SLIDE 1
ZK Proofs (cntd.) Composition
Lecture 16
ZK Proofs (cntd.) Composition ZK Proofs (cntd.) Composition - - PowerPoint PPT Presentation
ZK Proofs (cntd.) Composition ZK Proofs (cntd.) Composition - - PowerPoint PPT Presentation
ZK Proofs (cntd.) Composition ZK Proofs (cntd.) Composition Lecture 16 An Example RECALL An Example RECALL Graph Isomorphism An Example RECALL Graph Isomorphism (G 0 ,G 1 ) in L iff there exists an isomorphism such that (G 0 )=G 1
SLIDE 2
SLIDE 3
An Example
RECALL
SLIDE 4
An Example
Graph Isomorphism
RECALL
SLIDE 5
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
RECALL
SLIDE 6
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ
RECALL
SLIDE 7
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
RECALL
SLIDE 8
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G*
RECALL
SLIDE 9
G* := π(G1) (random π)
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G*
RECALL
SLIDE 10
G* := π(G1) (random π)
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G* G*
RECALL
SLIDE 11
G* := π(G1) (random π)
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G* G*
random bit b RECALL
SLIDE 12
G* := π(G1) (random π)
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G* G*
random bit b
b
RECALL
SLIDE 13
G* := π(G1) (random π)
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G* G*
random bit b
b
if b=1, π* := π if b=0, π* := πoσ RECALL
SLIDE 14
G* := π(G1) (random π)
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G* G*
random bit b
b
if b=1, π* := π if b=0, π* := πoσ
π*
RECALL
SLIDE 15
G* := π(G1) (random π)
An Example
Graph Isomorphism
(G0,G1) in L iff there exists an isomorphism σ such that σ(G0)=G1
IP protocol: send σ ZK protocol
Bob sees only b, π* and G* s.t. π*(Gb) = G* G*
random bit b
b
if b=1, π* := π if b=0, π* := πoσ G*=π*(Gb)?
π*
RECALL
SLIDE 16
The Legend of William Tell
A Side Story
SLIDE 17
The Legend of William Tell
A Side Story
Bob: William Tell is a great marksman!
SLIDE 18
The Legend of William Tell
A Side Story
Bob: William Tell is a great marksman! Charlie: How do you know?
SLIDE 19
The Legend of William Tell
A Side Story
Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this!
SLIDE 20
The Legend of William Tell
A Side Story
Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this!
SLIDE 21
The Legend of William Tell
A Side Story
Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up!
SLIDE 22
The Legend of William Tell
A Side Story
Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 23
The Legend of William Tell
A Side Story
Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 24
The Legend of William Tell
A Side Story
Bob: G0 and G1 are isomorphic! Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 25
The Legend of William Tell
A Side Story
Bob: G0 and G1 are isomorphic! Charlie: How do you know? Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 26
The Legend of William Tell
A Side Story
Bob: G0 and G1 are isomorphic! Charlie: How do you know? Bob: Alice just proved it to me! See this: Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 27
The Legend of William Tell
A Side Story
Bob: G0 and G1 are isomorphic! Charlie: How do you know? Bob: Alice just proved it to me! See this: G*, b, π* s.t. G*=π*(Gb) Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 28
The Legend of William Tell
A Side Story
Bob: G0 and G1 are isomorphic! Charlie: How do you know? Bob: Alice just proved it to me! See this: G*, b, π* s.t. G*=π*(Gb) Charlie: That convinced you? Anyone could have made it up! Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 29
The Legend of William Tell
A Side Story
Bob: G0 and G1 are isomorphic! Charlie: How do you know? Bob: Alice just proved it to me! See this: G*, b, π* s.t. G*=π*(Gb) Charlie: That convinced you? Anyone could have made it up! Bob: But I picked b at random and she had no trouble answering me... Bob: William Tell is a great marksman! Charlie: How do you know? Bob: I just saw him shoot an apple placed on his son’s head! See this! Charlie: That apple convinced you? Anyone could have made it up! Bob: But I saw him shoot it...
