Proofs of Restricted Shuffles Bjrn Terelius and Douglas Wikstrm KTH, - PowerPoint PPT Presentation

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Proofs of Restricted Shuffles Björn Terelius and Douglas Wikström KTH, Stockholm May 3, 2010 Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations A motivating example: Voting Consider a voting system where each voter submit an encrypted vote. Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations A motivating example: Voting Consider a voting system where each voter submit an encrypted vote. ◮ How can we ensure that the voters remain anonymous when the votes are decrypted? Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations A motivating example: Voting Consider a voting system where each voter submit an encrypted vote. ◮ How can we ensure that the voters remain anonymous when the votes are decrypted? ◮ There are two main ways to achieve this, homomorphic tallying [CGS97] and mixnets [Cha81]. Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Mixnets S 1 E ( m 1 ) m π (1) S 2 E ( m 2 ) m π (2) MN · · · . . . ) m π ( N ) m N ( E S N Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Mixnets (2) ◮ How can we implement a mixnet? Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Mixnets (2) ◮ How can we implement a mixnet? ◮ Chain of mixservers, each permutes and re-encrypts its list of inputs. L k − 1 L 0 L 1 L 2 L k · · · T 1 T 2 T k Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Proof of a shuffle ◮ How can we verify that a server really permutes and re-encrypts the votes? Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Proof of a shuffle ◮ How can we verify that a server really permutes and re-encrypts the votes? ◮ Let each server produce an interactive zero-knowledge proof, a proof of a shuffle [SK95, Nef01, FS01]. Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Proof of a shuffle ◮ How can we verify that a server really permutes and re-encrypts the votes? ◮ Let each server produce an interactive zero-knowledge proof, a proof of a shuffle [SK95, Nef01, FS01]. ◮ Like [FS01], we will construct a proof that a commitment contains a permutation matrix. Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Proof of a shuffle ◮ How can we verify that a server really permutes and re-encrypts the votes? ◮ Let each server produce an interactive zero-knowledge proof, a proof of a shuffle [SK95, Nef01, FS01]. ◮ Like [FS01], we will construct a proof that a commitment contains a permutation matrix. ◮ One can then prove that the encrypted votes are permuted accordingly. Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Test for permutation matrices M permutation matrix M not permutation matrix     0 1 0 0 1 0 M = 1 0 0 M = 2 0 − 1     0 0 1 0 0 1 Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Test for permutation matrices M permutation matrix M not permutation matrix     0 1 0 0 1 0 M = 1 0 0 M = 2 0 − 1     0 0 1 0 0 1     x 2 x 2 Mx = x 1 Mx = 2 x 1 − x 3     x 3 x 3 Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Test for permutation matrices M permutation matrix M not permutation matrix     0 1 0 0 1 0 M = 1 0 0 M = 2 0 − 1     0 0 1 0 0 1     x 2 x 2 Mx = x 1 Mx = 2 x 1 − x 3     x 3 x 3 � N � N i = 1 � m i , x � = x 2 x 1 x 3 i = 1 � m i , x � = x 2 ( 2 x 1 − x 3 ) x 3 = x 1 x 2 x 3 � = x 1 x 2 x 3 Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Test for permutation matrices Theorem (Permutation Matrix) Let M = ( m i , j ) be an N × N-matrix over Z q and x = ( x 1 , . . . , x N ) be a list of variables. Then M is a permutation matrix if and only if � N � N i = 1 � m i , x � = i = 1 x i and M 1 = 1 . Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Test for permutation matrices Theorem (Permutation Matrix) Let M = ( m i , j ) be an N × N-matrix over Z q and x = ( x 1 , . . . , x N ) be a list of variables. Then M is a permutation matrix if and only if � N � N i = 1 � m i , x � = i = 1 x i and M 1 = 1 . Lemma (Schwartz-Zippel) Let f ∈ Z q [ x 1 , . . . , x N ] be a non-zero polynomial of total degree d and let e 1 , . . . , e N be chosen randomly from Z q . Then Pr [ f ( e 1 , . . . , e N ) = 0 ] ≤ d q . Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Recall Pedersen commitments Let g , g 1 be randomly chosen generators in a group of prime order q . The Pedersen commitment of m ∈ Z q is C ( m , s ) = g s g m 1 where s is chosen randomly from Z q . Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Recall Pedersen commitments Let g , g 1 be randomly chosen generators in a group of prime order q . The Pedersen commitment of m ∈ Z q is C ( m , s ) = g s g m 1 where s is chosen randomly from Z q . ◮ perfectly hiding ◮ computationally binding ◮ homomorphic, C ( m , s ) C ( m ′ , s ′ ) = C ( m + m ′ , s + s ′ ) C ( m , s ) e = C ( em , es ) Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Generalized Pedersen commitments [FS01] Let g , g 1 , . . . , g N be randomly chosen generators in a group of prime order q . We commit to a vector m = ( m 1 , . . . , m N ) T by N � g m i C ( m , s ) = g s i i = 1 where s is chosen randomly from Z q . Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Generalized Pedersen commitments [FS01] Let g , g 1 , . . . , g N be randomly chosen generators in a group of prime order q . We commit to a vector m = ( m 1 , . . . , m N ) T by N � g m i C ( m , s ) = g s i i = 1 where s is chosen randomly from Z q . ◮ perfectly hiding ◮ computationally binding ◮ homomorphic, C ( m , s ) C ( m ′ , s ′ ) = C ( m + m ′ , s + s ′ ) C ( m , s ) e = C ( em , es ) Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Generalized Pedersen commitments We commit column-wise to an N × N -matrix M = ( m i , j ) , so a = C ( M , s ) is a list of N commitments satisfying C ( M , s ) e = C ( Me , � s , e � ) where we use the convention � N a e = i = 1 a e i . i Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations A review of sigma proofs A sigma proof is a three-message protocol such that 1. the view of the verifier can be simulated for any given challenge Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations A review of sigma proofs A sigma proof is a three-message protocol such that 1. the view of the verifier can be simulated for any given challenge 2. a witness can be computed from any pair of accepting transcripts with the same random tape and distinct challenges Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles

Introduction Proof of Knowledge of Permutation Matrix Restricted Permutations Example: Proof of knowledge of discrete logarithm P wants to prove knowledge of x such that y = g x 1. P chooses r at random and sends α = g r 2. V sends a random challenge c 3. P responds with d = cx + r V accepts the proof iff y c α = g d Björn Terelius and Douglas Wikström Proofs of Restricted Shuffles