Non-interactive Zero-knowledge Proof System Research Articles

A logarithmic-sized accountable ring signature scheme in the standard model

Ring signature and group signature are two major cryptographic primitives providing users anonymity and authentication simultaneously. While both primitives enable any user to sign messages as a member of a set of users, the feature of ring signature is that a signer can choose a group in an ad-hoc manner, which is called a ring, by itself. Conversely, in group signature, a group membership is managed by some trusted third party, which is called a group manager, and an (appropriate) accountability is provided for the group manager to identify illegal anonymous signers. Accountable ring signature (ARS) is a cryptographic primitive combining the features of ring signature and group signature. ARS allows signers to choose their groups (rings) in an ad-hoc manner, and at the same time, maintain accountability by forcing them to select a designated opener who can identify them.In this paper, we propose the first ARS scheme with O(log⁡n) signature size in the standard model (without depending on the random oracle methodology), where n is the size of a ring. More precisely, we propose a new generic construction of ARS based on (standard) signature, (standard) public key encryption, non-interactive zero-knowledge proof system, somewhere perfectly binding hash function, and public key encryption with non-interactive opening. All building blocks for our ARS scheme can be obtained under the decisional linear (DLIN) assumption over bilinear groups.

Robust Subgroup Multisignature with One-Time Public Keys in Order

Robust subgroup multisignature allows any subgroup of signers from a global set to sign a given message on behalf of the whole group, and the individual signatures should be verified before the combination process, which resists poison signature attacks. An emerging application of robust subgroup multisignatures in blockchain is that a qualified subgroup of a global set of users has reached agreement. In the integrated blockchain and edge computing system, the edge server can naturally act as a combiner in multisignatures and help other end devices produce the final aggregate signature. In this paper, we propose a robust subgroup multisignature with one-time public keys in order that has two advantages for solving the signers ordering problem and one-time public key problem simultaneously. Our scheme is a nontrivial extension of Galindo et al.’s robust subgroup multisignature scheme and can be proven unforgeable, robust and chronological in random oracles. Our scheme can also be suitable for the consortium blockchain by adding a noninteractive zero-knowledge (NIZK) proof system for certifying the one-time public keys.

Simulatable verifiable random function from the LWE assumption

A verifiable random function (VRF) is a pseudorandom function F that can be publicly verified. A simulatable VRF (sVRF) is an important variant of a VRF, which additionally provides simulatability. Informally, the simulatability of a VRF depicts the ability to simulate a valid proof π that y=F(sk,x) for any input x and any output value y. A (simulatable) VRF can be used in the E-Cash, E-Lottery, blockchain and constructing the multi-theorem non-interactive zero-knowledge (NIZK) proof. However, up to now, the existing constructions of an sVRF either rely on non-standard assumptions (e.g., the Q-type ones), or are built in the random oracle model, or resort to time-consuming techniques like the Cook-Levin reduction.In this paper, we design the first sVRF from the LWE assumption in the standard model (free of a random oracle) without using a Cook-Levin reduction. In our construction of an sVRF, we take as building blocks a pseudorandom function, a trapdoor fully homomorphic commitment (FHC) scheme, and a NIZK proof system for a language specified by FHC. Our trapdoor FHC is the key technical tool, which helps the simplification of the underlying NIZK language, thus making possible an instantiation of a NIZK proof from LWE without a Cook-Levin reduction. Together with an LWE-based PRF, we obtain an sVRF scheme from LWE.

Group signatures and more from isogenies and lattices: generic, simple, and efficient

We construct an efficient dynamic group signature (or more generally an accountable ring signature) from isogeny and lattice assumptions. Our group signature is based on a simple generic construction that can be instantiated by cryptographically hard group actions such as the CSIDH group action or an MLWE-based group action. The signature is of size O(log N), where N is the number of users in the group. Our idea builds on the recent efficient OR-proof by Beullens, Katsumata, and Pintore (Asiacrypt’20), where we efficiently add a proof of valid ciphertext to their OR-proof and further show that the resulting non-interactive zero-knowledge proof system is online extractable. Our group signatures satisfy more ideal security properties compared to previously known constructions, while simultaneously having an attractive signature size. The signature size of our isogeny-based construction is an order of magnitude smaller than all previously known post-quantum group signatures (e.g., 6.6 KB for 64 members). In comparison, our lattice-based construction has a larger signature size (e.g., either 126 KB or 89 KB for 64 members depending on the satisfied security property). However, since the O(cdot )-notation hides a very small constant factor, it remains small even for very large group sizes, say 2^{20}.

