New Constructions of Statistical NIZKs: Dual-Mode DV-NIZKs and More - - PowerPoint PPT Presentation
New Constructions of Statistical NIZKs: Dual-Mode DV-NIZKs and More Benot Libert, Alain Passelgue, Hoeteck Wee, and David J. Wu May 2020 Non-Interactive Zero-Knowledge (NIZK) [BFM88] accept if NP language 0,1 0,1
Completeness: ∀𝑦 ∈ ℒ ∶ Pr 𝑄, 𝑊 (𝑦) = accept = 1 “Honest prover convinces honest verifier of true statements” Soundness: ∀𝑦 ∉ ℒ, ∀𝑄∗ ∶ Pr 𝑄∗, 𝑊 𝑦 = accept ≤ 𝜁 “No prover can convince honest verifier of false statement” [BFM88]
can consider both computational and statistical variants
[BFM88] Zero-Knowledge: for all efficient verifiers 𝑊∗, there exists an efficient simulator 𝒯 where
can consider both computational and statistical variants
public CRS secret verification key
publicly-verifiable
Construction Assumption Soundness Zero-Knowledge
[FLS90] factoring computational statistical [GOS06] 𝑙-Lin (pairing group) stat. comp. stat. comp. [CHK03] CDH (pairing group) computational statistical [PS19] LWE stat. comp. stat. comp. [SW14] iO + OWFs statistical computational [QRW19, CH19, KNYY19] CDH computational statistical [LQRWW19] CDH/LWE/LPN computational computational [CDIKLOV19] DCR stat. comp. stat. comp.
malicious designated-verifier
publicly-verifiable
Construction Assumption Soundness Zero-Knowledge
[GOS06] 𝑙-Lin (pairing group) stat. comp. stat. comp. [PS19] LWE stat. comp. stat. comp. [SW14] iO + OWFs statistical computational [CDIKLOV19] DCR stat. comp. stat. comp.
malicious designated-verifier
Statistical zero-knowledge seems more difficult to achieve
Statistical ZK provides everlasting privacy This work: Compiling NIZKs in the hidden-bits model to statistical (DV)-NIZKs
Statistical ZK provides everlasting privacy This work: Compiling NIZKs in the hidden-bits model to statistical (DV)-NIZKs
More precisely: DV-NIZKs are “dual-mode” and maliciously secure
Statistical ZK provides everlasting privacy This work: Compiling NIZKs in the hidden-bits model to statistical (DV)-NIZKs
Weaker assumption compared to [GOS06] which required 𝑙-Lin in both groups (𝑙-KerLin is a search assumption implied by 𝑙-Lin)
publicly-verifiable
Construction Assumption Soundness Zero-Knowledge
[FLS90] factoring computational statistical [GOS06] 𝑙-Lin (1, 2) stat. comp. stat. comp. [CHK03] CDH (pairing group) computational statistical [PS19] LWE stat. comp. stat. comp. [SW14] iO + OWFs statistical computational [QRW19, CH19, KNYY19] CDH computational statistical [LQRWW19] CDH/LWE/LPN computational computational [CDIKLOV19] DCR stat. comp. stat. comp. This work DDH/QR/DCR stat. comp. stat. comp. This work 𝒍-Lin (𝟐), 𝒍-KerLin (𝟑) computational statistical
malicious designated-verifier
prover has access to uniformly random bit string of length 𝑜 𝑜 bits long
[FLS90]
prover has access to uniformly random bit string of length 𝑜
𝑜 bits long prover outputs a subset 𝐽 ⊆ [𝑜] and a proof 𝜌
[FLS90]
verifier only sees the subset of the bits in 𝐽 and proof 𝜌
𝑜 bits long
prover outputs a subset 𝐽 ⊆ [𝑜] and a proof 𝜌
[FLS90]
verifier only sees the subset of the bits in 𝐽 and proof 𝜌
𝑜 bits long
prover outputs a subset 𝐽 ⊆ [𝑜] and a proof 𝜌
[FLS90]
NIZKs in the hidden-bits model NIZKs in the CRS model cryptographic compiler
hidden-bits string “commitment” 𝜏 Prover can selectively open 𝜏 to 𝑗, 𝑐𝑗 for indices 𝑗 of its choosing
[FLS90]
hidden-bits string “commitment” 𝜏 Prover can selectively open 𝜏 to 𝑗, 𝑐𝑗 for indices 𝑗 of its choosing
[FLS90]
NIZKs in the hidden-bits model NIZKs in the CRS model cryptographic compiler
hidden-bits string “commitment” 𝜏
Instantiations: [FLS90]: trapdoor permutations (computational NIZK proofs) [CHK03]:CDH over a pairing group (computational NIZK proofs) [QRW19, CH19, KNYY19]:hidden-bits generators from CDH (computational DV-NIZK proofs)
[FLS90]
NIZKs in the hidden-bits model NIZKs in the CRS model cryptographic compiler
hidden-bits string “commitment” 𝜏 Possible to instantiate FLS to obtain statistical ZK?
