Witness Indistinguishable Proofs Research Articles

Wildcarded identity-based ring signatures based on linearly homomorphic signatures

In identity-based ring signatures (IBRS) (Zhang and Kim, 2002), a binary string ID∈{0,1}L for L∈N, representing a unique information about a signer (e.g., e-mail address, telephone number), is associated with a secret-key. Its owner can anonymously signs a message under a set of IDs called ring including the signer’s ID. Wildcarded IBRS (WIBRS) (Ishizaka&Kiyomoto, ISC’20) is a generalization of IBRS, in which the ring consists of wildcarded IDs. The signer correctly signs iff her ID matches at least one of the wildcarded IDs. To the best of our knowledge, the only one known WIBRS scheme adaptively secure under standard assumptions is obtained as an instantiation of the attribute-based signatures scheme by Sakai et al. (PKC’16). It has signatures of length O(kL) and secret-keys of (constant) length O(1), where k denotes cardinality of the ring. In this paper, we propose a generic WIBRS construction, built by linearly homomorphic signatures and non-interactive witness-indistinguishable proof. We instantiate it to obtain a concrete WIBRS scheme secure under standard assumptions, whose length of signatures (resp. secret-keys) O(k+L) (resp. O(L)).

A Note on Perfect Correctness by Derandomization

We show a general compiler that transforms a large class of erroneous cryptographic schemes (such as public-key encryption, indistinguishability obfuscation, and secure multiparty computation schemes) into perfectly correct ones. The transformation works for schemes that are correct on all inputs with probability noticeably larger than half, and are secure under parallel repetition. We assume the existence of one-way functions and of functions with deterministic (uniform) time complexity 2^{O(n)} and non-deterministic circuit complexity 2^{Omega (n)}. Our transformation complements previous results that showed how public-key encryption and indistinguishability obfuscation that err on a noticeable fraction of inputs can be turned into ones that for all inputs are often correct, showing that they can be made perfectly correct. The technique relies on the idea of “reverse randomization” [Naor, Crypto 1989] and on Nisan–Wigderson style derandomization, previously used in cryptography to remove interaction from witness-indistinguishable proofs and commitment schemes [Barak, Ong and Vadhan, Crypto 2003].

An Adaptively Secure Functional Encryption for Randomized Functions

Abstract Functional encryption (FE) can provide a fine-grained access control on the encrypted message. Therefore, it has been applied widely in security business. The previous works about functional encryptions most focused on the deterministic functions. The randomized algorithm has wide application, such as securely encryption algorithms against chosen ciphertext attack, privacy-aware auditing. Based on this, FE for randomized functions was proposed. The existing constructions are provided in a weaker selective security model, where the adversary is forced to output the challenge message before the start of experiment. This security is not enough in some scenes. In this work, we present a novel construction for FE, which supports the randomized functionalities. We use the technology of key encapsulated mechanism to achieve adaptive security under the simulated environment, where the adversary is allowed to adaptively choose the challenge message at any point in time. Our construction is built based on indistinguishability obfuscation, non-interactive witness indistinguishable proofs and perfectly binding commitment scheme.

Verifiable Random Functions from Non-interactive Witness-Indistinguishable Proofs

Verifiable random functions (VRFs) are pseudorandom functions where the owner of the seed, in addition to computing the function’s value y at any point x, can also generate a non-interactive proof $$\pi $$ that y is correct, without compromising pseudorandomness at other points. Being a natural primitive with a wide range of applications, considerable efforts have been directed toward the construction of such VRFs. While these efforts have resulted in a variety of algebraic constructions (from bilinear maps or the RSA problem), the relation between VRFs and other general primitives is still not well understood. We present new constructions of VRFs from general primitives, the main one being non-interactive witness-indistinguishable proofs (NIWIs). This includes: (1) a selectively secure VRF assuming NIWIs and non-interactive commitments. As usual, the VRF can be made adaptively secure assuming subexponential hardness of the underlying primitives. (2) An adaptively secure VRF assuming (polynomially hard) NIWIs, non-interactive commitments, and (single-key) constrained pseudorandom functions for a restricted class of constraints. The above primitives can be instantiated under various standard assumptions, which yields corresponding VRF instantiations, under different assumptions than were known so far. One notable example is a non-uniform construction of VRFs from subexponentially hard trapdoor permutations, or more generally, from verifiable pseudorandom generators (the construction can be made uniform under a standard derandomization assumption). This partially answers an open question by Dwork and Naor (FOCS ’00). The construction and its analysis are quite simple. Both draw from ideas commonly used in the context of indistinguishability obfuscation.

