alice Bob non-interactive method for one party to prove to another that a statement S is true, without revealing anything other than the veracity of S.

1

Completeness: S is true verifier will be convinced of this fact

2

Soundness: S is false no cheating prover can convince the verifier that S is true

3

Zero-knowledge: S is true no cheating verifier learns anything other than this fact.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

5 / 38

slide-9
SLIDE 9

Non-Interactive Witness-Indistinguishable Proof

Alice Bob non-interactive method for one party to prove to another that a statement S is true, without revealing which witness was used.

1

Completeness: S is true verifier will be convinced of this fact

2

Soundness: S is false no cheating prover can convince the verifier that S is true

3

Witness indistinguishability: S is true no cheating verifier can distinguish between two provers that use different witnesses.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

6 / 38

slide-10
SLIDE 10

History of NIZK Proofs

Inefficient NIZK Blum-Feldman-Micali, 1988. ... De Santis-Di Crescenzo-Persiano, 2002. Alternative: Fiat-Shamir heuristic, 1986: interactive ZK proof NIZK But there are examples of insecure Fiat-Shamir transformation Groth-Ostrovsky-Sahai, 2006. Groth-Sahai, 2008.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

7 / 38

slide-11
SLIDE 11

History of NIZK Proofs

Inefficient NIZK Blum-Feldman-Micali, 1988. ... De Santis-Di Crescenzo-Persiano, 2002. Alternative: Fiat-Shamir heuristic, 1986: interactive ZK proof NIZK But there are examples of insecure Fiat-Shamir transformation Groth-Ostrovsky-Sahai, 2006. Groth-Sahai, 2008.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

7 / 38

slide-12
SLIDE 12

History of NIZK Proofs

Inefficient NIZK Blum-Feldman-Micali, 1988. ... De Santis-Di Crescenzo-Persiano, 2002. Alternative: Fiat-Shamir heuristic, 1986: interactive ZK proof NIZK But there are examples of insecure Fiat-Shamir transformation Groth-Ostrovsky-Sahai, 2006. Groth-Sahai, 2008.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

7 / 38

slide-13
SLIDE 13

History of NIZK Proofs

Inefficient NIZK Blum-Feldman-Micali, 1988. ... De Santis-Di Crescenzo-Persiano, 2002. Alternative: Fiat-Shamir heuristic, 1986: interactive ZK proof NIZK But there are examples of insecure Fiat-Shamir transformation Groth-Ostrovsky-Sahai, 2006. Groth-Sahai, 2008.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

7 / 38

slide-14
SLIDE 14

Applications of NIZK Proofs

Fancy signature schemes

group signatures ring signatures traceable signatures . . .

Efficient non-interactive proof of correctness of shuffle Non-interactive anonymous credentials CCA-2-secure encryption schemes Identification E-voting E-cash . . .

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

8 / 38

slide-15
SLIDE 15

Composite order bilinear structure: What ?

(e, G, GT, g, n) bilinear structure: G, GT multiplicative groups of order n = pq

n = RSA integer

g = G e : G × G → GT

e(g, g) = GT e(g a, g b) = e(g, g)ab, a, b ∈ Z

deciding group membership, group operations, bilinear map      efficiently computable.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

9 / 38

slide-16
SLIDE 16

Composite order bilinear structure: Why ?

1

Deciding Diffie-Hellman tuples: given (g, g a, g b, g c) ∈ G4 c = ab ⇐ ⇒ e(g a, g b) = e(g, g c)

2

If h ∈ Gq: ∀v ∈ G, e(h, v)q = 1 e(g ahb, g)q = e(g, g)aq Applications: “Somewhat homomorphic” encryption, Traitor tracing, Signatures, Attribute-based encryption, Fully secure HIBE, . . .

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

10 / 38

slide-17
SLIDE 17

Composite order bilinear structure: Why ?

1

Deciding Diffie-Hellman tuples: given (g, g a, g b, g c) ∈ G4 c = ab ⇐ ⇒ e(g a, g b) = e(g, g c)

2

If h ∈ Gq: ∀v ∈ G, e(h, v)q = 1 e(g ahb, g)q = e(g, g)aq Applications: “Somewhat homomorphic” encryption, Traitor tracing, Signatures, Attribute-based encryption, Fully secure HIBE, . . .

