Nir Bitansky, Ran Canetti, Omer Paneth, Alon Rosen Largest Known Prime 257,885,161 β 1 Electronic Frontier Foundation offers $250,000 prize for a prime with at least a billion digits 9 10 10 βThe first number larger then that is not divisible by any number other than 1 and itselfβ Knowledge Algorithm Polynomial Time Extraction Procedure Knowledge Proofs of Knowledge π₯ββ Witness Extraction π Hide the Witness π Secrecy : Zero-Knowledge \ Witness indistinguishability Goal: Extract knowledge that is not publicly available CCA Encryption ππΎ Reduction πΈππ(π₯) To CPA π₯ Extraction πΈππ(π) π΄ π·ππ π₯ π More Knowledge Reduction π₯ Extraction π΄ Zero-knowledge Proofs, Signatures, Non-malleable Commitments, Multi-party Computation, Obfuscation,β¦ How to Extract? Algorithm Extraction? Knowledge Extraction by Interaction Or : Black-Box Extraction Public Parameters Adversary Extraction Out of Reach Applications 2-Message Succinct Argument (SNARG) π π 3-Message Zero-Knowledge π π Out of Reach Applications Black-Box Security Proof is Impossible [Goldreich-Krawczyk] [Gentry-Wichs] π π π π Knowledge of Exponent [Damgård 92] π₯ Non-Black-Box Extraction Extraction π, β Adversary π₯ βπ΄ βπΈ s.t. π΄ π,β β π ,β π₯ ππ₯ , βπ₯ β πΈ π,β β π₯ Applications of KEA [HT98,BP04,Mie08,G10,L12,BCCT13,GGPR13,BCIOP13] Knowledge of Exponent Assumption* (KEA) * and variants 2-Message Succinct Argument (SNARG) 3-Message Zero-Knowledge Extractable Functions [Canetti-Dakdouk 08] A family of function ππ is extractable if: πβ$ π₯ Extraction Adversary ππ (π₯) βπ΄ βπΈ s.t. π΄ π β ππ (π₯) β πΈ π β π₯ Remarks on EF β’ KEA is an example for EF. β’ We want EF that are also one-way. β’ The image of π should be sparse. πβ$ π₯ Extraction Adversary ππ (π₯) OWF, CRHF Applications of EF [BCCT12,GLR12,DFH12] Knowledge of Exponent Extractable One-Way Functions (EOWF) 3-Message Zero-Knowledge Extractable Collision-Resistant Hash Functions (ECRH) 2-Message Succinct Argument (Privately Verifiable) β’ Clean assumptions β’ Candidates β’ Strong applications What is missing? A Reduction Using EF Assuming: βπ΄ βπΈ s.t. π΄ π β ππ (π₯) β πΈ π β π₯ Reduction π₯ πΈ π΄ πβ$ ππ (π₯) Do Extractable One-Way Functions with an Explicit Extractor Exist? It depends on the Auxiliary Input. Example: Zero-Knowledge Auxiliary input π₯ββ π₯ π π ππ π‘ π Definition of EF with A.I. For every π΄ and auxiliary input π§π΄ there exist πΈ and auxiliary input π§πΈ such that for every auxiliary input π§: π΄ π§π΄ , π§, π β ππ (π₯) β πΈ π§πΈ , π§, π β π₯ Types of A.I. For every π΄ and auxiliary input π§π΄ there exist πΈ and auxiliary input π§πΈ such that for every auxiliary input π§: π΄ π§π΄ , π§, π β ππ (π₯) β πΈ π§πΈ , π§, π β π₯ Individual \ Common Bounded \ Unbounded What type of A.I. do we need? Example: Zero-Knowledge Zero-Knowledge: β For every π there exists a simulator π β such that for every π₯, π π₯ β (π, π )(π₯) What For π₯ need you get bounded from individual A.I. A.I.: For every sequential π β and composition every π₯ there need exists a unbounded simulator π such A.I. that π π₯ β (π, π)(π₯) EOWF with unbounded common A.I.: π§ > |π(π₯)| EOWF* with bounded A.I.: π§π΄ , π§ < |π(π₯)| Explicit Extractor Impossible Indistinguishability Obfuscation Open Possible Delegation for P Subexp-LWE from Subexp-PIR [Kalai-Raz-Rothblum13] Generalized EOWF EOWF* = Privately-Verifiable