On the Existence of Three Round Zero-Knowledge Proofs Nils - - PowerPoint PPT Presentation

▶
on the existence of three round zero knowledge proofs
SMART_READER_LITE
LIVE PREVIEW

On the Existence of Three Round Zero-Knowledge Proofs Nils - - PowerPoint PPT Presentation

Mar 28, 2024 256 likes •841 views

On the Existence of Three Round Zero-Knowledge Proofs Nils Fleischhacker, Vipul Goyal, Abhishek Jain Tel Aviv, May 2, 2018 Round-Complexity of ZK-Proofs for NP 2 Round-Complexity of ZK-Proofs for NP 2 Round-Complexity of ZK-Proofs for NP

slide-1
SLIDE 1

On the Existence of Three Round Zero-Knowledge Proofs

Nils Fleischhacker, Vipul Goyal, Abhishek Jain Tel Aviv, May 2, 2018
slide-2
SLIDE 2 2 Round-Complexity of ZK-Proofs for NP
slide-3
SLIDE 3 2 Round-Complexity of ZK-Proofs for NP
slide-4
SLIDE 4 2 Round-Complexity of ZK-Proofs for NP [GO94]
slide-5
SLIDE 5 2 Round-Complexity of ZK-Proofs for NP [GO94]
  • [GK96]
slide-6
SLIDE 6 2 Round-Complexity of ZK-Proofs for NP [GO94]
  • [GK96]
slide-7
SLIDE 7 2 Round-Complexity of ZK-Proofs for NP [GO94]
  • [GK96]
[Katz08] black box simulation
slide-8
SLIDE 8 2 Round-Complexity of ZK-Proofs for NP [GO94]
  • [GK96]
[Katz08] black box simulation [KRR17] public coin
slide-9
SLIDE 9 2 Round-Complexity of ZK-Proofs for NP [GO94]
  • [GK96]
[Katz08] black box simulation [KRR17] public coin
slide-10
SLIDE 10 3 The Result Assuming sub-exponentially secure iO and sub-exponentially secure PRFs as well as exponentially secure input-hiding obfuscation for multi-bit point functions, even private coin three round zero-knowledge proofs can only exist for languages in BPP.
slide-11
SLIDE 11 4 What About Four Rounds? ◮ We do not expect our technique to easily extend to four rounds. ◮ Our result extends to a weaker notion of ǫ-ZK. ◮ For ǫ-ZK, four round private coin protocols exist based on keyless multi-collision resistant hash functions (MCRH). [BKP17]
slide-12
SLIDE 12 5 Compressing Proofs
slide-13
SLIDE 13 5 Compressing Proofs
slide-14
SLIDE 14 5 Compressing Proofs
slide-15
SLIDE 15 5 Compressing Proofs Sadly, it’s not that simple.
slide-16
SLIDE 16 6 Proofs vs. Arguments Π Π′ We lose statistical soundness. Π′ is only an argument. Π Sound Π′ Sound Π not ZK
slide-17
SLIDE 17 7 How to Compress Proofs α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ
slide-18
SLIDE 18 7 How to Compress Proofs α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ
slide-19
SLIDE 19 7 How to Compress Proofs α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ
slide-20
SLIDE 20 7 How to Compress Proofs α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ β ←$ {0, 1}n
slide-21
SLIDE 21 8 The Public Coin Case α ← P1(x, w) α β ←$ {0, 1}n β γ ← P2(x, w) γ
slide-22
SLIDE 22 8 The Public Coin Case α ← P1(x, w) α β ←$ {0, 1}n β γ ← P2(x, w) γ
slide-23
SLIDE 23 8 The Public Coin Case α ← P1(x, w) α β ←$ {0, 1}n β γ ← P2(x, w) γ H ←$ H
slide-24
SLIDE 24 8 The Public Coin Case α ← P1(x, w) α β ←$ {0, 1}n β γ ← P2(x, w) γ H ←$ H H β := H(x, α)
slide-25
SLIDE 25 8 The Public Coin Case α ← P1(x, w) α β ←$ {0, 1}n β γ ← P2(x, w) γ H ←$ H H β := H(x, α) (α, )
slide-26
SLIDE 26 8 The Public Coin Case α ← P1(x, w) α β ←$ {0, 1}n β γ ← P2(x, w) γ H ←$ H H β := H(x, α) (α, ) [KRR17]: H := iO(PRFk(·))
slide-27
SLIDE 27 9 But What About Private Coin? α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ
slide-28
SLIDE 28 9 But What About Private Coin? α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ CV[k, x](α) s := PRFk(α) β := V1(x, α; s) return β
slide-29
SLIDE 29 9 But What About Private Coin? α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ CV[k, x](α) s := PRFk(α) β := V1(x, α; s) return β
slide-30
SLIDE 30 9 But What About Private Coin? α ← P1(x, w) α β ← V1(x, α) β γ ← P2(x, w) γ B ← iO(CV[k, x]) CV[k, x](α) s := PRFk(α) β := V1(x, α; s) return β B β := B(α) (α, )
slide-31
SLIDE 31 10 How to Prove it. Π Π′ We need to prove two things:
  • 1. If Π′ is sound then Π is not zero knowledge.
  • 2. The compression preserves soundness. I.e., if Π is sound then
Π′ is also sound.
slide-32
SLIDE 32 11 Π′ sound = ⇒ Π′ not ZK [GO94] aux α β ← aux(α) β γ (α, β, γ)
slide-33
SLIDE 33 11 Π′ sound = ⇒ Π′ not ZK [GO94] aux α β ← aux(α) β γ (α, β, γ) Sim aux (α′, β′, γ′)
slide-34
SLIDE 34 11 Π′ sound = ⇒ Π′ not ZK [GO94] aux α β ← aux(α) β γ (α, β, γ) Sim aux (α′, β′, γ′) ≈c
slide-35
SLIDE 35 12 Π′ sound = ⇒ Π′ not ZK B (α, β, γ) ← Sim(B) (α, γ)
  • (x∗ ∈ L) ≈c (x∗ ∈ L) unless L ∈ BPP
slide-36
SLIDE 36 12 Π′ sound = ⇒ Π′ not ZK B (α, β, γ) ← Sim(B) (α, γ)
  • (x∗ ∈ L) ≈c (x∗ ∈ L) unless L ∈ BPP

But is it sound?

slide-37
SLIDE 37 13 How Can a Prover Cheat? Defining Bad Alphas.