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

10 / 38

slide-18
SLIDE 18

Composite order bilinear structure: Why ?

1

Deciding Diffie-Hellman tuples: given (g, g a, g b, g c) ∈ G4 c = ab ⇐ ⇒ e(g a, g b) = e(g, g c)

2

If h ∈ Gq: ∀v ∈ G, e(h, v)q = 1 e(g ahb, g)q = e(g, g)aq Applications: “Somewhat homomorphic” encryption, Traitor tracing, Signatures, Attribute-based encryption, Fully secure HIBE, . . .

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

10 / 38

slide-19
SLIDE 19

Boneh-Goh-Nissim Encryption Scheme

Public key: (e, G, GT, n) bilinear structure with n = pq g ∈ G, h ∈ Gq. Secret key: p, q Encryption: c = g mhr (r

$

← Zn) Decryption: cq = (g mhr)q = g mqhqr = (g q)m (+ DL) IND-CPA-secure under the:

Subgroup Membership Assumption

Hard to distinguish h ∈ Gq from random h of order n

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

11 / 38

slide-20
SLIDE 20

Boneh-Goh-Nissim Commitment Scheme

Public key: (e, G, GT, n = pq) bilinear structure g ∈ G, h ∈ Gq. Commitment: c = g mhr (r

$

← Zn) Perfectly binding: unique m mod p Computationally hiding: indistinguishable from h of order n Somewhat homomorphic properties: (g ahr) · (g bhs) = g a+bhr+s e(g ahr, g bhs) = e(g a, g b)e(hr, g b)e(g a, hs)e(hr, hs) = e(g, g)abe(h, g as+rbhrs)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

12 / 38

slide-21
SLIDE 21

Groth-Ostrovsky-Sahai: NIZK Proof for Circuit SAT

Groth, Ostrovsky and Sahai (2006)

Perfect completeness, perfect soundness, computational zero-knowledge for NP Common reference string: O(k) bits Proof: O(|C|k) bits

Circuit-SAT is NP-complete w1 w2 w3 w4 1 Idea:

Commit wi using BGN encryption Prove the validity using homomorphic properties

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

13 / 38

slide-22
SLIDE 22

NIZK Proof for Circuit SAT

g w1hr1 = c1 g w2hr2 = c2 g w3hr3 = c3 c4 = g w4hr4 g 1 Prove wi ∈ {0, 1} for i ∈ {1, 2, 3, 4} Prove w4 = ¬(w1 ∧ w2) Prove 1 = ¬(w3 ∧ w4)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

14 / 38

slide-23
SLIDE 23

Proof for c Containing 0 or 1

w mod p ∈ {0, 1} ⇐ ⇒ w(w − 1) = 0 mod p For c = g whr we have e(c, cg −1) = e(g whr, g w−1hr) = e(g w, g w−1)e(hr, g w−1)e(g w, hr)e(hr, hr) = e(g, g)w(w−1)e(h, (g 2w−1hr

  • π

)r) π = g 2w−1hr = proof that c contains 0 or 1 modp. (c detemines w uniquely modp since ord(h) = q) Randomizable proof !

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

15 / 38

slide-24
SLIDE 24

Proof for c Containing 0 or 1

w mod p ∈ {0, 1} ⇐ ⇒ w(w − 1) = 0 mod p For c = g whr we have e(c, cg −1) = e(g whr, g w−1hr) = e(g w, g w−1)e(hr, g w−1)e(g w, hr)e(hr, hr) = e(g, g)w(w−1)e(h, (g 2w−1hr

  • π

)r) π = g 2w−1hr = proof that c contains 0 or 1 modp. (c detemines w uniquely modp since ord(h) = q) Randomizable proof !

