zero knowledge succinct arguments an introduction
play

Zero Knowledge Succinct Arguments: an Introduction Alessandro - PowerPoint PPT Presentation

Zero Knowledge Succinct Arguments: an Introduction Alessandro Chiesa UC Berkeley 1 Motivation 2 3 cryptography is a powerful tool for building secure systems 3 cryptography is a powerful tool for building secure systems much of the


  1. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output [GMR85]: ZKPs for certain number-theoretic problems (QR,QNR) If one-way functions exist: 7

  2. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output [GMR85]: ZKPs for certain number-theoretic problems (QR,QNR) If one-way functions exist: [GMW86]: ZKPs for all poly- time computable functions F 7

  3. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output [GMR85]: ZKPs for certain number-theoretic problems (QR,QNR) If one-way functions exist: [GMW86]: ZKPs for all poly- time computable functions F [BGGHKMR88]: ZKPs for all poly- space computable functions F 7

  4. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output Powerful cryptographic primitive. 8

  5. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output Powerful cryptographic primitive. BUT 8

  6. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output Powerful cryptographic primitive. BUT interactive 8

  7. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output Powerful cryptographic primitive. BUT interactive not succinct 8

  8. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output Powerful cryptographic primitive. BUT interactive not succinct communication complexity & verification complexity are proportional to time( F ) 8

  9. Zero Knowledge Proofs [GMR85] “I know x s.t. y = F ( x )” P V rover erifier F function F function y claimed output x private input y claimed output Powerful cryptographic primitive. BUT interactive not succinct communication complexity & verification complexity for typical F are proportional to time( F ) size( F ) ≪ time( F ) 8

  10. Zero Knowledge Succinct Proofs [Kilian92][Micali94] 9

  11. Zero Knowledge Succinct Proofs [Kilian92][Micali94] “I know x s.t. y = F ( x )” P V 9

  12. Zero Knowledge Succinct Proofs [Kilian92][Micali94] “I know x s.t. y = F ( x )” P V ∃ x : y = F ( x ) → Pr[ P ( F , y , x ) convinces V ( F , y )]=1 completeness ∄ x : y = F ( x ) → ∀ P’ Pr[ P’ convinces V ( F , y )] ≃ 0 soundness zero knowledge ∃ x : y = F ( x ) → ∀ V’ , S ( V' , F , y ) ≃ view of V' with P ( F , y , x ) succinctness V ( F , y ) runs in time proportional to | F |+| y | (not time( F )+| y |) 9

  13. Zero Knowledge Succinct Proofs [Kilian92][Micali94] “I know x s.t. y = F ( x )” P V ∃ x : y = F ( x ) → Pr[ P ( F , y , x ) convinces V ( F , y )]=1 completeness * ∄ x : y = F ( x ) → ∀ P’ Pr[ P’ convinces V ( F , y )] ≃ 0 soundness zero knowledge ∃ x : y = F ( x ) → ∀ V’ , S ( V' , F , y ) ≃ view of V' with P ( F , y , x ) succinctness V ( F , y ) runs in time proportional to | F |+| y | (not time( F )+| y |) 9

  14. Zero Knowledge Succinct Proofs [Kilian92][Micali94] “I know x s.t. y = F ( x )” P V ∃ x : y = F ( x ) → Pr[ P ( F , y , x ) convinces V ( F , y )]=1 completeness * ∄ x : y = F ( x ) → ∀ P’ Pr[ P’ convinces V ( F , y )] ≃ 0 soundness zero knowledge ∃ x : y = F ( x ) → ∀ V’ , S ( V' , F , y ) ≃ view of V' with P ( F , y , x ) succinctness V ( F , y ) runs in time proportional to | F |+| y | (not time( F )+| y |) * must relax to computational soundness: ∀ PPT P’ ... [GH98] 9

  15. Zero Knowledge Succinct Proofs [Kilian92][Micali94] Arguments “I know x s.t. y = F ( x )” P V ∃ x : y = F ( x ) → Pr[ P ( F , y , x ) convinces V ( F , y )]=1 completeness * ∄ x : y = F ( x ) → ∀ P’ Pr[ P’ convinces V ( F , y )] ≃ 0 soundness zero knowledge ∃ x : y = F ( x ) → ∀ V’ , S ( V' , F , y ) ≃ view of V' with P ( F , y , x ) succinctness V ( F , y ) runs in time proportional to | F |+| y | (not time( F )+| y |) * must relax to computational soundness: ∀ PPT P’ ... [GH98] 9