Generalized EOWF 1. EOWF* suffices for applications of EOWF. 2. The impossibility results holds also for EOWF* 3. Can remove * assuming publicly-verifiable delegation for P (P-certificates) Application [BCCGLRT13] EOWF EOWF with bounded A.I. EOWF* with bounded A.I. β 3-Message Zero-Knowledge β 3-Message Zero-Knowledge For verifiers w. bounded A.I. Survey Construction Impossibility Construction EOWF* with Bounded A.I from Privately-Verifiable Delegation for P EOWF with Bounded A.I from Publicly-Verifiable Delegation for P First Attempt β’ OWF π: 0,1 2π β 0,1 2π β’ Extraction from π΄ < π (no restriction on space or running time) β’ Single function - No key (impossible for unbounded A.I) First Attempt π π, π β 0,1 , PRG: 0,1 π(π, π ) = PRG π π β 0,1 if π β π π 0 First Attempt π π, π β 0,1 , PRG: 0,1 PRG π π(π, π ) = π π 1 π β 0,1 π π if π β 0 π if π = 0 Interpert π as a program outputting 2π bits Extraction π π΄ 1 ( π΄ < π) βπ¦ π 0π , π΄ = π΄ 1π = π¦ πΈ 1π β 0π , π΄ PRG π π(π, π ) = π 1π π if π β 0 if π = 0π One-Wayness 1. π ππ , ππ β π2π 2. The image of π is sparse PRG π π(π, π ) = π 1π π if π β 0 if π = 0π Problem π is not poly-time computable! Solution: Delegation for P (following the protocols of [B01,BLV03]) ππ πΊπ π π(π, π ) = π 1π π if π β 0 if π = 0π Delegation for P Gen $ β π π poly ππ π: π 1π β π¦ π polylog ππ < π Final Construction β β β π(π, π , π, π¦ , π , π ) π β 0π π¦ = PRG π π = Gen π Output: (π¦, π) π = 0π If π β is a valid proof for π 1π β π¦ β under π β Output: (π¦ β , π β ) Extraction π π΄ 1 β (π¦, π) π πΈ 1π β (0π , π΄, π, π¦, π, π β ) β π When π is a proof that π΄ 1 β π¦ under π One-Wayness 1. π ππ , ππ β (π2π , π) 2. The image of π is sparse 3. Soundness of delegation Generalized EOWF π (π π₯ , π₯β²) Hardness: For a random π₯ it is hard to find π₯ β² β π (π(π)) Extraction: For every π΄ there exists πΈ such that π΄ β π π₯ β πΈ β π₯ β² β π (π(π₯)) Privately-Verifiable GEOWF: Can efficiently test π₯ β π (π(π₯)) only given π₯ Impossibility Assuming indistinguishability obfuscation, there is not EOWF with unbounded common auxiliary input Intuition π₯ Non-Black-Box Extractor Adversary π ππ π₯ Common A.I β Universal Extractor There exists πΈ s.t. for every A and π§: π΄ π§, π β ππ (π₯) β πΈ π΄, π§, π β π₯ Plan 1. Assuming virtual black-box obfuscation 2. Assuming indistinguishability obfuscation [Goldreich, Hada-Tanaka] Common A.I. ππ (π₯) π΄ π, π§ πΈ π₯ Universal Extraction Universal Adversary π ππ (π₯) π΄ π, π§ = π΄ Universal Extractor π₯ Black-Box Extraction Black-box obfuscation Universal Adversary π ππ (π₯) π΄ π, π§ = π΄ Universal Extractor π₯ Black-Box Extraction Black-Box Extractor Adversary π π₯π = π ππ πΉ π π (π) ππ (π₯π ) π₯π Indistinguishability Obfuscation πΆ2 β‘ πΆ1 Compute the same function Indistinguishability Obfuscation Extractor Adversary π π₯π = ππ πΉπ (π) ππ (π₯π ) π₯π Prove that the obfuscation hides π₯π Indistinguishability Obfuscation Extractor π π₯π = ππ πΉπ (π) ππ (π₯π ) π₯π β Extractor π Alternative adversary hides π₯π ππ (π₯π ) π₯π Alternative Adversary Using the Sahai-Waters puncturing technique ππ πΉπ π ππ ππ (π₯π ) Indistinguishability Obfuscation Extractor π ππ (π₯π ) hides π₯π π₯π Back to the Construction? EOWF with unbounded individual A.I. |π§π΄ | > |π(π₯)| Extractable CRHF\COM\1-to-1 OWF Impossible Open Possible Thank You ο
© Copyright 2026 Paperzz