Scriptable and composable SNARKs in the trusted hardware model1

Non-interactive zero-knowledge proof or argument (NIZK) systems are widely used in many security sensitive applications to enhance computation integrity, privacy and scalability. In such systems, a prover wants to convince one or more verifiers that the result of a public function is correctly computed without revealing the (potential) private input, such as the witness. In this work, we introduce a new notion, called scriptable SNARK, where the prover and verifier(s) can specify the function (or language instance) to be proven via a script. We formalize this notion in UC framework and provide a generic trusted hardware based solution. We then instantiate our solution in both SGX and Trustzone with Lua script engine. The system can be easily used by typical programmers without any cryptographic background. The benchmark result shows that our solution is better than all the known SNARK proof systems w.r.t. prover’s running time (1000 times faster), verifier’s running time, and the proof size. In addition, we also give a lightweight scriptable SNARK protocol for hardware with limited state, e.g., Θ ( λ ) bits. Finally, we show how the proposed scriptable SNARK can be readily deployed to solve many well-known problems in the blockchain context, e.g. verifier’s dilemma, fast joining for new players, etc.

Improvements on Non-Interactive Zero-Knowledge Proof Systems Related to Quadratic Residuosity Languages

Non-interactive zero-knowledge (NIZK) proof systems are very useful for statement verification without interaction in cryptography; they entail just one message, called the proof, that convinces the verifier of the truth of the statement without leaking any extra information. Many NIZK proof systems are related to quadratic residuosity languages and follow three main steps. First, the prover and the verifier sample a common reference string (CRS) in some particular form. Second, the prover proves that n is a Blum integer (BL,n=p1t1·p2t2, where p1 and p2 are different primes both congruent to 3 modulo 4, and t1 and t2 are odd). Third, various statements (e.g., NQRn,ORn,ANDn,T(k,t), and 3SAT) can be proven by the prover based on the properties of BL. In this study, we improve the NIZK proof system for n∈BL based on the special distribution of the square roots modulo n and embed this proof in the third step. Moreover, we show that the CRS can be sampled more efficiently using the improved process.

QMA-Hardness of Consistency of Local Density Matrices with Applications to Quantum Zero-Knowledge

We provide several advances to the understanding of the class of Quantum Merlin-Arthur proof systems (QMA), the quantum analogue of NP. Our central contribution is proving a longstanding conjecture that the Consistency of Local Density Matrices (CLDM) problem is QMA-hard under Karp reductions. The input of CLDM consists of local reduced density matrices on sets of at most k qubits, and the problem asks if there is an n-qubit global quantum state that is consistent with all of the k-qubit local density matrices. The containment of this problem in QMA and the QMA-hardness under Turing reductions were proved by Liu [APPROX-RANDOM 2006]. Liu also conjectured that CLDM is QMA-hard under Karp reductions, which is desirable for applications, and we finally prove this conjecture. We establish this result using the techniques of simulatable codes of Grilo, Slofstra, and Yuen [FOCS 2019], simplifying their proofs and tailoring them to the context of QMA. In order to develop applications of CLDM, we propose a framework that we call locally simulatable proofs for QMA: this provides QMA proofs that can be efficiently verified by probing only k qubits and, furthermore, the reduced density matrix of any k-qubit subsystem of an accepting witness can be computed in polynomial time, independently of the witness. Within this framework, we show advances in quantum zero-knowledge. We show the first commit-and-open computational zero-knowledge proof system for all of QMA, as a quantum analogue of a "sigma" protocol. We then define a Proof of Quantum Knowledge, which guarantees that a prover is effectively in possession of a quantum witness in an interactive proof, and show that our zero-knowledge proof system satisfies this definition. Finally, we show that our proof system can be used to establish that QMA has a quantum non-interactive zero-knowledge proof system in the secret parameter setting.

