statistical zaps and new
play

Statistical Zaps and New Oblivious Transfer Protocols Vipul Goyal - PowerPoint PPT Presentation

1 Statistical Zaps and New Oblivious Transfer Protocols Vipul Goyal Abhishek Jain Zhengzhong Jin Giulio Malavolta Carnegie Mellon University Carnegie Mellon Johns Hopkins Johns Hopkins University of California, University University


  1. 13 Starting Idea β€’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H 𝑙 β‹… 𝑙 [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] 𝚻 -protocol 𝑦 ∈ 𝑀 𝑦 ∈ 𝑀 V P P V key 𝑙 for CIH 𝛽 Prepare 𝛽 𝛾 𝛾 = H 𝑙 (𝛽) 𝛿

  2. 13 Starting Idea β€’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H 𝑙 β‹… 𝑙 [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] 𝚻 -protocol 𝑦 ∈ 𝑀 𝑦 ∈ 𝑀 V P P V key 𝑙 for CIH 𝛽 Prepare 𝛽 𝛾 𝛾 = H 𝑙 (𝛽) Compute 𝛿 𝛿

  3. 13 Starting Idea β€’ Compress a Ξ£ -protocol via a C orrelation I ntractable H ash (CIH) H 𝑙 β‹… 𝑙 [CGH98, KRR17, CCRR18, HL18, CCH+19, PS19] 𝚻 -protocol 𝑦 ∈ 𝑀 𝑦 ∈ 𝑀 V P P V key 𝑙 for CIH 𝛽 Prepare 𝛽 𝛾 𝛾 = H 𝑙 (𝛽) Compute 𝛿 𝛿 𝛽, 𝛿

  4. 14 C orrelation I ntractable H ash (CIH) A CIH is a hash function H 𝑙 β‹… 𝑙 : βˆ€ 𝐷 , let 𝑙 ← 0,1 poly(πœ‡) , it’s hard to find an 𝑦 , such that H 𝑙 (β‹…) 𝑦 β‹… H 𝑙 𝑦 = 𝐷(𝑦) 𝐷(β‹…)

  5. 15 Idea for Security 𝚻 -protocol 𝑦 ∈ 𝑀 𝑦 ∈ 𝑀 V P V P CIH key 𝑙 𝛽 = Com 𝑛 Prepare 𝛽 𝛾 𝛾 = CIH 𝑙 (𝛽) 𝛽, 𝛿 𝛿

  6. 15 Idea for Security 𝚻 -protocol 𝑦 ∈ 𝑀 𝑦 ∈ 𝑀 V P V P CIH key 𝑙 𝛽 = Com 𝑛 Prepare 𝛽 𝛾 𝛾 = CIH 𝑙 (𝛽) 𝛽, 𝛿 𝛿 β€’ WI: follows from hiding property of the commitment

  7. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  8. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  9. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  10. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor 𝛾 βˆ— = 𝐷(𝛽 βˆ— ) Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  11. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor 𝛾 βˆ— = 𝐷(𝛽 βˆ— ) Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  12. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor 𝛾 βˆ— = 𝐷(𝛽 βˆ— ) Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— Contradicts CIH! β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  13. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor 𝛾 βˆ— = 𝐷(𝛽 βˆ— ) Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— Contradicts CIH! β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  14. 15 Idea for Security 𝚻 -protocol 𝑦 βˆ‰ 𝑀 𝑦 βˆ‰ 𝑀 Cheating Cheating V V Prover 𝛽 βˆ— = Com 𝑛 βˆ— CIH key 𝑙 Prover 𝛾 βˆ— 𝛽 βˆ— , 𝛿 βˆ— 𝛿 βˆ— β€’ Soundness: Extract 𝑛 βˆ— from 𝛽 βˆ— using a trapdoor 𝛾 βˆ— = 𝐷(𝛽 βˆ— ) Given 𝑛 βˆ— , the (only) accepting 𝛾 βˆ— is efficiently computable Verifier accepts β‡’ 𝛾 βˆ— = CIH 𝑙 𝛽 βˆ— = 𝐷 𝛽 βˆ— Contradicts CIH! β€’ Hiding & Extractable commitments can be built in CRS model β‡’ Zaps in CRS model

