Non-interactive Zero-knowledge Proofs Research Articles

A Smart Contract System for Decentralized Borda Count Voting

In this article, we propose the first self-tallying decentralized e-voting protocol for a ranked-choice voting system based on Borda count. Our protocol does not need any trusted setup or tallying authority to compute the tally. The voters interact through a publicly accessible bulletin board for executing the protocol in a way that is publicly verifiable. Our main protocol consists of two rounds. In the first round, the voters publish their public keys, and in the second round they publish their randomized ballots. All voters provide Non-interactive Zero-Knowledge (NIZK) proofs to show that they have been following the protocol specification honestly without revealing their secret votes. At the end of the election, anyone including a third-party observer will be able to compute the tally without needing any tallying authority. We provide security proofs to show that our protocol guarantees the maximum privacy for each voter. We have implemented our protocol using Ethereum's blockchain as a public bulletin board to record voting operations as publicly verifiable transactions. The experimental data obtained from our tests show the protocol's potential for the real-world deployment.

Preserving Privacy in Mobile Health Systems Using Non-Interactive Zero-Knowledge Proof and Blockchain

The advent of miniaturized mobile devices with wireless communication capability and integrated with biosensors has revolutionized healthcare systems. The devices can be used by individuals as wearable accessories to collect health data regularly. This type of medical assistance supported by mobile devices to monitor patients and offer health services remotely is known as mobile health (mHealth). Although mHealth provides many benefits and has become popular, it can pose severe privacy risks. Many features in mHealth are managed through a smartphone. Thus, one of the most worrying issues involves communication between the monitoring devices and the smartphone. When communication uses Bluetooth, it is standard for a device to be paired with the smartphone; but generally, it is not exclusively associated with a specific mHealth app. This characteristic can allow a data theft attack by a malicious app or fake data injection by an illegitimate device. To address this issue, we present an authentication scheme based on Non-Interactive Zero-Knowledge Proof that is lightweight enough to run on mHealth devices with minimal resources. Our scheme ensures that legitimate devices interact exclusively with the official mHealth application. To ensure the patient's privacy-preserving throughout the system, we address the issues of storing, managing, and sharing data using blockchain. Since there is no privacy in the standard blockchain, we present a scheme in which the health data transmitted, stored, or shared are protected by Attribute-Based Encryption. The outcome is a system with fine-grained access control, entirely managed by the patient, and an end-to-end privacy guarantee.

Traceability in Permissioned Blockchain

In this paper, we have achieved privacy protection and high transparency in a permissioned blockchain. There is a sidechain that connects the permissionless blockchain and the permissioned blockchain. The behavior in the permissioned blockchain is almost a black box from the perspective of the permissionless blockchain. While this fact is useful for privacy protection, there is room for improvement in terms of transparency. To improve the transparency of the permissioned blockchain under privacy protection, we consider traceability in the permissioned blockchain consisting of the following three properties: trade privacy (who trades with whom and at what asset amount), preservation (the total amount inside the permissioned blockchain, including deposits and withdrawals to the permissionless blockchain, is immutable), and noninvolvement (some members in the permissioned blockchain are not involved in some trades, and it is possible to prove that specified members performed the transaction). To the best of our knowledge, we are the first to achieve both preservation and noninvolvement while protecting the privacy of transactions. Our approach is as follows. We model traceability based on the hidden Markov model. Because the proof of traceability requires the calculation of more than quadratic degrees, we encrypt this model by homomorphic encryption. The number of participants in the permissioned blockchain corresponds to the number of additions in the model. Then, we can construct the encrypted model by employing somewhat homomorphic encryption. The establishment of the original model is verifiable by applying the noninteractive zero-knowledge proof of the knowledge that the plaintext is equal to zero. This is an adaptation of Benhamouda et al. (Asiacrypt 2014).

CCA Secure Public Key Encryption against After-the-Fact Leakage without NIZK Proofs

In leakage resilient cryptography, there is a seemingly inherent restraint on the ability of the adversary that it cannot get access to the leakage oracle after the challenge. Recently, a series of works made a breakthrough to consider a postchallenge leakage. They presented achievable public key encryption (PKE) schemes which are semantically secure against after-the-fact leakage in the split-state model. This model puts a more acceptable constraint on adversary’s ability that the adversary cannot query the leakage of secret states as a whole but the functions of several parts separately instead of prechallenge query only. To obtain security against chosen ciphertext attack (CCA) for PKE schemes against after-the-fact leakage attack (AFL), existing works followed the paradigm of “double encryption” which needs noninteractive zero knowledge (NIZK) proofs in the encryption algorithm. We present an alternative way to achieve AFL-CCA security via lossy trapdoor functions (LTFs) without NIZK proofs. First, we formalize the definition of LTFs secure against AFL (AFLR-LTFs) and all-but-one variants (ABO). Then, we show how to realize this primitive in the split-state model. This primitive can be used to construct AFLR-CCA secure PKE scheme in the same way as the method of “CCA from LTFs” in traditional sense.

Oracle separations between quantum and non-interactive zero-knowledge classes

We study the relationship between problems solvable by quantum algorithms in polynomial time and those for which zero-knowledge proofs exist. In prior work, Aaronson [1] showed an oracle separation between BQP and SZK, i.e. an oracle A such that SZKA⊈BQPA. In this paper we give a simple extension of Aaronson's result to non-interactive zero-knowledge proofs with perfect security. This class, NIPZK, is the most restrictive zero-knowledge class. We show that even for this class we can construct an A with NIPZKA⊈BQPA. In building up this result, we first review Aaronson's proof for SZK and show a very simple proof for a new intermediate result, a separation between BQP and NISZK.

Concise ID-based mercurial functional commitments and applications to zero-knowledge sets

Zero-knowledge sets (ZKS) is a basic cryptographic primitive that can be used to commit to a set S and prove statements such as $$x\in S$$ or $$x\notin S$$ , without revealing anything else on S. Mercurial commitment is a useful tool to construct ZKS. Trapdoor q-mercurial commitment, an extension of normal mercurial commitment, results in more efficient ZKS with much shorter proofs when combining with a q-arity Merkle tree. ID-based trapdoor mercurial commitment is proposed by Chen et al. in 2011 to mainly solve the conflicts between propagation and plagiarism of non-interactive zero-knowledge proofs in ZKS, but it only supports binary Merkle tree. In this paper, we present the first ID-based mercurial functional commitment which provides more efficient ZKS than Chen et al.’s scheme by extending it to vector commitment. Moreover, our mercurial functional commitment supports the functionality of linear functions, where commitment to a message vector (e.g., $$\mathbf {m}=(m_1,m_2,\ldots ,m_n)\in {\mathcal {D}}^n$$ ) can later be de-committed to a linear function $$\sum _{i=1}^n m_i x_i=y\in {\mathcal {R}}$$ of some vector coordinates. It has applications in generalized ZKS which allows us to provide proof of a linear computation on values in a database other than just membership/non-membership statements. Besides, the proposed mercurial functional commitment, as an extension of mercurial vector commitment, is concise (the sizes of the commitments and hard/soft openings are independent of the length of the function description or messages) and achieves both linear-size public keys and constant-size assumptions.

Group Signatures with Message-Dependent Opening: Formal Definitions and Constructions

This paper introduces a new capability for group signatures called message-dependent opening. It is intended to weaken the high trust placed on the opener; i.e., no anonymity against the opener is provided by an ordinary group signature scheme. In a group signature scheme with message-dependent opening (GS-MDO), in addition to the opener, we set up an admitter that is not able to extract any user’s identity but admits the opener to open signatures by specifying messages where signatures on the specified messages will be opened by the opener. The opener cannot extract the signer’s identity from any signature whose corresponding message is not specified by the admitter. This paper presents formal definitions of GS-MDO and proposes a generic construction of it from identity-based encryption and adaptive non-interactive zero-knowledge proofs. Moreover, we propose two specific constructions, one in the standard model and one in the random oracle model. Our scheme in the standard model is an instantiation of our generic construction but the message-dependent opening property is bounded. In contrast, our scheme in the random oracle model is not a direct instantiation of our generic construction but is optimized to increase efficiency and achieves the unbounded message-dependent opening property. Furthermore, we also demonstrate that GS-MDO implies identity-based encryption, thus implying that identity-based encryption is essential for designing GS-MDO schemes.

Non-interactive zero knowledge proofs for the authentication of IoT devices in reduced connectivity environments

Current authentication protocols seek to establish authenticated sessions over insecure channels while maintaining a small footprint considering the energy consumption and computational overheads. Traditional authentication schemes must store a form of authentication data on the devices, putting this data at risk. Approaches based on purely public/private key infrastructure come with additional computation and maintenance costs. This work proposes a novel non-interactive zero-knowledge (NIZKP) authentication protocol that incorporates the limiting factors in IoT communication devices and sensors. Our protocol considers the inherent network instability and replaces the ZKP NP-hard problem using the Merkle tree structure for the creation of the authentication challenge. A series of simulations evaluate the performance of NIZKP against traditional ZKP approaches based on graph isomorphism. A set of performance metrics has been used, namely the channel rounds for client authentication, effects of the authentication processes, and the protocol interactions to determine areas of improvements. The simulation results indicate empirical evidence for the suitability of our NIKP approach for authentication purposes in resource-constrained IoT environments.

Simulation-based receiver selective opening CCA secure PKE from standard computational assumptions

In the situation where there are one sender and multiple receivers and the sender transmits ciphertexts of correlated plaintexts, a receiver selective opening (RSO) attack for a public key encryption (PKE) scheme considers adversaries that can corrupt some of the receivers and get their secret keys and plaintexts. Security against RSO attacks for a PKE scheme ensures confidentiality of ciphertexts of uncorrupted receivers. Simulation-based RSO security against chosen ciphertext attacks (SIM-RSO-CCA) is the strongest security notion in all RSO attack scenarios. Jia, Lu, and Li (2016) [19] proposed the first SIM-RSO-CCA secure PKE scheme. However, their scheme used indistinguishability obfuscation, which is not known to be constructed from any standard computational assumption. In this paper, we give two contributions for constructing SIM-RSO-CCA secure PKE from standard computational assumptions. Firstly, we propose a generic construction of SIM-RSO-CCA secure PKE using an IND-CPA secure PKE scheme and a non-interactive zero-knowledge proof system satisfying one-time simulation soundness. Secondly, we propose an efficient and concrete construction of SIM-RSO-CCA secure PKE based on the decisional Diffie-Hellman (DDH) assumption. Moreover, we give a method for efficiently expanding the plaintext space of the DDH-based construction. By applying this method to the construction, we obtain the first DDH-based SIM-RSO-CCA secure PKE scheme supporting a super-polynomially large plaintext space with compact ciphertexts.

Short tightly secure signatures for signing a vector of group elements: A new approach

We give a new approach to build tightly secure signatures for signing a vector of group elements in a bilinear group. We illustrate its usefulness to construct efficient signature schemes by giving two new constructions of partially structure preserving signature schemes, a weaker version of structure preserving signatures which are still compatible with Groth-Sahai Non-Interactive Zero-Knowledge Proofs. The first scheme is simpler to analyze, while the second scheme is more efficient and has a signature size of only 3 group elements. This is comparable to the state-of-the art in tightly secure signatures in bilinear groups without the partial structure preserving property. We finally give a third construction using the same ideas, a tightly secure signature scheme in bilinear groups which is comparable with the state-of-the-art.

