The Measure-and-Reprogram Technique 2.0: Multi-Round Fiat-Shamir and - - PowerPoint PPT Presentation

▶
the measure and reprogram technique 2 0 multi round fiat
SMART_READER_LITE
LIVE PREVIEW

The Measure-and-Reprogram Technique 2.0: Multi-Round Fiat-Shamir and - - PowerPoint PPT Presentation

Nov 05, 2022 220 likes •713 views

The Measure-and-Reprogram Technique 2.0: Multi-Round Fiat-Shamir and More Jelle Don, CWI Amsterdam Joint work with Serge Fehr and Christian Majenz Introduction Proving Fiat-Shamir digital signatures and ZK proof systems secure against

slide-1
SLIDE 1

The Measure-and-Reprogram Technique 2.0: Multi-Round Fiat-Shamir and More

Jelle Don, CWI Amsterdam Joint work with Serge Fehr and Christian Majenz

slide-2
SLIDE 2

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Introduction

  • Proving Fiat-Shamir digital signatures and ZK proof systems

secure against quantum attackers

  • Secure in the Quantum Random-Oracle Model (QROM)
  • Extending an existing QROM technique to a larger class of

applications, notably

– Multi-round Fiat-Shamir signatures (Example: MQDSS) – Bulletproofs – Sequential-OR Proofs

  • Proving tightness
slide-3
SLIDE 3

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Quantum Random-Oracle Model

  • We model the public hash

function as an external random-oracle

  • All parties have quantum query

access, which means that

– The function cannot be

computed locally

– Parties can query a

superposition of inputs

A OH

slide-4
SLIDE 4

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Main results

  • Multi-input reprogrammability of the QROM:

A OH A S OH

slide-5
SLIDE 5

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Main results

  • Multi-input reprogrammability of the QROM:

A OH A S

slide-6
SLIDE 6

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Main results

  • Security of multi-round Fiat-Shamir in the QROM:

for any 2n+1-round public-coin proof system

  • Tightness:

– For typical 3-round schemes, there exists a FS attack that boosts

the best interactive adversary by a factor

– The attack can be extended to an artifjcial multi-round scheme.

This attack boosts the adversary’s success by

slide-7
SLIDE 7

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Outline of the talk

  • Fiat-Shamir transformation
  • How measure-and-reprogram 1.0 is applied
  • Multi-round Fiat-Shamir; what we need
  • Proof idea for multi-input reprogrammability
  • Another application; sequential OR-proofs
slide-8
SLIDE 8

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

The Fiat-Shamir transformation

slide-9
SLIDE 9

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

The Fiat-Shamir transformation

slide-10
SLIDE 10

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

The Fiat-Shamir transformation

slide-11
SLIDE 11

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

The Fiat-Shamir transformation

slide-12
SLIDE 12

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

The Fiat-Shamir transformation

slide-13
SLIDE 13

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

The Fiat-Shamir transformation

slide-14
SLIDE 14

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Measure-and-reprogram 1.0 [DFMS19]

A OH A S

slide-15
SLIDE 15

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Application to plain Fiat-Shamir

A OH

slide-16
SLIDE 16

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Application to plain Fiat-Shamir

A S

slide-17
SLIDE 17

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Application to plain Fiat-Shamir

A S

slide-18
SLIDE 18

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Application to plain Fiat-Shamir

A S

slide-19
SLIDE 19

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Application to plain Fiat-Shamir

A S

slide-20
SLIDE 20

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Application to plain Fiat-Shamir

A S

slide-21
SLIDE 21

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Application to plain Fiat-Shamir

A S

slide-22
SLIDE 22

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

  • There exist 2n+1 round public coin interactive proof systems, for

constant or logarithmic n.

  • Generalized ‘multi-round’ FS transform takes away the

interaction.

slide-23
SLIDE 23

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

slide-24
SLIDE 24

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

slide-25
SLIDE 25

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

slide-26
SLIDE 26

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

A OH A S

slide-27
SLIDE 27

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

A OH

slide-28
SLIDE 28

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

A OH

slide-29
SLIDE 29

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

OH A S

slide-30
SLIDE 30

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

OH A S

slide-31
SLIDE 31

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

OH A S A

slide-32
SLIDE 32

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

OH A S A

slide-33
SLIDE 33

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

S A S A OH

slide-34
SLIDE 34

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

S A S S S S

slide-35
SLIDE 35

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

S A S S S S A

slide-36
SLIDE 36

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

slide-37
SLIDE 37

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

slide-38
SLIDE 38

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

slide-39
SLIDE 39

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

slide-40
SLIDE 40

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-input reprogrammability

slide-41
SLIDE 41

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Measure-and-reprogram 2.0

A OH A S

slide-42
SLIDE 42

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Measure-and-reprogram 2.0

slide-43
SLIDE 43

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Measure-and-reprogram 2.0

slide-44
SLIDE 44

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

S A S S S S

slide-45
SLIDE 45

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

slide-46
SLIDE 46

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

S A S S S S Solution: include previous challenge in the hash: Solution: include previous challenge in the hash:

slide-47
SLIDE 47

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Multi-round Fiat-Shamir

S A S S S S Solution: include previous challenge in the hash: Solution: include previous challenge in the hash:

slide-48
SLIDE 48

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

Sequential OR-proofs

  • Introduced by Liu, Wei and Wong in 2004

– Proves at least one of two statements x1,x2 is

true, without revealing which one:

slide-49
SLIDE 49

Jelle Don, CWI Amsterdam Measure-and-reprogram 2.0

The end

Thank you for listening. Questions?