  15. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer

  16. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P

  17. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P 𝑐 ← $ 0,1 Prepare 𝑛 , 𝑐 β€² ← $ 0,1

  18. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P 𝑐 ← $ 0,1 Prepare 𝑛 , 𝑐 β€² ← $ 0,1 Receiver (𝑐) Sender

  19. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P 𝑐 ← $ 0,1 Prepare 𝑛 , 𝑐 β€² ← $ 0,1 Receiver (𝑐) Sender

  20. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P 𝑐 ← $ 0,1 Prepare 𝑛 , 𝑐 β€² ← $ 0,1 Receiver (𝑐) Sender 𝑛 βŠ₯ Put in 𝑐 β€² -position

  21. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P 𝑐 ← $ 0,1 Prepare 𝑛 , 𝑐 β€² ← $ 0,1 Receiver (𝑐) Sender 𝑛 βŠ₯ Put in 𝑐 β€² -position

  22. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P 𝑐 ← $ 0,1 Prepare 𝑛 , 𝑐 β€² ← $ 0,1 Receiver (𝑐) Sender With Pr = 1/2 , 𝑐 = 𝑐 β€² , extract 𝑛 √ 𝑛 βŠ₯ 𝑛 βŠ₯ Put in 𝑐 β€² -position

  23. 16 Hiding & Extractability in Plain Model β€’ Use a 2-round statistical sender-private oblivious transfer V P 𝑐 ← $ 0,1 Prepare 𝑛 , 𝑐 β€² ← $ 0,1 Receiver (𝑐) Sender With Pr = 1/2 , 𝑐 β‰  𝑐 β€² , hide 𝑛 √ 𝑛 βŠ₯ 𝑛 βŠ₯ Put in 𝑐 β€² -position

  24. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝛽 = Com 𝑛 𝛾 𝛿

  25. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝛽 = Com 𝑛 𝛾 𝛿

  26. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P V P 𝛽 = Com 𝑛 Prepare 𝛽 CIH key 𝑙 𝛾 𝛾 = CIH 𝑙 (𝛽) 𝛿 Compute 𝛿 𝛽, 𝛿

  27. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Prepare 𝛽 CIH key 𝑙 𝛾 𝛾 = CIH 𝑙 (𝛽) 𝛿 Compute 𝛿 𝛽, 𝛿

  28. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝛽 CIH key 𝑙 𝛾 𝛾 = CIH 𝑙 (𝛽) 𝛿 Compute 𝛿 𝛽, 𝛿

  29. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝛽 CIH key 𝑙 OT 1 , 𝛾 𝛾 = CIH 𝑙 (𝛽) 𝛿 Compute 𝛿 𝛽, 𝛿

  30. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝑛 CIH key 𝑙 OT 1 , 𝛾 𝛾 = CIH 𝑙 (𝛽) 𝛿 Compute 𝛿 𝛽, 𝛿

  31. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝑛 CIH key 𝑙 OT 1 , 𝛾 Sender 𝛾 = CIH 𝑙 (𝛽) 𝛿 Compute 𝛿 𝛽, 𝛿

  32. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝑛 CIH key 𝑙 OT 1 , 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 𝛽, 𝛿

  33. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝑛 CIH key 𝑙 OT 1 , 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿

  34. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝑛 CIH key 𝑙 OT 1 , 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿 β€’ Statistical WI with err β‰ˆ 1/2 (when 𝑐 β‰  𝑐′ ) β€’ Computational Soundness

  35. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝑛 CIH key 𝑙 OT 1 , 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿 β€’ Statistical WI with err β‰ˆ 1/2 (when 𝑐 β‰  𝑐′ ) β€’ Computational Soundness

  36. 17 β€˜Weakly Secure’ Statistical Zaps 𝚻 -protocol V P 𝑐 ← $ 0,1 𝑐 β€² ← $ 0,1 V P 𝛽 = Com 𝑛 Receiver (𝑐) Prepare 𝑛 CIH key 𝑙 OT 1 , 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿 β€’ Statistical WI with err β‰ˆ 1/2 (when 𝑐 β‰  𝑐′ ) β€’ Computational Soundness

  37. 18 Amplify the Security Receiver Sender

  38. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š

  39. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š

  40. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š 2 π‘š -positions … … βŠ₯ 𝑛 βŠ₯ 𝒄 β€² -th position

