An Efficient Parallel Repetition Theorem

Håstad, Johan; Pass, Rafael; Wikström, Douglas; Pietrzak, Krzysztof

doi:10.1007/978-3-642-11799-2_1

Cited by 35 publications

(52 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We remark that our approach shares similarities with previous works on the topic of soundness amplification under parallel repetitions, such as [BIN97] [PV07] [IJK07], and especially [HPPW08]; in particular, our use of Raz's lemma is similar to its use in [HPPW08]. However, whereas those works show how to transform a parallel prover with "small" success probability into a stand-alone prover with "high" success probability, we show how to transform a rewinding parallel prover into a (non-rewinding) stand-alone prover.…”

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bsupporting

confidence: 60%

“…Very informally, we establish that parallel repetition of public-coin protocols not only reduces the soundness error [PV07,HPPW08], but also qualitatively strengthen the soundness-the new protocols will be secure even under a "resetting" attack.…”

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bmentioning

confidence: 65%

“…T can thus no longer determine whether an external verifier accepts or rejects when doing test-runs, which is crucial for deciding which messages to forward externally. By relying on the "trust-halving" technique from [IW97,BIN97], and its refinement in [HPPW08], we show how T can make an "educated" guess which is sufficiently good.…”

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bmentioning

confidence: 99%

“…As an independent contribution, we believe that our techniques elucidates an intriguing (and useful) connection between lower bounds for black-box ZK, and feasibility results for soundness/hardness amplification. As mentioned, our core technical contribution shows that (appropriate) parallel-repetition of a public-coin protocol not only reduced the soundness error [PV07,HPPW08], but also yields a protocol that is sound even under a resetting attack [GK96b,CGGM00,BGGL01]. To establish our ZK lowerbound, we only consider a "weak" notion of "resettablesoundness" where the statement to be proved cannot be changed.…”

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bmentioning

confidence: 99%

“…We will use Raz's lemma [Raz98] in analogy with [IJK07,HPPW08] In other words, let {U j } j be independent random variables, and let W be an event over Π j U j . If W occurs with high probability and there are many U j , then on average over j, sampling U j conditioned on W does not differ much from simply sampling U j .…”

Section: Note That Inmentioning

confidence: 99%

See 4 more Smart Citations

On the Composition of Public-Coin Zero-Knowledge Protocols

Pass

Tseng

Wikström

2009

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. We show that only languages in BPP have public-coin, blackbox zero-knowledge protocols that are secure under an unbounded (polynomial) number of parallel repetitions. This result holds both in the plain model (without any set-up) and in the Bare Public-Key Model (where the prover and the verifier have registered public keys). We complement this result by showing the existence of a public-coin black-box zero-knowledge proof that remains secure under any a-priori bounded number of concurrent executions.

show abstract

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bsupporting

confidence: 60%

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bmentioning

confidence: 65%

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bmentioning

confidence: 99%

Section: Theorem (Informal) If L Has a Public-coin Argument In The Bmentioning

confidence: 99%

Section: Note That Inmentioning

confidence: 99%

See 3 more Smart Citations

On the Composition of Public-Coin Zero-Knowledge Protocols

Pass

Tseng

Wikström

2009

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

Simultaneous Amplification: The Case of Non-interactive Zero-Knowledge

Goyal¹,

Jain

Sahai

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Channels of Small Log-Ratio Leakage and Characterization of Two-Party Differentially Private Computation

Haitner

Mazor

Shaltiel

et al. 2019

Theory of Cryptography

View full text Add to dashboard Cite

Consider a ppt two-party protocol Π = (A, B) in which the parties get no private inputs and obtain outputs O A , O B ∈ {0, 1}, and let V A and V B denote the parties' individual views.The leakage of Π is the amount of information a party obtains about the event O A = O B ; that is, the leakage ǫ is the maximum, over P ∈ {A, B}, of the distance betweenTypically, this distance is measured in statistical distance, or, in the computational setting, in computational indistinguishability. For this choice, Wullschleger [TCC '09] showed that if ǫ ≪ α then the protocol can be transformed into an OT protocol.We consider measuring the protocol leakage by the log-ratio distance (which was popularized by its use in the differential privacy framework). The log-ratio distance between X, Y over domain Ω is the minimal ǫ ≥ 0 for which, for every v ∈ Ω, log Pr[X=v] PrIn the computational setting, we use computational indistinguishability from having log-ratio distance ǫ. We show that a protocol with (noticeable) accuracy α ∈ Ω(ǫ 2 ) can be transformed into an OT protocol (note that this allows ǫ ≫ α). We complete the picture, in this respect, showing that a protocol with α ∈ o(ǫ 2 ) does not necessarily imply OT. Our results hold for both the information theoretic and the computational settings, and can be viewed as a "fine grained" approach to "weak OT amplification".We then use the above result to fully characterize the complexity of differentially private twoparty computation for the XOR function, answering the open question put by Goyal, Khurana, Mironov, Pandey, and Sahai [ICALP '16] and Haitner, Nissim, Omri, Shaltiel, and Silbak [FOCS '18]. Specifically, we show that for any (noticeable) α ∈ Ω(ǫ 2 ), a two-party protocol that computes the XOR function with α-accuracy and ǫ-differential privacy can be transformed into an OT protocol. This improves upon Goyal et al. that only handle α ∈ Ω(ǫ), and upon Haitner et al. who showed that such a protocol implies (infinitely-often) key agreement (and not OT). Our characterization is tight since OT does not follow from protocols in which α ∈ o(ǫ 2 ), and extends to functions (over many bits) that "contain" an "embedded copy" of the XOR function.

show abstract

An Efficient Parallel Repetition Theorem

Cited by 35 publications

References 16 publications

On the Composition of Public-Coin Zero-Knowledge Protocols

On the Composition of Public-Coin Zero-Knowledge Protocols

Simultaneous Amplification: The Case of Non-interactive Zero-Knowledge

Channels of Small Log-Ratio Leakage and Characterization of Two-Party Differentially Private Computation

Contact Info

Product

Resources

About