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

15 / 38

slide-25
SLIDE 25

A Simple Observation

b0 b1 b2 b0 + b1 + 2b2 − 2 −2 1 1 −1 1 1 1 1 −1 1 −1 1 1 1 1 1 1 1 1 2 b2 = ¬(b0 ∧ b1) ⇐ ⇒ b0 + b1 + 2b2 − 2 ∈ {0, 1}

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

16 / 38

slide-26
SLIDE 26

A Simple Observation

b0 b1 b2 b0 + b1 + 2b2 − 2 −2 1 1 −1 1 1 1 1 −1 1 −1 1 1 1 1 1 1 1 1 2 b2 = ¬(b0 ∧ b1) ⇐ ⇒ b0 + b1 + 2b2 − 2 ∈ {0, 1}

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

16 / 38

slide-27
SLIDE 27

Proof for NAND-gate

g w1hr1 = c1 g w2hr2 = c2 g w3hr3 = c3 c4 = g w4hr4 g 1 Given c1, c2 and c4 commitments for bits w1, w2, w4 Wish to prove w4 = ¬(w1 ∧ w2). i.e. w1 + w2 + 2w4 − 2 ∈ {0, 1} We have c1c2c2

4g −2

= (g w0hr0) · (g w1hr1) · (g w4hr4)2g −2 = g w0+w1+2w4−2hr0+r1+2r4 Prove that c1c2c2

4g −2 contains 0 or 1

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

17 / 38

slide-28
SLIDE 28

NIZK Proof for Circuit SAT

g w1hr1 = c1 g w2hr2 = c2 g w3hr3 = c3 c4 = g w4hr4 g 1 Prove wi ∈ {0, 1} for i ∈ {1, 2, 3, 4} → 2k bits Prove w4 = ¬(w1 ∧ w2) → k bits Prove 1 = ¬(w3 ∧ w4) → k bits CRS size: 3k bits Proof size: (2|W | + |C|)k bits

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

18 / 38

slide-29
SLIDE 29

Groth-Ostrowsky-Sahai is ZK

Subgroup Membership Assumption

Hard to distinguish h ∈ G of order q from random h of order n Simulation simulated CRS h of order n by choosing g = hτ the simulation trapdoor is τ perfectly hiding trapdoor commitments g 1hr1 = c1 g 1hr2 = c2 g 1hr3 = c3 c4 = g 1hr4 g 1

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

19 / 38

slide-30
SLIDE 30

Groth-Ostrowsky-Sahai is ZK

Subgroup Membership Assumption

Hard to distinguish h ∈ G of order q from random h of order n Simulation simulated CRS h of order n by choosing g = hτ the simulation trapdoor is τ perfectly hiding trapdoor commitments g 1hr1 = c1 g 1hr2 = c2 g 1hr3 = c3 c4 = g 1hr4 g 1

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

19 / 38

slide-31
SLIDE 31

Groth-Ostrowsky-Sahai is ZK

Subgroup Membership Assumption

Hard to distinguish h ∈ G of order q from random h of order n Simulation simulated CRS h of order n by choosing g = hτ the simulation trapdoor is τ perfectly hiding trapdoor commitments g 1hr1 = c1 g 1hr2 = c2 g 1hr3 = c3 c4 = g 1hr4 g 1

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

19 / 38

slide-32
SLIDE 32

Groth-Ostrowsky-Sahai is ZK

Witness-indistinguishable 0/1-proof c1 = g 1hr1

π1 = (ghr1)r1 is the proof that c1 contains 1

c1 = g 1hr1 = g 0ghr1 = g 0hτ+r1

π0 = (g −1hτ+r1)τ+r1 is the proof that c1 contains 0

π0 = (g −1hτ+r1)τ+r1 = (g −1hτ)τ+r1(hr)r+τ = (hr+τ)r = (g 1hr)r = π1 Witness-indistinguishable NAND-proof We have c1c2c2

4g −2

= (g 1hr1) · (g 1hr2) · (g 1hr4)2g −2 = g 2hr0+r1+2r4 = g 1hτ+r1+r2+2r4 Computational ZK → Subgroup membership assumption

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

20 / 38

slide-33
SLIDE 33

Groth-Ostrovsky-Sahai: Summary

Perfect completeness and soundness, computational zero-knowledge for NP Idea:

Commit bits using BGN encryption Prove the validity using homomorphic properties Plug the commitments c in the equations and provide additionnal group element π to check the validity e(g w, g wg −1) = 1 e(c, cg −1) = e(h, π)

