An Efficient Pairing-Based Shuffle Argument

Fauzi, Prastudy; Lipmaa, Helger; Siim, Janno; Zając, Michał

doi:10.1007/978-3-319-70697-9_4

Cited by 25 publications

(27 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…) The proof is a direct consequence of the fact that scheme from Fig. 2 is an argument of knowledge in the generic group model, as proven by Fauzi et al [5,Theorem 2]. Indeed, if this is the case there exists an extractor which given A outputs a witness w * such that ( 0 v ) = ( M N ) w * .…”

Section: Soundness Of Lindmentioning

confidence: 77%

“…We give a less efficient scheme where both proof size and verification cost are approximately the double of the first construction, more concretely, the proof size is (6d + 3)G 1 + (2d + 3)G 2 group elements and the verification requires 8d + 9 pairings. For the first construction, we need to rely on the knowledge soundness of QA-NIZK arguments of membership in linear spaces, which has only been proven in the generic group model [5]. The second argument is fully based on falsifiable assumptions.…”

Section: Our Resultsmentioning

confidence: 99%

“…On the other hand, the "witness switching attack" is easy to rule out, as it requires the attacker to know two openings for C 1 , but this breaks the binding property of the first commitment. However, because the commitment is shrinking we do not know how to extract w to get a reduction to the binding property unless we use the knowledge soundness property of the QA-NIZK Argument as proven (in the generic group model) in [5].…”

Section: Our Techniquesmentioning

confidence: 99%

“…Their crs is circuit dependent but they made it universal using a crs for the universal circuit. 5 . The verifier's runtime is O((n + d)polylog(s)), and the communication complexity is O(d · polylog(s)), where s is the size of the circuit, and in most other parameters it is far from being efficient (crs size, prover complexity).…”

Section: Previous Workmentioning

confidence: 99%

“…For witness samplable distributions, we only know a proof in the generic group model. The proof is a trivial consequence of the knowledge soundness property of QA-NIZK arguments which has already been used in previous works [5]. It has a proof size of k group elements when instantiated for the k-Lin Assumption.…”

Section: Argument For Linear Languagesmentioning

confidence: 99%

See 4 more Smart Citations

Shorter Pairing-Based Arguments Under Standard Assumptions

González

Ràfols

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper constructs efficient non-interactive arguments for correct evaluation of arithmetic and boolean circuits with proof size O(d) group elements, where d is the multiplicative depth of the circuit, under falsifiable assumptions. This is achieved by combining techniques from SNARKs and QA-NIZK arguments of membership in linear spaces. The first construction is very efficient (the proof size is ≈ 4d group elements and the verification cost is ≈ 4d pairings and O(n + n + d) exponentiations, where n is the size of the input and n of the output) but one type of attack can only be ruled out assuming the knowledge soundness of QA-NIZK arguments of membership in linear spaces. We give an alternative construction which replaces this assumption with a decisional assumption in bilinear groups at the cost of approximately doubling the proof size. The construction for boolean circuits can be made zero-knowledge with Groth-Sahai proofs, resulting in a NIZK argument for circuit satisfiability based on falsifiable assumptions in bilinear groups of proof size O(n + d).Our main technical tool is what we call an "argument of knowledge transfer". Given a commitment C1 and an opening x, such an argument allows to prove that some other commitment C2 opens to f (x), for some function f , even if C2 is not extractable. We construct very short, constant-size, pairing-based arguments of knowledge transfer with constant-time verification for any linear function and also for Hadamard products. These allow to transfer the knowledge of the input to lower levels of the circuit.

show abstract

Section: Soundness Of Lindmentioning

confidence: 77%

Section: Our Resultsmentioning

confidence: 99%

Section: Our Techniquesmentioning

confidence: 99%

Section: Previous Workmentioning

confidence: 99%

Section: Argument For Linear Languagesmentioning

confidence: 99%

See 3 more Smart Citations

Shorter Pairing-Based Arguments Under Standard Assumptions

González

Ràfols

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Shorter Quadratic QA-NIZK Proofs

Daza

González

Pindado

et al. 2019

Public-Key Cryptography – PKC 2019

View full text Add to dashboard Cite

Despite recent advances in the area of pairing-friendly Non-Interactive Zero-Knowledge proofs, there have not been many efficiency improvements in constructing arguments of satisfiability of quadratic (and larger degree) equations since the publication of the Groth-Sahai proof system (JoC'12). In this work, we address the problem of aggregating such proofs using techniques derived from the interactive setting and recent constructions of SNARKs. For certain types of quadratic equations, this problem was investigated before by González et al. (ASI-ACRYPT'15). Compared to their result, we reduce the proof size by approximately 50% and the common reference string from quadratic to linear, at the price of using less standard computational assumptions. A theoretical motivation for our work is to investigate how efficient NIZK proofs based on falsifiable assumptions can be. On the practical side, quadratic equations appear naturally in several cryptographic schemes like shuffle and range arguments.

show abstract