SLIDE 30
Zero-Knowledge Proofs
SLIDE 31
Zero-Knowledge Proofs
Interactive Proof
SLIDE 32
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
SLIDE 33
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
SLIDE 34
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
SLIDE 35
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
SLIDE 36
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
SLIDE 37
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
SLIDE 38
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
Verifier’s view could have been “simulated”
SLIDE 39
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
Verifier’s view could have been “simulated”
SLIDE 40
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
Verifier’s view could have been “simulated”
SLIDE 41
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
Verifier’s view could have been “simulated”
x i n L
SLIDE 42
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
Verifier’s view could have been “simulated”
x i n L
Ah, got it! 42
SLIDE 43
Ah, got it! 42
Zero-Knowledge Proofs
Interactive Proof
Complete and Sound
ZK Property:
Verifier’s view could have been “simulated” For every adversarial strategy, there exists a simulation strategy
x i n L
Ah, got it! 42
SLIDE 44
ZK Property (in other pict’ s)
proto proto
Env REAL
i’face
Env IDEAL
F
R
x,w x Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 45
ZK Property (in other pict’ s)
proto proto
Env REAL
i’face
Env IDEAL
F
R
x,w x Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 46
ZK Property (in other pict’ s)
proto proto
Env REAL
i’face
Env IDEAL
F
R
x,w x Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 47
ZK Property (in other pict’ s)
proto proto
Env REAL
i’face
Env IDEAL
F
R
Classical definition uses simulation
- nly for corrupt receiver;
x,w x Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 48
ZK Property (in other pict’ s)
proto proto
Env REAL
i’face
Env IDEAL
F
R
Classical definition uses simulation
- nly for corrupt receiver;
and uses only standalone security: Environment gets only a transcript at the end x,w x Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 49
SIM ZK
proto proto
Env REAL
i’face
Env IDEAL
F
R
x,w x Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 50
SIM ZK
proto proto
Env REAL
i’face
Env IDEAL
F
R
x,w x
- SIM-ZK would require simulation also when prover is corrupt
Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 51
SIM ZK
proto proto
Env REAL
i’face
Env IDEAL
F
R
x,w x
- SIM-ZK would require simulation also when prover is corrupt
- Then simulator is a witness extractor
Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 52
SIM ZK
proto proto
Env REAL
i’face
Env IDEAL
F
R
x,w x
- SIM-ZK would require simulation also when prover is corrupt
- Then simulator is a witness extractor
- Adding this (in standalone setting) makes it a Proof of Knowledge
Secure (and correct) if: ∀ ∃ s.t. ∀
- utput of
is distributed identically in REAL and IDEAL x
SLIDE 53
A ZK Proof for Graph Colorability
SLIDE 54
A ZK Proof for Graph Colorability
G,coloring
SLIDE 55
Uses a commitment protocol as a subroutine
A ZK Proof for Graph Colorability
G,coloring
F
SLIDE 56
Uses a commitment protocol as a subroutine
A ZK Proof for Graph Colorability
Use random colors
G,coloring
F
SLIDE 57
Uses a commitment protocol as a subroutine
A ZK Proof for Graph Colorability
Use random colors
G,coloring
F
committed
SLIDE 58
Uses a commitment protocol as a subroutine
A ZK Proof for Graph Colorability
pick random edge Use random colors
edge G,coloring
F
committed
SLIDE 59
Uses a commitment protocol as a subroutine
A ZK Proof for Graph Colorability
pick random edge Use random colors
edge G,coloring
F
reveal edge committed
SLIDE 60
Uses a commitment protocol as a subroutine
A ZK Proof for Graph Colorability
pick random edge distinct colors? Use random colors
edge G,coloring
F
reveal edge committed
SLIDE 61
Uses a commitment protocol as a subroutine
A ZK Proof for Graph Colorability
pick random edge distinct colors? Use random colors
edge G,coloring OK
F
reveal edge committed
SLIDE 62
Uses a commitment protocol as a subroutine At least 1/m probability of catching a wrong proof
A ZK Proof for Graph Colorability
pick random edge distinct colors? Use random colors
edge G,coloring OK
F
reveal edge committed
SLIDE 63
Uses a commitment protocol as a subroutine At least 1/m probability of catching a wrong proof Soundness amplification: Repeat say mk times (with independent color permutations)
A ZK Proof for Graph Colorability
pick random edge distinct colors? Use random colors
edge G,coloring OK
F
reveal edge committed
SLIDE 64
A Commitment Protocol
SLIDE 65
Using a OWP f and a hardcore predicate for it B
A Commitment Protocol
SLIDE 66
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
SLIDE 67
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
b
SLIDE 68
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
random x
b
SLIDE 69
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
random x
f(x), b ⊕ B(x) b
SLIDE 70
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
random x
f(x), b ⊕ B(x) b committed
SLIDE 71
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
random x
f(x), b ⊕ B(x) b committed
SLIDE 72
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
random x
f(x), b ⊕ B(x) b committed reveal
SLIDE 73
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
random x
f(x), b ⊕ B(x) b x,b committed reveal
SLIDE 74
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
consistent? random x
f(x), b ⊕ B(x) b x,b committed reveal
SLIDE 75
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding
A Commitment Protocol
consistent? random x
f(x), b ⊕ B(x) b b x,b committed reveal
SLIDE 76
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding Perfectly binding because f is a permutation
A Commitment Protocol
consistent? random x
f(x), b ⊕ B(x) b b x,b committed reveal
SLIDE 77
Using a OWP f and a hardcore predicate for it B Satisfies only classical (IND) security, in terms of hiding and binding Perfectly binding because f is a permutation Hiding because B(x) is pseudorandom given f(x)
A Commitment Protocol
consistent? random x
f(x), b ⊕ B(x) b b x,b committed reveal
SLIDE 78
ZK Results
SLIDE 79
ZK Results
IP and ZK defined [GMR’85]
SLIDE 80
ZK Results
IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86]
SLIDE 81
ZK Results
IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist
SLIDE 82
ZK Results
IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist ZK for all of IP [BGGHKMR’88]
SLIDE 83
ZK Results
IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist ZK for all of IP [BGGHKMR’88] Everything that can be proven can be proven in zero- knowledge! (Assuming OWF)
SLIDE 84
ZK Results
IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist ZK for all of IP [BGGHKMR’88] Everything that can be proven can be proven in zero- knowledge! (Assuming OWF) Variants (known for NP)
SLIDE 85
ZK Results
IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist ZK for all of IP [BGGHKMR’88] Everything that can be proven can be proven in zero- knowledge! (Assuming OWF) Variants (known for NP) ZKPoK, Statistical ZK Arguments, Non-Interactive ZK (using a common random string), Witness-Indistinguishable Proofs, …
SLIDE 86
ZK Proofs: What for?
