Post-Quantum Zero-Knowledge Proofs for Accumulators with - - PowerPoint PPT Presentation

▶
post quantum zero knowledge proofs for accumulators
SMART_READER_LITE
LIVE PREVIEW

Post-Quantum Zero-Knowledge Proofs for Accumulators with - - PowerPoint PPT Presentation

Jan 01, 2024 324 likes •616 views

Post-Quantum Zero-Knowledge Proofs for Accumulators with Applications to Ring Signatures from Symmetric-Key Primitives David Derler , Sebastian Ramacher , Daniel Slamanig PQC rypto 18, April 9, 2018 1 Ring Signatures P

slide-1
SLIDE 1

‡ §

Post-Quantum Zero-Knowledge Proofs for Accumulators

with Applications to Ring Signatures from Symmetric-Key Primitives David Derler‡, Sebastian Ramacher‡, Daniel Slamanig§ PQCrypto’18, April 9, 2018

1

slide-2
SLIDE 2

Ring Signatures

  • Privacy enhancing primitive
  • Sign a message on behalf of ad-hoc group (= ring)

Signature attests some member of ring signed Signer remains anonymous within ring

  • 2
slide-3
SLIDE 3

PQ Ring Signatures

How to build ring signatures in a post-quantum setting?

  • Code based [MCG08]
  • Multivariate [MP17]

Linear size in # ring members! Only recently first sublinear ring signatures:

  • Lattice based [LLNW16]

From generic accumulator based approach [DKNS04]

3

slide-4
SLIDE 4

Can we build ring signatures solely from symmetric key primitives?

3

slide-5
SLIDE 5

PQ Ring Signature Intuition

Generic approach [DKNS04]

  • Compute compact representation of public keys
  • Prove knowledge of a secret key
  • Corresponding to one of the public keys

+ Incorporate message

4

slide-6
SLIDE 6

PQ Ring Signature Intuition

Generic approach [DKNS04]

  • Compute compact representation of public keys
  • Prove knowledge of a secret key
  • Corresponding to one of the public keys

+ Incorporate message

Instantiation via Merkle trees

y0,0 y0,1 y0,2 y1,2 y1,1 y2,2 x2,2 y3,2

4

slide-7
SLIDE 7

PQ Ring Signature Intuition

Generic approach [DKNS04]

  • Compute compact representation of public keys
  • Prove knowledge of a secret key
  • Corresponding to one of the public keys

+ Incorporate message

Instantiation via Merkle trees

y0,0 y0,1 y0,2 y1,2 y1,1 y2,2 x2,2 y3,2 Public keys of users

4

slide-8
SLIDE 8

PQ Ring Signature Intuition

Generic approach [DKNS04]

  • Compute compact representation of public keys
  • Prove knowledge of a secret key
  • Corresponding to one of the public keys

+ Incorporate message

Instantiation via Merkle trees

y0,0 y0,1 y0,2 y1,2 y1,1 y2,2 x2,2 y3,2 Public keys of users Inner nodes: y1,1 ← H(y2,2||y3,2)

4

slide-9
SLIDE 9

PQ Ring Signature Intuition

Generic approach [DKNS04]

  • Compute compact representation of public keys
  • Prove knowledge of a secret key
  • Corresponding to one of the public keys

+ Incorporate message

Instantiation via Merkle trees

y0,0 y0,1 y0,2 y1,2 y1,1 y2,2 x2,2 y3,2 Public keys of users Inner nodes: y1,1 ← H(y2,2||y3,2) Each public key associated to a secret key

4

slide-10
SLIDE 10

Zero-Knowledge Membership Proof

Naive approach reveals path taken Trivial approach

  • Disjunctive proof of knowledge over all possible paths
  • Linear size in # ring members!

y0,0 y0,1 y0,2 y1,2 y1,1 y2,2 y3,2 y0,0 y0,1 y0,2 y1,2 y1,1 y2,2 y3,2

5

slide-11
SLIDE 11

Zero-Knowledge Membership Proof

Use commutative hash function? [DKNS04]

  • yi = H(ai, bi) = H(bi, ai)
  • yi, ai, bi not revealed (except root of tree)
  • Does not reveal whether we continue lef or right
  • Not directly possible in symmetric setting!

6

slide-12
SLIDE 12

Zero-Knowledge Membership Proof

Use commutative hash function? [DKNS04]

  • yi = H(ai, bi) = H(bi, ai)
  • yi, ai, bi not revealed (except root of tree)
  • Does not reveal whether we continue lef or right
  • Not directly possible in symmetric setting!