Common reference string: O(k) bits Proof: O(|C|k) bits

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

21 / 38

slide-34
SLIDE 34

Groth- //////////// Ostrovsky-Sahai: Summary

Perfect completeness and soundness, computational zero-knowledge for NP Idea:

Commit bits using BGN encryption Prove the validity using homomorphic properties Plug the commitments c in the equations and provide additionnal group element π to check the validity e(g w, g wg −1) = 1 e(c, cg −1) = e(h, π)

Common reference string: O(k) bits Proof: O(|C|k) bits

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

21 / 38

slide-35
SLIDE 35

Groth- //////////// Ostrovsky-Sahai: Summary

witness-indistinguishability Perfect completeness and soundness, / / / / / / / / / / / / / / / / / computational/ / / / / / / / / / / / / / / / / / / / / zero-knowledge for NP Idea:

Commit bits using BGN encryption Prove the validity using homomorphic properties Plug the commitments c in the equations and provide additionnal group element π to check the validity e(g w, g wg −1) = 1 e(c, cg −1) = e(h, π)

Common reference string: O(k) bits Proof: O(|C|k) bits

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

21 / 38

slide-36
SLIDE 36

Groth- //////////// Ostrovsky-Sahai: Summary

witness-indistinguishability Perfect completeness and soundness, / / / / / / / / / / / / / / / / / computational/ / / / / / / / / / / / / / / / / / / / / zero-knowledge for / / / / NP algebraic languages Idea:

Commit bits using BGN encryption Prove the validity using homomorphic properties Plug the commitments c in the equations and provide additionnal group element π to check the validity e(g w, g wg −1) = 1 e(c, cg −1) = e(h, π)

Common reference string: O(k) bits Proof: O(|C|k) bits

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

21 / 38

slide-37
SLIDE 37

Groth- //////////// Ostrovsky-Sahai: Summary

witness-indistinguishability Perfect completeness and soundness, / / / / / / / / / / / / / / / / / computational/ / / / / / / / / / / / / / / / / / / / / zero-knowledge for / / / / NP algebraic languages Idea: group elements

Commit/ / / / / bits using BGN encryption Prove the validity using homomorphic properties Plug the commitments c in the equations and provide additionnal group element π to check the validity e(g w, g wg −1) = 1 e(c, cg −1) = e(h, π)

Common reference string: O(k) bits Proof: O(|C|k) bits

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

21 / 38

slide-38
SLIDE 38

Groth- //////////// Ostrovsky-Sahai: Summary

witness-indistinguishability Perfect completeness and soundness, / / / / / / / / / / / / / / / / / computational/ / / / / / / / / / / / / / / / / / / / / zero-knowledge for / / / / NP algebraic languages Idea: group elements

Commit/ / / / / bits using / / / / / / BGN encryption Prove the validity using homomorphic properties Plug the commitments c in the equations and provide additionnal group element π to check the validity e(g w, g wg −1) = 1 e(c, cg −1) = e(h, π)

Common reference string: O(k) bits Proof: O(|C|k) bits

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

21 / 38

slide-39
SLIDE 39

Groth- //////////// Ostrovsky-Sahai: Summary

witness-indistinguishability Perfect completeness and soundness, / / / / / / / / / / / / / / / / / computational/ / / / / / / / / / / / / / / / / / / / / zero-knowledge for / / / / NP algebraic languages Idea: group elements

Commit/ / / / / bits using / / / / / / BGN encryption Prove the validity using homomorphic properties Plug the commitments c in the equations and provide additionnal group element π to check the validity e(g w, g wg −1) = 1 e(c, cg −1) = e(h, π)

Common reference string: O(k) bits Proof: / / / / / / / / / O(|C|k) bits O(|E|k)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

21 / 38

slide-40
SLIDE 40

Symmetric bilinear structure

(e, G, GT, g, p) bilinear structure: G, GT multiplicative groups of order p

p = prime integer

g = G e : G × G → GT

e(g, g) = GT e(g a, g b) = e(g, g)ab, a, b ∈ Z

deciding group membership, group operations, bilinear map      efficiently computable.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

22 / 38

slide-41
SLIDE 41

Boneh-Boyen-Shacham Encryption Scheme

Public key: (e, G, GT, p) g, u = g x, v = g y ∈ G Secret key: x, y Encryption: (c1, c2, c3) = (uα, v β, mg α+β) (α, β