Complementary witness soundness for witness indistinguishable proof system and CCA2 public-key encryption schemes

We introduce the notion of complementary-witness-soundness for a witness indistinguishable proof system. We then present a new general framework for public key encryption schemes, denoted as CWSWI-type encryption, based on a complementary-witness-sound witness indistinguishable CWSWI proof system. The construction of a CWSWI-type encryption scheme is relatively straightforward, while the security thereof against adaptive chosen ciphertext attack denoted CCA2 can be rigorously proven. Many existing CCA2 public key encryption schemes can be interpreted as being of CWSWI-type, including the schemes of Lindell, Cramer-Shoup and Peikert-Waters. Thus, our CWSWI approach provides a novel means for designing and analysing CCA2 secure public key encryption schemes.

Fully adaptive attribute-based group signature in standard model

Attribute-based group signatures (ABGS) allow a signer to anonymously prove her membership in a group and her ownership of certain attributes, thus can find many applications where both privacy and authentication are required. In this paper, we present a new construction of ABGS based on Fuchsbauer’s automorphic signatures and the Groth and Sahai’s non-interactive witness-indistinguishable proof system. Compared with other ABGS in the literature, our construction is proved secure against fully adaptive adversaries in the standard model, instead of against selected adversaries in the random oracle model. In addition, it admits any signing policies if they can be described as monotone Boolean formulas, and the size of a signature is independent of the number of signers in the group.

Traceable attribute‐based signcryption

ABSTRACTSigncryption can provide confidentiality and authenticity for many cryptographic applications. In this study, we propose a new efficient attribute‐based signcryption scheme. This scheme achieves confidentiality against chosen ciphertext attacks and unforgeability against chosen messages attacks in the selective attribute model. In addition, our scheme enjoys traceability by use of non‐interactive witness indistinguishable proofs; that is, the authority can break the anonymity of users when necessary. Compared with previous works, our scheme has advantages in terms of functionality and efficiency simultaneously. Copyright © 2013 John Wiley & Sons, Ltd.

Efficient Noninteractive Proof Systems for Bilinear Groups

Noninteractive zero-knowledge proofs and noninteractive witness-indistinguishable proofs have played a significant role in the theory of cryptography. However, lack of efficiency has prevented them from being used in practice. One of the roots of this inefficiency is that noninteractive zero-knowledge proofs have been constructed for general NP-complete languages such as Circuit Satisfiability, causing an expensive blowup in the size of the statement when reducing it to a circuit. The contribution of this paper is a general methodology for constructing very simple and efficient noninteractive zero-knowledge proofs and noninteractive witness-indistinguishable proofs that work directly for a wide class of languages that are relevant in practice (namely, ones involving the satisfiability of equations over bilinear groups), without needing a reduction to Circuit Satisfiability. Groups with bilinear maps have enjoyed tremendous success in the field of cryptography in recent years and have been used to construct a plethora of protocols. This paper provides noninteractive witness-indistinguishable proofs and noninteractive zero-knowledge proofs that can be used in connection with these protocols. Our goal is to spread the use of noninteractive cryptographic proofs from mainly theoretical purposes to the large class of practical cryptographic protocols based on bilinear groups.

