Online/Offline OR Composition of -Protocols Michele Ciampi - - PowerPoint PPT Presentation
Online/Offline OR Composition of -Protocols Michele Ciampi Alessandra Scafuro Giuseppe Persiano DIEM Boston University and DISA-MIS Universit di Salerno Northeastern University Universit di Salerno ITALY USA ITALY Luisa Siniscalchi Ivan
Michele Ciampi DIEM Università di Salerno ITALY Giuseppe Persiano DISA-MIS Università di Salerno ITALY Alessandra Scafuro Boston University and Northeastern University USA Luisa Siniscalchi DIEM Università di Salerno ITALY Ivan Visconti DIEM Università di Salerno ITALY
A fundamental crypto tool with many applications Identification Schemes Simulation-Based Security E-Voting Systems … Useful in cryptography when the witness is protected: Witness Indistinguishable (WI), Witness Hiding (WH), Zero Knowledge (ZK) e.g., prove knowledge of one thing OR another thing OR …
2
NP-reduction
x
WI Proof of Knowledge of Hamiltonicity [Blum86, LapidotShamir90]
In theory In practice x∈L
“(G, C) in RHAM” m1 m2 m3
3
x= gy
gr c r+cy
e.g. Discret Log [Schnorr89])
“(x, y) in RDlog”
NP-reduction
x
WI Proof of Knowledge of Hamiltonicity [Blum86, LapidotShamir90]
In theory In practice x∈L
“(G, C) in RHAM” m1 m2 m3
3
x= gy
gr c r+cy
e.g. Discret Log [Schnorr89])
“(x, y) in RDlog”
NP-reduction
x
WI Proof of Knowledge of Hamiltonicity [Blum86, LapidotShamir90]
In theory In practice
Observation: neither [LS90] nor [Schnorr89] need theorem+ witness Observation: [LS90] and [Schnorr89] need the theorem and witness only in the last round
x∈L
“(G, C) in RHAM” m1 m2 m3
3
x
a c z
4
Completeness
x
a c z
4
Completeness SHVZK Sim(x,c)⇒
x
a c z
4
Completeness SHVZK Sim(x,c)⇒
x
a c z a’ c z’
4
Completeness SHVZK Sim(x,c)⇒
x
a c z a’ c z’≡
4
Completeness SHVZK Sim(x,c)⇒ Special Soundness
x
a c z a’ c z’≡
4
Completeness SHVZK Sim(x,c)⇒ Special Soundness
x
a c z a’ c z’≡
x, (a c z) x, (a c’ z’)
w: (x,w)∈ R
4
5
Consider the ∑-protocols 𝛵0 and 𝛵1 for R0 and R1 and compile them using
[CramerDamgardSchoenmakers94]
NP-reduction
(x0 V x1)
WI Proof of Knowledge of Hamiltonicity [Blum86, LS90]
In theory In practice In both cases you get 3 rounds, WI and PoK
“(G, C) in RHAM”
5
NP-reduction
(x0 V x1)
WI Proof of Knowledge of Hamiltonicity [Blum86, LS90]
In theory In practice
“(G, C) in RHAM”
6
Consider the ∑-protocols 𝛵0 and 𝛵1 for R0 and R1 and compile them using
[CramerDamgardSchoenmakers94]
NP-reduction
(x0 V x1)
WI Proof of Knowledge of Hamiltonicity [Blum86, LS90]
In theory In practice
x0 and x1 are needed already at the 1rd round No need to know any theorem already at the 1rd round
“(G, C) in RHAM”
6
Consider the ∑-protocols 𝛵0 and 𝛵1 for R0 and R1 and compile them using
[CramerDamgardSchoenmakers94]
Delayed-Input Completeness
In theory In practice
Completeness [LS90] [CDS94]
7
a c
8
a c
(w)
8
a c z
(w)
8
Delayed-Input Completeness Adaptive-Input Proof of Knowledge
In theory In practice
Completeness Proof of Knowledge [LS90] [CDS94]
9
a c
10
a c z
10
a
(a,c,z) x
10
a
c’ x’ (a,c,z) x
10
a
c’ x’ z’ (a,c,z) x x’ (a,c’,z’)
10
a
c’ x’ z’ w witness for x (a,c,z) x x’ (a,c’,z’)
10
Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable [LS90] [CDS94]
11
a c
12
a c w1,w2 witnesses for x (x,w1,w2)
(wb)
12
a c z w1,w2 witnesses for x (x,w1,w2)
(wb)
12
Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable Assumption: OWP
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable Assumption: none [LS90] [CDS94]
13
Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable Assumption: OWP Requires NP-reduction and gives Computational WI
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable Assumption: none No NP-reduction and gives Perfect WI [LS90] [CDS94]
14
Delayed-Input Completeness Adaptive-Input Proof of Knowledge Adaptive-Input Witness Indistinguishable Assumption: OWP Requires NP-reduction and gives Computational WI Applicable to All NP
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable Assumption: none No NP-reduction and gives Perfect WI Restricted to ∑-protocols [LS90] [CDS94]