$

← Zp) Decryption: c3/(c1/x

1

c1/y

2

) = m IND-CPA-secure under the:

Decision Linear Assumption

given (u, v, g, uα, v β), Hard to distinguish g α+β from random

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

23 / 38

slide-42
SLIDE 42

Boneh-Boyen-Shacham Commitment Scheme

Public key: (e, G, GT, p) g, u, v ∈ G Commitment: (c1, c2, c3) = (uα, v β, mg α+β) (α, β

$

← Zp) Perfectly binding: unique m ∈ G Computationally hiding: indistinguishable from random g Addition: (c1, c2, c3) · (c′

1, c′ 2, c′ 3) = (uα+α′, v β+β′, mg α+α′+β+β′)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

24 / 38

slide-43
SLIDE 43

Asymmetric bilinear structure

(e, G1, G2, GT, g1, g2, p) bilinear structure: G1, G2, GT multiplicative groups of order p

p = prime integer

gi = Gi e : G1 × G2 → GT

e(g1, g2) = GT e(g a

1 , g b 2 ) = e(g1, g2)ab, a, b ∈ Z

deciding group membership, group operations, bilinear map      efficiently computable.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

25 / 38

slide-44
SLIDE 44

ElGamal Encryption Scheme

Public key: (e, G1, GT, p) g1, h1 = g y

1 ∈ G1

Secret key: y Encryption: (c1, c2) = (g α

1 , mhα 1 ) (α

$

← Zp) Decryption: c2/cy

1 = m

IND-CPA-secure under the:

Decisional Diffie Hellman

given (g1, g α

1 , g β 1 ), Hard to distinguish g αβ 1

from random

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

26 / 38

slide-45
SLIDE 45

ElGamal Commitment Scheme

Public key: (e, G1, GT, p) g1, h1 ∈ G1 Commitment: (c1, c2) = (g α

1 , mhα 1 ) (α

$

← Zp) Perfectly binding: unique m ∈ G1 Computationally hiding: indistinguishable from random g1 Addition: (c1, c2) · (c′

1, c′ 2) = (g α+α′ 1

, mhα+α′

1

)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

27 / 38

slide-46
SLIDE 46

Groth-Sahai Proof System

Groth-Sahai Proof System Pairing product equation (PPE): for variables X1, . . . , Xn ∈ G (E) :

n

  • i=1

e(Ai, Xi)

n

  • i=1

n

  • j=1

e(Xi, Xj)γi,j = tT determined by Ai ∈ G, γi,j ∈ Zp and tT ∈ GT. Groth-Sahai WI proofs that elements in G that were committed to satisfy PPE Assumption DLIN SXDH SD Variables 3 2 1 PPE 9 (2,2) 1 (Linear) 3 2 1 Verification 12n + 27 5m + 3n + 16 n + 1

  • O. B., G. Fuchsbauer, M.

Izabach` ene, A. Jambert,

  • H. Sibert, D. Vergnaud

Batch Groth-Sahai. ACNS 2010

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

28 / 38

slide-47
SLIDE 47

Groth-Sahai Proof System

Groth-Sahai Proof System Pairing product equation (PPE): for variables X1, . . . , Xn ∈ G (E) :

n

  • i=1

e(Ai, Xi)

n

  • i=1

n

  • j=1

e(Xi, Xj)γi,j = tT determined by Ai ∈ G, γi,j ∈ Zp and tT ∈ GT. Groth-Sahai WI proofs that elements in G that were committed to satisfy PPE Assumption DLIN SXDH SD Variables 3 2 1 PPE 9 (2,2) 1 (Linear) 3 2 1 Verification 12n + 27 5m + 3n + 16 n + 1

  • O. B., G. Fuchsbauer, M.

