Online/Offline OR Composition of -Protocols Michele Ciampi - - PowerPoint PPT Presentation

online offline or composition of protocols
SMART_READER_LITE
LIVE PREVIEW

Online/Offline OR Composition of -Protocols Michele Ciampi - - PowerPoint PPT Presentation

Online/Offline OR Composition of -Protocols Michele Ciampi Alessandra Scafuro Giuseppe Persiano DIEM Boston University and DISA-MIS Universit di Salerno Northeastern University Universit di Salerno ITALY USA ITALY Luisa Siniscalchi Ivan


slide-1
SLIDE 1

Online/Offline OR Composition

  • f ∑-Protocols

Michele Ciampi DIEM Università di Salerno ITALY Giuseppe Persiano DISA-MIS Università di Salerno ITALY Alessandra Scafuro Boston University and Northeastern University USA Luisa Siniscalchi DIEM Università di Salerno ITALY Ivan Visconti DIEM Università di Salerno ITALY

slide-2
SLIDE 2

Proofs of Knowledge (PoKs)

A fundamental crypto tool with many applications Identification Schemes Simulation-Based Security E-Voting Systems … Useful in cryptography when the witness is protected: Witness Indistinguishable (WI), Witness Hiding (WH), Zero Knowledge (ZK) e.g., prove knowledge of one thing OR another thing OR …

2

slide-3
SLIDE 3

G

NP-reduction

x

WI Proof of Knowledge of Hamiltonicity [Blum86, LapidotShamir90]

P V

Proofs of Knowledge (PoKs)

In theory In practice x∈L

“(G, C) in RHAM” m1 m2 m3

3

slide-4
SLIDE 4

∑-protocol for R

x= gy

P V

gr c r+cy

e.g. Discret Log [Schnorr89])

“(x, y) in RDlog”

G

NP-reduction

x

WI Proof of Knowledge of Hamiltonicity [Blum86, LapidotShamir90]

P V

Proofs of Knowledge (PoKs)

In theory In practice x∈L

“(G, C) in RHAM” m1 m2 m3

3

slide-5
SLIDE 5

∑-protocol for R

x= gy

P V

gr c r+cy

e.g. Discret Log [Schnorr89])

“(x, y) in RDlog”

G

NP-reduction

x

WI Proof of Knowledge of Hamiltonicity [Blum86, LapidotShamir90]

P V

Proofs of Knowledge (PoKs)

In theory In practice

Observation: neither [LS90] nor [Schnorr89] need theorem+ witness Observation: [LS90] and [Schnorr89] need the theorem and witness only in the last round

x∈L

“(G, C) in RHAM” m1 m2 m3

3

slide-6
SLIDE 6

∑-protocol for relation R

x

P(w) V

a c z

4

slide-7
SLIDE 7

∑-protocol for relation R

Completeness

x

P(w) V

a c z

4

slide-8
SLIDE 8

∑-protocol for relation R

Completeness SHVZK Sim(x,c)⇒

x

P(w) V

a c z

4

slide-9
SLIDE 9

∑-protocol for relation R

Completeness SHVZK Sim(x,c)⇒

x

P(w) V

a c z a’ c z’

4

slide-10
SLIDE 10

∑-protocol for relation R

Completeness SHVZK Sim(x,c)⇒

x

P(w) V

a c z a’ c z’≡

4

slide-11
SLIDE 11

∑-protocol for relation R

Completeness SHVZK Sim(x,c)⇒ Special Soundness

x

P(w) V

a c z a’ c z’≡

4

slide-12
SLIDE 12

∑-protocol for relation R

Completeness SHVZK Sim(x,c)⇒ Special Soundness

x

P(w) V

a c z a’ c z’≡

x, (a c z) x, (a c’ z’)

w: (x,w)∈ R

4

slide-13
SLIDE 13

R0 OR R1

5

slide-14
SLIDE 14

R0 OR R1

Consider the ∑-protocols 𝛵0 and 𝛵1 for R0 and R1 and compile them using

[CramerDamgardSchoenmakers94]

G

NP-reduction

(x0 V x1)