[FLS90]
Instantiations: [FLS90]: trapdoor permutations (computational NIZK proofs) [CHK03]:CDH over a pairing group (computational NIZK proofs) [QRW19, CH19, KNYY19]:hidden-bits generators from CDH (computational DV-NIZK proofs)
NIZKs in the hidden-bits model NIZKs in the CRS model
[FLS90]: trapdoor permutations (computational NIZK proofs) [CHK03]: CDH over a pairing group (computational NIZK proofs) [QRW19, CH19, KNYY19]: computational hidden-bits generators from CDH (computational DV-NIZK arguments)
[FLS90]
[CHK03, QRW19, CH19, KNYY19]
Each exponent 𝑧 ∈ ℤ𝑞 defines a hidden bits string
𝑐𝑗 ≔ hc ℎ𝑗
𝑧
hard-core bit
𝑥1, … , 𝑥𝑜 ← ℤ𝑞
Prover samples 𝑧 ← ℤ𝑞 and commits to hidden bits string with 𝜏 = 𝑧 ∈ Committing to a hidden-bits string: [CHK03]: Use a pairing: 𝑓 𝑧, ℎ𝑗 = 𝑓 , ℎ𝑗
𝑧
Opening 𝝉 to a bit 𝒄𝒋: reveal ℎ𝑗
𝑧 and prove that , 𝑧, ℎ𝑗, ℎ𝑗 𝑧 is a DDH tuple
[QRW19, CH19, KNYY19]: Use Cramer-Shoup hash-proof system [CS98, CS02, CKS08] publicly-verifiable designated-verifier
[CHK03, QRW19, CH19, KNYY19]
Each exponent 𝑧 ∈ ℤ𝑞 defines a hidden bits string
𝑐𝑗 ≔ hc ℎ𝑗
𝑧
hard-core bit
𝑥1, … , 𝑥𝑜 ← ℤ𝑞 Statistical binding: choice of 𝜏 (with ℎ1, … , ℎ𝑜) completely defines 𝑐1, … , 𝑐𝑜
Prover samples 𝑧 ← ℤ𝑞 and commits to hidden bits string with 𝜏 = 𝑧 ∈ Committing to a hidden-bits string:
Resulting NIZK satisfies statistical soundness
[CHK03, QRW19, CH19, KNYY19]
Each exponent 𝑧 ∈ ℤ𝑞 defines a hidden bits string
𝑐𝑗 ≔ hc ℎ𝑗
𝑧
hard-core bit
𝑥1, … , 𝑥𝑜 ← ℤ𝑞 Computational hiding: unopened bits computationally hidden since hc is hard-core Resulting NIZK satisfies computational zero-knowledge
Prover samples 𝑧 ← ℤ𝑞 and commits to hidden bits string with 𝜏 = 𝑧 ∈ Committing to a hidden-bits string: Need to compute 𝑥𝑗𝑧 from 𝑥𝑗 and 𝑧 which is precisely CDH
𝑜+1
𝑜, we write 𝒘 ≔ 𝑤1, … , 𝑤𝑜 [𝒘] plays the role of the family 𝒙1 , … , 𝒙𝑜 play the role
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑜+1
𝑜, we write 𝒘 ≔ 𝑤1, … , 𝑤𝑜
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
similar principle as used to construct lossy PKE from DDH [HJR16] [𝒘] plays the role of the generator 𝒙1 , … , 𝒙𝑜 play the role
Each vector 𝒛 ∈ ℤ𝑞
𝑜+1
defines a hidden bits string
𝑜+1
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑐𝑗 ≔ 𝐼 𝒛𝑈𝒙𝑗 Prover’s commitment: 𝜏 = 𝒛𝑈𝒘 ∈ Statistically binding in binding mode: choice of 𝜏 (and CRS) completely defines 𝑐1, … , 𝑐𝑜 𝒛𝑈𝒙𝑗 = 𝑡𝑗𝒛𝑈𝒘 = 𝑡𝑗𝜏
𝐼: → 0,1 is universal hash
Each vector 𝒛 ∈ ℤ𝑞
𝑜+1
defines a hidden bits string
𝑜+1
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑐𝑗 ≔ 𝐼 𝒛𝑈𝒙𝑗 Prover’s commitment: 𝜏 = 𝒛𝑈𝒘 ∈ Statistically hiding in hiding mode: choice of 𝜏 (and CRS) completely hides 𝑐1, … , 𝑐𝑜
if 𝒘, 𝒙1, … , 𝒙𝑜 ∈ ℤ𝑞
𝑜+1 are linearly independent and 𝒛 ← ℤ𝑞 𝑜+1, 𝒛𝑈𝒙𝑗 is uniform given 𝒛𝑈𝒘, 𝒛𝑈𝒙𝑘 for 𝑘 ≠ 𝑗