Security and Privacy on Blockchain

Blockchain offers an innovative approach to storing information, executing transactions, performing functions, and establishing trust in an open environment. Many consider blockchain as a technology breakthrough for cryptography and cybersecurity, with use cases ranging from globally deployed cryptocurrency systems like Bitcoin, to smart contracts, smart grids over the Internet of Things, and so forth. Although blockchain has received growing interests in both academia and industry in the recent years, the security and privacy of blockchains continue to be at the center of the debate when deploying blockchain in different applications. This article presents a comprehensive overview of the security and privacy of blockchain. To facilitate the discussion, we first introduce the notion of blockchains and its utility in the context of Bitcoin-like online transactions. Then, we describe the basic security properties that are supported as the essential requirements and building blocks for Bitcoin-like cryptocurrency systems, followed by presenting the additional security and privacy properties that are desired in many blockchain applications. Finally, we review the security and privacy techniques for achieving these security properties in blockchain-based systems, including representative consensus algorithms, hash chained storage, mixing protocols, anonymous signatures, non-interactive zero-knowledge proof, and so forth. We conjecture that this survey can help readers to gain an in-depth understanding of the security and privacy of blockchain with respect to concept, attributes, techniques, and systems.

Multi-theorem Preprocessing NIZKs from Lattices

Non-interactive zero-knowledge (NIZK) proofs are fundamental to modern cryptography. Numerous NIZK constructions are known in both the random oracle and the common reference string (CRS) models. In the CRS model, there exist constructions from several classes of cryptographic assumptions such as trapdoor permutations, pairings, and indistinguishability obfuscation. However, at the time of the initial publication of this work, we did not have constructions of NIZKs from standard lattice assumptions. In this work, we take an initial step toward constructing multi-theorem NIZKs for general $$\mathsf {NP}$$ languages from standard lattice assumptions by considering a relaxation to the preprocessing model and a new model we call the designated-prover model. In the preprocessing model, a setup algorithm generates secret proving and verification keys for the prover and the verifier, respectively. In the designated-prover model, the proving key is secret, but the verification key is public. In both settings, the proving key is used to construct proofs and the verification key is used to check proofs. Finally, in the multi-theorem setting, both the proving and verification keys should be reusable for an unbounded number of theorems without compromising soundness or zero-knowledge. Previous constructions of NIZKs in the preprocessing model that rely on weaker assumptions like one-way functions or oblivious transfer are only secure in a single-theorem setting. Thus, constructing multi-theorem NIZKs in these relaxed models does not seem to be inherently easier than constructing them in the CRS model. In this work, we first construct a multi-theorem preprocessing NIZK argument from context-hiding homomorphic signatures. In fact, the construction is a designated-prover NIZK. We also show that using homomorphic commitments, we can get statistically sound proofs in the preprocessing and designated-prover models. Together with lattice-based instantiations of homomorphic signatures and commitments, we obtain the first multi-theorem NIZKs in the preprocessing and designated-prover models from standard lattice assumptions. Finally, we show how to generalize our construction to obtain a universally composable NIZK (UC-NIZK) in the preprocessing model from standard lattice assumptions. Our UC-NIZK relies on a simple preprocessing protocol based on a new primitive we call blind homomorphic signatures.

Privacy-aware Decentralized and Scalable Access Control Management for IoT Environment

In recent years, the Internet of Things (IoT) plays a vital role in our daily activities .Owing to the increased number of vulnerabilities on the IoT devices, security becomes critical in the untrustworthy IoT environment. Access control is one of the top security concerns, however, implementing the traditional access control mechanisms in the resource-constrained nature of the IoT devices is a challenging task. With the emergence of blockchain technology, several recent research works have focused on the adoption of blockchain in IoT to resolve the security concerns. Despite, integrating the blockchain in the resource-constrained IoT context is difficult. To overcome these obstacles, the proposed work presents a privacy-aware IoT security architecture to ensure the access control based on Smart contract for resource-constrained and distributed IoT devices. The design of the proposed architecture incorporates three main components such as the contextual blockchain gateway, decentralized revocation manager, and non-interactive zero-knowledge proof based validation. By modeling the contextual blockchain gateway, the proposed architecture ensures the dynamic authentication and authorization based on the contextual information and access policies. Instead of integrating the blockchain technology into resource-constrained IoT devices, the smart contract-based distributed access control system with the contextual blockchain gateway provides the scalable solution. With the association of decentralized revocation manager in the smart contract, it prevents the resource access from the unauthorized users by dynamically generating and updating the revoked user list of all the nodes in the smart contract. Moreover, the proposed architecture employs the non-interactive zeroknowledge proof cryptographic protocol to ensure the transaction privacy within the smart contract. Consequently, it maintains the trade-off between the transparency and privacy while ensuring the security for the distributed IoT environment.

New technique for chosen-ciphertext security based on non-interactive zero-knowledge

In this study, we propose a new method for conversion from a one-way (OW)-secure key encapsulation mechanism (KEM) into a chosen-ciphertext (CCA) secure KEM in the random oracle model. Our conversion method is based on the non-interactive zero-knowledge (NIZK) proof system for proving the relationships (e.g., equality or linearity) of discrete logarithms, where the security analysis of our conversion method depends on the NIZK properties of soundness and zero-knowledge. Our conversion method achieves tight security reduction and it is semi-generic in the sense that other than OW-security, a KEM should be NIZK-compatible. From a theoretical viewpoint, our conversion method can be considered as the corresponding approach for obtaining an efficient signature by applying the Fiat–Shamir transform to the NIZK system. We applied our conversion method to several OW-secure (identity-based) KEMs and compared the results with those obtained by previous methods for achieving CCA security.

QANIZK for adversary-dependent languages and their applications

Quasi-Adaptive Non-Interactive Zero-Knowledge (QANIZK) proofs make possible efficient NIZK with short proofs by allowing the common reference string to depend on the language. The strongest notion of (computational) soundness for QANIZK is Unbounded Simulation-Soundness (USS). For USS, however, the language is completely beyond the adversary's control.In this paper, we introduce a stronger notion of USS for QANIZK, called USS for Adversary-Dependent Languages (USS-ADL), by allowing the adversary to adaptively develop the language. We present a generic construction of efficient USS-ADL-QANIZK for diverse vector spaces (DVS) over graded rings, of which linear subspaces over bilinear groups are specific instantiations.–Our generic construction provides the first USS-QANIZK for DVS over graded rings. This complements Abdalla et al.'s work (Eurocrypt'15) of QANIZK with one-time simulation-soundness.–As for applications, USS-ADL-QANIZK leads to modular constructions of digital signature and linearly homomorphic (structure-preserving) signature schemes with black-box security reductions.The instantiations cover the efficient USS-QANIZK for linear subspaces over bilinear groups proposed by Kiltz and Wee (Eurocrypt'15), a variant of the efficient structure-preserving signature proposed by Kiltz et al. (Crypto'15) and the efficient linearly homomorphic structure-preserving signature proposed by Kiltz and Wee (Eurocrypt'15). Our USS-ADL-QANIZK provides a new perspective on their constructions and security proofs in a unified way.

A fair offline electronic cash scheme with multiple-bank in standard model

ABSTRACTOffline electronic cash is a new and well-acknowledged type of e-cash scheme that can release the bank from participating in every spending protocol. However, it is still an unsolved problem to design a secure and efficient fair offline e-cash scheme. Considering this problem, in this paper, we have proposed a fair offline electronic cash scheme with multiple banks in pairing-based instantiation. We adopt Groth–Sahai non-interactive zero-knowledge proof technology in our scheme, to design non-interactive e-cash transactions. Additionally, inspired by Water’s group signature, our solution supports not only multiple users, but also users with accounts in different banks. Moreover, our scheme has efficient double-spending checking and a fair control mechanism. We have formally defined the security properties of the scheme in a standard model, and provided the detailed security proofs of the security properties concerning chosen ciphertext attack (CCA) anonymity, unforgeability and traceability. Analysis and comparison show that our scheme has advantages both in security and in efficiency.

NIZKCTF: A Noninteractive Zero-Knowledge Capture-the-Flag Platform

Capture the Flag (CTF) competitions are increasingly important for the Brazilian cybersecurity community as education and professional tools. Unfortunately, CTF platforms may suffer from security issues, giving an unfair advantage to competitors. To mitigate this, we propose NIZKCTF, the first open-audit CTF platform based on non-interactive zero-knowledge proofs.