  16. Achieving Succinctness 10

  17. Achieving Succinctness Zero Knowledge Succinct Proof 10

  18. Achieving Succinctness Zero Knowledge Succinct Proof [Kilian92] 10

  19. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] [Kilian92] 10

  20. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q P [Kilian92] D 10

  21. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q P [Kilian92] D 10

  22. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q P [Kilian92] D 10

  23. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q P [Kilian92] D 10

  24. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] D 10

  25. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] Q D 10

  26. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D 10

  27. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D 10

  28. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D TOFIX interactive not succinct 10

  29. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D TOFIX interactive not succinct 10

  30. Achieving Succinctness Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D TOFIX interactive not succinct bad concrete efficiency 10

  31. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D TOFIX interactive not succinct bad concrete efficiency 11

  32. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] TOFIX interactive not succinct bad concrete efficiency 11

  33. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK TOFIX interactive not succinct bad concrete efficiency 11

  34. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK Random Oracle (SHA-256) TOFIX interactive not succinct bad concrete efficiency 11

  35. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK Random Oracle (SHA-256) TOFIX interactive not succinct bad concrete efficiency 11

  36. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK Random Oracle (SHA-256) COM TOFIX P interactive not succinct bad concrete efficiency 11

  37. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK Random Oracle (SHA-256) COM TOFIX P interactive not succinct bad concrete efficiency 11

  38. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK Random Oracle (SHA-256) COM TOFIX P interactive Q not succinct bad concrete efficiency 11

  39. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK Random Oracle (SHA-256) COM TOFIX P interactive DECOM Q not succinct bad concrete efficiency 11

  40. Achieving Non-Interactivity Probabilistically Checkable Proof Zero Knowledge Succinct Proof [BFLS91][FGLSS96][AS92][ALMSS92] Q COM P P [Kilian92] DECOM Q D D [Micali94] (the first) Zero Knowledge SNARK Random Oracle (SHA-256) COM TOFIX P interactive DECOM Q not succinct D bad concrete efficiency 11

  41. Modern Era 12

  42. The Quest for ZK-SNARKs without Random Oracles 13

  43. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] 13

  44. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): 13

  45. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Knowledge of Exponent [D 92 ] 13

  46. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Knowledge of Exponent [D 92 ] 13

  47. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Knowledge of Exponent [D 92 ] Extractable Hash Functions 13

  48. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Knowledge of Exponent [D 92 ] Extractable Hash Functions [BC C T 12 ] [DFH 12 ] [GLR 12 ] [B C 12 ] [BC C T 13 ] [BC C GLRT 16 ] 13

  49. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Knowledge of Exponent [D 92 ] Extractable Hash Functions [BC C T 12 ] [DFH 12 ] [GLR 12 ] [B C 12 ] [BC C T 13 ] [BC C GLRT 16 ] based on PCPs 13

  50. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Knowledge of Exponent [D 92 ] Extractable Hash Functions Linear-Only Encryption/Encoding [BC C T 12 ] [DFH 12 ] [GLR 12 ] [B C 12 ] [BC C T 13 ] [BC C GLRT 16 ] based on PCPs 13

  51. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Knowledge of Exponent [D 92 ] Extractable Hash Functions Linear-Only Encryption/Encoding [G 10 ] [WSRBW 15 ] [BC C T 12 ] [L 12 ] [BBFR 15 ] [DFH 12 ] [B C IOP 13 ] [B C TV 14b ] [GLR 12 ] [GGPR 13 ] [ C TV 15 ] [B C 12 ] [PGHR 13 ] [CFHKKNPZ 15 ] [BC C T 13 ] [B C GTV 13 ] [BISW 17 ] [BC C GLRT 16 ] ⁞ [B C TV 14a ] [DFGK 14 ] based on PCPs 13

