Ran Canetti, Huijia (Rachel) Lin, Omer Paneth Zero-Knowledge Proofs โข Completeness โข Soundness ๐ฅ โ โ? ๐ซ ๐ฑ Zero-Knowledge Proofs โข Completeness โข Soundness โข Zero-knowledge ๐ฅโโ ๐ซ ๐ฑ๐ฑโ Zero-Knowledge [Goldwasser-Micali-Rackoff 85] โข ๐ฑ โ learn nothing except "๐ฅ โ โ" โข ๐ฑ โ knows how to generate a proof โข There is a Simulator that efficiently extracts a proof from ๐ฑ โ Two Types of Zero-Knowledge proofs Public-Coin Protocols ๐1 โ ๐ ๐1 ๐ซ ๐2 โ ๐ ๐2 ๐ฑ Concurrent Composition ๐1 ๐2 ๐1 ๐2 ๐ซ ๐ซ ๐3 ๐3 ๐4 ๐4 ๐ฑโ State of the Art Constant-round public-coin zero-knowledge [Barak 01] Concurrent zero-knowledge [Richardson-Kilian 99] [Kilian-Petrank 01] [Prabhakaran-Rosen-Sahai 02] Question Is there a public-coin concurrent zero-knowledge protocol? Yes! (well, almost) Technical Motivation Combine state of the art simulation techniques Applications to concurrent 2PC [Goyal 13] What are the existing simulation techniques? The Simulator Simulator proof transcript ๐ฑโ How does the simulator โ extract a proof from ๐ฑ ? The FLS Paradigm [Feige-Lapidot-Shamir 90] Set a trapdoor statement such that only ๐ฑ knows a trapdoor witness ๐ซ Witness Indistinguishable proof for ๐ฅ โ โ or for a trapdoor statement ๐ฑ The FLS Paradigm Simulator ๐ฑโ proof transcript trapdoor witness How does the simulator extract a trapdoor witness? Rewinding ๐1 ๐ ๐ซ Question-answer slot ๐ ๐4 ๐ฑ Rewinding ๐1 ๐ฎ ๐ ๐โฒ ๐ ๐โฒ ๐ + ๐โฒ = Trapdoor witness ๐4 ๐ฑ โ Other Techniques โข Public-coin protocols [Goldreich-Krawczyk 96] โข Concurrent composition [Dwork-Naor-Sahai 98] Public-Coin Protocols ๐0 ๐ ๐ฎ ๐โฒ Goldreich-Krawczyk 96: ๐ ๐โฒ โ ๐ฑ No black-box simulator ๐ and ๐โฒ are independent Public-Coin Protocols The solution: Non-black-box simulation [Barak 01] Concurrent Composition ๐1 ๐ ๐1 ๐ ๐ซ ๐ซ ๐ ๐4 ๐ ๐4 ๐ฑโ Concurrent Composition ๐1 ๐ฎ ๐ ๐โฒ ๐1 ๐1 โฒ ๐ ๐โฒ ๐ ๐4 ๐โฒ ๐4 โฒ ๐ ๐โฒ ๐ฑ โ Concurrent Composition ๐1 ๐โฒ ๐ ๐1 ๐ฎ ๐1 โฒ ๐ ๐โฒ ๐โฒโฒ ๐โฒโฒโฒ ๐ ๐โฒ ๐โฒโฒ ๐โฒโฒโฒ ๐4 ๐4 โฒ ๐ ๐โฒ ๐ฑ โ Concurrent Composition The solution: Rewinding with many slots [Richardson-Kilian 99] [Kilian-Petrank 01] [Prabhakaran-Rosen-Sahai 02] Current Techniques rewinding stand-alone private-coin zero-knowledge rewinding with many slots concurrent zero-knowledge [RK,KP,PRS] non-black-box simulation public-coin zero-knowledge [Barak 01] This work public-coin concurrent zero-knowledge Barakโs Protocol (sketch) ๐ = COM(ฮ ) ๐ ๐ซ ๐ฑ Witness indistinguishable proof for ๐ฅ โ โ or trapdoor statement Trapdoor statement: the program ฮ predicts the randomness ๐ before it was sent Barakโs Protocol ๐ = COM(ฮ ) ๐ ๐ซ ๐ฑ Witness indistinguishable proof for ๐ฅ โ โ or ฮ c โ ๐ Trapdoor statement: โฮ : ๐ = COM ฮ โง ฮ ๐ โ ๐ Barakโs Protocol Soundness: ๐ซโ can not commit to ฮ that predicts ๐ Zero-knowledge: ฮ = ๐ฑโ ๐ซ ๐ฎ ๐ = COM(ฮ ) ๐ = COM(๐ฑ โ ) ๐ ๐ Witness indistinguishable proof โ Proof that ๐ฑ (๐)๐ โ ๐ for ๐ฅ โ โ or ฮ c โ ๐ฑ โ๐ฑ Concurrent Barak ๐ = COM(๐ฑ โ ) ๐ ๐ ๐ฎ ๐ฑโ Proof ๐ Proof that ๐ฑ โ (๐) โ๐ Concurrent Barak ๐ = COM(๐ฑ โ โ , ๐, "Proof" ) ๐ ๐ ๐ฎ Proof ๐ ๐ฑ โ (๐, ๐, "Proof") โ ๐ ๐ฑโ Folklore Approach [Deng-Goyal-Sahai 09] [Pass-Rosen-Tseng 11] [Goyal-Jain-Ostrovsky-Richelson-Visconti 13] Folklore Approach ๐ = COM(๐ฑ โ โ , ๐, "Proof" ) ๐ ๐ ๐ฎ Proof ๐ ๐ฑโ Folklore Approach ๐ = COM(๐ฎโฒ) ๐ฎโฒ ๐ ๐ ๐ฎ Proof ๐ Proof that ๐ฎโฒ(๐) โ ๐ ๐ฑโ Simulation Running Time ๐ = COM(๐ฎโฒ) ๐ = COM(๐ฎโฒ) ๐ฎโฒ ๐ ๐ฎ Proof that ๐ฎโฒ(๐) โ ๐ ๐ Proof that ๐ฎโฒ(๐) โ ๐ ๐ฑโ ๐ฎโฒ Simulation Running Time ๐ ๐ฎ โฒ ๐ ๐ฎ โฒ ๐ ๐ฎโฒ โฅ 2๐ ๐ฎ โฒ ๐ฎโฒ Proof that ๐ฎ โฒ (๐) โ ๐ Proof that ๐ฎโฒ(๐) โ ๐ ๐ฎโฒ Simulation Running Time ๐ ๐ฎ โฒ โฅ 2๐ ๐ฎ โฒ ๐ ๐ฎ โฒ โฅ 2๐ ๐ฎ โฒ โฅ 4๐ ๐ฎ โฒ โฆ ๐ฎโฒ Proof that ๐ฎ โฒ (๐) โ ๐ Proof that ๐ฎโฒ(๐) โ ๐ Proof that ๐ฎโฒ(๐) โ ๐ ๐ฎโฒ ๐ฎโฒ Recursive Rewinding ๐1 ๐2 โฒ ๐2 ๐1 ๐ฎ ๐1 โฒ ๐2 ๐2 โฒ ๐2 โฒโฒ ๐2 โฒโฒโฒ ๐3 ๐3 โฒ ๐3 โฒโฒ ๐3 โฒโฒโฒ ๐4 ๐4 โฒ ๐3 ๐3 โฒ ๐ฑ โ The Problem Simulate Prove a ๐ โฅ2โ ๐ a proof statement Roadmap add slots stand-alone private-coin zero-knowledge non-black-box simulation public-coin zero-knowledge [Barak 01] concurrent zero-knowledge [RK,KP,PRS] simulation runtime is exponential concurrent compassion public-coin concurrent zero-knowledge Concurrent Zero-Knowledge ๐1 ๐1 ๐ซ Slot ๐1 ๐2 ๐ฑ ๐2 ๐6 Slot Concurrent Zero-Knowledge ๐1 ๐ฎ ๐1 ๐1 โฒ ๐1 ๐1 โฒ ๐2 ๐1 + ๐1 โฒ ๐2 ๐6 ๐ฑโ Concurrent Zero-Knowledge ๐1 ๐1 ๐1 ๐ฎ ๐2 ๐2 โฒ ๐2 ๐2 โฒ ๐2 + ๐2 โฒ ๐6 ๐ฑโ Concurrent Zero-Knowledge ๐ซ ๐ซ ๐ฑโ Concurrent Zero-Knowledge ๐ฎ ๐ฑโ Concurrent Zero-Knowledge ๐ฎ ๐ฑโ The KP-PRS Strategy The KP-PRS Strategy The Protocol ๐1 = COM(ฮ ) ๐1 โฆ ๐ซ Slot Slot ๐๐ = COM(ฮ ) ๐๐ WI proof for ๐ฅ โ โ or โi, ฮ : ๐๐ = COM ฮ โง ฮ ๐๐ โ ๐๐ ๐ฑ Simulation Black-box world - Rewinding Non-black-box world โ Proving Simulation ๐๐ = COM(๐ฎโฒ) KP-PRS Block ๐ฎ ๐๐ ๐ฎโฒ Round complexity 1+๐ log ๐ for ๐ > 0 Proof that ๐ฎ โฒ (๐๐ ) โ ๐๐ ๐ฑ โ A Caveat Simulation constructs many long proof Solved by using memory delegation Need all session to use one hash function The Global Hash Model โ โ๐ โ collision-resistant hash function ๐ซ ๐ฑ ๐ซ ๐ฑ ๐ซ ๐ฑ The Global Hash Model Breaking soundness Explicit uniform reduction Finding collisions The Global Hash Model Uniform Hash Function ๐ซ ๐ฑ ๐ซ ๐ฑ ๐ซ Protocol in the plain model against uniform adversaries ๐ฑ The Global Hash Model SHA-256 ๐ซ ๐ฑ ๐ซ ๐ฑ ๐ซ Protocol in the plain model from human ignorance [Rogaway 06] ๐ฑ GHM vs. CRS Common reference string model Global hash model Simulated ๐ถ๐ ๐ with a trapdoor Simulation for every โ Public-coin concurrent zero-knowledge NIZK Black-box impossibility [Pass-Tseng-Wikstroฬm] What is next? โข [Goyal 13]: Public-coin concurrent zero-knowledge with poly(๐) rounds without a global hash โข Open question: Public-coin concurrent zero-knowledge with O(log ๐) rounds without a global hash โข Open question: Concurrent zero-knowledge with o(log ๐) rounds [slide: Mira Blenekiy]
© Copyright 2026 Paperzz