Zero-knowledge Proof System Research Articles

Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption

We present several new and fairly practical public-key encryption schemes and prove them secure against adaptive chosen ciphertext attack. One scheme is based on Paillier's Decision Composite Residuosity (DCR) assumption, while another is based in the classical Quadratic Residuosity (QR) assumption. The analysis is in the standard cryptographic model, i.e., the security of our schemes does not rely on the Random Oracle model.<br /> <br />We also introduce the notion of a universal hash proof system. Essentially, this is a special kind of non-interactive zero-knowledge proof system for an NP language. We do not show that universal hash proof systems exist for all NP languages, but we do show how to construct very efficient universal hash proof systems for a general class of group-theoretic language membership problems.<br /> <br />Given an efficient universal hash proof system for a language with certain natural cryptographic indistinguishability properties, we show how to construct an efficient public-key encryption schemes secure against adaptive chosen ciphertext attack in the standard model. Our construction only uses the universal hash proof system as a primitive: no other primitives are required, although even more efficient encryption schemes can be obtained by using hash functions with appropriate collision-resistance properties. We show how to construct efficient universal hash proof systems for languages related to the DCR and QR assumptions. From these we get corresponding public-key encryption schemes that are secure under these assumptions. We also show that the Cramer-Shoup encryption scheme (which up until now was the only practical encryption scheme that could be proved secure against adaptive chosen ciphertext attack under a reasonable assumption, namely, the Decision Diffie-Hellman assumption) is also a special case of our general theory.

Zero Knowledge and the Chromatic Number

We present a new technique, inspired by zero-knowledge proof systems, for proving lower bounds on approximating the chromatic number of a graph. To illustrate this technique we present simple reductions frommax-3-coloringandmax-3-sat, showing that it is hard to approximate the chromatic number withinΩ(Nδ) for someδ>0. We then apply our technique in conjunction with the probabilistically checkable proofs of Håstad and show that it is hard to approximate the chromatic number to withinΩ(N1−ε) for anyε>0, assuming NP⊈ZPP. Here, ZPP denotes the class of languages decidable by a random expected polynomial-time algorithm that makes no errors. Our result matches (up to low order terms) the known gap for approximating the size of the largest independent set. PreviousO(Nδ) gaps for approximating the chromatic number (such as those by Lund and Yannakakis, and by Furer) did not match the gap for independent set nor extend beyondΩ(N1/2−ε).

The power of preprocessing in zero-knowledge proofs of knowledge

We show that, after a constant-round preprocessing stage, it is possible for a prover to prove knowledge of a witness for any polynomial-time relation without any further interaction. The number of proofs that can be given is not bounded by any fixed polynomial in the size of the preprocessing. Our construction is based on the sole assumption that one-way functions and noninteractive zero-knowledge proof systems of membership exist.

How to construct constant-round zero-knowledge proof systems for NP

Constant-round zero-knowledge proof systems for every language in $$\mathcal{N}\mathcal{P}$$ are presented, assuming the existence of a collection of claw-free functions. In particular, it follows ...

Linear Zero-Knowledgde. A Note on Efficient Zero-Knowledge Proofs and Arguments

We present a zero-knowledge proof system [19] for any NP language L, which<br />allows showing that x in L with error probability less than 2^−k using communication<br />corresponding to O(|x|^c) + k bit commitments, where c is a constant depending only<br />on L. The proof can be based on any bit commitment scheme with a particular set<br />of properties. We suggest an efficient implementation based on factoring.<br />We also present a 4-move perfect zero-knowledge interactive argument for any NP-language<br />L. On input x in L, the communication complexity is O(|x|^c) max(k; l)<br />bits, where l is the security parameter for the prover. Again, the protocol can be<br />based on any bit commitment scheme with a particular set of properties. We suggest<br />efficient implementations based on discrete logarithms or factoring.<br />We present an application of our techniques to multiparty computations, allowing<br />for example t committed oblivious transfers with error probability 2^−k to be done<br />simultaneously using O(t+k) commitments. Results for general computations follow<br />from this.<br />As a function of the security parameters, our protocols have the smallest known<br />asymptotic communication complexity among general proofs or arguments for NP.<br />Moreover, the constants involved are small enough for the protocols to be practical in<br />a realistic situation: both protocols are based on a Boolean formula Phi containing and-<br />, or- and not-operators which verifies an NP-witness of membership in L. Let n be<br />the number of times this formula reads an input variable. Then the communication<br />complexity of the protocols when using our concrete commitment schemes can be<br />more precisely stated as at most 4n + k + 1 commitments for the interactive proof<br />and at most 5nl +5l bits for the argument (assuming k <= l). Thus, if we use k = n,<br />the number of commitments required for the proof is linear in n.<br />Both protocols are also proofs of knowledge of an NP-witness of membership in<br />the language involved.

