Zero-knowledge

Ran Canetti, Huijia (Rachel) Lin, Omer Paneth
Zero-Knowledge Proofs
โ€ข Completeness
โ€ข Soundness
๐‘ฅ โˆˆ โ„’?
๐’ซ
๐’ฑ
Zero-Knowledge Proofs
โ€ข Completeness
โ€ข Soundness
โ€ข Zero-knowledge
๐‘ฅโˆˆโ„’
๐’ซ
๐’ฑ๐’ฑโˆ—
Zero-Knowledge
[Goldwasser-Micali-Rackoff 85]
โ€ข ๐’ฑ โˆ— learn nothing except "๐‘ฅ โˆˆ โ„’"
โ€ข ๐’ฑ โˆ— knows how to generate a proof
โ€ข There is a Simulator that
efficiently extracts a proof from ๐’ฑ โˆ—
Two Types of
Zero-Knowledge proofs
Public-Coin Protocols
๐‘Ÿ1 โ† ๐‘ˆ
๐‘š1
๐’ซ
๐‘Ÿ2 โ† ๐‘ˆ
๐‘š2
๐’ฑ
Concurrent Composition
๐‘š1
๐‘š2
๐‘š1
๐‘š2
๐’ซ
๐’ซ
๐‘š3
๐‘š3
๐‘š4
๐‘š4
๐’ฑโˆ—
State of the Art
Constant-round public-coin
zero-knowledge
[Barak 01]
Concurrent zero-knowledge
[Richardson-Kilian 99]
[Kilian-Petrank 01]
[Prabhakaran-Rosen-Sahai 02]
Question
Is there a
public-coin concurrent
zero-knowledge protocol?
Yes! (well, almost)
Technical Motivation
Combine state of the art
simulation techniques
Applications to concurrent 2PC
[Goyal 13]
What are the existing
simulation techniques?
The Simulator
Simulator
proof transcript
๐’ฑโˆ—
How does the simulator
โˆ—
extract a proof from ๐’ฑ ?
The FLS Paradigm
[Feige-Lapidot-Shamir 90]
Set a trapdoor statement such that
only ๐’ฑ knows a trapdoor witness
๐’ซ
Witness Indistinguishable
proof for ๐‘ฅ โˆˆ โ„’ or
for a trapdoor statement
๐’ฑ
The FLS Paradigm
Simulator
๐’ฑโˆ—
proof transcript
trapdoor
witness
How does the simulator
extract a trapdoor witness?
Rewinding
๐‘š1
๐‘ž
๐’ซ
Question-answer
slot
๐‘Ž
๐‘š4
๐’ฑ
Rewinding
๐‘š1
๐’ฎ
๐‘ž
๐‘žโ€ฒ
๐‘Ž
๐‘Žโ€ฒ
๐‘Ž + ๐‘Žโ€ฒ = Trapdoor witness
๐‘š4
๐’ฑ
โˆ—
Other Techniques
โ€ข Public-coin protocols
[Goldreich-Krawczyk 96]
โ€ข Concurrent composition
[Dwork-Naor-Sahai 98]
Public-Coin Protocols
๐‘Ÿ0
๐‘ž
๐’ฎ
๐‘žโ€ฒ
Goldreich-Krawczyk
96:
๐‘Ÿ
๐‘Ÿโ€ฒ
โˆ—
๐’ฑ
No black-box simulator
๐‘Ÿ and ๐‘Ÿโ€ฒ are independent
Public-Coin Protocols
The solution:
Non-black-box simulation
[Barak 01]
Concurrent Composition
๐‘š1
๐‘ž
๐‘š1
๐‘ž
๐’ซ
๐’ซ
๐‘Ž
๐‘š4
๐‘Ž
๐‘š4
๐’ฑโˆ—
Concurrent Composition
๐‘š1
๐’ฎ
๐‘ž
๐‘žโ€ฒ
๐‘š1
๐‘š1 โ€ฒ
๐‘ž
๐‘žโ€ฒ
๐‘Ž
๐‘š4
๐‘Žโ€ฒ
๐‘š4 โ€ฒ
๐‘Ž
๐‘Žโ€ฒ
๐’ฑ
โˆ—
Concurrent Composition
๐‘š1
๐‘žโ€ฒ
๐‘ž
๐‘š1
๐’ฎ
๐‘š1 โ€ฒ
๐‘ž
๐‘žโ€ฒ
๐‘žโ€ฒโ€ฒ
๐‘žโ€ฒโ€ฒโ€ฒ
๐‘Ž
๐‘Žโ€ฒ
๐‘Žโ€ฒโ€ฒ