WI Proof of Knowledge of Hamiltonicity [Blum86, LS90]

P V

In theory In practice In both cases you get 3 rounds, WI and PoK

“(G, C) in RHAM”

5

slide-15
SLIDE 15

G

NP-reduction

(x0 V x1)

WI Proof of Knowledge of Hamiltonicity [Blum86, LS90]

P V

R0 OR R1: The Gap

In theory In practice

“(G, C) in RHAM”

6

Consider the ∑-protocols 𝛵0 and 𝛵1 for R0 and R1 and compile them using

[CramerDamgardSchoenmakers94]

slide-16
SLIDE 16

G

NP-reduction

(x0 V x1)

WI Proof of Knowledge of Hamiltonicity [Blum86, LS90]

P V

R0 OR R1: The Gap

In theory In practice

x0 and x1 are needed already at the 1rd round No need to know any theorem already at the 1rd round

“(G, C) in RHAM”

6

Consider the ∑-protocols 𝛵0 and 𝛵1 for R0 and R1 and compile them using

[CramerDamgardSchoenmakers94]

slide-17
SLIDE 17

R0 OR R1: The Gap

Delayed-Input Completeness

In theory In practice

Completeness [LS90] [CDS94]

7

slide-18
SLIDE 18

Delayed-Input Completeness

P V

a c

8

slide-19
SLIDE 19

Delayed-Input Completeness

P V

a c

x

(w)

8

slide-20
SLIDE 20

Delayed-Input Completeness

P V

a c z

x

(w)

8

slide-21
SLIDE 21

R0 OR R1: The Gap

Delayed-Input Completeness Adaptive-Input Proof of Knowledge

In theory In practice

Completeness Proof of Knowledge [LS90] [CDS94]

9

slide-22
SLIDE 22

Adaptive-Input PoK

P*

a c

Extractor

x

10

slide-23
SLIDE 23

Adaptive-Input PoK

P*

a c z

Extractor

x

10

slide-24
SLIDE 24

Adaptive-Input PoK

P*

a

Extractor

x

(a,c,z) x

10

slide-25
SLIDE 25

Adaptive-Input PoK

P*

a

Extractor

c’ x’ (a,c,z) x

10

slide-26
SLIDE 26

Adaptive-Input PoK

P*

a

Extractor

c’ x’ z’ (a,c,z) x x’ (a,c’,z’)

10

slide-27
SLIDE 27

Adaptive-Input PoK

P*

a

Extractor

c’ x’ z’ w witness for x (a,c,z) x x’ (a,c’,z’)

10

slide-28
SLIDE 28

R0 OR R1: The Gap

Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable [LS90] [CDS94]

11

slide-29
SLIDE 29

Adaptive-Input WI

P V*

a c

12

slide-30
SLIDE 30

Adaptive-Input WI

P V*

a c w1,w2 witnesses for x (x,w1,w2)

(wb)

12

slide-31
SLIDE 31

Adaptive-Input WI

P V*

a c z w1,w2 witnesses for x (x,w1,w2)

(wb)

12

slide-32
SLIDE 32

R0 OR R1: The Gap

Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable Assumption: OWP

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable Assumption: none [LS90] [CDS94]

13

slide-33
SLIDE 33

R0 OR R1: The Gap

Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable Assumption: OWP Requires NP-reduction and gives Computational WI

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable Assumption: none No NP-reduction and gives Perfect WI [LS90] [CDS94]

14

slide-34
SLIDE 34

R0 OR R1: The Gap

Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable Assumption: OWP Requires NP-reduction and gives Computational WI Applicable to All NP

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable Assumption: none No NP-reduction and gives Perfect WI Restricted to ∑-protocols [LS90] [CDS94]

15

slide-35
SLIDE 35

R0 OR R1 The Gap

A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity

16

slide-36
SLIDE 36

R0 OR R1 The Gap

A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity

e.g. [Pass – Eurocrypt 03], [KaOs – Crypto 04], [YuZh – Eurocrypt 07][ScVi – Eurocrypt 12]…