  41. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š 2 π‘š -positions … … βŠ₯ 𝑛 βŠ₯ 𝒄 β€² -th position

  42. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š 2 π‘š -positions 𝒄 -th position … … βŠ₯ 𝑛 βŠ₯ 𝒄 β€² -th position … … βŠ₯ 𝑛 βŠ₯

  43. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š 2 π‘š -positions … … βŠ₯ 𝑛 βŠ₯ 𝒄 β€² -th position … … βŠ₯ 𝑛 βŠ₯

  44. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š 2 π‘š -positions With Pr = 1 βˆ’ 2 βˆ’π‘š , 𝒄 β‰  𝒄 β€² , hide 𝑛 √ … … βŠ₯ 𝑛 βŠ₯ 𝒄 β€² -th position … … βŠ₯ 𝑛 βŠ₯

  45. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š 2 π‘š -positions With Pr = 2 βˆ’π‘š , 𝒄 = 𝒄 β€² , extract 𝑛 √ … … βŠ₯ 𝑛 βŠ₯ 𝒄 β€² -th position … … βŠ₯ 𝑛 βŠ₯

  46. 18 Amplify the Security Receiver Sender 𝒄 β€² ← 0,1 π‘š 𝒄 ← 0,1 π‘š 2 π‘š -positions With Pr = 2 βˆ’π‘š , 𝒄 = 𝒄 β€² , extract 𝑛 √ … … βŠ₯ 𝑛 βŠ₯ 𝒄 β€² -th position … … βŠ₯ 𝑛 βŠ₯ β€’ Can be abstracted as a 2-round statistical hiding extractable commitment [KKS18]

  47. 19 πšπ›πͺ𝐭 𝚻 -protocol V P 𝒄 ← $ 0,1 π‘š 𝒄 β€² ← $ 0,1 π‘š V P 𝛽 = Com 𝑛 Receiver (𝒄) Prepare 𝑛 OT 1 , CIH key 𝑙 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿

  48. 19 πšπ›πͺ𝐭 𝚻 -protocol V P 𝒄 ← $ 0,1 π‘š 𝒄 β€² ← $ 0,1 π‘š V P 𝛽 = Com 𝑛 Receiver (𝒄) Prepare 𝑛 OT 1 , CIH key 𝑙 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿 β€’ Statistical WI with err β‰ˆ 1/2 π‘š (negligible) β€’ Computational Soundness via Complexity Leveraging β€’ Public Coin Property : OT 1 is pseudorandom

  49. 19 πšπ›πͺ𝐭 𝚻 -protocol V P 𝒄 ← $ 0,1 π‘š 𝒄 β€² ← $ 0,1 π‘š V P 𝛽 = Com 𝑛 Receiver (𝒄) Prepare 𝑛 OT 1 , CIH key 𝑙 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿 β€’ Statistical WI with err β‰ˆ 1/2 π‘š (negligible) β€’ Computational Soundness via Complexity Leveraging β€’ Public Coin Property : OT 1 is pseudorandom

  50. 19 πšπ›πͺ𝐭 𝚻 -protocol V P 𝒄 ← $ 0,1 π‘š 𝒄 β€² ← $ 0,1 π‘š V P 𝛽 = Com 𝑛 Receiver (𝒄) Prepare 𝑛 OT 1 , CIH key 𝑙 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿 β€’ Statistical WI with err β‰ˆ 1/2 π‘š (negligible) β€’ Computational Soundness via Complexity Leveraging β€’ Public Coin Property : OT 1 is pseudorandom

  51. 19 πšπ›πͺ𝐭 𝚻 -protocol V P 𝒄 ← $ 0,1 π‘š 𝒄 β€² ← $ 0,1 π‘š V P 𝛽 = Com 𝑛 Receiver (𝒄) Prepare 𝑛 OT 1 , CIH key 𝑙 𝛾 Sender 𝛾 = CIH 𝑙 (OT 2 ) 𝛿 Compute 𝛿 OT 2 , 𝛿 β€’ Statistical WI with err β‰ˆ 1/2 π‘š (negligible) β€’ Computational Soundness via Complexity Leveraging β€’ Public Coin Property : OT 1 is pseudorandom Statistical Zaps

Recommend


More recommend