13 Starting Idea β’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H π β π [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] π» -protocol π¦ β π π¦ β π V P P V key π for CIH π½ Prepare π½ πΎ πΎ = H π (π½) πΏ
13 Starting Idea β’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H π β π [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] π» -protocol π¦ β π π¦ β π V P P V key π for CIH π½ Prepare π½ πΎ πΎ = H π (π½) Compute πΏ πΏ
13 Starting Idea β’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H π β π [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] π» -protocol π¦ β π π¦ β π V P P V key π for CIH π½ Prepare π½ πΎ πΎ = H π (π½) Compute πΏ πΏ π½, πΏ
14 C orrelation I ntractable H ash (CIH) A CIH is a hash function H π β π : β π· , let π β 0,1 poly(π) , itβs hard to find an π¦ , such that H π (β ) π¦ β H π π¦ = π·(π¦) π·(β )
15 Idea for Security π» -protocol π¦ β π π¦ β π V P V P CIH key π π½ = Com π Prepare π½ πΎ πΎ = CIH π (π½) π½, πΏ πΏ
15 Idea for Security π» -protocol π¦ β π π¦ β π V P V P CIH key π π½ = Com π Prepare π½ πΎ πΎ = CIH π (π½) π½, πΏ πΏ β’ WI: follows from hiding property of the commitment
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β Contradicts CIH! β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β Contradicts CIH! β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β Contradicts CIH! β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender π β₯ Put in π β² -position
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender π β₯ Put in π β² -position
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender With Pr = 1/2 , π = π β² , extract π β π β₯ π β₯ Put in π β² -position
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender With Pr = 1/2 , π β π β² , hide π β π β₯ π β₯ Put in π β² -position
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π½ = Com π πΎ πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π½ = Com π πΎ πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P V P π½ = Com π Prepare π½ CIH key π πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Prepare π½ CIH key π πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π½ CIH key π πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π½ CIH key π OT 1 , πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 (when π β πβ² ) β’ Computational Soundness
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 (when π β πβ² ) β’ Computational Soundness
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 (when π β πβ² ) β’ Computational Soundness
18 Amplify the Security Receiver Sender
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions β¦ β¦ β₯ π β₯ π β² -th position
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions β¦ β¦ β₯ π β₯ π β² -th position
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions π -th position β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions With Pr = 1 β 2 βπ , π β π β² , hide π β β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions With Pr = 2 βπ , π = π β² , extract π β β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions With Pr = 2 βπ , π = π β² , extract π β β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯ β’ Can be abstracted as a 2-round statistical hiding extractable commitment [KKS18]
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom Statistical Zaps
Recommend
More recommend