α

slide-38
SLIDE 38 13 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad
  • 1. Specify a set of bad α’s.
slide-39
SLIDE 39 13 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad
  • 1. Specify a set of bad α’s.
  • 2. Prove that a cheating prover must use a bad α to cheat.
slide-40
SLIDE 40 13 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad ???
  • 1. Specify a set of bad α’s.
  • 2. Prove that a cheating prover must use a bad α to cheat.
  • 3. Prove that bad α’s remain hidden by the obfuscation.
slide-41
SLIDE 41 14 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad
slide-42
SLIDE 42 14 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad ◮ In the public coin case, defining bad α’s is trivial: Any α, such that for β := PRFk(α) there exists an accepting γ.
slide-43
SLIDE 43 14 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad ◮ In the public coin case, defining bad α’s is trivial: Any α, such that for β := PRFk(α) there exists an accepting γ. ◮ In the private coin case, however there may always be accepting γ’s.
slide-44
SLIDE 44 14 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad ◮ In the public coin case, defining bad α’s is trivial: Any α, such that for β := PRFk(α) there exists an accepting γ. ◮ In the private coin case, however there may always be accepting γ’s. ◮ But, those γ’s depend on which consistent random tape was used.
slide-45
SLIDE 45 14 How Can a Prover Cheat? Defining Bad Alphas.

α

Bad ◮ In the public coin case, defining bad α’s is trivial: Any α, such that for β := PRFk(α) there exists an accepting γ. ◮ In the private coin case, however there may always be accepting γ’s. ◮ But, those γ’s depend on which consistent random tape was used. ◮ Security of iO and puncturable PRF hide which random tape was used.
slide-46
SLIDE 46 15 Bad Alphas in the Private Coin Case.

α

Bad ◮ An α is bad if the random tape s := PRFk(α) leads to a β such that for (α, β) there exists γ that will be accepted by the verifier with high probability over all consistent random tapes.
slide-47
SLIDE 47 16 Hiding Bad Alphas. ◮ A cheating prover will output a bad α with high probability.
slide-48
SLIDE 48 16 Hiding Bad Alphas. ◮ A cheating prover will output a bad α with high probability. ◮ This can be lead to a direct contradiction with the soundness
  • f Π but incurs an exponential loss.
slide-49
SLIDE 49 16 Hiding Bad Alphas. ◮ A cheating prover will output a bad α with high probability. ◮ This can be lead to a direct contradiction with the soundness
  • f Π but incurs an exponential loss.
◮ We follow the approach of [KRR17] and “transfer” the loss to a seperate primitive.
slide-50
SLIDE 50 17 Input Hiding Obfuscation of Multi-Bit Point Functions hideO α∗, s∗ B Correctness: B(α∗) = s∗ ∀α = α∗ : B(α) = ⊥ Security: Pr[A(B, 1n) = α∗] ≤ 2−n
slide-51
SLIDE 51 17 Input Hiding Obfuscation of Multi-Bit Point Functions hideO α∗, s∗ B Correctness: B(α∗) = s∗ ∀α = α∗ : B(α) = ⊥ Security: Pr[A(B, 1n) = α∗] ≤ 2−n Can be instantiated in the generic group model by [CD08] as shown in [BC10] based on a strong variant of DDH.
slide-52
SLIDE 52 18 Transferring the Loss
slide-53
SLIDE 53 18 Transferring the Loss Cpct[k, α∗, β∗](α) if α ? =α∗ β := β∗ else s := PRFk(α) β := V1(x, α; s) return β
slide-54
SLIDE 54 18 Transferring the Loss Cpct[k, α∗, β∗](α) if α ? =α∗ β := β∗ else s := PRFk(α) β := V1(x, α; s) return β Conditioned on α∗ being bad we get that Pr k,α∗,s∗,iO,A
  • P∗
iO
  • Cpct[k{α∗}, α∗, V1(x∗, α; s∗)]
  • = (α∗, γ)
  • is slightly higher than random chance.
slide-55
SLIDE 55 18 Transferring the Loss Cpct[k, α∗, β∗](α) if α ? =α∗ β := β∗ else s := PRFk(α) β := V1(x, α; s) return β Chide[k, B](α) s := B(α) if s = ⊥ s := PRFk(α) β := V1(x∗, α; s) return β Conditioned on α∗ being bad we get that Pr k,α∗,s∗,iO,A
  • P∗
iO
  • Cpct[k{α∗}, α∗, V1(x∗, α; s∗)]
  • = (α∗, γ)
  • is slightly higher than random chance.
slide-56
SLIDE 56 19 Conclusion Assuming sub-exponentially secure iO and sub-exponentially secure PRFs as well as exponentially secure input-hiding obfuscation for multi-bit point functions, three round zero-knowledge proofs can
  • nly exist for languages in BPP.

Thanks!

ia.cr/2018/167