Non-interactive Zero-knowledge Proofs Of Knowledge Research Articles

Traceable ring signatures: general framework and post-quantum security

Traceable ring signature (TRS), a variant of ring signature, allows a signer to sign a message anonymously labeled with a tag on behalf of a group of users, but may reveal the signer’s identity if he creates two signatures with the same tag. TRS provides accountable anonymity for users, and serves as an important role in e-voting systems and e-coupon services. However, current TRS schemes are built on hard problems in number theory that cannot resist quantum attackers. To address this issue, first, we propose a general framework of TRS, by using a non-interactive zero-knowledge proof of knowledge, a hash family, and a pseudorandom function with some additional properties. Then, by instantiating our framework, we give two concrete efficient TRS schemes from lattices and symmetric-key primitives respectively, and both of them are proven to be secure in the quantum random oracle model. Moreover, both schemes have logarithmic signature size.

Functional Signcryption

Functional encryption (FE) allows to restrict decryption in a highly sophisticated fashion, whereas, functional signature (FS) enables to enforce arbitrarily complex control on signing capabilities. This paper introduces a new cryptographic primitive, termed as functional signcryption (FSC), which unifies the functionalities of FE and FS into a cost-effective formulation. FSC is a crucial step towards efficient implementation of modern digital communication and storage systems that demand advanced forms of confidentiality and authenticity simultaneously. Precisely, we make the following contributions:−First, we present a formal definition of FSC and carefully formulate its security requirements.−Next, we provide a generic construction of FSC supporting signing and decryption functionalities realizable by general polynomial size circuits, based on fundamental cryptographic tools, namely, indistinguishability obfuscation (IO) for circuits and statistically simulation-sound non-interactive zero-knowledge proof of knowledge (SSS-NIZKPoK).−Finally, we exhibit a number of representative applications of this interesting cryptographic primitive:(i)We develop the first ever attribute-based signcryption (ABSC) scheme for arbitrary polynomial size circuits from FSC.(ii)We show how FSC can be utilized to build SSS-NIZKPoK systems and IO for general circuits. This result in conjunction with our FSC construction can be interpreted as establishing an equivalence between FSC and the other two important cryptographic primitives.

Scalable Zero Knowledge Via Cycles of Elliptic Curves

Non-interactive zero-knowledge proofs of knowledge for general NP statements are a powerful cryptographic primitive, both in theory and in practical applications. Recently, much research has focused on achieving an additional property, succinctness, requiring the proof to be very short and easy to verify. Such proof systems are known as zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs), and are desired when communication is expensive, or the verifier is computationally weak. Existing zk-SNARK implementations have severe scalability limitations, in terms of space complexity as a function of the size of the computation being proved (e.g., running time of the NP statement’s decision program). First, the size of the proving key is quasilinear in the upper bound on the computation size. Second, producing a proof requires “writing down” all intermediate values of the entire computation, and then conducting global operations such as FFTs. The bootstrapping technique of Bitansky et al. (STOC ’13), following Valiant (TCC ’08), offers an approach to scalability, by recursively composing proofs: proving statements about acceptance of the proof system’s own verifier (and correctness of the program’s latest step). Alas, recursive composition of known zk-SNARKs has never been realized in practice, due to enormous computational cost. Using new elliptic-curve cryptographic techniques, and methods for exploiting the proof systems’ field structure and nondeterminism, we achieve the first zk-SNARK implementation that practically achieves recursive proof composition. Our zk-SNARK implementation runs random-access machine programs and produces proofs of their correct execution, on today’s hardware, for any program running time. It takes constant time to generate the keys that support all computation sizes. Subsequently, the proving process only incurs a constant multiplicative overhead compared to the original computation’s time, and an essentially-constant additive overhead in memory. Thus, our zk-SNARK implementation is the first to have a well-defined, albeit low, clock rate of “verified instructions per second”.

Black-Box Accumulation: Collecting Incentives in a Privacy-Preserving Way

Abstract We formalize and construct black-box accumulation (BBA), a useful building block for numerous important user-centric protocols including loyalty systems, refund systems, and incentive systems (as, e.g., employed in participatory sensing and vehicle-to-grid scenarios). A core requirement all these systems share is a mechanism to let users collect and sum up values (call it incentives, bonus points, reputation points, etc.) issued by some other parties in a privacy-preserving way such that curious operators may not be able to link the different transactions of a user. At the same time, a group of malicious users may not be able to cheat the system by pretending to have collected a higher amount than what was actually issued to them. As a first contribution, we fully formalize the core functionality and properties of this important building block. Furthermore, we present a generic and non-interactive construction of a BBA system based on homomorphic commitments, digital signatures, and non-interactive zero-knowledge proofs of knowledge. For our construction, we formally prove security and privacy properties. Finally, we propose a concrete instantiation of our construction using Groth-Sahai commitments and proofs as well as the optimal structure-preserving signature scheme of Abe et al. and analyze its efficiency.