  52. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Generic Group Model [G 16 ] Knowledge of Exponent [D 92 ] Extractable Hash Functions Linear-Only Encryption/Encoding [G 10 ] [WSRBW 15 ] [BC C T 12 ] [L 12 ] [BBFR 15 ] [DFH 12 ] [B C IOP 13 ] [B C TV 14b ] [GLR 12 ] [GGPR 13 ] [ C TV 15 ] [B C 12 ] [PGHR 13 ] [CFHKKNPZ 15 ] [BC C T 13 ] [B C GTV 13 ] [BISW 17 ] [BC C GLRT 16 ] ⁞ [B C TV 14a ] [DFGK 14 ] based on PCPs 13

  53. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Generic Group Model [G 16 ] Knowledge of Exponent [D 92 ] Extractable Hash Functions Linear-Only Encryption/Encoding [G 10 ] [WSRBW 15 ] [BC C T 12 ] [L 12 ] [BBFR 15 ] [DFH 12 ] [B C IOP 13 ] [B C TV 14b ] [GLR 12 ] [GGPR 13 ] [ C TV 15 ] [B C 12 ] [PGHR 13 ] [CFHKKNPZ 15 ] [BC C T 13 ] [B C GTV 13 ] [BISW 17 ] [BC C GLRT 16 ] ⁞ [B C TV 14a ] [DFGK 14 ] based on PCPs based on linear PCPs 13

  54. The Quest for ZK-SNARKs without Random Oracles Negative result: constructing them "requires strong assumptions" [GW11] Positive results (under strong assumptions): Generic Group Model [G 16 ] Knowledge of Exponent [D 92 ] Extractable Hash Functions Linear-Only Encryption/Encoding [G 10 ] [WSRBW 15 ] [BC C T 12 ] [L 12 ] [BBFR 15 ] [DFH 12 ] [B C IOP 13 ] [B C TV 14b ] [GLR 12 ] [GGPR 13 ] [ C TV 15 ] [B C 12 ] [PGHR 13 ] [CFHKKNPZ 15 ] [BC C T 13 ] [B C GTV 13 ] [BISW 17 ] [BC C GLRT 16 ] ⁞ [B C TV 14a ] [DFGK 14 ] based on PCPs based on linear PCPs strike a different tradeoff… 13

  55. ZK-SNARKs from Linear PCPs 14

  56. ZK-SNARKs from Linear PCPs Linear PCP [IKO07][B C IOP13] Q P h ~ ↵ , · i D 14

  57. ZK-SNARKs from Linear PCPs Linear PCP [IKO07][B C IOP13] Q P h ~ ↵ , · i [B C IOP13] D 14

  58. ZK-SNARKs from Linear PCPs Linear PCP Zero Knowledge SNARK [IKO07][B C IOP13] Q P h ~ ↵ , · i [B C IOP13] D 14

  59. ZK-SNARKs from Linear PCPs Linear PCP Zero Knowledge SNARK [IKO07][B C IOP13] Setup pk Q vk P h ~ ↵ , · i [B C IOP13] P V D 14

  60. ZK-SNARKs from Linear PCPs linear-only Linear PCP Zero Knowledge SNARK encodings [IKO07][B C IOP13] Setup pk Q vk P h ~ ↵ , · i [B C IOP13] P V D 14

  61. ZK-SNARKs from Linear PCPs linear-only Linear PCP Zero Knowledge SNARK encodings [IKO07][B C IOP13] Setup pk Q vk P h ~ ↵ , · i [B C IOP13] P V D 14

  62. ZK-SNARKs from Linear PCPs linear-only Linear PCP Zero Knowledge SNARK encodings [IKO07][B C IOP13] Setup pk Q vk P h ~ ↵ , · i [B C IOP13] P V D pk vk 14

  63. ZK-SNARKs from Linear PCPs linear-only Linear PCP Zero Knowledge SNARK encodings [IKO07][B C IOP13] Setup pk Q vk P h ~ ↵ , · i [B C IOP13] P V D Q pk vk 14

  64. ZK-SNARKs from Linear PCPs linear-only Linear PCP Zero Knowledge SNARK encodings [IKO07][B C IOP13] Setup pk Q vk P h ~ ↵ , · i [B C IOP13] P V D Q pk Enc vk 14

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend