on round-optimal zero knowledge in the bare public key model
Post on 22-Feb-2016
29 Views
Preview:
DESCRIPTION
TRANSCRIPT
On Round-Optimal Zero Knowledge
in the Bare Public Key Model
Alessandra Scafuro and Ivan ViscontiUniversity of Salerno
ITALY
FOCUS: Round-Optimal (4 rounds) concurrent and resettable Zero Knowledge
in the Bare Public Key Modelhave already been achieved:
Round-optimal Concurrent ZK: (standard assumptions)
• [Z03] only sequential soundness, • [DV05] concurrent soundness, • [V06] efficiently,• [D09] minimal assumptions,• [YZ10] sophisticated notion of
argument of knowledge.
What do we do in this paper ?
Round-optimal Resettable ZK: (complexity leveraging)
• [MR01] only sequential soundness,
• [DPV04] concurrent soundness,• [YZ07] under generic
assumptions.
Our ContributionPoint-out a subtle issue in the zero knowledge proof of all round-
optimal (concurrent and resettable) protocols.
Protocol’s structure of almost all round-optimal protocols makes problematic the design of any simulator.
New round-optimal concurrent ZK with concurrent soundness and standard assumptions.
Exceptions: could admit alternative simulators:- Resettable ZK of [YZ07]: uses complexity leveraging.- Concurrent ZK of [Z03]: only sequential soundness.
Alternative proof?
• The same protocol admits efficient implementation.• Round-optimal resettable ZK (similar to [YZ07]), with a new proof.
Outline• Definitions
- Concurrent Zero Knowledge- Bare Public Key (BPK) Model - Concurrent Zero Knowledge and Soundness in the BPK model
• Round-optimal Concurrent Zero Knowledge: - the issue of all zero-knowledge simulators- the difficulty of designing any alternative simulator
• Our technique
Zero knowledge Interactive Proofs(standard model)
P Vx ∈ L(x,w) ∈ RL
Soundness: if the theorem is false any P* cannot convince V.
Completeness: if both P and V are honest, V accepts the proof.
Zero Knowledge: (intuition) any V* learns nothing but the fact that the theorem is true.
Zero Knowledge (stand-alone)
Sim
x ∈ L
V*rewind
Coins V*
OutputP V*x, witness
Coins V*
Output
Stand-alone : V* opens a single session
Black Box Sim: rewind V*
V* does not learn anything?
Concurrent Zero KnowledgeMore realistic setting: V* can open many sessions concurrently.
P V*Session 1
Session 2 V*Session 3 V*
V*Session 4
Upon seeing a new msg, V* adaptively plays new sessions
Constant-round concurrent black-box Zero Knowledge (cZK) in the standard model is
impossible [CKPR01].
Achieving black-box constant-round cZK requires setup assumptions.
Bare Public Key ModelIntroduced in STOC 2000 by Canetti, Goldreich, Goldwasser, MicaliAssumption: each verifier must be associated with a permanent public key,registered before any proof starts.
Registration Phase
Proof Phase
VID1 (SK1)
VIDi (SKi)
PKID1
PKIDi
register
register
Public file
• Non-interactive• Fully controlled by V*• No trusted party involved
• V* can still open an unbounded (poly) number of sessions.
• V* has full control of the schedule• Restriction: V* cannot play with
identity not in public file.
PPublic fileV*
IDiIDi ?
V*V*
IDi
IDkIDk?
Achieving constant-round concurrent ZK in the BPK model
Px ∈ L(x,w) ∈ RL
VID
SKIDPKID
1-πV
2-πV
3-πV
VID uses its secret SKID
in 3-πV. (extractable through rewinds)
• once SKID is extracted, all sessions
played with VID are run in straight-line
Concurrent Zero Knowledge Sim:
P convinces VID if1) it knows witness OR2) it knows SKID
1-πP
2-πP
3-πP
• gets SKID by rewinding πV
• runs πP in straight-line using SKID
• poly: number of extraction bounded by number of identities.
