Characterizing Deterministic- Prover Zero Knowledge Nir Bitansky - PowerPoint PPT Presentation

Characterizing Deterministic- Prover Zero Knowledge Nir Bitansky Arka Rai Choudhuri Tel Aviv University Johns Hopkins University

Zero Knowledge [Goldwasser-Micali- Rackoff’85] $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier (𝑦)

Zero Knowledge [Goldwasser-Micali- Rackoff’85] $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier (𝑦) Completeness: ∀𝑦 ∈ ℒ , verifier accepts. (Computational) Soundness Zero Knowledge

Zero Knowledge [Goldwasser-Micali- Rackoff’85] $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier (𝑦) Completeness (Computational) Soundness: ∀𝑦 ∉ ℒ , no PPT prover can make the verifier accept. Zero Knowledge

Zero Knowledge [Goldwasser-Micali- Rackoff’85] $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier (𝑦) Completeness (Computational) Soundness Zero Knowledge: ∀ Verifiers ∃ Simulator

Zero Knowledge [Goldwasser-Micali- Rackoff’85] $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier (𝑦) Completeness (Computational) Soundness Zero Knowledge: ∀ Verifiers ∃ Simulator $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier’s view in an execution with the prover

Zero Knowledge [Goldwasser-Micali- Rackoff’85] $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier (𝑦) Completeness (Computational) Soundness Zero Knowledge: ∀ Verifiers ∃ Simulator $ $ $ $ $ $ Verifier’s view in an execution with the prover

Zero Knowledge [Goldwasser-Micali- Rackoff’85] $ $ $ $ $ $ Prover (𝑦, 𝑥) Verifier (𝑦) Completeness (Computational) Soundness Zero Knowledge: ∀ Verifiers ∃ Simulator $ $ $ $ $ $ $ $ $ $ $ $ ≈ Verifier’s view in an execution with the prover Simulator’s output on input 𝑦

Many Flavors of Zero-Knowledge (ZK) ∀ Verifier ∃ Simulator ≈ View (𝑦) GMR ZK

Many Flavors of Zero-Knowledge (ZK) ∀ Verifier ∀ Verifier ∃ Simulator ∃ Simulator ∀ aux-IP 𝑨 ∈ 0,1 ∗ ≈ ≈ View View (𝑦, 𝑨) (𝑦) GMR ZK Auxiliary-input ZK

Many Flavors of Zero-Knowledge (ZK) ∀ Verifier ∀ Verifier ∃ Simulator ∃ Simulator ∃ Simulator ∀ Verifier ∀ aux-IP 𝑨 ∈ 0,1 ∗ ≈ ≈ ≈ View View View (𝑦, 𝑨) (𝑦) (𝑦) GMR ZK Auxiliary-input ZK Black-box ZK

Deterministic Prover Zero Knowledge (DPZK) Deterministic Prover (𝑦, 𝑥) Verifier (𝑦)

Deterministic Prover Zero Knowledge (DPZK) Deterministic Prover (𝑦, 𝑥) Verifier (𝑦) Is prover randomness essential for zero knowledge?

Limitations of DPZK [Golreich- Oren’94] ∀ Verifier ∀ Verifier ∃ Simulator ∃ Simulator ∃ Simulator ∀ Verifier ∀ aux-IP 𝑨 ∈ 0,1 ∗ ≈ ≈ ≈ View View View (𝑦, 𝑨) (𝑦) (𝑦) GMR ZK Auxiliary-input ZK Black-box ZK

Limitations of DPZK [Golreich- Oren’94] ∀ Verifier ∀ Verifier ∃ Simulator ∃ Simulator ∃ Simulator ∀ Verifier ∀ aux-IP 𝑨 ∈ 0,1 ∗ ≈ ≈ ≈ View View View (𝑦, 𝑨) (𝑦) (𝑦) GMR ZK Auxiliary-input ZK Black-box ZK Impossible for non-trivial languages.

