A New Approach to Efficient Non-Malleable Zero-Knowledge

Abstract

AbstractNon-malleable zero-knowledge, originally introduced in the context of man-in-the-middle attacks, serves as an important building block to protect against concurrent attacks where different protocols may coexist and interleave. While this primitive admits almost optimal constructions in the plain model, they are several orders of magnitude slower in practice than standalone zero-knowledge. This is in sharp contrast to non-malleable commitments where practical constructions (under the DDH assumption) have been known for a while.We present a new approach for constructing efficient non-malleable zero-knowledge for all languages in \(\mathcal{N}\mathcal{P}\), based on a new primitive called instance-based non-malleable commitment (\(\textsf{IB}\text {-}\textsf{NMC}\)). We show how to construct practical \(\textsf{IB}\text {-}\textsf{NMC}\) by leveraging the fact that simulators of sub-linear zero-knowledge protocols can be much faster than the honest prover algorithm. With an efficient implementation of \(\textsf{IB}\text {-}\textsf{NMC}\), our approach yields the first general-purpose non-malleable zero-knowledge protocol that achieves practical efficiency in the plain model.All of our protocols can be instantiated from symmetric primitives such as block-ciphers and collision-resistant hash functions, have reasonable efficiency in practice, and are general-purpose. Our techniques also yield the first efficient non-malleable commitment scheme without public-key assumptions.KeywordsNon-malleabilityEfficiencySymmetric assumptions