15
A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity
16
A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity
e.g. [Pass – Eurocrypt 03], [KaOs – Crypto 04], [YuZh – Eurocrypt 07][ScVi – Eurocrypt 12]…
16
A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity
[GMPP16 – tomorrow], [Kiayias0Z15 – CCS15], [BBKPV16 – eprint]…
Recently Delayed-Input completeness is widely used
e.g. [Pass – Eurocrypt 03], [KaOs – Crypto 04], [YuZh – Eurocrypt 07][ScVi – Eurocrypt 12]…
16
17
x= gy
gr c z=r+cy
c’ z’=r+c’y’ x’= gy’
Issue observed in [BernhardPereiraWarinschi12] about the weak Fiat-Shamir transform
∑-Protocols (in general) are not Adaptive-Input PoK
18
x= gy
gr c z=r+cy
gr’ z=r’+cr
19
x= gy
gr c z=r+cy
gr’ z=r’+cr
19
x= gy
gr c z=r+cy
gr’ z=r’+cr
Our transform applies to the class described in [Cramer96, Maurer15, CramerDamgard98] e.g. Schnorr, Guillou–Quisquater, Diffie–Hellman, Multiplication proof for pedersen commitments, …
19
20
In theory In practice
[LS90] [CDS94] [CPS+ TCC 2016-A] This work
21
Delayed-Input Completeness
In theory In practice
Completeness [LS90] [CDS94] Semi-Delayed Input Completeness [CPS+ TCC 2016-A] Delayed-Input Completeness: All input ∑-protocols have to be Delayed-Input This work
21
Delayed-Input Completeness Adaptive-Input PoK
In theory In practice
Completeness Proof of Knowledge [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge [CPS+ TCC 2016-A] Delayed-Input Completeness: All input ∑-protocols have to be Delayed-Input Proof of Knowledge This work
21
Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* [CPS+ TCC 2016-A] Delayed-Input Completeness: All input ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI This work
21
Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable Assumption: none [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none [CPS+ TCC 2016-A] Delayed-Input Completeness: All input ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH This work
21
Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP Works with multiple OR compositions
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable Assumption: none Works with multiple OR compositions [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none Works with only one OR composition [CPS+ TCC 2016-A] Delayed-Input Completeness: All input ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH Works with multiple OR compositions This work
21
Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP Works with multiple OR compositions Requires NP-reduction and gives Computational WI
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable Assumption: none Works with multiple OR compositions No NP-reduction and gives Perfect WI [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none Works with only one OR composition No NP-reduction and gives Perfect WI [CPS+ TCC 2016-A] Delayed-Input Completeness: All input ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH Works with multiple OR compositions No NP-reduction and gives Computational WI This work
21
Delayed-Input Completeness Adaptive-Input PoK Adaptive-Input WI Assumption: OWP Works with multiple OR compositions Requires NP-reduction and gives Computational WI Applicable to All NP
In theory In practice
Completeness Proof of Knowledge Witness Indistinguishable Assumption: none Works with multiple OR compositions No NP-reduction and gives Perfect WI Restricted to ∑-protocols [LS90] [CDS94] Semi-Delayed Input Completeness Proof of Knowledge Semi-Adaptive Input WI: one of two instances is adaptively chosen by V* Assumption: none Works with only one OR composition No NP-reduction and gives Perfect WI Restricted to (a large class of) ∑-protocols [CPS+ TCC 2016-A] Delayed-Input Completeness: All input ∑-protocols have to be Delayed-Input Proof of Knowledge Adaptive-Input WI Assumption: DDH Works with multiple OR compositions No NP-reduction and gives Computational WI Restricted to (a large class of) ∑-protocols This work
