Transcript Slides
Nir Bitansky and Omer Paneth The Result Assuming OT there exist a resettably-sound ZK protocol (Previous constructions of resettably-sound ZK relied on CRHF) Zero-Knowledge Proofs Zero Knowledge Soundness π₯ β β? π« π± Zero-Knowledge Proofs Soundness π₯ββ π«β π± Zero-Knowledge Proofs Zero Knowledge π₯ββ π« π±β Intuition: π± β βknowsβ how to generate a proof itself! π« π±β We can efficiently extract a proof from π± β The Simulator Accepting transcript: π±β Simulator The Simulator π±β π« β π±β Simulator Black-Box Simulator π±β Black Box Simulator Non-Black-Box Simulator π± β Non Black Box Simulator Black-Box vs. Non-Black-Box Can Non-Black-Box Simulation really achieve more than Black-Box Simulation? Black-Box vs. Non-Black-Box Constant-round public-coin ZK (for NP, with negligible soundness error) Not considering 3-round ZK from KEA [Hada-Tanaka 98, Bellare-Palacio 04] CRHF + PCP Argument Black Box Simulator [Goldreich-Krawczyk 90] Non Black Box Simulator [Barak 01] Black-Box vs. Non-Black-Box Black Box Simulator Non Black Box Simulator Constant-round public-coin ZK GK90,B01 Resettably-sound ZK BGGL01 Constant-round bounded-concurrent ZK and MPC B01,PR03 Constant-round ZK with strict polynomial-time simulation\knowledge extraction BL02 Simultaneously resettable ZK and MPC DGS09,GM11 Constant-round covert MPC GJ10 Constant-round public-coin parallel ZK PRT11 Simultaneously resettable WI proof of knowledge COSV12 Non-Black-Box Simulation BGGL01,B01,PR03,BL02,DGS9,GS09, GM11,GJ10,PRT11,COSV12β¦ Barak Barak 01 01 Non-Black-Box Simulation BGGL01,B01,PR03,BL02,DGS9,GS09, GM11,GJ10,PRT11,COSV12β¦ Barak 01 CRHF + PCP Barakβs ZK Protocol The FLS paradigm: [Feige-Lapidot-Shamir 99] Generation protocol for trapdoor π π« Witness indistinguishable proof that π₯ β β or π« βknowsβ π π± Barakβs ZK Protocol The FLS paradigm: [Feige-Lapidot-Shamir 99] A proof generated using a witness for π₯ β β and a proof generated using the trapdoor π are protocol indistinguishable Generation for trapdoor π π« Witness indistinguishable proof that π₯ β β or π« βknowsβ π π± Barakβs ZK Protocol Q: Can we have a trapdoor generation protocol where π± is public-coin? A: Not using black-box simulation. Barakβs ZK Protocol Q: Can we have a trapdoor generation protocol where π± is public-coin? A: (Barak 01) Yes! Trapdoor is the entire code of π± β Problem of βLongβ Trapdoor (Or: problem of βshortβ messages) π« Witness indistinguishable proof that π₯ β β or π« βknowsβ π = π± β π± β is an arbitrary polynomial π± Barakβs ZK Protocol Fixing the problem: 1. Use a Universal Argument β a succinct witness indistinguishable proof based on PCPs [kilian 92, Barak-Goldreich 08] 2. Use a collision-resistant hash function to give a shrinking commitment to trapdoor. Non-Black-Box Simulation