Zero Knowledge Proofs from Ring-LWE Xiang Xie, Rui Xue, Minqian Wang - - PowerPoint PPT Presentation

▶
zero knowledge proofs from ring lwe
SMART_READER_LITE
LIVE PREVIEW

Zero Knowledge Proofs from Ring-LWE Xiang Xie, Rui Xue, Minqian Wang - - PowerPoint PPT Presentation

Nov 27, 2023 237 likes •608 views

Zero Knowledge Proofs from Ring-LWE Xiang Xie, Rui Xue, Minqian Wang Chinese Academy of Sciences CANS 2013, Paraty Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE Outline ZKPs 1 Related Works 2 Our

slide-1
SLIDE 1

Zero Knowledge Proofs from Ring-LWE

Xiang Xie, Rui Xue, Minqian Wang

Chinese Academy of Sciences

CANS 2013, Paraty

slide-2
SLIDE 2

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Outline

1

ZKPs

2

Related Works

3

Our Results

4

Tools Σ-Protocol Learning with Errors over Rings

5

Commitment from RLWE

6

ZKP from RLWE Proving Knowledge of Valid Opending Component-Wise Relations Reduce Communication Complexity

2 / 26

slide-3
SLIDE 3

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Zero-Knowledge Proofs [GoldwassorMicaliRackoff’85]

Verifier Prover . . . π = (x, ω) ∈ R π reveals nothing except the statement itself.

3 / 26

slide-4
SLIDE 4

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Related Works of ZKPs

◮ Number Theoretical: [FeigeShamir’90], [CramerDamg˚ ard’98], [CramerDamg˚ ard’09], [GrothSahai’08] (paring), etc. ◮ General: [IshaiKushilevitzOstrovskySahai’07] (MPC). ◮ Lattice-Based: [MicciancioVadhan’03], [KawachiTanakaXagawa’08], [AsharovJainL´

  • pez-AltTromerVaikuntanathanWichs’12],

[Lyubashevsky’08], [Lyubashevsky’12], [LingNguyenStehl´ eWang’13]. ◮ LPN-based: [JainKrennPietrzakTentes’12].

4 / 26

slide-5
SLIDE 5

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Our Results

◮ Commitment scheme from Ring Learning with Errors (RLWE). ◮ ZKP that proves the knowledge of the message hidden in our commitment scheme. ◮ Two ZKPs that prove component-wise relations of the messages in the commitment scheme.

5 / 26

slide-6
SLIDE 6

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Σ-Protocol

◮ Our ZKPs are essentially Σ-protocols (see [Damg˚ ard’04]). Σ-protocol: Verifier Prover t c ← C s

6 / 26

slide-7
SLIDE 7

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Completeness: The verifier V accepts whenever (x, ω) ∈ R. ◮ Special Soundness: There exists a PPT algorithm Ext such that: ω′ ← Ext({(t, c, sc) : c ∈ C}), and (x, ω′) ∈ R. ◮ Special honest-verifier zero-knowledge: There exists a PPT simulator S such that: (tx, c, sx) ← S(x, c) ≈ (t, c, s).

7 / 26

slide-8
SLIDE 8

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Completeness: The verifier V accepts whenever (x, ω) ∈ R. ◮ Special Soundness: There exists a PPT algorithm Ext such that: ω′ ← Ext({(t, c, sc) : c ∈ C}), and (x, ω′) ∈ R. ◮ Special honest-verifier zero-knowledge: There exists a PPT simulator S such that: (tx, c, sx) ← S(x, c) ≈ (t, c, s). Note: ◮ Σ-protocol can be extended to a ZKP for the same relation [Damg˚ ard’04], [Damg˚ ardGoldreichOkamoto’95]. ◮ Soundness is different from standard definition. We require Ext has input (t, c, sc) for all c ∈ C with the same t. The knowledge error of the resulting ZKP scheme is 1 − 1/|C| instead of 1/|C|.

7 / 26

slide-9
SLIDE 9

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Learning with Errors over Rings (RLWE)

◮ RLWE is introduced by Lyubashevsky, Peikert and Regev [LPR’10]. Let R = Z[X]/(Xd + 1), where d = 2k for some k ≥ 0. For an integer q, let Rq = R/qR. The following two distributions are hard to distinguish: a1 ← Rq; b1 = a1 · s + e1 mod q a2 ← Rq; b2 = a2 · s + e2 mod q . . . am ← Rq; bm = am · s + em mod q a1 ← Rq; b1 ← Rq a2 ← Rq; b2 ← Rq . . . am ← Rq; bm ← Rq Where s ← Rq, and ei ← χ over R. ei∞ ≤ β ≪ q.