SLIDE 87
Authentication
ZK Proofs: What for?
SLIDE 88
Authentication
Using ZK Proof of Knowledge
ZK Proofs: What for?
SLIDE 89
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
ZK Proofs: What for?
SLIDE 90
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols
ZK Proofs: What for?
SLIDE 91
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
SLIDE 92
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1
SLIDE 93
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1
Prove to me x1 is what you should have sent me now
SLIDE 94
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1
Prove to me x1 is what you should have sent me now
SLIDE 95
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1
Prove to me x1 is what you should have sent me now OK
SLIDE 96
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1 y1
Prove to me x1 is what you should have sent me now OK
SLIDE 97
Prove y1 is what...
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1 y1
Prove to me x1 is what you should have sent me now OK
SLIDE 98
Prove y1 is what...
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1 y1
Prove to me x1 is what you should have sent me now OK
SLIDE 99
Prove y1 is what...
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1 y1
Prove to me x1 is what you should have sent me now OK OK
SLIDE 100
Prove y1 is what...
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1 y1 x2
Prove to me x1 is what you should have sent me now OK OK
SLIDE 101
Prove y1 is what...
Authentication
Using ZK Proof of Knowledge
Canonical use: As a tool in larger protocols
To enforce “honest behavior” in protocols At each step prove in ZK it was done as prescribed
ZK Proofs: What for?
x1 y1 x2
Prove to me x1 is what you should have sent me now Prove x2 is what... OK OK
SLIDE 102
Does it fit in?
x1 y1 x2
SLIDE 103
Does the proof stay ZK in the big picture?
Does it fit in?
x1 y1 x2
SLIDE 104
Does the proof stay ZK in the big picture?
Composition
Does it fit in?
x1 y1 x2
SLIDE 105
Does the proof stay ZK in the big picture?
Composition
Several issues: auxiliary information from previous runs, concurrency issues, malleability/man-in-the- middle
Does it fit in?
x1 y1 x2
SLIDE 106
Does the proof stay ZK in the big picture?
Composition
Several issues: auxiliary information from previous runs, concurrency issues, malleability/man-in-the- middle
In general, to allow composition more complicated protocols
Does it fit in?
x1 y1 x2
SLIDE 107
GM1 vs. Hacker Hacker vs. GM2
Composition Issues
SLIDE 108
GM1 vs. Hacker Hacker vs. GM2
Multiple executions provide new
- pportunities for the hacker
Composition Issues
SLIDE 109
GM1 vs. Hacker Hacker vs. GM2
Will not lose against both! Play the GM’s against each other
Multiple executions provide new
- pportunities for the hacker
Composition Issues
SLIDE 110
GM1 vs. Hacker Hacker vs. GM2
Will not lose against both! Play the GM’s against each other
Multiple executions provide new
- pportunities for the hacker
Person-in-the-middle attack
Composition Issues
SLIDE 111
Multiple executions provide new
- pportunities for the hacker
Person-in-the-middle attack Simulability of a single execution doesn’t imply simulation for multiple executions
Composition Issues
SLIDE 112
x1 in L x3 in L x4 in L x2 in L wR1,wR2,wR3
Multiple executions provide new
- pportunities for the hacker
Person-in-the-middle attack Simulability of a single execution doesn’t imply simulation for multiple executions
Composition Issues
SLIDE 113
x1 in L x3 in L x4 in L x2 in L wR1,wR2,wR3
Multiple executions provide new
- pportunities for the hacker
Person-in-the-middle attack Simulability of a single execution doesn’t imply simulation for multiple executions
Composition Issues
Or when run along with other protocols
SLIDE 114
Universal Composition
SLIDE 115
Universal Composition
A security guarantee
SLIDE 116
Universal Composition
A security guarantee that can be given for a “composed system”
SLIDE 117
Universal Composition
A security guarantee that can be given for a “composed system” such that security for each component separately implies security for the entire system
SLIDE 118
Universal Composition
A security guarantee that can be given for a “composed system” such that security for each component separately implies security for the entire system and is meaningful! (otherwise, “everything is secure” is composable)
SLIDE 119
Universal Composition
A security guarantee that can be given for a “composed system” such that security for each component separately implies security for the entire system and is meaningful! (otherwise, “everything is secure” is composable) Will use SIM security