BGGL01,B01,PR03,BL02,DGS9,GS09, GM11,GJ10,PRT11,COSV12β¦ Barak 01 CRHF + UA\PCP Are Barakβs techniques inherent in non-black-box simulation? No! Can its applications be achieved without collision-resistant hashing and universal arguments? Yes! Resettable Protocols π΄ π΅ Resettable Protocols π΄π΄ π΅ Resettable Protocols π΄ π΅ Resettable ZK [Canetti-Goldreich-Goldwasser-Micali 00] π₯ββ π« π±β Resettably-Sound ZK [Micali-Reyzin 01, Barak-Goldreich-Goldwasser-Lindell 01] π₯ββ π«β π± Resettably-Sound ZK [Barak-Goldreich-Goldwasser-Lindell01, Goldreich-Krawczyk 90] π« π± Black Box Simulator Resettably-Sound ZK Black Box Simulator π± π«β π± π±β Black Box Simulator Resettably-Sound ZK [Barak-Goldreich-Goldwasser-Lindell 01] π« π± Non Black Box Simulator Using CRHF and UA The Result Assuming only OT there exist a constant-round resettably-sound ZK protocol that does not make use of UA. The Technique A new non-black-box simulation technique from the Impossibility of Obfuscation Program Obfuscation πͺ is an obfuscation of a function family ππ : ππ π₯ π΄ π πͺ Ξ k ππ (π₯) β Ξ k π΄ Obfuscation and ZK If we can obfuscate π± β : π±β β πͺ(π± ) Non Black Box Simulator Black Box Simulator Resettably-Sound ZK Obfuscation and ZK Assuming OWFs, there exist a family of functions ππ that can not be obfuscated. [Barak-Goldreich-Impagliazzo-Rudich-Sahai-Vadhan-Yang 01] Resettably-Sound ZK βEasyβ Impossibility of obfuscation Obfuscation and ZK Assuming OWFs, there exist a family of functions ππ that can not be obfuscated. [Barak-Goldreich-Impagliazzo-Rudich-Sahai-Vadhan-Yang 01] Resettably-Sound ZK βHardβ Impossibility of obfuscation + OT Unobfuscatable functions ππ 1. βπ΄, π β π: 2. βπΈ, βπΆ β‘ ππ : π΄ πΆ πΈ π π The Protocol π = πΆππ(π) π¦=0 π π« π β ππ π Secure function evaluation of ππ (π¦) ππ (π¦) where π = πΆππ(π) Witness Indistinguishable proof that π₯ β β or π« βknowsβ π π π± Proof Idea - Resettable Soundness π = πΆππ(π) π¦ π«β π ππ (π¦) SFE of ππ (π¦) π β ππ π± ππ π«β π Proof Idea β Zero Knowledge Non Black Box Simulator π±β πΆ β‘ ππ πΈ π Proof Idea β Zero Knowledge πΆ β‘ ππ π = πΆππ(π) π¦ ππ (π¦) π SFE of ππ (π¦) π±β Non Black Box Simulator π±β πΆ β‘ ππ πΈ π Proof Idea β Zero Knowledge πΆ β‘ ππ π = πΆππ(π) π¦ β₯ β₯ SFE of ππ (π¦) π π¦ π πΆ π¦ = β₯ π±β π w.p. w.p. 1 β π Proof Idea β Zero Knowledge πΆ β‘ ππ πΆβ² β‘ ππ \ β₯ π¦ πΆβ² β‘ ππ \ β₯ π± β β₯ ππ (π¦) β¦ 1 π π±β πΆβ² β‘ ππ \ β₯ π±β β₯ ππ (π¦) Proof Idea β Zero Knowledge Non Black Box Simulator π = πΆππ(π) π¦=0 π ππ (π¦) π±β π π β ππ SFE of ππ (π¦) πΆ β‘ ππ πΈ π Witness Indistinguishable proof that π₯ β β or π« βknowsβ π π±β The SFE Protocol ππ π = πΆππ(π) π« β π¦ ππ (π¦) SFE of ππ (π¦) π π± π«β How Howto to instantiate instantiate this box? box? this π = πΆππ(π) π¦ ππ (π¦) SFE of ππ (π¦) π π±β πΆ β‘ ππ The SFE Protocol π¦ Semi-honest SFE of ππ (π¦) π ZK proof of knowledge π« ZK proof of knowledge ππ (π¦) π±π± The SFE Protocol π¦ Semi-honest SFE of ππ (π¦) π ZK proof of knowledge π« ZK proof of knowledge ππ (π¦) π± The SFE Protocol π¦ Semi-honest SFE of ππ (π¦) π Resettably-sound ZK POK Based on resettably-sound ZK [BGGL01,GS09] π« Resettable ZK POK ππ (π¦) π± The SFE Protocol ππ π = πΆππ(π) π« β π¦ ππ (π¦) SFE of ππ (π¦) π π± π«β π₯ββ π₯ββ π = πΆππ(π) π¦ ππ (π¦) SFE of ππ (π¦) π π±β πΆ β‘ ππ Instance-dependent SFE π₯ββ π₯ββ SFE π₯ of ππ (π¦) ZK POK Resettable POK Resettable ZK + Strongly unobfuscatable functions Instance-dependent SFE π« π±ππΌ π΅1 π π«ππΌ π± π΅3 π₯ββ POK π₯ββ Resettable ZK WI Instance-dependent SFE Com(π) π« π±ππΌ π΅1 π π«ππΌ π± π΅3 π₯ββ POK π₯ββ Resettable ZK Instance-dependent SFE Comπ₯ (π) π« π±ππΌ π΅1 π π«ππΌ π± π΅3 π₯ββ POK π₯ββ Resettable ZK Simulation Running Time Non Black Box Simulator π±β πΆ β‘ ππ πΈ π Simulation Running Time πΆ β‘ ππ πΆβ² β‘ ππ \ β₯ π¦ πΆβ² β‘ ππ \ β₯ π± β β₯ πΆβ² β‘ ππ \ β₯ π±β ππ (π¦) ππ (π¦) poly(π) πΆ = π β¦ 1 π π±β β₯ Proof Idea β Zero Knowledge Non Black Box Simulator π = πΆππ(π) π¦=0 π ππ (π¦) π±β π π β ππ SFE of ππ (π¦) πΆ β‘ ππ πΈ π Witness Indistinguishable proof that π₯ β β or π« βknowsβ π π±β Simulation Running Time Non Black Box Simulator π±β πΆ β‘ ππ πΈ π π w.p. |πΆ| π = poly(π) w.p. 1 β π πΌ π poly π =πβ + 1 β π β poly π = poly π π Simulation Running Time Non Black Box Simulator π±β πΈ πΆ β‘ ππ π πΈ(πΆ) = π( πΆ 2 ) πΌ π poly π =πβ π 2 1 + 1 β π β poly π > π Simulation Running Time π = πΆππ(π) π¦=0 π« π β ππ π ππ (π¦) SFE of ππ (π¦) Witness Indistinguishable proof that π₯ β β or π« βknowsβ π π± Simulation Running Time π = πΆππ(π) π¦=0 π ππ (π¦) π« π β ππ SFE of ππ (π¦) π¦=0 π ππ (π¦) SFE of ππ (π¦) Witness Indistinguishable proof that π₯ β β or π« βknowsβ π π± Simulation Running Time Non Black Box Simulator π±β πΈ πΆ β‘ ππ π poly π πΆ = π πΌ π poly π =πβ π 2 + 1 β π β poly π = poly π Comparison to [Barak 01] # rounds Assumptions Uses Trapdoor PCP\UA Length PublicCoin Barak 01 O(1) CRHF Yes Long Yes This work O(1) OT No Short No One More Application Simultaneously resettable ZK π₯ββ π«β π₯ββ π± π« π±β [BGGL 01]: Can a protocol be resettable ZK and resettably-sound simultaneously? Simultaneously resettable ZK π₯ββ π«β π₯ββ π± [Deng-Goyal-Sahai 09]: Yes! π« π±β Simultaneously resettable ZK Resettably-sound ZK Non-black-box simulation Long trapdoor Short trapdoor Black-box simulation Bounded concurrent ZK Concurrent ZK Resettable ZK Simultaneously resettable ZK Resettably-sound ZK Non-black-box simulation Short trapdoor Black-box simulation Concurrent ZK Resettable ZK Simultaneously resettable ZK π = πΆππ(π) π¦=0 ×π π« ππ (π¦) π β ππ π SFE of ππ (π¦) π± 12] [Cho-Ostrovsky-Scafuro-Visconti Simultaneously Resettable Witness Indistinguishable proof that π₯ β β or π« βknowsβ π ? ο