Izabach` ene, A. Jambert,

  • H. Sibert, D. Vergnaud

Batch Groth-Sahai. ACNS 2010

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

28 / 38

slide-48
SLIDE 48

Groth-Sahai Proof System

Groth-Sahai Proof System Pairing product equation (PPE): for variables X1, . . . , Xn ∈ G (E) :

n

  • i=1

e(Ai, Xi)

n

  • i=1

n

  • j=1

e(Xi, Xj)γi,j = tT determined by Ai ∈ G, γi,j ∈ Zp and tT ∈ GT. Groth-Sahai WI proofs that elements in G that were committed to satisfy PPE Assumption DLIN SXDH SD Variables 3 2 1 PPE 9 (2,2) 1 (Linear) 3 2 1 Verification 3n + 6 m + 2n + 8 n + 1

  • O. B., G. Fuchsbauer, M.

Izabach` ene, A. Jambert,

  • H. Sibert, D. Vergnaud

Batch Groth-Sahai. ACNS 2010

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

28 / 38

slide-49
SLIDE 49

Groth-Sahai Proof System: NIWI

(E) :

n

  • i=1

e(Ai, Xi)

n

  • i=1

n

  • j=1

e(Xi, Xj)γi,j = tT Setup on input the bilinear group output a commitment key ck Com on input ck, X ∈ G, randomness ρ output commitment cX to X Prove on input ck, (Xi, ρi)i=1,...,n and (E) output a proof φ Verify on input ck, cXi, (E) and φ output 0 or 1 Properties: correctness honestly generated proofs are accepted by Verify soundness ExtSetup outputs (ck, ek) s.t. given cXi and φ s.t. Verify(ck, cXi, E, π) = 1 then Extract(ek, cXi) returns X ′

i that satisfies (E)

witness-indistinguishability WISetup outputs ck∗ indist. from ck s.t.

Com produces statistically hiding commitments Given (Xi, ρi), (X ′

i , ρ′ i) s.t. Com(ck∗,

Xi, ρi) = Com(ck∗, Xi, ρi) and Xi and Xi satisfy E then Prove(ck∗, Xi, ρi) ≡ Prove(ck∗, Xi, ρi)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

29 / 38

slide-50
SLIDE 50

Groth-Sahai Proof System: NIWI

(E) :

n

  • i=1

e(Ai, Xi)

n

  • i=1

n

  • j=1

e(Xi, Xj)γi,j = tT Setup on input the bilinear group output a commitment key ck Com on input ck, X ∈ G, randomness ρ output commitment cX to X Prove on input ck, (Xi, ρi)i=1,...,n and (E) output a proof φ Verify on input ck, cXi, (E) and φ output 0 or 1 Properties: correctness honestly generated proofs are accepted by Verify soundness ExtSetup outputs (ck, ek) s.t. given cXi and φ s.t. Verify(ck, cXi, E, π) = 1 then Extract(ek, cXi) returns X ′

i that satisfies (E)

witness-indistinguishability WISetup outputs ck∗ indist. from ck s.t.

Com produces statistically hiding commitments Given (Xi, ρi), (X ′

i , ρ′ i) s.t. Com(ck∗,

Xi, ρi) = Com(ck∗, Xi, ρi) and Xi and Xi satisfy E then Prove(ck∗, Xi, ρi) ≡ Prove(ck∗, Xi, ρi)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

29 / 38

slide-51
SLIDE 51

Groth-Sahai Proof System: NIWI

(E) :

n

  • i=1

e(Ai, Xi)

n

  • i=1

n

  • j=1

e(Xi, Xj)γi,j = tT Setup on input the bilinear group output a commitment key ck Com on input ck, X ∈ G, randomness ρ output commitment cX to X Prove on input ck, (Xi, ρi)i=1,...,n and (E) output a proof φ Verify on input ck, cXi, (E) and φ output 0 or 1 Properties: correctness honestly generated proofs are accepted by Verify soundness ExtSetup outputs (ck, ek) s.t. given cXi and φ s.t. Verify(ck, cXi, E, π) = 1 then Extract(ek, cXi) returns X ′

i that satisfies (E)

witness-indistinguishability WISetup outputs ck∗ indist. from ck s.t.

