Online/Offline OR Composition of -Protocols Michele Ciampi - PowerPoint PPT Presentation

Online/Offline OR Composition of ∑ -Protocols Michele Ciampi Alessandra Scafuro Giuseppe Persiano DIEM Boston University and DISA-MIS Università di Salerno Northeastern University Università di Salerno ITALY USA ITALY Luisa Siniscalchi Ivan Visconti DIEM DIEM Università di Salerno Università di Salerno ITALY ITALY

Proofs of Knowledge (PoKs) A fundamental crypto tool with many applications Identification Schemes Simulation-Based Security E-Voting Systems … Useful in cryptography when the witness is protected: Witness Indistinguishable (WI), Witness Hiding (WH), Zero Knowledge (ZK) e.g., prove knowledge of one thing OR another thing OR … 2

Proofs of Knowledge (PoKs) In theory In practice x ∈ L G NP-reduction x “(G, C) in R HAM ” WI Proof of Knowledge of Hamiltonicity [Blum86, L apidot S hamir 90 ] P V m 1 m 2 m 3 3

Proofs of Knowledge (PoKs) In theory In practice x ∈ L ∑ -protocol for R G NP-reduction x “(G, C) in R HAM ” “(x, y) in R Dlog ” e.g. Discret Log [Schnorr89]) WI Proof of Knowledge of Hamiltonicity [Blum86, L apidot S hamir 90 ] x= g y V P g r P V m 1 c m 2 r+cy m 3 3

Proofs of Knowledge (PoKs) Observation: neither [LS90] Observation: [LS90] and [Schnorr89] need the nor In theory theorem and witness only in [Schnorr89] need theorem+ In practice the last round witness x ∈ L ∑ -protocol for R G NP-reduction x “(G, C) in R HAM ” “(x, y) in R Dlog ” e.g. Discret Log [Schnorr89]) WI Proof of Knowledge of Hamiltonicity [Blum86, L apidot S hamir 90 ] x= g y V P g r P V m 1 c m 2 r+cy m 3 3

∑ -protocol for relation R x V P (w) a c z 4

∑ -protocol for relation R x V P (w) Completeness a c z 4

∑ -protocol for relation R x V P (w) Completeness a c SHVZK Sim(x,c) ⇒ z 4

∑ -protocol for relation R x V P (w) Completeness a a’ c SHVZK Sim(x,c) ⇒ c z z’ 4

∑ -protocol for relation R x V P (w) Completeness a a’ z’ ≡ c SHVZK Sim(x,c) ⇒ c z 4

∑ -protocol for relation R x V P (w) Completeness a a’ z’ ≡ c SHVZK Sim(x,c) ⇒ c z Special Soundness 4

∑ -protocol for relation R x V P (w) Completeness a a’ z’ ≡ c SHVZK Sim(x,c) ⇒ c z Special Soundness x , ( a c z) w: ( x ,w) ∈ R x , ( a c’ z’) 4

R 0 OR R 1 5

R 0 OR R 1 In theory In practice G (x 0 V x 1 ) Consider the ∑ -protocols 𝛵 0 NP-reduction and 𝛵 1 for R 0 and R 1 and “(G, C) in R HAM ” WI Proof of Knowledge of Hamiltonicity compile them using [Blum86, LS90] [ C ramer D amgard S choenmakers 94 ] P V In both cases you get 3 rounds, WI and PoK 5

R 0 OR R 1 : The Gap In theory In practice G (x 0 V x 1 ) Consider the ∑ -protocols 𝛵 0 NP-reduction and 𝛵 1 for R 0 and R 1 and “(G, C) in R HAM ” WI Proof of Knowledge of Hamiltonicity compile them using [Blum86, LS90 ] [ C ramer D amgard S choenmakers 94 ] P V 6

R 0 OR R 1 : The Gap In theory In practice G (x 0 V x 1 ) Consider the ∑ -protocols 𝛵 0 NP-reduction and 𝛵 1 for R 0 and R 1 and “(G, C) in R HAM ” WI Proof of Knowledge of Hamiltonicity compile them using [Blum86, LS90 ] [ C ramer D amgard S choenmakers 94 ] P V No need to know any theorem x 0 and x 1 are needed already already at the 1 rd round at the 1 rd round 6

R 0 OR R 1 : The Gap In theory In practice [CDS94] [LS90] Delayed-Input Completeness Completeness 7

Delayed-Input Completeness P V a c 8

Delayed-Input Completeness x (w) P V a c 8

Delayed-Input Completeness x (w) P V a c z 8

R 0 OR R 1 : The Gap In theory In practice [CDS94] [LS90] Delayed-Input Completeness Completeness Proof of Knowledge Adaptive-Input Proof of Knowledge 9

Adaptive-Input PoK x P * Extractor a c 10

Adaptive-Input PoK x P * Extractor a c z 10

Adaptive-Input PoK x P * Extractor a x (a,c,z) 10

Adaptive-Input PoK x’ P * Extractor a x (a,c,z) c’ 10

Adaptive-Input PoK x’ P * Extractor a x (a,c,z) c’ x’ (a,c’,z’) z’ 10

Adaptive-Input PoK x’ P * Extractor a x (a,c,z) c’ x’ (a,c’,z’) z’ w witness for x 10

