Concise Mercurial Vector Commitments and Independent Zero-Knowledge Sets with Short Proofs

Abstract

Abstract. Introduced by Micali, Rabin and Kilian (MRK), the basic primitive of zero-knowledge sets (ZKS) allows a prover to commit to a secret set S so as to be able to prove statements such as x ∈ S or x ∈ S. Chase et al. showed that ZKS protocols are underlain by a cryptographic primitive termed mercurial commitment. A (trapdoor) mercurial commitment has two commitment procedures. At committing time, the committer can choose not to commit to a specific message and rather generate a dummy value which it will be able to softly open to any message without being able to completely open it. Hard commitments, on the other hand, can be hardly or softly opened to only one specific message. At Eurocrypt 2008, Catalano, Fiore and Messina (CFM) introduced an extension called trapdoor q-mercurial commitment (qTMC), which allows committing to a vector of q messages. These qTMC schemes are interesting since their openings w.r.t. specific vector positions can be short (ideally, the opening length should not depend on q), which provides zero-knowledge sets with much shorter proofs when such a commitment is combined with a Merkle tree of arity q. The CFM construction notably features short proofs of non-membership as it makes use of a qTMC scheme with short soft openings. A problem left open is that hard openings still have size O(q), which prevents proofs of membership from being as compact as those of non-membership. In this paper, we solve this open problem and describe a new qTMC scheme where hard and short position-wise openings, both, have constant size. We then show how our scheme is amenable to constructing independent zero-knowledge sets (i.e., ZKS's that prevent adversaries from correlating their set to the sets of honest provers, as defined by Gennaro and Micali). Our solution retains the short proof property for this important primitive as well.

Batch Proofs of Partial Knowledge

“…We propose and formally define a new type of cryptographic commitments called all-but-k commitments. Our new commitments have similarities with mercurial vector commitments [16], with the key conceptual difference being that the revelation protocol for all-but-k commitments explicitly reveals an upper bound on the number of soft-committed values in the opening. We provide a concrete construction of all-but-k commitments that is based on Kate et al's PolyCommit DL polynomial commitment scheme [13].…”

“…This paper proposes a new batch proof protocol that generalizes the aforementioned protocols by Peng et al [20] and by Peng and Bao [18]. Our protocol uses a new type of commitment with similarities to mercurial vector commitments [16]. Briefly, a mercurial commitment is a special type of commitment with a modified binding property.…”

Efficient Verifiable Range and Closest Point Queries in Zero-Knowledge

“…Zero knowledge sets [10,12,28,30] and zero knowledge lists [19] provide both privacy and integrity of the respective datasets in the following model. A malicious prover commits to a database and a malicious verifier queries it; the prover may try to give answers inconsistent with the committed database, while the verifier may try to learn information beyond query answers.…”

Primary-Secondary-Resolver Membership Proof Systems

“…Later, Libert and Yung [52] introduced a new construction for q-TMCs, based on the q-Diffie Hellman exponent assumption, and managed to shorten the memberships proofs by a constant factor as well. All those ZKS constructions have the same basic structure: a tree (either binary as in [54,25] or with arity q as in [24,52]), where the leaves represent the elements in the universe and a proof of membership or non-membership is a path of commitments from the root to the leaf. All four ZKS constructions use proofs made up of O(log |U |) group elements and require O(log |U |) modular exponentiations for verification.…”