Com produces statistically hiding commitments Given (Xi, ρi), (X ′

i , ρ′ i) s.t. Com(ck∗,

Xi, ρi) = Com(ck∗, Xi, ρi) and Xi and Xi satisfy E then Prove(ck∗, Xi, ρi) ≡ Prove(ck∗, Xi, ρi)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

29 / 38

slide-52
SLIDE 52

Several subcases

(E) : A • X + X • Γ X = tT Pairing product equation θ : 9 elements Γ = 0, linear θ : 3 elements Proof : φ = S⊤i( A) + S⊤(Γ + Γ⊤)i( X) + S⊤ΓS u + rand u.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

30 / 38

slide-53
SLIDE 53

Several subcases

(E) : A • X = tT Pairing product equation θ : 9 elements Γ = 0, linear θ : 3 elements Proof : φ = S⊤i( A). π = R⊤ A

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

30 / 38

slide-54
SLIDE 54

Several subcases

(E) : a • Y + x • B + x • Γ Y = T Multi-scalar equation θ : 9 elements x = 0, linear θ : 3 elements in Zp Y = 0, linear θ : 2 elements in G Proof : φ = R⊤i( B) + R⊤Γi( Y ) + S⊤i′( a) + S⊤Γ⊤i( x) + R⊤ΓS u + rand u.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

31 / 38

slide-55
SLIDE 55

Several subcases

(E) : a • Y = T Multi-scalar equation θ : 9 elements x = 0, linear θ : 3 elements in Zp Y = 0, linear θ : 2 elements in G Proof : φ = S⊤i′( a).

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

31 / 38

slide-56
SLIDE 56

Several subcases

(E) : x • B = T Multi-scalar equation θ : 9 elements x = 0, linear θ : 3 elements in Zp Y = 0, linear θ : 2 elements in G Proof : φ = R⊤i( B). π = R⊤ B

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

31 / 38

slide-57
SLIDE 57

Several subcases

(E) : a • x + x • Γ x = t Quadratic equation θ : 6 elements Γ = 0, linear θ : 2 elements in Zp Proof : φ = R⊤i′( b) + R⊤(Γ + Γ⊤)i′( x) + R⊤ΓR u + rand u.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

32 / 38

slide-58
SLIDE 58

Several subcases

(E) : a • x = t Quadratic equation θ : 6 elements Γ = 0, linear θ : 2 elements in Zp Proof : φ = R⊤i′( b). π = R⊤ b

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

32 / 38

slide-59
SLIDE 59

Groth-Sahai Proof System: DLin

(E) : e(X, g x) = 1T Setup ck = ((u1,1, 1, g), (1, u2,2, g), (u3,1, u3,2, u3,3)) ∈ (G3)3 u1,1, u2,2

$

← G and λ, µ

$

← Z∗

p

u3 = uλ

1 ⊙ uµ 2 = (u3,1 = uλ 1,1, u3,2 = uµ 2,2, u3,3 = g λ+µ)

Com cY = (us1

1,1 · us3 3,1, us2 2,2 · us3 3,2, Y · g s1+s2 · us3 3,3).

Prove φ = (g s1x, g s2x, g s3x)⊤ Verify i( A) • cY

?

= u • φ

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

33 / 38

slide-60
SLIDE 60

Groth-Sahai Proof System: DLin

(E) : e(X, g x) = 1T Setup ck = (u1, u2, u3). Com cY = (1, 1, Y )⊙us1

1 ⊙us2 2 ⊙us3 3 = (us1 1,1·us3 3,1, us2 2,2·us3 3,2, Y ·g s1+s2 ·us3 3,3).

Prove φ = (g s1x, g s2x, g s3x)⊤ Verify i( A) • cY

?

= u • φ

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

33 / 38

slide-61
SLIDE 61

Groth-Sahai Proof System: DLin

(E) : e(X, g x) = 1T Setup ck = (u1, u2, u3). Com cY = (us1

1,1 · us3 3,1, us2 2,2 · us3 3,2, Y · g s1+s2 · us3 3,3).

Prove φ = S⊤ A = (g s1x, g s2x, g s3x)⊤ Verify i( A) • cY

?

= u • φ

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

33 / 38

slide-62
SLIDE 62

Groth-Sahai Proof System: DLin

(E) : e(X, g x) = 1T Setup ck = (u1, u2, u3). Com cY = (us1

1,1 · us3 3,1, us2 2,2 · us3 3,2, Y · g s1+s2 · us3 3,3).

Prove φ = (g s1x, g s2x, g s3x)⊤ Verify i( A) • cY

?