16

slide-37
SLIDE 37

R0 OR R1 The Gap

A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity

[GMPP16 – tomorrow], [Kiayias0Z15 – CCS15], [BBKPV16 – eprint]…

Recently Delayed-Input completeness is widely used

e.g. [Pass – Eurocrypt 03], [KaOs – Crypto 04], [YuZh – Eurocrypt 07][ScVi – Eurocrypt 12]…

16

slide-38
SLIDE 38

Our Results

2) Bridging the gap 1) From PoK to Adaptive-Input PoK

17

slide-39
SLIDE 39

Our First Result: from PoK to Adaptive-Input PoK

x= gy

P*

gr c z=r+cy

Extractor

c’ z’=r+c’y’ x’= gy’

Issue observed in [BernhardPereiraWarinschi12] about the weak Fiat-Shamir transform

∑-Protocols (in general) are not Adaptive-Input PoK

18

slide-40
SLIDE 40

Our Transform

x= gy

P

gr c z=r+cy

From PoK to Adaptive-Input PoK

V

gr’ z=r’+cr

19

slide-41
SLIDE 41

Our Transform

x= gy

P

gr c z=r+cy

From PoK to Adaptive-Input PoK

V

gr’ z=r’+cr

19

slide-42
SLIDE 42

Our Transform

x= gy

P

gr c z=r+cy

From PoK to Adaptive-Input PoK

V

gr’ z=r’+cr

Our transform applies to the class described in [Cramer96, Maurer15, CramerDamgard98] e.g. Schnorr, Guillou–Quisquater, Diffie–Hellman, Multiplication proof for pedersen commitments, …

19

slide-43
SLIDE 43

Our Results

2) Bridging the gap 1) From PoK to Adaptive-Input PoK

20

slide-44
SLIDE 44

R0 OR R1: Bridging the Gap

In theory In practice

[LS90] [CDS94] [CPS+ TCC 2016-A] This work

21

slide-45
SLIDE 45

R0 OR R1: Bridging the Gap

Delayed-Input Completeness

In theory In practice

Completeness [LS90] [CDS94] Semi-Delayed Input Completeness [CPS+ TCC 2016-A] Delayed-Input Completeness: All input 
 ∑-protocols have to be Delayed-Input This work

21

slide-46
SLIDE 46

R0 OR R1: Bridging the Gap

Delayed-Input Completeness Adaptive-Input PoK

In theory In practice

Completeness Proof of Knowledge [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge [CPS+ TCC 2016-A] Delayed-Input Completeness: All input 
 ∑-protocols have to be Delayed-Input Proof of Knowledge This work

21

slide-47
SLIDE 47

R0 OR R1: Bridging the Gap

Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* [CPS+ TCC 2016-A] Delayed-Input Completeness: All input 
 ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI This work

21

slide-48
SLIDE 48

R0 OR R1: Bridging the Gap

Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable Assumption: none [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none [CPS+ TCC 2016-A] Delayed-Input Completeness: All input 
 ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH This work

21

slide-49
SLIDE 49

R0 OR R1: Bridging the Gap

Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP Works with multiple OR compositions

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable Assumption: none Works with multiple OR compositions [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none Works with only one OR composition [CPS+ TCC 2016-A] Delayed-Input Completeness: All input 
 ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH Works with multiple OR compositions This work

21

slide-50
SLIDE 50

R0 OR R1: Bridging the Gap

Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP Works with multiple OR compositions Requires NP-reduction and gives Computational WI

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable Assumption: none Works with multiple OR compositions No NP-reduction and gives Perfect WI [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none Works with only one OR composition No NP-reduction and gives Perfect WI [CPS+ TCC 2016-A] Delayed-Input Completeness: All input 
 ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH Works with multiple OR compositions No NP-reduction and gives Computational WI This work

21

slide-51
SLIDE 51

R0 OR R1: Bridging the Gap

Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP Works with multiple OR compositions Requires NP-reduction and gives Computational WI Applicable to All NP