“is able to compute something computable only with knowledge of SKID “
Concurrent Soundness in the BPK model
P* VIDSKID
PKID 1-πV
2-πV
3-πV
1-πP2-πP
3-πP
Proving concurrent soundness: rule out MiM Attack
Concurrent executions
1-πV
2-πV3-πV
VIDSKID
MiM1-πP(SKID)
IDEA: if known, the secret SKID should be used already in the first msg 1-πP .
Concurrent Zero Knowledge Still preserved. Sim extracts the secret before having to play the first msg 1-πP .
P convinces VID if1) it knows witness OR2) it knows SKID
Concurrent Zero Knowledge and Soundness
P VIDSKID
(PKID, w)
1-πV
2-πV
3-πV
(SKID) 1-πP
2-πP
3-πP
Outline• Definitions
- Concurrent Zero Knowledge- Bare Public Key (BPK) Model - Concurrent Zero Knowledge and Soundness in the BPK model
• Round-optimal Concurrent Zero Knowledge: - the issue of all zero-knowledge simulators- the difficulty of designing any alternative simulator
• Our technique
Round-Optimal (4 rounds) Concurrent Zero Knowledge and Soundness
P VIDSKID
(PKID, w)
1-πV
2-πV
3-πV
(SKID) 1-πP
2-πP
3-πPSim has to play the msg dependent on SKID without knowing it yet.
The secret is used before VID completes its protocol.
Concurrent Simulator?
Concurrent Simulator in Literature
V*ID1-πV
2-πV
3-πV2-πP
Simulation in phasesSimWhen playing with an
“unresolved” identity:
1) Play a “bad” first message
“bad” 1-πP2) Extract the secret needed to solve the session.
3) Start simulation from scratch (a new phase) with knowledge of one more secret SKID.
Number of phases = number of identities (poly)
Our contribution: Such simulation approach leads to a
distinguishable distribution.
all (published) simulators follow this strategy.
A dummy attackP V* Schedule
Session 2
(SKID) 1-πP
1-πV
2-πV
2-πP3-πP
3-πV
1-πV
2-πV(SKID) 1-πP
Session 1
2-πP
3-πP
3-πV
A dummy attackP V*
Session 2
(SKID) 1-πP
1-πV
2-πV
2-πP3-πP
3-πV
1-πV
2-πV(SKID) 1-πP
Session 1
2-πP
3-πP
3-πV
V* aborts Session 1 with prob. 1/2V* aborts Session 2 with prob. 1/2(taken over the transcript seen so far)
V* Strategy
A dummy attackP V* V* Strategy
Session 2
(SKID) 1-πP
1-πV
2-πV
1-πV
2-πV(SKID) 1-πP
Session 1
V* aborts Session 1 with prob. 1/2V* aborts Session 2 with prob. 1/2(taken over the transcript seen so far)
Prob. Abort in Real Game
Pr [Abort S1] x Pr[Abort S2] = 1/2 x 1/2 = 1/4
A dummy attackSim V* V* Strategy
Session 2
(SKID) 1-πP
1-πV
2-πV
1-πV
2-πV(SKID) 1-πP
Session 1
V* aborts Session 1 with prob. 1/2V* aborts Session 2 with prob. 1/2(taken over the transcript seen so far)
Prob. Abort in Real Game
2-πP 3-πV
1) Extract secret to solve Session 1 Pr [Abort S1] x Pr[Abort S2] =
1/2 x 1/2 = 1/4
Prob. Abort SimulationCase 1.Pr [Abort S1] x Pr[Abort S2] = 1/2 x 1/2 = 1/4
Case 2.Pr[Abort S2] x Pr[NOT Abort S1]
A dummy attackSim V*
1-πV
Session 1
2-πV 1-πP
(SKID) 1-πP
1-πV
2-πV
Session 2
V* Strategy V* aborts Session 1 with prob. 1/2V* aborts Session 2 with prob. 1/2(taken over the transcript seen so far)
Prob. Abort in Real Game
Pr [Abort S1] x Pr[Abort S2] = 1/2 x 1/2 = 1/4
Prob. Abort SimulationCase 1.Pr [Abort S1] x Pr[Abort S2] = 1/2 x 1/2 = 1/4
Case 2.Pr[Abort S2] x Pr[NOT Abort S1]
2) Start the simulation from scratch with knowledge of secret.
x Pr[Case 1]
= 1/2 x 1/2 x 1/4 = 1/16
Sim outputs two aborts with probability at least Case 1 + Case 2 > Real Game
transcript changes
• Trivially, there exists a simulator for the dummy V* seen so far.