R 0 OR R 1 : The Gap In theory In practice [CDS94] [LS90] Delayed-Input Completeness Completeness Adaptive-Input Proof of Knowledge Proof of Knowledge Adaptive-Input Witness Indistinguishable Witness Indistinguishable 11

Adaptive-Input WI V * P a c 12

Adaptive-Input WI (x,w 1 ,w 2 ) (w b ) V * P a c w 1 ,w 2 witnesses for x 12

Adaptive-Input WI (x,w 1 ,w 2 ) (w b ) V * P a c z w 1 ,w 2 witnesses for x 12

R 0 OR R 1 : The Gap In theory In practice [CDS94] [LS90] Delayed-Input Completeness Completeness Adaptive-Input Proof of Knowledge Proof of Knowledge Adaptive-Input Witness Indistinguishable Witness Indistinguishable Assumption: OWP Assumption: none 13

R 0 OR R 1 : The Gap In theory In practice [CDS94] [LS90] Delayed-Input Completeness Completeness Adaptive-Input Proof of Knowledge Proof of Knowledge Adaptive-Input Witness Indistinguishable Witness Indistinguishable Assumption: OWP Assumption: none Requires NP-reduction and gives No NP-reduction and gives Computational WI Perfect WI 14

R 0 OR R 1 : The Gap In theory In practice [CDS94] [LS90] Delayed-Input Completeness Completeness Adaptive-Input Proof of Knowledge Proof of Knowledge Adaptive-Input Witness Indistinguishable Witness Indistinguishable Assumption: OWP Assumption: none Requires NP-reduction and gives No NP-reduction and gives Computational WI Perfect WI Applicable to All NP Restricted to ∑ -protocols 15

R 0 OR R 1 The Gap A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity 16

R 0 OR R 1 The Gap A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity e.g. [Pass – Eurocrypt 03], [KaOs – Crypto 04], [YuZh – Eurocrypt 07][ScVi – Eurocrypt 12]… 16

R 0 OR R 1 The Gap A larger protocols using [CDS94] instead of [LS90] may have a worse round complexity e.g. [Pass – Eurocrypt 03], [KaOs – Crypto 04], [YuZh – Eurocrypt 07][ScVi – Eurocrypt 12]… Recently Delayed-Input completeness is widely used [GMPP16 – tomorrow], [Kiayias0Z15 – CCS15], [BBKPV16 – eprint]… 16

Our Results 1) From PoK to Adaptive-Input PoK 2) Bridging the gap 17

Our First Result: from PoK to Adaptive-Input PoK ∑ -Protocols (in general) are not Adaptive-Input PoK P* Extractor g r c c’ z=r+cy x= g y z’=r+c’y’ x’= g y’ Issue observed in [ B ernhard P ereira W arinschi 12 ] about the weak Fiat-Shamir transform 18

Our Transform From PoK to Adaptive-Input PoK P V g r’ g r c z=r’+c r z=r+cy x= g y 19

Our Transform From PoK to Adaptive-Input PoK P V g r’ g r c z=r’+c r z=r+cy x= g y 19

Our Transform From PoK to Adaptive-Input PoK P V g r’ g r c z=r’+c r z=r+cy x= g y Our transform applies to the class described in [ C ramer 96 , M aurer 15 , C ramer D amgard 98 ] e.g. Schnorr, Guillou–Quisquater, Diffie–Hellman, Multiplication proof for pedersen commitments, … 19

Our Results 1) From PoK to Adaptive-Input PoK 2) Bridging the gap 20

R 0 OR R 1 : Bridging the Gap In theory In practice [LS90] [CDS94] This work [CPS + TCC 2016-A] 21

R 0 OR R 1 : Bridging the Gap In theory In practice [LS90] [CDS94] Delayed-Input Completeness Completeness This work [CPS + TCC 2016-A] Delayed-Input Completeness: All input 
 Semi-Delayed Input Completeness ∑ -protocols have to be Delayed-Input 21

R 0 OR R 1 : Bridging the Gap In theory In practice [LS90] [CDS94] Delayed-Input Completeness Completeness Adaptive-Input PoK Proof of Knowledge This work [CPS + TCC 2016-A] Delayed-Input Completeness: All input 
 Semi-Delayed Input Completeness ∑ -protocols have to be Delayed-Input Proof of Knowledge Proof of Knowledge 21

R 0 OR R 1 : Bridging the Gap In theory In practice [LS90] [CDS94] Delayed-Input Completeness Completeness Adaptive-Input PoK Proof of Knowledge Adaptive-Input WI Witness Indistinguishable This work [CPS + TCC 2016-A] Delayed-Input Completeness: All input 
 Semi-Delayed Input Completeness ∑ -protocols have to be Delayed-Input Proof of Knowledge Proof of Knowledge Semi-Adaptive Input WI: one of two instances is Adaptive-Input WI adaptively chosen by V* 21

R 0 OR R 1 : Bridging the Gap In theory In practice [LS90] [CDS94] Delayed-Input Completeness Completeness Adaptive-Input PoK Proof of Knowledge Adaptive-Input WI Witness Indistinguishable Assumption: OWP Assumption: none This work [CPS + TCC 2016-A] Delayed-Input Completeness: All input 
 Semi-Delayed Input Completeness ∑ -protocols have to be Delayed-Input Proof of Knowledge Proof of Knowledge Semi-Adaptive Input WI: one of two instances is Adaptive-Input WI adaptively chosen by V* Assumption: DDH Assumption: none 21