Functional Signcryption

Functional encryption (FE) allows to restrict decryption in a highly sophisticated fashion, whereas, functional signature (FS) enables to enforce arbitrarily complex control on signing capabilities. This paper introduces a new cryptographic primitive, termed as functional signcryption (FSC), which unifies the functionalities of FE and FS into a cost-effective formulation. FSC is a crucial step towards efficient implementation of modern digital communication and storage systems that demand advanced forms of confidentiality and authenticity simultaneously. Precisely, we make the following contributions:−First, we present a formal definition of FSC and carefully formulate its security requirements.−Next, we provide a generic construction of FSC supporting signing and decryption functionalities realizable by general polynomial size circuits, based on fundamental cryptographic tools, namely, indistinguishability obfuscation (IO) for circuits and statistically simulation-sound non-interactive zero-knowledge proof of knowledge (SSS-NIZKPoK).−Finally, we exhibit a number of representative applications of this interesting cryptographic primitive:(i)We develop the first ever attribute-based signcryption (ABSC) scheme for arbitrary polynomial size circuits from FSC.(ii)We show how FSC can be utilized to build SSS-NIZKPoK systems and IO for general circuits. This result in conjunction with our FSC construction can be interpreted as establishing an equivalence between FSC and the other two important cryptographic primitives.

PrivBox: Verifiable decentralized reputation system for online marketplaces

In online marketplaces (e-commerce, cloud marketplaces), potential buyers/consumers do not have direct access to inspect the quality of products and services offered by retailers and service providers of marketplaces. Therefore, consumers have to trust the reputation system of the marketplace for making a meaningful decision whether they should have interaction with the particular service provider or not. Consumer’s feedback plays an important role while evaluating the trustworthiness of the service provider, but it brings challenges to security and the consumer’s privacy. Existing centralized reputation systems collect and process consumer’s feedback at the centralized trusted system but these systems could leak sensitive information of consumers (such as buying history, likes and dislikes). To ensure the privacy of consumers, in this paper, we present PrivBox, a privacy-preserving decentralized reputation system that computes reputation of retailers or service providers by leveraging feedback from users in a secure and private way. The PrivBox system uses primitives of a homomorphic cryptographic system and non-interactive zero-knowledge proof to achieve objectives of privacy-preservation and well-formedness. PrixBox performs its operations in a decentralized setting, and ensures the following characteristics. (1) It guarantees privacy of consumers without relying on any trusted setup or trusted third party system, (2) it ensures that the consumer’s feedback ratings remain within the prescribed range, and (3) it enables consumers and service providers to verify the computed statistics without relying on a trusted third party. To evaluate the performance, we have implemented operations of the PrivBox system. The results demonstrate that the proposed system has a small communication and computation overheads with the essential properties of privacy-preservation and decentralization.

Efficient unlinkable sanitizable signatures from signatures with re‐randomizable keys

A sanitizable signature scheme is a malleable signature scheme where a designated third party has the permission to modify certain parts of the message and adapt the signature accordingly. This primitive was introduced by Ateniese et al. (ESORICS 2005) and Brzuska et al. (PKC 2009) formalized the initially suggested five security properties. In the subsequent year, Brzuska et al. (PKC 2010) introduced a notion called unlinkability where the basic idea is that linking message-signature pairs of the same document should be infeasible. Brzuska et al. formalized this notion and suggested a generic instantiation based on group signatures with a special structure. Unfortunately, the most efficient instantiations of group signatures do not have this property. In this work, we present the first efficient construction of unlinkable sanitizable signatures based on a novel type of signature schemes with re-randomizable keys. This property allows one to re-randomize both the signing and the verification key separately but consistently. Given a signature scheme with re-randomizable keys, we obtain a sanitizable signature scheme by signing the message with a re-randomized key and proving in zero-knowledge that the derived key originates from either the signer or the sanitizer. To obtain an efficient instantiation, we instantiate this generic idea with Schnorr signatures and efficient Σ -protocols that we turn into a non-interactive zero-knowledge proof via the Fiat-Shamir transformation. In this work, we present an optimized version that is more efficient than the construction we suggested in the extended abstract of this work at PKC 2016.