= u • φ

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

33 / 38

slide-63
SLIDE 63

Groth-Sahai Proof System: DLin

(E) : e(X, g x) = 1T Setup ck = (u1, u2, u3). Com cY = (us1

1,1 · us3 3,1, us2 2,2 · us3 3,2, Y · g s1+s2 · us3 3,3).

Prove φ = (g s1x, g s2x, g s3x)⊤ Verify i( A) • cY

?

= u • φ Properties: Pairing Product Equation Linear.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

33 / 38

slide-64
SLIDE 64

New Subcases with SXDH

(E) : A • Y + X • B + X • Γ Y = tT Pairing product equation θ : 2* 4 elements

  • X = 0, linear θ : 2 elements in G1
  • Y = 0, linear θ : 2 elements in G2
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

34 / 38

slide-65
SLIDE 65

New Subcases with SXDH

(E) : A • Y = tT Pairing product equation θ : 2* 4 elements

  • X = 0, linear θ : 2 elements in G1
  • Y = 0, linear θ : 2 elements in G2
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

34 / 38

slide-66
SLIDE 66

New Subcases with SXDH

(E) : X • B = tT Pairing product equation θ : 2* 4 elements

  • X = 0, linear θ : 2 elements in G1
  • Y = 0, linear θ : 2 elements in G2
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

34 / 38

slide-67
SLIDE 67

New Subcases with SXDH

(E) : A • y + X • b + X • Γ y = T1 Multi-scalar equation in G1 θ : 2 elements in G1, 4 in G2

  • X = 0, linear θ : 1 element in G1
  • y = 0, linear θ : 2 elements in Zp
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

35 / 38

slide-68
SLIDE 68

New Subcases with SXDH

(E) : A • y = T1 Multi-scalar equation in G1 θ : 2 elements in G1, 4 in G2

  • X = 0, linear θ : 1 element in G1
  • y = 0, linear θ : 2 elements in Zp
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

35 / 38

slide-69
SLIDE 69

New Subcases with SXDH

(E) : X • b = T1 Multi-scalar equation in G1 θ : 2 elements in G1, 4 in G2

  • X = 0, linear θ : 1 element in G1
  • y = 0, linear θ : 2 elements in Zp
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

35 / 38

slide-70
SLIDE 70

New Subcases with SXDH

(E) : a • y + x • b + x • Γ y = t Quadratic equation θ : 2 elements in G1, 2 in G2

  • x = 0, linear θ : 2 elements in Zp
  • y = 0, linear θ : 2 elements in Zp
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

36 / 38

slide-71
SLIDE 71

New Subcases with SXDH

(E) : a • y = t Quadratic equation θ : 2 elements in G1, 2 in G2

  • x = 0, linear θ : 2 elements in Zp
  • y = 0, linear θ : 2 elements in Zp
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

36 / 38

slide-72
SLIDE 72

New Subcases with SXDH

(E) : x • b = t Quadratic equation θ : 2 elements in G1, 2 in G2

  • x = 0, linear θ : 2 elements in Zp
  • y = 0, linear θ : 2 elements in Zp
  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

36 / 38

slide-73
SLIDE 73

Groth-Sahai Proof System: NIZK

such equations are not known to always have NIZK proofs auxiliary variables and equations have to be introduced. If tT = n′

j=1 e(gj, hj) for known g1, . . . , gn′, h1, . . . , hn′ ∈ G, the simulator

can prove that

n

  • i=1

e(Ai, Xi) ·

n

  • i=1

·

n

  • j=1

e(Xi, Xj)aij =

n′

  • j=1

e(gj, Yj) and that introduced variables Y1, . . . , Yn′ satisfy the linear equations Yj = hj. size of NIZK proofs not constant.

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

37 / 38

slide-74
SLIDE 74

Conclusion

Groth-Sahai framework for NIWI/NIZK proofs Applications

Non-frameable group signatures Efficient (offline) e-cash system Group signatures with VLR Fair blind signatures

Ongoing work

(Non-interactive) Receipt-Free E-voting (Round-optimal) Blind Signatures (under classical assumption)

  • O. Blazy (ENS)

Groth-Sahai proof system

  • Jan. 21st 2011

38 / 38