Statistical Zaps and New Oblivious Transfer Protocols Vipul Goyal - PowerPoint PPT Presentation
1 Statistical Zaps and New Oblivious Transfer Protocols Vipul Goyal Abhishek Jain Zhengzhong Jin Giulio Malavolta Carnegie Mellon University Carnegie Mellon Johns Hopkins Johns Hopkins University of California, University University
13 Starting Idea β’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H π β π [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] π» -protocol π¦ β π π¦ β π V P P V key π for CIH π½ Prepare π½ πΎ πΎ = H π (π½) πΏ
13 Starting Idea β’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H π β π [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] π» -protocol π¦ β π π¦ β π V P P V key π for CIH π½ Prepare π½ πΎ πΎ = H π (π½) Compute πΏ πΏ
13 Starting Idea β’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H π β π [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] π» -protocol π¦ β π π¦ β π V P P V key π for CIH π½ Prepare π½ πΎ πΎ = H π (π½) Compute πΏ πΏ π½, πΏ
14 C orrelation I ntractable H ash (CIH) A CIH is a hash function H π β π : β π· , let π β 0,1 poly(π) , itβs hard to find an π¦ , such that H π (β ) π¦ β H π π¦ = π·(π¦) π·(β )
15 Idea for Security π» -protocol π¦ β π π¦ β π V P V P CIH key π π½ = Com π Prepare π½ πΎ πΎ = CIH π (π½) π½, πΏ πΏ
15 Idea for Security π» -protocol π¦ β π π¦ β π V P V P CIH key π π½ = Com π Prepare π½ πΎ πΎ = CIH π (π½) π½, πΏ πΏ β’ WI: follows from hiding property of the commitment
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β Contradicts CIH! β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β Contradicts CIH! β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
15 Idea for Security π» -protocol π¦ β π π¦ β π Cheating Cheating V V Prover π½ β = Com π β CIH key π Prover πΎ β π½ β , πΏ β πΏ β β’ Soundness: Extract π β from π½ β using a trapdoor πΎ β = π·(π½ β ) Given π β , the (only) accepting πΎ β is efficiently computable Verifier accepts β πΎ β = CIH π π½ β = π· π½ β Contradicts CIH! β’ Hiding & Extractable commitments can be built in CRS model β Zaps in CRS model
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender π β₯ Put in π β² -position
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender π β₯ Put in π β² -position
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender With Pr = 1/2 , π = π β² , extract π β π β₯ π β₯ Put in π β² -position
16 Hiding & Extractability in Plain Model β’ Use a 2-round statistical sender-private oblivious transfer V P π β $ 0,1 Prepare π , π β² β $ 0,1 Receiver (π) Sender With Pr = 1/2 , π β π β² , hide π β π β₯ π β₯ Put in π β² -position
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π½ = Com π πΎ πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π½ = Com π πΎ πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P V P π½ = Com π Prepare π½ CIH key π πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Prepare π½ CIH key π πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π½ CIH key π πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π½ CIH key π OT 1 , πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (π½) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ π½, πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 (when π β πβ² ) β’ Computational Soundness
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 (when π β πβ² ) β’ Computational Soundness
17 βWeakly Secureβ Statistical Zaps π» -protocol V P π β $ 0,1 π β² β $ 0,1 V P π½ = Com π Receiver (π) Prepare π CIH key π OT 1 , πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 (when π β πβ² ) β’ Computational Soundness
18 Amplify the Security Receiver Sender
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions β¦ β¦ β₯ π β₯ π β² -th position
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions β¦ β¦ β₯ π β₯ π β² -th position
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions π -th position β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions With Pr = 1 β 2 βπ , π β π β² , hide π β β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions With Pr = 2 βπ , π = π β² , extract π β β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯
18 Amplify the Security Receiver Sender π β² β 0,1 π π β 0,1 π 2 π -positions With Pr = 2 βπ , π = π β² , extract π β β¦ β¦ β₯ π β₯ π β² -th position β¦ β¦ β₯ π β₯ β’ Can be abstracted as a 2-round statistical hiding extractable commitment [KKS18]
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom
19 πππͺπ π» -protocol V P π β $ 0,1 π π β² β $ 0,1 π V P π½ = Com π Receiver (π) Prepare π OT 1 , CIH key π πΎ Sender πΎ = CIH π (OT 2 ) πΏ Compute πΏ OT 2 , πΏ β’ Statistical WI with err β 1/2 π (negligible) β’ Computational Soundness via Complexity Leveraging β’ Public Coin Property : OT 1 is pseudorandom Statistical Zaps
Recommend
More recommend
Explore More Topics
Stay informed with curated content and fresh updates.