Receiver Selective Opening Chosen Ciphertext Secure Identity-Based Encryption

In the situation where there are one sender and multiple receivers, a receiver selective opening (RSO) attack for an identity-based encryption (IBE) scheme considers adversaries that can corrupt some of the receivers and get their user secret keys and plaintexts. Security against RSO attacks for an IBE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. In this paper, we formalize a definition of RSO security against chosen ciphertext attacks (RSO-CCA security) for IBE and propose the first RSO-CCA secure IBE schemes. More specifically, we construct an RSO-CCA secure IBE scheme based on an IND-ID-CPA secure IBE scheme and a non-interactive zero-knowledge proof system with unbounded simulation soundness and multi-theorem zero-knowledge. Through our generic construction, we obtain the first pairing-based and lattice-based RSO-CCA secure IBE schemes.

On the Impossibility of NIZKs for Disjunctive Languages From Commit-and-Prove NIZKs

This paper considers the problem of expanding a language class that can be proven by a non-interactive zero-knowledge proof system (NIZK) in a black-box manner in the common reference string model. Namely, given NIZKs for two languages, <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">L</i> <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</sub> and <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">L</i> <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> , can we construct an NIZK for <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">L</i> <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">0</sub> v <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">L</i> <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> in a black-box manner? NIZKs for disjunctive languages have a large number of applications, such as electronic voting. Therefore, such a black-box construction may enable the efficient constructions of such applications. However, Abe et al. (PKC 2020) showed that this is impossible if the two given NIZKs are simulation-sound. In this paper, we prove that it is also impossible if the two given NIZKs are constructed by the commit-and-prove methodology that is typically used in many cryptographic protocols, including NIZKs. This result suggests that if we want to augment the capability of NIZKs in terms of the languages they can prove, we should rely on certain properties or structures of the underlying NIZKs, such as algebraic structures.

Simulation-based receiver selective opening CCA secure PKE from standard computational assumptions

In the situation where there are one sender and multiple receivers and the sender transmits ciphertexts of correlated plaintexts, a receiver selective opening (RSO) attack for a public key encryption (PKE) scheme considers adversaries that can corrupt some of the receivers and get their secret keys and plaintexts. Security against RSO attacks for a PKE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. Simulation-based RSO security against chosen ciphertext attacks (SIM-RSO-CCA) is the strongest security notion in all RSO attack scenarios. Jia, Lu, and Li (2016) [19] proposed the first SIM-RSO-CCA secure PKE scheme. However, their scheme used indistinguishability obfuscation, which is not known to be constructed from any standard computational assumption. In this paper, we give two contributions for constructing SIM-RSO-CCA secure PKE from standard computational assumptions. Firstly, we propose a generic construction of SIM-RSO-CCA secure PKE using an IND-CPA secure PKE scheme and a non-interactive zero-knowledge proof system satisfying one-time simulation soundness. Secondly, we propose an efficient and concrete construction of SIM-RSO-CCA secure PKE based on the decisional Diffie-Hellman (DDH) assumption. Moreover, we give a method for efficiently expanding the plaintext space of the DDH-based construction. By applying this method to the construction, we obtain the first DDH-based SIM-RSO-CCA secure PKE scheme supporting a super-polynomially large plaintext space with compact ciphertexts.

New technique for chosen-ciphertext security based on non-interactive zero-knowledge

In this study, we propose a new method for conversion from a one-way (OW)-secure key encapsulation mechanism (KEM) into a chosen-ciphertext (CCA) secure KEM in the random oracle model. Our conversion method is based on the non-interactive zero-knowledge (NIZK) proof system for proving the relationships (e.g., equality or linearity) of discrete logarithms, where the security analysis of our conversion method depends on the NIZK properties of soundness and zero-knowledge. Our conversion method achieves tight security reduction and it is semi-generic in the sense that other than OW-security, a KEM should be NIZK-compatible. From a theoretical viewpoint, our conversion method can be considered as the corresponding approach for obtaining an efficient signature by applying the Fiat–Shamir transform to the NIZK system. We applied our conversion method to several OW-secure (identity-based) KEMs and compared the results with those obtained by previous methods for achieving CCA security.