8 / 26

slide-10
SLIDE 10

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

[LyubashevskyPeikertRegev’10] If there exists a PPT algorithm solves RLWE problem, then there exists a PPT quantum algorithm solves some hard lattice problems for all d-dimensional ideal lattices.

9 / 26

slide-11
SLIDE 11

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Commitment from RLWE

The message space is Rℓ

  • q. Let χ be a β-bounded distribution over R.

◮ KeyGen(1λ) : Sample a1 ← Rm

q and A2 ← Rm×ℓ q

, output A = [a1|A2] ∈ Rm×(ℓ+1)

q

. ◮ Com(A, m ∈ Rℓ

q) : Sample s ← Rq and e ← χm, output

c = A[s|m] + e ∈ Rm

q .

◮ Ver(A, c, (s, m)) : Accept iff c − A[s|m]∞ ≤ β.

10 / 26

slide-12
SLIDE 12

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Commitment from RLWE

The message space is Rℓ

  • q. Let χ be a β-bounded distribution over R.

◮ KeyGen(1λ) : Sample a1 ← Rm

q and A2 ← Rm×ℓ q

, output A = [a1|A2] ∈ Rm×(ℓ+1)

q

. ◮ Com(A, m ∈ Rℓ

q) : Sample s ← Rq and e ← χm, output

c = A[s|m] + e ∈ Rm

q .

◮ Ver(A, c, (s, m)) : Accept iff c − A[s|m]∞ ≤ β. Security: ◮ Computational hiding: c = A[s|m] + e = a1 · s + e + A2m ◮ Perfect binding: For uniformly random A, Pr[y∞ ≤ 2β : y = Ax, x = 0] ≤ negl(λ).

10 / 26

slide-13
SLIDE 13

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Proving Knowledge of Valid Opending

Relation: RRLWE = {((A, c), (s, m, e)) : c = A(sm) + e mod q ∧ e∞ ≤ β}. ◮ Extend Stern’s ZKP for syndrome decoding problem. Similar to [JainKrennPietrzakTentes’12] and [LingNguyenStehl´ eWang’13]. ◮ The challenge set C = {1, 2, 3}. The first two openings prove A, c have the form c = A[s|m] + e. ◮ Obstacle: How to prove e is “short” without revealing anything else?

11 / 26

slide-14
SLIDE 14

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ If e ∈ {0, 1}m and e1 = β: Prover sends π(e) for a uniformly random permutation π. π(e) only reveals the Hamming weight of e.

12 / 26

slide-15
SLIDE 15

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ If e ∈ {0, 1}m and e1 = β: Prover sends π(e) for a uniformly random permutation π. π(e) only reveals the Hamming weight of e. ◮ If e ∈ {0, 1}m and e1 ≤ β: Extend e ∈ {0, 1}m to e′ ∈ {0, 1}m+β by padding, such that e′1 = β. Prover sends π(e′). m m β

12 / 26

slide-16
SLIDE 16

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ If e ∈ Zm and e∞ ≤ β: Decompose e: e =

k−1

  • i=0

2i · ˜ ei, k = ⌊log β⌋ + 1, ˜ ei ∈ {−1, 0, 1}m Extend ˜ ei ∈ {−1, 0, 1}m to ei ∈ {−1, 0, 1}3m. Prover sends πi(ei). m m 2m #{−1} = m #{0} = m #{1} = m

13 / 26

slide-17
SLIDE 17

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ If e ∈ Rm and e∞ ≤ β. View e ∈ Zdm by the coefficient

  • representation. The same as above.