๐‘Žโ€ฒโ€ฒโ€ฒ
๐‘š4
๐‘š4 โ€ฒ
๐‘Ž
๐‘Žโ€ฒ
๐’ฑ
โˆ—
Concurrent Composition
The solution:
Rewinding with many slots
[Richardson-Kilian 99]
[Kilian-Petrank 01]
[Prabhakaran-Rosen-Sahai 02]
Current Techniques
rewinding
stand-alone
private-coin
zero-knowledge
rewinding with
many slots
concurrent
zero-knowledge
[RK,KP,PRS]
non-black-box
simulation
public-coin
zero-knowledge
[Barak 01]
This work
public-coin
concurrent
zero-knowledge
Barakโ€™s Protocol (sketch)
๐‘ = COM(ฮ )
๐‘Ÿ
๐’ซ
๐’ฑ
Witness indistinguishable proof
for ๐‘ฅ โˆˆ โ„’ or trapdoor statement
Trapdoor statement: the program ฮ  predicts
the randomness ๐‘Ÿ before it was sent
Barakโ€™s Protocol
๐‘ = COM(ฮ )
๐‘Ÿ
๐’ซ
๐’ฑ
Witness indistinguishable proof
for ๐‘ฅ โˆˆ โ„’ or ฮ  c โ†’ ๐‘Ÿ
Trapdoor statement:
โˆƒฮ : ๐‘ = COM ฮ  โˆง ฮ  ๐‘ โ†’ ๐‘Ÿ
Barakโ€™s Protocol
Soundness:
๐’ซโˆ— can not commit to ฮ  that predicts ๐‘Ÿ
Zero-knowledge:
ฮ  = ๐’ฑโˆ—
๐’ซ ๐’ฎ
๐‘ = COM(ฮ )
๐‘ = COM(๐’ฑ โˆ— )
๐‘Ÿ
๐‘Ÿ
Witness indistinguishable proof
โˆ—
Proof
that
๐’ฑ
(๐‘)๐‘Ÿ โ†’ ๐‘Ÿ
for ๐‘ฅ โˆˆ โ„’ or ฮ  c โ†’
๐’ฑ
โˆ—๐’ฑ
Concurrent Barak
๐‘ = COM(๐’ฑ โˆ— )
๐‘
๐‘Ÿ
๐’ฎ
๐’ฑโˆ—
Proof
๐‘Ÿ
Proof that ๐’ฑ โˆ— (๐‘)
โ†’๐‘Ÿ
Concurrent Barak
๐‘ = COM(๐’ฑ โˆ— โ‹…, ๐‘, "Proof" )
๐‘
๐‘Ÿ
๐’ฎ
Proof
๐‘Ÿ
๐’ฑ โˆ— (๐‘, ๐‘, "Proof") โ†’ ๐‘Ÿ
๐’ฑโˆ—
Folklore Approach
[Deng-Goyal-Sahai 09]
[Pass-Rosen-Tseng 11]
[Goyal-Jain-Ostrovsky-Richelson-Visconti 13]
Folklore Approach
๐‘ = COM(๐’ฑ โˆ— โ‹…, ๐‘, "Proof" )
๐‘
๐‘Ÿ
๐’ฎ
Proof
๐‘Ÿ
๐’ฑโˆ—
Folklore Approach
๐‘ = COM(๐’ฎโ€ฒ)
๐’ฎโ€ฒ
๐‘
๐‘Ÿ
๐’ฎ
Proof
๐‘Ÿ
Proof that ๐’ฎโ€ฒ(๐‘) โ†’ ๐‘Ÿ
๐’ฑโˆ—
Simulation Running Time
๐‘ = COM(๐’ฎโ€ฒ)
๐‘ = COM(๐’ฎโ€ฒ)
๐’ฎโ€ฒ
๐‘Ÿ
๐’ฎ
Proof that ๐’ฎโ€ฒ(๐‘) โ†’ ๐‘Ÿ
๐‘Ÿ
Proof that ๐’ฎโ€ฒ(๐‘) โ†’ ๐‘Ÿ
๐’ฑโˆ—
๐’ฎโ€ฒ
Simulation Running Time
๐‘‡ ๐’ฎ
โ€ฒ
๐‘‡ ๐’ฎ
โ€ฒ
๐‘‡ ๐’ฎโ€ฒ
โ‰ฅ 2๐‘‡ ๐’ฎ โ€ฒ
๐’ฎโ€ฒ
Proof that ๐’ฎ โ€ฒ (๐‘) โ†’ ๐‘Ÿ
Proof that ๐’ฎโ€ฒ(๐‘) โ†’ ๐‘Ÿ
๐’ฎโ€ฒ
Simulation Running Time
๐‘‡ ๐’ฎ โ€ฒ โ‰ฅ 2๐‘‡ ๐’ฎ โ€ฒ
๐‘‡ ๐’ฎ โ€ฒ โ‰ฅ 2๐‘‡ ๐’ฎ โ€ฒ โ‰ฅ 4๐‘‡ ๐’ฎ โ€ฒ
โ€ฆ
๐’ฎโ€ฒ
Proof that ๐’ฎ โ€ฒ (๐‘) โ†’ ๐‘Ÿ
Proof that ๐’ฎโ€ฒ(๐‘) โ†’ ๐‘Ÿ
Proof that ๐’ฎโ€ฒ(๐‘) โ†’ ๐‘Ÿ
๐’ฎโ€ฒ
๐’ฎโ€ฒ
Recursive Rewinding
๐‘š1
๐‘š2 โ€ฒ
๐‘š2
๐‘š1
๐’ฎ
๐‘š1 โ€ฒ
๐‘š2
๐‘š2 โ€ฒ
๐‘š2 โ€ฒโ€ฒ
๐‘š2 โ€ฒโ€ฒโ€ฒ
๐‘š3
๐‘š3 โ€ฒ
๐‘š3 โ€ฒโ€ฒ
๐‘š3 โ€ฒโ€ฒโ€ฒ
๐‘š4