Strongly simulation-extractable leakage-resilient NIZK

This paper defines strongly simulation-extractable (sSE) leakage resiliency (LR), which is a new notion for non-interactive zero-knowledge (NIZK) proof system. For an sSE-NIZK proof system, there exists a probabilistic polynomial-time extractor that can always extract a correct witness from any valid proof generated by the adversary, who can obtain proofs of true statements previously given by the simulator. The proof generated by the adversary may depend on a statement---tag pair which has already been used by the simulator. Furthermore, if the adversary can also learn leakage on witnesses and randomness which can explain the proofs generated by the simulator, then the sSE-NIZK proof system is said to satisfy the property of LR. In ASIACRYPT 2010, Dodis, Haralambiev, Lopez-Alt, and Wichs proposed the definitions of true simulation-extractable (tSE) NIZK proof system and sSE-NIZK proof system and gave their constructions. The tSE-NIZK proof system is the same as the sSE-NIZK proof system except that the proof generated by the adversary cannot depend on a statement---tag pair which was used by the simulator. As an extension of the tSE-NIZK proof system, Garg, Jain, and Sahai defined a new notion for NIZK proof system called tSE-LR in CRYPTO 2011 and provided the construction of tSE-LR-NIZK proof system. We extend the notion of tSE-LR-NIZK proof system and construct it by improving the construction of tSE-LR-NIZK proof system. An sSE-LR-NIZK proof system is applicable to construct a fully leakage-resilient signature scheme which is strongly existentially unforgeable, while a tSE-LR-NIZK proof system is applicable to construct one which just satisfies the weak existentially unforgeability. Although there has already been a great deal of research proposed for cryptographic primitives in the leakage models, as far as we know, this is the first fully leakage-resilient signature scheme that is strongly existentially unforgeable.

Non-Interactive Anonymous Credential Based on Structure-Preserving Signature

ABSTRACTStructure-preserving signature, as a special kind of digital signature, provides a way to construct modular cryptographic protocols with reasonable efficiency while retaining conceptual simplicity. This feature makes it suitable to be applied in the construction of non-interactive anonymous credential systems, which allows the user to convince a verifier of the possession of a certificate issued by the trusted authority anonymously and efficiently without interaction. In this paper, we design a secure and efficient structure-preserving signature scheme (SPSIG), and combine the scheme with Groth–Sahai non-interactive zero-knowledge (GSNIZK) proof system to construct a non-interactive anonymous credential scheme. The SPSIG is based on q-ADH-SDH assumption and can resist existential forgery in the chosen message attack. The message, signature, and verification keys are group elements, which are fully compatible with the GSNIZK system. The SXDH assumption is employed to instantiate the certificate-proving process, which is considered to be the most efficient instantiation at the moment. We analyze the efficiency and formally prove the security in the standard model. The result shows that our scheme satisfies correctness, zero knowledge, and unforgeability, and achieves identity authentication in the way of anonymity. Besides, our scheme has stronger anonymity, traceability, and non-interaction, and has lower communication cost compared with the conventional schemes.

Tightly secure signatures and public-key encryption

We construct the first public-key encryption (PKE) scheme whose chosen-ciphertext (i.e., IND-CCA) security can be proved under a standard assumption and does not degrade in either the number of users or the number of ciphertexts. In particular, our scheme can be safely deployed in settings in which no a-priori bound on the number of encryptions and/or users is known. As a central technical building block, we devise the first structure-preserving signature scheme with a tight security reduction. (This signature scheme may be of independent interest.) Combining this scheme with Groth---Sahai proofs yields a tightly simulation-sound non-interactive zero-knowledge proof system for group equations. If we use this proof system in the Naor---Yung double encryption scheme, we obtain a tightly IND-CCA secure PKE scheme from the decision linear assumption. We point out that our techniques are not specific to PKE security. Rather, we view our signature scheme and proof system as general building blocks that can help to achieve a tight security reduction.