14 / 26

slide-18
SLIDE 18

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Basic ZKP

Relation: RRLWE = {((A, c), (s, m, e)) : c = A(sm) + e mod q ∧ e∞ ≤ β}. ◮ Prover first decomposes e ∈ Rm to ei ∈ R3m according the method above. ◮ Define matrix ˆ I = [Im|0m|0m] ∈ Rm×3m. Note that : c = A(s|m) + e ⇔ c = A(s|m) + ˆ I(

k−1

  • i=0

2i · ei)

15 / 26

slide-19
SLIDE 19

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Prover samples (r0, ..., rk−1) ← (R3m

q )k, v ← R1+ℓ q

, and k random permutations (π0, ..., πk−1). Sends:          C1 = Com

  • {πi}k−1

i=0 , t1 = Av + ˆ

I(k−1

i=0 2i · ri)

  • C2 =

Com

  • {t2i = πi(ri)}k−1

i=0

  • C3 =

Com

  • {t3i = πi(ri + ei)}k−1

i=0

  • 16 / 26
slide-20
SLIDE 20

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Prover samples (r0, ..., rk−1) ← (R3m

q )k, v ← R1+ℓ q

, and k random permutations (π0, ..., πk−1). Sends:          C1 = Com

  • {πi}k−1

i=0 , t1 = Av + ˆ

I(k−1

i=0 2i · ri)

  • C2 =

Com

  • {t2i = πi(ri)}k−1

i=0

  • C3 =

Com

  • {t3i = πi(ri + ei)}k−1

i=0

  • ◮ Verifier chooses Ch ← {1, 2, 3} and sends to Prover.

16 / 26

slide-21
SLIDE 21

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Prover samples (r0, ..., rk−1) ← (R3m

q )k, v ← R1+ℓ q

, and k random permutations (π0, ..., πk−1). Sends:          C1 = Com

  • {πi}k−1

i=0 , t1 = Av + ˆ

I(k−1

i=0 2i · ri)

  • C2 =

Com

  • {t2i = πi(ri)}k−1

i=0

  • C3 =

Com

  • {t3i = πi(ri + ei)}k−1

i=0

  • ◮ Verifier chooses Ch ← {1, 2, 3} and sends to Prover.

◮ According to Ch, Prover does the following:    Ch = 1,

  • pen C1, C2;

Ch = 2,

  • pen C1, C3;

Ch = 3,

  • pen C2, C3.

16 / 26

slide-22
SLIDE 22

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Prover samples (r0, ..., rk−1) ← (R3m

q )k, v ← R1+ℓ q

, and k random permutations (π0, ..., πk−1). Sends:          C1 = Com

  • {πi}k−1

i=0 , t1 = Av + ˆ

I(k−1

i=0 2i · ri)

  • C2 =

Com

  • {t2i = πi(ri)}k−1

i=0

  • C3 =

Com

  • {t3i = πi(ri + ei)}k−1

i=0

  • ◮ Verifier chooses Ch ← {1, 2, 3} and sends to Prover.

◮ According to Ch, Prover does the following:    Ch = 1,

  • pen C1, C2;

Ch = 2,

  • pen C1, C3;

Ch = 3,

  • pen C2, C3.

◮ Verifier checks the following:    Ch = 1, check t1 − ˆ I · k−1

i=0 2i · π−1 i

(t2i)

  • ∈ Img(A);

Ch = 2, check t1 + c − ˆ I · k−1

i=0 2i · π−1 i

(t3i)

  • ∈ Img(A);

Ch = 3, check t3i − t2i ∈ {−1, 0, 1}3md.

16 / 26

slide-23
SLIDE 23

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Correctness: obvious. ◮ Special Soundness: Ch = 1 and Ch = 2 guarantee that A, c have the proper form. Ch = 3 guarantees e is small. ◮ Special Honest-Verifier Zero-Knowledge: By the decomposition and extension technique. Similar to [LingNguyenStehl´ eWang’13].

17 / 26

slide-24
SLIDE 24

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Component-Wise Relations

Relation: RCWRLWE =

  • (A, c1, c2, c3), (s1, s2, s3, m1, m2, m3, e1, e2, e3)
  • :

3

  • i=1
  • ci = A(si|mi) + ei mod q ∧ ei∞ ≤ β
  • ∧ m3 = m1 ◦ m2
  • .

Where ◦ denotes the component-wise addition or multiplication in Rq.

18 / 26

slide-25
SLIDE 25

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ If m1, m2, m3 ∈ {0, 1}ℓ, extend them to ˆ m1, ˆ m2, ˆ m3 m1 ˆ m1

  • m2

ˆ m2

  • m3

ˆ m3 ℓ 4ℓ #{(1, 1)} = #{(1, 0)} = #{(0, 1)} = #{(0, 0)} = ℓ ◮ Prover sends π( ˆ m1), π( ˆ m2), π( ˆ m3), note that π( ˆ m1) ◦ π( ˆ m2) = π( ˆ m3)

19 / 26

slide-26
SLIDE 26

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ If m1, m2, m3 ∈ Zℓ

  • q. Extend to ˆ

m1, ˆ m2, ˆ m3 ∈ Zq2ℓ

q

as before. Note: This method only works for q = poly(λ).