ID-based non-interactive zero-knowledge proof system based on one-out-of-two non-interactive oblivious transfer

In this paper, we propose an ID-based non-interactive zero-knowledge proof system based on the 1-out-of-2 noninteractive oblivious transfer protocol. This zero-knowledge proof system is secure against a newly discovered cheating attack.

Subquadratic zero-knowledge

article Free AccessSubquadratic zero-knowledge Authors: Joan Boyar Odense Univ., Odense, Denmark Odense Univ., Odense, DenmarkView Profile , Gilles Brassard Univ. of Montreal, Montreal, P.Q., Canada Univ. of Montreal, Montreal, P.Q., CanadaView Profile , René Peralta Univ. of Wisconsin at Milwaukee Univ. of Wisconsin at MilwaukeeView Profile Authors Info & Claims Journal of the ACMVolume 42Issue 6Nov. 1995 pp 1169–1193https://doi.org/10.1145/227683.227686Published:01 November 1995Publication History 11citation490DownloadsMetricsTotal Citations11Total Downloads490Last 12 Months17Last 6 weeks9 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

Definitions and properties of zero-knowledge proof systems

In this paper we investigate some properties of zero-knowledge proofs, a notion introduced by Goldwasser, Micali, and Rackoff. We introduce and classify two definitions of zero-knowledge: auxiliary...

The knowledge complexity of quadratic residuosity languages

Noninteractive perfect zero-knowledge (ZK) proofs are very elusive objects. In fact, since the introduction of the noninteractive model of Blum . (1988), the only perfect zero-knowledge proof known was the one for quadratic nonresiduosity of Blum . (1991). The situation is no better in the interactive case where perfect zero-knowledge proofs are known only for a handful of particular languages.In this work, we show that a large class of languages related to quadratic residuosity admits noninteractive perfect zero-knowledge proofs. More precisely, we give a protocol for the language of thresholds of quadratic residuosity.Moreover, we develop a new technique for converting noninteractive zero-knowledge proofs into round-optimal zero-knowledge proofs for an even wider class of languages. The transformation preserves perfect zero knowledge in the sense that, if the noninteractive proof we started with is a perfect zero-knowledge proof, then we obtain a round-optimal perfect zero-knowledge proof. The noninteractive perfect zero-knowledge proofs presented in this work can be transformed into 4-round (which is optimal) interactive perfect zero-knowledge proofs. Until now, the only known 4-round perfect ZK proof systems were the ones for quadratic nonresiduosity (Goldwasser et al., 1989) and for graph nonisomorphism (Goldreich et al., 1986) and no 4-round perfect zero-knowledge proof system was known for the simple case of the language of quadratic residues.

Zero-Knowledge Proofs

On a moonless night the spy returns to the castle after a reconnoitering mission to the enemy camp. As he nears the gate a voice whispers, What's the password? But is it friend or foe who whispers? How can the spy show that he knows the password without actually revealing it to a possible imposter? The spy's dilemma is commonplace now with the widespread use of telecommunications. When your automatic teller machine communicates with your bank, each must be assured that the other is legitimate; the electronic must be unforgeable and must be of no use to imposters and eavesdroppers. One method that has been proposed for exchanging passwords in this context is the zero-knowledge proof. Renaissance mathematicians developed their own primitive zero-knowledge proof systems. When both Tartaglia and Fior claimed knowledge of an algebraic solution to cubic equations, a contest was arranged in which each proposed thirty problems for the other to solve. In the end, Tartaglia had solved all thirty, thus providing a convincing demonstration that he knew the method without actually revealing it. Fior solved none. (It turned out that each had worked out solutions to certain classes of cubics, but neither had solved the general problem [2]). We've progressed considerably in formalizing this idea. An interactive protocol comprises two algorithms P (the prover) and V (the verifier) that read a common input string w of length Iwl and then compute and communicate in alternating turns to determine whether w has some specified property. The verifier is polynomially-bounded: it must eventually halt and its total computation time must be bounded by a fixed polynomial in Iw 1. When it halts, the verifier outputs either accept or reject depending upon whether the property holds for w. The verifier is probabilistic, that is, allowed to make random choices during the computation according to the results of coin tosses. The prover is allowed to have unlimited computational power. A language is a set of strings. An interactive proof system for Z is an interactive protocol in which P helps V to decide whether w E -Z. We require that with high probability the verifier be correct when accepting or rejecting the membership of w in -Z. More precisely, for every constant c > 0, for sufficiently large w E -Z the probability (over all coin tosses) that V halts and accepts must be at least 1 Iwl c. If w e -Z then we require that no prover P* be able to convince V otherwise: that is, for every c > 0 and large enough w, and for any interactive protocol (P*, V), V rejects with probability at least 1 Iw Ic.