Alternative Simulation Strategies?
Simulation in phases yields a distinguishable output.
• what about more sophisticated V* that aborts with different probability in different sessions….?
The problem: the protocol’s structure of round-optimal protocols
(SKID) 1-πP
1-πV
2-πV
2-πP3-πP
3-πV
P VID“bad” first msg
“good” first msg
• In order to “solve” a session (played with a new identity) Sim has to change the view of the verifier (first play a bad msg, then a good msg)
• changing the view of V* skews the output distribution.
RemarkProtocols that do not follow this structure could admit alternative strategies: • resZK [YZ07] complexity
leveraging.• cZK [Z03]: only sequential
soundness.
designing a successful simulation strategyseems problematic.
Outline• Definitions
- Concurrent Zero Knowledge- Bare Public Key (BPK) Model - Concurrent Zero Knowledge and Soundness in the BPK model
• Round-optimal Concurrent Zero Knowledge: - the issue of all zero-knowledge simulators- the difficulty of designing any alternative simulator
• Our technique
Our round-optimal concurrent ZK P VID
(PKID, w)
1-πV
2-πV
3-πV
(SKID) 1-πP
2-πP
3-πP
“permanent secret SKID”SKID
PKtemp
PKtemp ( )
- witness OR- permanent secret SKID OR
- temporary secret key SKtemp
is accepting ifP knows either:
KEY IDEA. Temporary secret key Sktemp is used only in the last msg 3-πP.
(only after the extraction)
1-πtemp
2-πtemp
3-πtemp
Make SKtemp
extractable through rewinds
(used only in the third round)
(used already in the first round)
pick (PKtemp , SKtemp ) randomly
(SKID)1-πP
The simulatorP
1-πV
2-πV
3-πV
(sec)1-πP
2-πP
3-πP
PKtemp
)PKtemp (
1-πtemp
2-πtemp
3-πtemp
VID
“permanent secret SKID”SKID
Two-mode simulation (allows to keep the main thread unchanged)
• to solve a session initiated by an unknown identity Sim extracts both permanent SKID and temporary key SKtemp, and computes the last msg using Sktemp .
• to solve a session initiated by a known identity Sim runs in straight-line computing 3-πP using the permanent secret SKID.
• the view of V* in the two modes must be statistically indistinguishable.
(SKID)1-πP
Concurrent soundness?P*
1-πV
2-πV
3-πV
((SKID)1-πP
2-πP
3-πP
PKtemp
)PKtemp (
1-πtemp
2-πtemp
3-πtemp
VID
SKID
Proof by witness extraction
- witness OR
- permanent secret SKID OR
- temporary secret key SKtemp
(used only in the third round)
to prove concurrent soundness secret must be used already in the first msg.
key point: the temporary keys used in concurrent sessions are independent.
Concurrent executions?
1-πtemp
2-πtemp
3-πtemp
PK’temp
VID
(SKID)1-πP
Actual implementationP
Σ1
Σ2
Σ3Σ2
Σ3
pk0,pk1
TC= TCom(pk0,pk1, Σ1)
Σ1
Σ2
Σ3
VID
PKID = f(x0), f(x1)SKID = x0,x1
C= com(xb)Pktemp = pk0,pk1, Sktemp = trap0, trap1.
• πV πtemp πP are implemented with Sigma Protocols.
• TCom is a two-round trapdoor commitment scheme.
• f is a OWP.
, open TCom as Σ1- Σ1 is the valid opening of TC AND(Σ1, Σ2, Σ3) is accepting.
• C is the commitment of xb OR• P knows the witness
(Σ1, Σ2, Σ3) is accepting iff:VID accepts if:
thanks
top related