A Survey of Noninteractive Zero Knowledge Proof System and Its Applications

Zero knowledge proof system which has received extensive attention since it was proposed is an important branch of cryptography and computational complexity theory. Thereinto, noninteractive zero knowledge proof system contains only one message sent by the prover to the verifier. It is widely used in the construction of various types of cryptographic protocols and cryptographic algorithms because of its good privacy, authentication, and lower interactive complexity. This paper reviews and analyzes the basic principles of noninteractive zero knowledge proof system, and summarizes the research progress achieved by noninteractive zero knowledge proof system on the following aspects: the definition and related models of noninteractive zero knowledge proof system, noninteractive zero knowledge proof system of NP problems, noninteractive statistical and perfect zero knowledge, the connection between noninteractive zero knowledge proof system, interactive zero knowledge proof system, and zap, and the specific applications of noninteractive zero knowledge proof system. This paper also points out the future research directions.

Latest Research Progress on Non-interactive Zero Knowledge Proof System

Latest Research Progress on Non-interactive Zero Knowledge Proof System

New Techniques for Noninteractive Zero-Knowledge

Noninteractive zero-knowledge (NIZK) proof systems are fundamental primitives used in many cryptographic constructions, including public-key encryption secure against chosen ciphertext attack, digital signatures, and various other cryptographic protocols. We introduce new techniques for constructing NIZK proofs based on groups with a bilinear map. Compared to previous constructions of NIZK proofs, our techniques yield dramatic reduction in the length of the common reference string (proportional to security parameter) and the size of the proofs (proportional to security parameter times the circuit size). Our novel techniques allow us to answer several long-standing open questions in the theory of noninteractive proofs. We construct the first perfect NIZK argument system for all NP. We construct the first universally composable NIZK argument for all NP in the presence of an adaptive adversary. We construct a non-interactive zap for all NP, which is the first that is based on a standard cryptographic security assumption.

Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption

We present several new and fairly practical public-key encryption schemes and prove them secure against adaptive chosen ciphertext attack. One scheme is based on Paillier's Decision Composite Residuosity (DCR) assumption, while another is based in the classical Quadratic Residuosity (QR) assumption. The analysis is in the standard cryptographic model, i.e., the security of our schemes does not rely on the Random Oracle model.&lt;br /&gt; &lt;br /&gt;We also introduce the notion of a universal hash proof system. Essentially, this is a special kind of non-interactive zero-knowledge proof system for an NP language. We do not show that universal hash proof systems exist for all NP languages, but we do show how to construct very efficient universal hash proof systems for a general class of group-theoretic language membership problems.&lt;br /&gt; &lt;br /&gt;Given an efficient universal hash proof system for a language with certain natural cryptographic indistinguishability properties, we show how to construct an efficient public-key encryption schemes secure against adaptive chosen ciphertext attack in the standard model. Our construction only uses the universal hash proof system as a primitive: no other primitives are required, although even more efficient encryption schemes can be obtained by using hash functions with appropriate collision-resistance properties. We show how to construct efficient universal hash proof systems for languages related to the DCR and QR assumptions. From these we get corresponding public-key encryption schemes that are secure under these assumptions. We also show that the Cramer-Shoup encryption scheme (which up until now was the only practical encryption scheme that could be proved secure against adaptive chosen ciphertext attack under a reasonable assumption, namely, the Decision Diffie-Hellman assumption) is also a special case of our general theory.

The power of preprocessing in zero-knowledge proofs of knowledge

We show that, after a constant-round preprocessing stage, it is possible for a prover to prove knowledge of a witness for any polynomial-time relation without any further interaction. The number of proofs that can be given is not bounded by any fixed polynomial in the size of the preprocessing. Our construction is based on the sole assumption that one-way functions and noninteractive zero-knowledge proof systems of membership exist.

ID-based non-interactive zero-knowledge proof system based on one-out-of-two non-interactive oblivious transfer

In this paper, we propose an ID-based non-interactive zero-knowledge proof system based on the 1-out-of-2 noninteractive oblivious transfer protocol. This zero-knowledge proof system is secure against a newly discovered cheating attack.