21
Assumption Completeness
Adaptive WI
Adaptive PoK Online Efficiency
[LS90]
OWP Delayed-Input k out of n (all adaptive) k out of n NP- reduction
[CDS94]
/ / / k out of n* Entire protocol
[CPSSV16]
/ Semi-Delayed Input 1 out of 2 (1 adaptive) k out of n* Entire protocol
This work
DDH Delayed-Input k out of n (all adaptive) k out of n* ≤ CDS94
22
com=((com1, com2, …, comn), 𝚸)
23
com=((com1, com2, …, comn), 𝚸)
At least k are perfectly binding
23
com=((com1, com2, …, comn), 𝚸)
At least k are perfectly binding
com dec
23
n-k commitments can be equivocated
com=((com1, com2, …, comn), 𝚸)
At least k are perfectly binding
com dec
23
n-k commitments can be equivocated
com=((com1, com2, …, comn), 𝚸)
At least k are perfectly binding
com dec
23
n-k commitments can be equivocated
e.g. k=1, n=2
P⅀
a1, a2
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2)
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c
x1,x2 wb
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1
x1,x2 wb
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1
x1,x2 wb
a1
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*
x1,x2 wb
a1
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*
x1,x2 wb
a1
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*
x1,x2 wb
OpenKN(com, a*) dec
a1
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*
x1,x2 wb
OpenKN(com, a*) dec
a1
R OR R
24
e.g. k=1, n=2
P⅀
a1, a2 com=ComKN(a1, a2) c P⅀(xb,wb,a1, c) z1 Sim⅀(x1-b,c) a* z*
x1,x2 wb
OpenKN(com, a*) dec
and a1 w.r.t com?
a1
R OR R
24
Ingredient 1: DDH
25
DH tuple
Ingredient 1: DDH
25
DH tuple non-DH tuple
Ingredient 1: DDH
25
Binding Perfect Hiding Computational If T is NDH Binding Computational Equivocal If T is DH Given T=(ga,gb,gc) Com(T,m) ⇒ dec, com
Ingredient 2: Instance dependent trapdoor commitment (IDTC) from DDH Constructions of IDTC follow directly from known constructions of Trapdoor Commitments from ∑-Protocols [Dam10, HL10, DN02]
26
(com1, com2, …, comn), 𝚸
27
(com1, com2, …, comn), 𝚸
At least k are perfectly binding
27
1) Select T1, T2, …, Tn
(com1, com2, …, comn), 𝚸
At least k are perfectly binding
27
1) Select T1, T2, …, Tn 2) Run Com(Ti,mi) ⇒ (deci,comi) for i=1,…,n and send (com1, com2, …, comn)
(com1, com2, …, comn), 𝚸
At least k are perfectly binding
27
1) Select T1, T2, …, Tn 2) Run Com(Ti,mi) ⇒ (deci,comi) for i=1,…,n and send (com1, com2, …, comn) 3) Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH (prove with [CDS94])
(com1, com2, …, comn), 𝚸
At least k are perfectly binding
27
1) Select T1, T2, …, Tn 2) Run Com(Ti,mi) ⇒ (deci,comi) for i=1,…,n and send (com1, com2, …, comn) 3) Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH (prove with [CDS94])
(com1, com2, …, comn), 𝚸
At least k are perfectly binding
27
Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH
T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)
e.g. k=1, n=2
28
Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH
T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)
e.g. k=1, n=2
T1’=(ga1,gb1,ga1･b1) T2’=(ga2,gb2,gc3)
28
Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH
T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)
e.g. k=1, n=2
T1’=(ga1,gb1,ga1･b1) T2’=(ga2,gb2,gc3)
𝚸CDS94: “T1’ is DH OR T2’ is DH”
28
Prove with 𝚸 that at least k of the n tuples T1, T2, …, Tn are non-DH
T1=(ga1,gb1,gc1) T2=(ga2,gb2,gc2)
e.g. k=1, n=2
T1’=(ga1,gb1,ga1･b1) T2’=(ga2,gb2,gc3)
𝚸CDS94: “T1’ is DH OR T2’ is DH” V accepts ⇔ One out of T1, T2 is a non-DH tuple
28
Our previous construction works for any (k,n) In the paper you can also find a construction that works for different NP-relations (e.g. RDlog or RDH) (This construction is non-trivial ad uses as a sub-protocol the construction showed before) We give also a compiler that transform a ∑-Protocol (belonging to the class described in [Cra96, Mau15, CD98]) in an Adaptive-Input PoK Open problem
Protocols?
29