Prior Work [Faonio-Nielsen- Venturi’17] Witness encryption for ℒ ⟹ Honest-verifier DPZK for ℒ Hash proof system for ℒ ⟹ Honest-verifier DPZK proofs for ℒ [Dahari- Lindell’20] Doubly enhanced injective OWFs ⟹ Honest-verifier DPZK proofs for NP Inefficient honest prover. Malicious-verifier DPZK for languages that have an entropy guarantee from witnesses.

Prior Work [Faonio-Nielsen- Venturi’17] Witness encryption for ℒ ⟹ Honest-verifier DPZK for ℒ Hash proof system for ℒ ⟹ Honest-verifier DPZK proofs for ℒ [Dahari- Lindell’20] Doubly enhanced injective OWFs ⟹ Honest-verifier DPZK proofs for NP Inefficient honest prover. Malicious-verifier DPZK for languages that have an entropy guarantee from witnesses.

Our Results ∀ Verifier ∀ Verifier ∃ Simulator ∃ Simulator ∃ Simulator ∀ Verifier ∀ aux-IP 𝑨 ∈ 0,1 ∗ ≈ ≈ ≈ View View View (𝑦, 𝑨) (𝑦) (𝑦) GMR ZK Auxiliary-input ZK Black-box ZK Impossible for non-trivial languages.

Our Results ∀ Verifier ∀ Verifier ∀ Verifier ∃ Simulator ∃ Simulator ∃ Simulator ∃ Simulator ∀ Verifier ∀ aux-IP 𝑨 ∈ 0,1 𝑐 ∀ aux-IP 𝑨 ∈ 0,1 ∗ ≈ ≈ ≈ ≈ View View View (𝑦, 𝑨) (𝑦, 𝑨) View (𝑦) (𝑦) GMR ZK 𝑐 -Bounded auxiliary-input ZK Auxiliary-input ZK Black-box ZK Impossible for non-trivial languages.

Our Results ∀ Verifier ∀ Verifier ∀ Verifier ∃ Simulator ∃ Simulator ∃ Simulator ∃ Simulator ∀ Verifier ∀ aux-IP 𝑨 ∈ 0,1 𝑐 ∀ aux-IP 𝑨 ∈ 0,1 ∗ ≈ ≈ ≈ ≈ View View View (𝑦, 𝑨) (𝑦, 𝑨) View (𝑦) (𝑦) GMR ZK 𝑐 -Bounded auxiliary-input ZK Auxiliary-input ZK Black-box ZK Impossible for non-trivial languages.

Our Results Assuming NIWIs + sub-exponentially secure iO + OWF, there exist two message DPZK arguments for NP ∩ coNP against bounded auxiliary-input verifiers. Also assuming sub-exponentially secure keyless CRHF, there exist two message DPZK arguments for all of NP against bounded auxiliary-input verifiers.

Our Results Assuming NIWIs + sub-exponentially secure iO + OWF, there exist two message DPZK arguments for NP ∩ coNP against bounded auxiliary-input verifiers. Also assuming sub-exponentially secure keyless CRHF, there exist two message DPZK arguments for all of NP against bounded auxiliary-input verifiers. Any DPZK argument for a language ℒ implies a witness encryption for ℒ .

Two Message DPZK Arguments

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17]

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Witness Encryption for ℒ Deterministic Decryption 𝑦 𝑥 WE.Enc WE.Dec 𝑛/⊥ ct 𝑦,𝑛 𝑛 ct 𝑦,𝑛

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Witness Encryption for ℒ Deterministic Decryption 𝑦 𝑥 WE.Enc WE.Dec 𝑛/⊥ ct 𝑦,𝑛 𝑛 ct 𝑦,𝑛 For 𝑦, 𝑥 ∈ Rel ℒ 𝑥 WE.Dec 𝑛 ct 𝑦,𝑛 Correctness

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Witness Encryption for ℒ Deterministic Decryption 𝑦 𝑥 WE.Enc WE.Dec 𝑛/⊥ ct 𝑦,𝑛 𝑛 ct 𝑦,𝑛 For 𝑦, 𝑥 ∈ Rel ℒ For 𝑦 ∉ ℒ 𝑥 ≈ WE.Dec 𝑛 ct 𝑦,0 ct 𝑦,1 ct 𝑦,𝑛 Correctness Security