Our technique

  • “Emulate” commutativity
  • Disjunctive statement per level

yi = H(ai||bi) ∨ yi = H(bi||ai)

6

slide-13
SLIDE 13

Our Ring Signatures

  • Accumulate public keys
  • Prove knowledge of secret key corresponding to public key
  • Proof membership of public key

7

slide-14
SLIDE 14

Our Ring Signatures

  • Accumulate public keys
  • Prove knowledge of secret key corresponding to public key
  • Proof membership of public key

Unforgeability:

  • From collision-free accumulator with one-way domain
  • And simulation-sound extractability

+ Prove that ZKB++/FS is simulation-sound extractable

7

slide-15
SLIDE 15

Our Ring Signatures

  • Accumulate public keys
  • Prove knowledge of secret key corresponding to public key
  • Proof membership of public key

Unforgeability:

  • From collision-free accumulator with one-way domain
  • And simulation-sound extractability

+ Prove that ZKB++/FS is simulation-sound extractable

Anonymity:

  • From zero-knowledge

7

slide-16
SLIDE 16

Instantiation & Signature Size

Instantiation

  • ZKB++
  • One-way function: use LowMC
  • Hash function: use LowMC in Sponge framework

Estimated signature sizes

  • Logarithmic in # of ring members

Ring size |σ| (FS/ROM) |σ| (Unruh/QROM) 25 2125 KB 3159 KB 210 4086 KB 6067 KB 220 8008 KB 11882 KB

8

slide-17
SLIDE 17

Can we do better? - New results

8

slide-18
SLIDE 18

Instantiating the Circuit

Multiplexer x0 x1 s M xs

9

slide-19
SLIDE 19

Instantiating the Circuit

Multiplexer x0 x1 M x0

9

slide-20
SLIDE 20

Instantiating the Circuit

Multiplexer x0 x1 1 M x1

9

slide-21
SLIDE 21

Instantiating the Circuit

ai+1 bi+1 si+1 H H M ai

9

slide-22
SLIDE 22

Instantiating the Circuit

ai+1 bi+1 si+1 M M H ai

9

slide-23
SLIDE 23

Instantiating the Circuit

ai+1 bi+1 si+1 M M H ai

  • Requires 2 AND gates / output bit

+ Can be optimized to only require 1 AND gate / output bit

9

slide-24
SLIDE 24

Smaller Signatures

  • Only one hash function evaluation
  • Two multiplexers with circuit optimizations
  • Additionally AND gates in digest size

Signature size reduction by factor ≈ 2 Ring size |σ| (FS/ROM) |σ| (Unruh/QROM) 25 1200 KB 2289 KB 210 2283 KB 4388 KB 220 4450 KB 8584 KB

10

slide-25
SLIDE 25

Conclusions

Important steps towards PQ privacy enhancing primitives

  • Solely from symmetric primitives
  • PQ accumulators + ZK proofs
  • Construction of ring signatures

Very flexible

  • Similar techniques recently used by Boneh et al. [BEF18]

In construction of PQ dynamic group signatures Future directions

  • New results → smaller signatures
  • Even smaller sizes for group signatures of Boneh et al.

? Further optimizations & new constructions

11

slide-26
SLIDE 26

Questions?

Full version: https://ia.cr/2017/1154 Supported by:

12

slide-27
SLIDE 27

References i

[BEF18] Dan Boneh, Saba Eskandarian, and Ben Fisch. Post-quantum group signatures from symmetric primitives. IACR Cryptology ePrint Archive, 2018:261, 2018. [DKNS04] Yevgeniy Dodis, Aggelos Kiayias, Antonio Nicolosi, and Victor Shoup. Anonymous identification in ad hoc groups. In EUROCRYPT, 2004. [LLNW16] Benoˆ ıt Libert, San Ling, Khoa Nguyen, and Huaxiong Wang. Zero-knowledge arguments for lattice-based accumulators: Logarithmic-size ring signatures and group signatures without trapdoors. In EUROCRYPT, 2016. [MCG08] Carlos Aguilar Melchor, Pierre-Louis Cayrel, and Philippe Gaborit. A new efficient threshold ring signature scheme based on coding theory. In PQCrypto, 2008. [MP17] Mohamed Saied Emam Mohamed and Albrecht Petzoldt. Ringrainbow - an efficient multivariate ring signature scheme. In AFRICACRYPT, 2017. 13