A perfect zero-knowledge proof system for a problem equivalent to the discrete logarithm

An interactive proof system is called perfect zero-knowledge if the probability distribution generated by any probabilistic polynomial-time verifier interacting with the prover on input theorem , c...

A uniform-complexity treatment of encryption and zero-knowledge

We provide a treatment of encryption and zero-knowledge in terms of uniform complexity measures. This treatment is appropriate for cryptographic settings modeled by probabilistic polynomial-time machines. Our uniform treatment allows the construction of secure encryption schemes and zero-knowledge proof systems (for allNP) using only uniform complexity assumptions.We show that uniform variants of the two definitions of security, presented in the pioneering work of Goldwasser and Micali, are in fact equivalent. Such a result was known before only for nonuniform formalization.Nonuniformity is implicit in all previous treatments of zero-knowledge in the sense that a zero-knowledge proof is required to “leak no knowledge” onall instances. For practical purposes, it suffices to require that it isinfeasible to find instances on which a zero-knowledge proof “leaks knowledge.” We show how to construct such zero-knowledge proof systems for every language inNP, using only a uniform complexity assumption. Properties of uniformly zero-knowledge proofs are investigated and their utility is demonstrated.

Proofs that yield nothing but their validity or all languages in NP have zero-knowledge proof systems

article Free Access Share on Proofs that yield nothing but their validity or all languages in NP have zero-knowledge proof systems Authors: Oded Goldreich Technion, Haifa, Israel Technion, Haifa, IsraelView Profile , Silvio Micali Massachusetts Institute of Technology, Cambridge Massachusetts Institute of Technology, CambridgeView Profile , Avi Wigderson Hebrew Univ., Jerusalem, Israel Hebrew Univ., Jerusalem, IsraelView Profile Authors Info & Claims Journal of the ACMVolume 38Issue 3July 1991 pp 690–728https://doi.org/10.1145/116825.116852Published:01 July 1991Publication History 808citation5,136DownloadsMetricsTotal Citations808Total Downloads5,136Last 12 Months700Last 6 weeks75 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

Secure multiparty protocols and zero-knowledge proof systems tolerating a faulty minority

A multiparty protocol to compute a function f(x 1, ..., x n ) operates as follows: each of n processors holds an input x i , and jointly they must compute and reveal f(x 1, ..., x n ) without revealing any additional information about the inputs. The processors are connected by secure communication lines but some number of processors may be corrupted by a resource-unbounded adversary that may attempt to interfere with the protocol or to gain extra information. Ben-Or, Goldwasser, Wigderson, Chaum, Crepeau, and Damgard have given protocols tolerating faults in t<n/3 processors. We improve the bound to t<n/2; as long as a majority remains uncorrupted, general and secure computations are achievable. To address and prove the security of our results, we introduce concise definitions for security and fault-tolerance. In particular, our notion of relative resilience--a means to compare the security and fault-tolerance of one protocol with that of another in a formal manner--provides a key tool for understanding and proving protocol security.

A discrete logarithm implementation of perfect zero-knowledge blobs

Brassard and Crépeau [BCr] introduced a simple technique for producing zero-knowledge proof systems based on blobs. As is to be expected, their implementation rests on an unproven cryptographic assumption, specifically, that it is easy to generate numbers that are difficult to factor. In this paper we present an implementation of blobs based on a different cryptographic assumption, specifically, that it is easy to generate primes p over which it is difficult to compute discrete logarithms. If, in addition, we can produce a generator for Z * p , this implementation then has the advantage that it leads to proof systems which are perfect zeroknowledge, rather than only almost perfect zero-knowledge.The relationship between factoring and finding discrete logarithms is not well understood, although Bach [Bac1] is an important contribution. Given our current state of number theoretic knowlege, there is no reason to prefer the cryptographic assumption required by one of these implementations over that required by the other. In any event, we introduce the notion of a product blob, whose favorable properties depend only on at least one of these assumptions holding.

The Knowledge Complexity of Interactive Proof Systems

Usually, a proof of a theorem contains more knowledge than the mere fact that the theorem is true. For instance, to prove that a graph is Hamiltonian it suffices to exhibit a Hamiltonian tour in it; however, this seems to contain more knowledge than the single bit Hamiltonian/non-Hamiltonian.In this paper a computational complexity theory of the “knowledge” contained in a proof is developed. Zero-knowledge proofs are defined as those proofs that convey no additional knowledge other than the correctness of the proposition in question. Examples of zero-knowledge proof systems are given for the languages of quadratic residuosity and 'quadratic nonresiduosity. These are the first examples of zero-knowledge proofs for languages not known to be efficiently recognizable.