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17]

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Deterministic Prover (𝑦, 𝑥) Verifier (𝑦) 𝑣 ⟵ 0,1 𝑜 ct 𝑦,𝑣 ⟵ WE.Enc 𝑦 (𝑣) ct 𝑦,𝑣

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Deterministic Prover (𝑦, 𝑥) Verifier (𝑦) 𝑣 ⟵ 0,1 𝑜 ct 𝑦,𝑣 ⟵ WE.Enc 𝑦 (𝑣) ct 𝑦,𝑣 𝑣 ≔ WE.Dec (ct 𝑦,𝑣 , 𝑥) ෤ 𝑣 ෤ Output 1 iff 𝑣 = ෤ 𝑣

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Deterministic Prover (𝑦, 𝑥) Verifier (𝑦) 𝑣 ⟵ 0,1 𝑜 ct 𝑦,𝑣 ⟵ WE.Enc 𝑦 (𝑣) ct 𝑦,𝑣 𝑣 ≔ WE.Dec (ct 𝑦,𝑣 , 𝑥) ෤ 𝑣 ෤ Output 1 iff 𝑣 = ෤ 𝑣 Completeness: From correctness of WE.

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Cheating Prover (𝑦) Verifier (𝑦) 𝑣 ⟵ 0,1 𝑜 ct 𝑦,𝑣 ⟵ WE.Enc 𝑦 (𝑣) ct 𝑦,𝑣 𝑣 ෤ Output 1 iff 𝑣 = ෤ 𝑣 Completeness Soundness: From WE security when 𝑦 ∉ ℒ

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Cheating Prover (𝑦) Verifier (𝑦) 𝑣 ⟵ 0,1 𝑜 ct 𝑦,𝑣 ⟵ WE.Enc 𝑦 (𝑣) ct 𝑦,0 ? Output 1 iff 𝑣 = ෤ 𝑣 Completeness Soundness: From WE security when 𝑦 ∉ ℒ

Honest Verifier DPZK [Faonio-Nielsen- Venturi’17] Simulator (𝑦) Verifier (𝑦) 𝑣 ⟵ 0,1 𝑜 ct 𝑦,𝑣 ⟵ WE.Enc 𝑦 (𝑣) ct 𝑦,𝑣 𝑣 ෤ Output 1 iff 𝑣 = ෤ 𝑣 Completeness Soundness Honest Verifier Zero Knowledge: Simulator knows 𝑣

Explainable Verifier DPZK There exist honest verifier coins that explains verifier messages as honest messages. Explainable Verifier Unlike related notion of semi-malicious adversaries, these coins may be hard to find.

Explainable Verifier DPZK There exist honest verifier coins that explains verifier messages as honest messages. Explainable Verifier Unlike related notion of semi-malicious adversaries, these coins may be hard to find. Simulator no longer “knows’’ the message that an explainable verifier encrypts via the Witness Encryption. Aux-I/P DPZK for explainable verifiers also ruled out by [Goldreich- Oren’94]

Explainable Verifier DPZK There exist honest verifier coins that explains verifier messages as honest messages. Explainable Verifier Unlike related notion of semi-malicious adversaries, these coins may be hard to find. Simulator no longer “knows’’ the message that an explainable verifier encrypts via the Witness Encryption. Aux-I/P DPZK for explainable verifiers also ruled out by [Goldreich- Oren’94] Idea: Use additional trapdoor statement that only the simulator can use.

Explainable Verifier DPZK size ≤ 𝑐 includes auxiliary input Deterministic Prover (𝑦, 𝑥) Verifier (𝑦) 𝑣 ⟵ 0,1 𝑜 ct 𝑦,𝑣 ⟵ WE.Enc 𝑦 (𝑣) ෥ ct 𝑦,𝑣 ct 𝑆,𝑣 𝑆 𝑣 ≔ WE.Dec (ct 𝑦,𝑣 , 𝑥) ෤ 𝑣 ෤ Output 1 iff 𝑣 = ෤ 𝑣