Constant-Round Concurrent Zero Knowledge in the Bounded Player Model

Abstract

Abstract. In [18] Goyal et al. introduced the bounded player model for secure computation. In the bounded player model, there are an a priori bounded number of players in the system, however, each player may execute any unbounded (polynomial) number of sessions. They showed that even though the model consists of a relatively mild relaxation of the standard model, it allows for round-efficient concurrent zero knowledge. Their protocol requires a super-constant number of rounds. In this work we show, constructively, that there exists a constant-round concurrent zero-knowledge argument in the bounded player model. Our result relies on a new technique where the simulator obtains a trapdoor corresponding to a player identity by putting together information obtained in multiple sessions. Our protocol is only based on the existence of a collision-resistance hash-function family and comes with a "straight-line" simulator. We note that this constitutes the strongest result known on constantround concurrent zero knowledge in the plain model (under well accepted relaxations) and subsumes Barak's constant-round bounded concurrent zero-knowledge result. We view this as a positive step towards getting constant round fully concurrent zero-knowledge in the plain model, without relaxations.

Survey on cyberspace security

“…Zero-knowledge proof is the foundation of many kinds of security protocol, and has been widely used to achieve identity authentication, electronic voting protocols and many other application protocols. Some new models and methods [74,75] have recently appeared in particular applications [76] of zero-knowledge proof.…”

4-Round Resettably-Sound Zero Knowledge

“…Inspired by the work of Lin and Pass [20], we instead require the prover to show that it knows a transcript-that has been signed, message-by-message, by the verifier through a "signature-chain". A similar approach was used also in [11,19]. Once we have done this change, we can simply remove all messages in the preamble phase (where the honest prover commits to 0) and just replace them with a signature slot.…”