Concurrent zero-knowledge

Dwork, Cynthia; Naor, Moni; Sahai, Amit

doi:10.1145/276698.276853

Cited by 335 publications

(390 citation statements)

References 27 publications

Supporting

Mentioning

388

Contrasting

Unclassified

Order By: Relevance

“…In the two decades since their introduction [2], zero-knowledge proofs have taken on a central role in the study of cryptographic protocols, both as a basic building block for more complex protocols and as a testbed for understanding important new issues such as composability (e.g., [3]) and concurrency (e.g., [4]). The "classic" constructions of zero-knowledge proofs came primarily in two flavors.…”

Section: Introductionmentioning

confidence: 99%

“…In recent years, a substantial effort has been devoted to understanding the security of cryptographic protocols when many executions are occurring concurrently (with adversarial scheduling). As usual, zeroknowledge proofs led the way in this effort, with early investigations of concurrency for relaxations of zero knowledge dating back to Feige's thesis [22], and the recent interest being sparked by the work of Dwork, Naor, and Sahai [4], which first defined the notion of concurrent zero knowledge. Research on concurrent zero knowledge has been very fruitful, with a sequence of works leading to essentially tight upper and lower bounds on round complexity for black-box simulation [23,24,25,26,27,28], and partly motivating the first non-blackbox-simulation zero-knowledge proof [29].…”

Section: Introductionmentioning

confidence: 99%

“…One of the main tools for constructing zero-knowledge proofs are commitment schemes, and indeed the only use of complexity assumptions in the construction of zero-knowledge proofs for all of NP [5] is to obtain a commitment scheme (used by the prover to commit to the NP witness, encoded as, e.g., a 3-coloring of a graph). Our results rely on a relaxed notion of commitment, called an instance-dependent commitment scheme, 4 which is implicit in [35] and formally defined in [36,34,19]. Roughly speaking, for a language L (or, more generally, a promise problem), a instance-dependent commitment scheme for L is a commitment protocol where the sender and receiver algorithms also depend on the instance x.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Concurrent Zero Knowledge Without Complexity Assumptions

Micciancio

Ong

Sahai

et al. 2006

Theory of Cryptography

Self Cite

View full text Add to dashboard Cite

Abstract. We provide unconditional constructions of concurrent statistical zero-knowledge proofs for a variety of non-trivial problems (not known to have probabilistic polynomial-time algorithms). The problems include Graph Isomorphism, Graph Nonisomorphism, Quadratic Residuosity, Quadratic Nonresiduosity, a restricted version of Statistical Difference, and approximate versions of the (coNP forms of the) Shortest Vector Problem and Closest Vector Problem in lattices.For some of the problems, such as Graph Isomorphism and Quadratic Residuosity, the proof systems have provers that can be implemented in polynomial time (given an NP witness) and haveÕ(log n) rounds, which is known to be essentially optimal for black-box simulation.To the best of our knowledge, these are the first constructions of concurrent zero-knowledge proofs in the plain, asynchronous model (i.e., without setup or timing assumptions) that do not require complexity assumptions (such as the existence of one-way functions).

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Concurrent Zero Knowledge Without Complexity Assumptions

Micciancio

Ong

Sahai

et al. 2006

Theory of Cryptography

Self Cite

View full text Add to dashboard Cite

show abstract

“…Zero-knowledge Protocols: Using moderately hard functions enables us to construct zero-knowledge protocols in various settings where either it is not known how to do it without timing considerations or even provably impossible. This includes concurrent zero-knowledge [26,37,43,15], Resettable Zero-Knowledge [14,25] and three-round zero-knowledge [32,25]. Furthermore Dwork and Stockmeyer [27] investigated the possibility of constructing nontrivial zero-knowledge interactive proofs under the assumption that the prover is computationally bounded during the execution of the protocol.…”

Section: Time-locksmentioning

confidence: 99%

Moderately Hard Functions: From Complexity to Spam Fighting

Naor

2003

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract.A key idea in cryptography is using hard functions in order to obtain secure schemes. The theory of hard functions (e.g. one-way functions) has been a great success story, and the community has developed a fairly strong understanding of what types of cryptographic primitives can be achieved under which assumption. We explore the idea of using moderately hard functions in order to achieve many tasks for which a perfect solution is impossible, for instance, denial-of-service. We survey some of the applications of such functions and in particular describe the properties moderately hard functions need for fighting unsolicited electronic mail. We suggest several research directions and (re)call for the development of a theory of such functions.

show abstract

“…The fact that on the Internet an adversary can control several players motivated the notion of concurrent zero knowledge [15] (cZK). Here the prover is simultaneously involved in several sessions and the scheduling of the messages is coordinated by the adversary who also keeps control of all verifiers.…”

Section: Introductionmentioning

confidence: 99%

Constant-Round Concurrent Zero Knowledge in the Bounded Player Model

Goyal

Jain

Ostrovsky

et al. 2013

Advances in Cryptology - ASIACRYPT 2013

View full text Add to dashboard Cite

Abstract. In [18] Goyal et al. introduced the bounded player model for secure computation. In the bounded player model, there are an a priori bounded number of players in the system, however, each player may execute any unbounded (polynomial) number of sessions. They showed that even though the model consists of a relatively mild relaxation of the standard model, it allows for round-efficient concurrent zero knowledge. Their protocol requires a super-constant number of rounds. In this work we show, constructively, that there exists a constant-round concurrent zero-knowledge argument in the bounded player model. Our result relies on a new technique where the simulator obtains a trapdoor corresponding to a player identity by putting together information obtained in multiple sessions. Our protocol is only based on the existence of a collision-resistance hash-function family and comes with a "straight-line" simulator. We note that this constitutes the strongest result known on constantround concurrent zero knowledge in the plain model (under well accepted relaxations) and subsumes Barak's constant-round bounded concurrent zero-knowledge result. We view this as a positive step towards getting constant round fully concurrent zero-knowledge in the plain model, without relaxations.

show abstract

Concurrent zero-knowledge

Cited by 335 publications

References 27 publications

Concurrent Zero Knowledge Without Complexity Assumptions

Concurrent Zero Knowledge Without Complexity Assumptions

Moderately Hard Functions: From Complexity to Spam Fighting

Constant-Round Concurrent Zero Knowledge in the Bounded Player Model

Contact Info

Product

Resources

About