๐‘š4 โ€ฒ
๐‘š3
๐‘š3 โ€ฒ
๐’ฑ
โˆ—
The Problem
Simulate
Prove a
๐‘‡
โ‰ฅ2โ‹…๐‘‡
a proof
statement
Roadmap
add slots
stand-alone
private-coin
zero-knowledge
non-black-box
simulation
public-coin
zero-knowledge
[Barak 01]
concurrent
zero-knowledge
[RK,KP,PRS]
simulation
runtime is
exponential
concurrent
compassion
public-coin
concurrent
zero-knowledge
Concurrent Zero-Knowledge
๐‘š1
๐‘ž1
๐’ซ
Slot
๐‘Ž1
๐‘ž2
๐’ฑ
๐‘Ž2
๐‘š6
Slot
Concurrent Zero-Knowledge
๐‘š1
๐’ฎ
๐‘ž1
๐‘ž1 โ€ฒ
๐‘Ž1
๐‘Ž1 โ€ฒ
๐‘ž2
๐‘Ž1 + ๐‘Ž1 โ€ฒ
๐‘Ž2
๐‘š6
๐’ฑโˆ—
Concurrent Zero-Knowledge
๐‘š1
๐‘ž1
๐‘Ž1
๐’ฎ
๐‘ž2
๐‘ž2 โ€ฒ
๐‘Ž2
๐‘Ž2 โ€ฒ
๐‘Ž2 + ๐‘Ž2 โ€ฒ
๐‘š6
๐’ฑโˆ—
Concurrent Zero-Knowledge
๐’ซ
๐’ซ
๐’ฑโˆ—
Concurrent Zero-Knowledge
๐’ฎ
๐’ฑโˆ—
Concurrent Zero-Knowledge
๐’ฎ
๐’ฑโˆ—
The KP-PRS Strategy
The KP-PRS Strategy
The Protocol
๐‘1 = COM(ฮ )
๐‘Ÿ1
โ€ฆ
๐’ซ
Slot
Slot
๐‘๐‘˜ = COM(ฮ )
๐‘Ÿ๐‘˜
WI proof for ๐‘ฅ โˆˆ โ„’ or
โˆƒi, ฮ : ๐‘๐‘– = COM ฮ  โˆง ฮ  ๐‘๐‘– โ†’ ๐‘Ÿ๐‘–
๐’ฑ
Simulation
Black-box world - Rewinding
Non-black-box world โ€“ Proving
Simulation
๐‘๐‘– = COM(๐’ฎโ€ฒ)
KP-PRS
Block
๐’ฎ
๐‘Ÿ๐‘–
๐’ฎโ€ฒ
Round complexity
1+๐œ–
log
๐‘› for ๐œ– > 0
Proof that ๐’ฎ โ€ฒ (๐‘๐‘– ) โ†’ ๐‘Ÿ๐‘–
๐’ฑ
โˆ—
A Caveat
Simulation constructs many long proof
Solved by using memory delegation
Need all session to use one hash function
The Global Hash Model
โ„Ž โ†๐‘… โ„‹
collision-resistant
hash function
๐’ซ
๐’ฑ
๐’ซ
๐’ฑ
๐’ซ
๐’ฑ
The Global Hash Model
Breaking
soundness
Explicit uniform
reduction
Finding
collisions
The Global Hash Model
Uniform Hash Function
๐’ซ
๐’ฑ
๐’ซ
๐’ฑ
๐’ซ
Protocol in the plain model
against uniform adversaries
๐’ฑ
The Global Hash Model
SHA-256
๐’ซ
๐’ฑ
๐’ซ
๐’ฑ
๐’ซ
Protocol in the plain model
from human ignorance [Rogaway 06]
๐’ฑ
GHM vs. CRS
Common reference
string model
Global hash
model
Simulated ๐ถ๐‘…๐‘†
with a trapdoor
Simulation for
every โ„Ž
Public-coin concurrent zero-knowledge
NIZK
Black-box impossibility
[Pass-Tseng-Wikstroฬˆm]
What is next?
โ€ข [Goyal 13]:
Public-coin concurrent zero-knowledge
with poly(๐‘›) rounds without a global hash
โ€ข Open question:
Public-coin concurrent zero-knowledge
with O(log ๐‘›) rounds without a global hash
โ€ข Open question:
Concurrent zero-knowledge
with o(log ๐‘›) rounds
[slide: Mira Blenekiy]