In theory In practice

Completeness Proof of Knowledge Witness Indistinguishable Assumption: none Works with multiple OR compositions No NP-reduction and gives Perfect WI Restricted to ∑-protocols [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none Works with only one OR composition No NP-reduction and gives Perfect WI Restricted to (a large class of) ∑-protocols [CPS+ TCC 2016-A] Delayed-Input Completeness: All input 
 ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH Works with multiple OR compositions No NP-reduction and gives Computational WI Restricted to (a large class of) ∑-protocols This work

21

slide-52
SLIDE 52

Comparison: Summary

Assumption Completeness

Adaptive WI

Adaptive PoK Online Efficiency

[LS90]

OWP Delayed-Input k out of n (all adaptive) k out of n NP- reduction

[CDS94]

/ / / k out of n* Entire protocol

[CPSSV16]

/ Semi-Delayed Input 1 out of 2 (1 adaptive) k out of n* Entire protocol

This work

DDH Delayed-Input k out of n (all adaptive) k out of n* ≤ CDS94

22

slide-53
SLIDE 53

Our Construction: Tools

Sen Rec

com=((com1, com2, …, comn), 𝚸)

  • (K,N) Trapdoor Commitment

23

slide-54
SLIDE 54

Our Construction: Tools

Sen Rec

com=((com1, com2, …, comn), 𝚸)

At least k are perfectly binding

  • (K,N) Trapdoor Commitment

23

slide-55
SLIDE 55

Our Construction: Tools

Sen Rec

com=((com1, com2, …, comn), 𝚸)

At least k are perfectly binding

  • (K,N) Trapdoor Commitment
  • ComKN(m1, m2, …, mn)
  • OpenKN(com, m1*, m2*, …, mn-k*)

com dec

23

n-k commitments can be equivocated

slide-56
SLIDE 56

Our Construction: Tools

Sen Rec

com=((com1, com2, …, comn), 𝚸)

At least k are perfectly binding

  • (K,N) Trapdoor Commitment
  • ⅀: Delayed-Input ∑-protocol for the relation R
  • ComKN(m1, m2, …, mn)
  • OpenKN(com, m1*, m2*, …, mn-k*)

com dec

23

n-k commitments can be equivocated

slide-57
SLIDE 57

Our Construction: Tools

Sen Rec

com=((com1, com2, …, comn), 𝚸)

At least k are perfectly binding

  • (K,N) Trapdoor Commitment
  • ⅀: Delayed-Input ∑-protocol for the relation R
  • Sim⅀: SHVZK simulator for ⅀
  • ComKN(m1, m2, …, mn)
  • OpenKN(com, m1*, m2*, …, mn-k*)

com dec

23

n-k commitments can be equivocated

slide-58
SLIDE 58

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2

P V

R OR R

24

slide-59
SLIDE 59

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2)

P V

R OR R

24

slide-60
SLIDE 60

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c

P V

R OR R

24

slide-61
SLIDE 61

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c

x1,x2 wb

P V

R OR R

24

slide-62
SLIDE 62

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1

x1,x2 wb

P V

R OR R

24

slide-63
SLIDE 63

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1

x1,x2 wb

P V

a1

R OR R

24

slide-64
SLIDE 64

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*

x1,x2 wb

P V

a1

R OR R

24

slide-65
SLIDE 65

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*

x1,x2 wb

P V

a1

R OR R

24

slide-66
SLIDE 66

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*

x1,x2 wb

OpenKN(com, a*) dec

P V

a1

R OR R

24

slide-67
SLIDE 67

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*

x1,x2 wb

OpenKN(com, a*) dec

P V

a1

R OR R

24

slide-68
SLIDE 68

Our Construction: Main Idea

e.g. k=1, n=2

P⅀

a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*

x1,x2 wb

OpenKN(com, a*) dec

  • Is dec a valid opening for a*

and a1 w.r.t com?

  • Is (a*, c ,z*) accepting for ⅀?
  • Is (a1, c ,z1) accepting for ⅀?