𝐼: → 0,1 is universal hash
Each vector 𝒛 ∈ ℤ𝑞
𝑜+1
defines a hidden bits string
𝑜+1
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑐𝑗 ≔ 𝐼 𝒛𝑈𝒙𝑗 Prover’s commitment: 𝜏 = 𝒛𝑈𝒘 ∈ Binding mode ⇒ statistically-binding hidden bits ⇒ statistical soundness Hiding mode ⇒ statistically-hiding hidden bits ⇒ statistical zero-knowledge
𝐼: → 0,1 is universal hash
Each vector 𝒛 ∈ ℤ𝑞
𝑜+1
defines a hidden bits string
𝑜+1
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑐𝑗 ≔ 𝐼 𝒛𝑈𝒙𝑗 Prover’s commitment: 𝜏 = 𝒛𝑈𝒘 ∈ Remaining ingredient: need a way for prover to open commitments to hidden bits
To open the commitment 𝜏 to value 𝑐𝑗, prover sends 𝑢𝑗 = 𝒛𝑈𝒙𝑗 together with a proof that ∃𝒛 ∈ ℤ𝑞
𝑜+1 such that 𝜏 = [𝒛𝑈𝒘] and 𝑢𝑗 = 𝒛𝑈𝒙𝑗
𝐼: → 0,1 is universal hash
Each vector 𝒛 ∈ ℤ𝑞
𝑜+1
defines a hidden bits string
𝑜+1
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑐𝑗 ≔ 𝐼 𝒛𝑈𝒙𝑗 Prover’s commitment: 𝜏 = 𝒛𝑈𝒘 ∈ Remaining ingredient: need a way for prover to open commitments to hidden bits
To open the commitment 𝜏 to value 𝑐𝑗, prover sends 𝑢𝑗 = 𝒛𝑈𝒙𝑗 together with a proof that ∃𝒛 ∈ ℤ𝑞
𝑜+1 such that 𝜏 = [𝒛𝑈𝒘] and 𝑢𝑗 = 𝒛𝑈𝒙𝑗
𝐼: → 0,1 is universal hash
Each vector 𝒛 ∈ ℤ𝑞
𝑜+1
defines a hidden bits string
𝑜+1
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑐𝑗 ≔ 𝐼 𝒛𝑈𝒙𝑗 Prover’s commitment: 𝜏 = 𝒛𝑈𝒘 ∈ Prover’s opening: 𝑢𝑗 = 𝒛𝑈𝒙𝑗 proof that ∃𝒛 ∈ ℤ𝑞
𝑜+1 ∶
𝜏 = [𝒛𝑈𝒘] and 𝑢𝑗 = 𝒛𝑈𝒙𝑗
Implication: dual-mode DV-NIZK from DDH
Each vector 𝒛 ∈ ℤ𝑞
𝑜+1
defines a hidden bits string
𝑜+1
𝑜+1 Two distributions for 𝒙𝑗:
𝑜+1
𝑐𝑗 ≔ 𝐼 𝒛𝑈𝒙𝑗 Extensions:
trusted setup
verifiers can choose their own verification key; zero-knowledge should hold even if vk𝑗 chosen maliciously
[QRW19]
trusted setup
verifiers can choose their own verification key; zero-knowledge should hold even if vk𝑗 chosen maliciously
[QRW19]
[see paper for details]
NIZKs in the hidden-bits model NIZKs in the CRS model
This work: Leverage the FLS compiler to achieve statistical zero-knowledge
NIZKs in the hidden-bits model NIZKs in the CRS model Other assumptions: Statistical (DV)-NIZKs from LPN? from CDH? Statistical NIZK arguments from factoring?
publicly-verifiable
Construction Assumption Soundness Zero-Knowledge [FLS90] factoring computational statistical [GOS06] 𝑙-Lin (1, 2) stat. comp. stat. comp. [CHK03] CDH (pairing group) computational statistical [PS19] LWE stat. comp. stat. comp. [SW14] iO + OWFs statistical computational [QRW19, CH19, KNYY19] CDH computational statistical [LQRWW19] CDH/LWE/LPN computational computational [CDIKLOV19] DCR stat. comp. stat. comp. This work DDH/QR/DCR stat. comp. stat. comp. This work 𝒍-Lin (𝟐), 𝒍-KerLin (𝟑) computational statistical
malicious designated-verifier
https://eprint.iacr.org/2020/265