20 / 26

slide-27
SLIDE 27

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ If m1, m2, m3 ∈ Zℓ

  • q. Extend to ˆ

m1, ˆ m2, ˆ m3 ∈ Zq2ℓ

q

as before. Note: This method only works for q = poly(λ). ◮ If m1, m2, m3 ∈ Rℓ

  • q. The dimension of ˆ

m1, ˆ m2, ˆ m3 is exponential!!! How to overcome this problem ?

20 / 26

slide-28
SLIDE 28

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Chinese Remainder Theorem (CRT)

Let R = Z[X]/(Xd + 1) with d = 2k for k ∈ N+. Let Rq = R/qR. ◮ Coefficient Representation: For a ∈ Rq, i.e a(X) = d−1

i=0 aiXi.

Represent a by (a0, ...ad) ∈ Zd

q.

◮ CRT Representation: If q = 1 mod 2d and q is prime, then (Xd + 1) =

d

  • i=1

(X − ζi) mod q. Represent a by

  • a(ζ1), ..., a(ζd)
  • ∈ Zd

q.

21 / 26

slide-29
SLIDE 29

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Add: for a, b ∈ Rq, then a + b is

  • a(ζ1) + b(ζ1), ..., a(ζd) + b(ζd)
  • ∈ Zd

q.

◮ Multiplication: for a, b ∈ Rq, then a · b ∈ Rq is

  • a(ζ1)b(ζ1), ..., a(ζd)b(ζd)
  • ∈ Zd

q.

We now can adapt the extension technique in the CRT representation.

22 / 26

slide-30
SLIDE 30

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Reduce Communication Complexity

◮ The method extends the dimension from ℓ to q2ℓ. Large Communication Complexity ! ◮ The reason is that we consider multiplication in Zq. We note that for addition, there is much simpler methods (without extension) due to the linearity.

23 / 26

slide-31
SLIDE 31

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Reduce Communication Complexity

◮ The method extends the dimension from ℓ to q2ℓ. Large Communication Complexity ! ◮ The reason is that we consider multiplication in Zq. We note that for addition, there is much simpler methods (without extension) due to the linearity. ◮ When proving multiplication, instead of directly extend the vector, we consider the following relations: m1 = ⌊log q⌋

j=0

2j · m1j; m2 = ⌊log q⌋

k=0

2k · m2k; mjk = m1j ⋄ m2k; m3 =

j,k 2j+k · mjk.

⋄ means component-wise bit multiplication.

23 / 26

slide-32
SLIDE 32

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Reduce Communication Complexity

◮ The method extends the dimension from ℓ to q2ℓ. Large Communication Complexity ! ◮ The reason is that we consider multiplication in Zq. We note that for addition, there is much simpler methods (without extension) due to the linearity. ◮ When proving multiplication, instead of directly extend the vector, we consider the following relations: m1 = ⌊log q⌋

j=0

2j · m1j; m2 = ⌊log q⌋

k=0

2k · m2k; mjk = m1j ⋄ m2k; m3 =

j,k 2j+k · mjk.

⋄ means component-wise bit multiplication. Note: we only need to extend the dimension to prove mjk = m1j ⋄ m2k. Since they are all binary vectors, the dimension is extended from ℓ to 4ℓ. But the prover needs extra log2 q + log q commitments.

23 / 26

slide-33
SLIDE 33

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Be Careful: Prover must convince Verifier that m1j and m2k are bit vectors.

24 / 26

slide-34
SLIDE 34

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ Be Careful: Prover must convince Verifier that m1j and m2k are bit vectors. ◮ To prove m ∈ {0, 1}ℓ. Prover extends m to ¯ m ∈ {0, 1}2ℓ and sends π( ¯ m), ℓ ℓ ℓ #{1} = ℓ #{0} = ℓ

24 / 26

slide-35
SLIDE 35

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

◮ We now can prove any polynomial relations of the messages under the commitment. ◮ The amortized complexity is ˜ O(λ|f|), where f is the polynomial relation.

25 / 26

slide-36
SLIDE 36

Outline ZKPs Related Works Our Results Tools Commitment from RLWE ZKP from RLWE

Questions ?

26 / 26