P V

a1

R OR R

24

slide-69
SLIDE 69

How to Construct an Efficient (K,N) Trapdoor Commitment

(ga,gb,gab) ≈ (ga,gb,gc)

Ingredient 1: DDH

25

slide-70
SLIDE 70

How to Construct an Efficient (K,N) Trapdoor Commitment

(ga,gb,gab) ≈ (ga,gb,gc)

DH tuple

Ingredient 1: DDH

25

slide-71
SLIDE 71

How to Construct an Efficient (K,N) Trapdoor Commitment

(ga,gb,gab) ≈ (ga,gb,gc)

DH tuple non-DH tuple

Ingredient 1: DDH

25

slide-72
SLIDE 72

How to Construct an Efficient (K,N) Trapdoor Commitment

Binding Perfect Hiding Computational If T is NDH Binding Computational Equivocal If T is DH Given T=(ga,gb,gc) Com(T,m) ⇒ dec, com

Ingredient 2: Instance dependent trapdoor commitment (IDTC) from DDH Constructions of IDTC follow directly from known constructions of Trapdoor Commitments from ∑-Protocols [Dam10, HL10, DN02]

26

slide-73
SLIDE 73

How to Construct an Efficient (K,N) Trapdoor Commitment

Sen Rec

(com1, com2, …, comn), 𝚸

27

slide-74
SLIDE 74

How to Construct an Efficient (K,N) Trapdoor Commitment

Sen Rec

(com1, com2, …, comn), 𝚸

At least k are perfectly binding

27

slide-75
SLIDE 75

How to Construct an Efficient (K,N) Trapdoor Commitment

1) Select T1, T2, …, Tn

Sen Rec

(com1, com2, …, comn), 𝚸

At least k are perfectly binding

27

slide-76
SLIDE 76

How to Construct an Efficient (K,N) Trapdoor Commitment

1) Select T1, T2, …, Tn 2) Run Com(Ti,mi) ⇒ (deci,comi) for i=1,…,n and send (com1, com2, …, comn)

Sen Rec

(com1, com2, …, comn), 𝚸

At least k are perfectly binding

27

slide-77
SLIDE 77

How to Construct an Efficient (K,N) Trapdoor Commitment

1) Select T1, T2, …, Tn 2) Run Com(Ti,mi) ⇒ (deci,comi) for i=1,…,n and send (com1, com2, …, comn) 3) Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH (prove with [CDS94])

Sen Rec

(com1, com2, …, comn), 𝚸

At least k are perfectly binding

27

slide-78
SLIDE 78

How to Construct an Efficient (K,N) Trapdoor Commitment

1) Select T1, T2, …, Tn 2) Run Com(Ti,mi) ⇒ (deci,comi) for i=1,…,n and send (com1, com2, …, comn) 3) Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH (prove with [CDS94])

Sen Rec

(com1, com2, …, comn), 𝚸

At least k are perfectly binding

27

slide-79
SLIDE 79

Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH

T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)

e.g. k=1, n=2

P V

28

slide-80
SLIDE 80

Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH

T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)

e.g. k=1, n=2

P V

T1’=(ga1,gb1,ga1・b1) T2’=(ga2,gb2,gc3)

28

slide-81
SLIDE 81

Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH

T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)

e.g. k=1, n=2

P V

T1’=(ga1,gb1,ga1・b1) T2’=(ga2,gb2,gc3)

𝚸CDS94: “T1’ is DH OR T2’ is DH”

28

slide-82
SLIDE 82

Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH

T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)

e.g. k=1, n=2

P V

T1’=(ga1,gb1,ga1・b1) T2’=(ga2,gb2,gc3)

𝚸CDS94: “T1’ is DH OR T2’ is DH” V accepts ⇔ One out of T1, T2 is a non-DH tuple

28

slide-83
SLIDE 83

More Results of Our Work

Our previous construction works for any (k,n) In the paper you can also find a construction that works for different NP-relations (e.g. RDlog or RDH) (This construction is non-trivial ad uses as a sub-protocol the construction showed before) We give also a compiler that transform a ∑-Protocol (belonging to the class described in [Cra96, Mau15, CD98]) in an Adaptive-Input PoK Open problem

  • Is it possible to extend adaptive PoK to a larger class of ∑-

Protocols?

29

slide-84
SLIDE 84

thanks