On constant-round concurrent non-malleable proof systems

Security under man-in-the-middle attacks is extremely important when protocols are executed on asynchronous networks, as the Internet. Focusing on interactive proof systems, one would like also to achieve unconditional soundness, so that proving a false statement is not possible even for a computationally unbounded adversarial prover. Motivated by such requirements, in this paper we address the problem of designing constant-round protocols in the plain model that enjoy simultaneously non-malleability (i.e., security against man-in-the-middle attacks) and unconditional soundness (i.e., they are proof systems). We first give a construction of a constant-round one–many (i.e., one honest prover, many honest verifiers) concurrent non-malleable zero-knowledge proof (in contrast to argument) system for every NP language in the plain model. We then give a construction of a constant-round concurrent non-malleable witness-indistinguishable proof system for every NP language. Compared with previous results, our constructions are the first constant-round proof systems that in the plain model guarantee simultaneously security against some non-trivial concurrent man-in-the-middle attacks and against unbounded malicious provers.

NON-INTERACTIVE IDENTITY-BASED DNF SIGNATURE SCHEME AND ITS EXTENSIONS

An ID-based DNF signature scheme is an ID-based signature scheme with an access structure which is expressed as a disjunctive normal form (DNF) with literals of signer identities. ID-based DNF signature schemes are useful to achieve not only signer-privacy but also a multi-user access control. In this paper, we formally define a notion of a (non-interactive) ID-based DNF signature and propose the first noninteractive ID-based DNF signature schemes that are secure under the computational Diffie-Hellman and subgroup decision assumptions. Our first scheme uses random oracles, and our second one is designed without random oracles. To construct the second one, we use a novel technique that converts a non-interactive witness indistinguishable proof system of encryption of one bit into a corresponding proof system of encryption of a bit-string. This technique may be of independent interest. The second scheme straightforwardly yields the first ID-based ring signature that achieves anonymity against full key exposure without random oracles. We finally present two extensions of the proposed ID-based DNF signature schemes to support multiple KGCs and different messages.

Simplified Design for Concurrent Statistical Zero-Knowledge Arguments

This paper shows that the protocol presented by Goyal et al. can be further simplified for a one-way function, with the simplified protocol being more practical for the decisional Diffie-Hellman assumption. Goyal et al. provided a general transformation from any honest verifier statistical zero-knowledge argument to a concurrent statistical zero-knowledge argument. Their transformation relies only on the existence of one-way functions. For the simplified transformation, the witness indistinguishable proof of knowledge protocols in “parallel” not only plays the role of preamble but also removes some computational zero-knowledge proofs, which Goyal et al. used to prove the existence of the valid openings to the commitments. Therefore, although some computational zero-knowledge proofs are replaced with a weaker notion, the witness indistinguishable protocol, the proof of soundness can still go through.

Derandomization in Cryptography

We give two applications of Nisan-Wigderson-type (NW-type) (“noncryptographic”) pseudorandom generators in cryptography. Specifically, assuming the existence of an appropriate NW-type generator, we construct the following two protocols: (1) a one-message witness-indistinguishable proof system for every language in NP, based on any trapdoor permutation. This proof system does not assume a shared random string or any setup assumption, so it is actually an “NP proof system.” (2) a noninteractive bit-commitment scheme based on any one-way function. The specific NW-type generator we need is a hitting set generator fooling nondeterministic circuits. It is known how to construct such a generator if $E = DTIME(2^{O(n)})$ has a function of nondeterministic circuit complexity $2^{\Omega(n)}$. Our witness-indistinguishable proofs are obtained by using the NW-type generator to derandomize the ZAPs of Dwork and Naor [Proceedings of the 41st Annual ACM Symposium on Foundations of Computer Science, 2000, pp. 283-293]. To our knowledge, this is the first construction of an NP proof system achieving a secrecy property. Our commitment scheme is obtained by derandomizing the interactive commitment scheme of Naor [J. Cryptology, 4 (1991), pp. 151-158]. Previous constructions of noninteractive commitment schemes were known only under incomparable assumptions.