Efficiency Limitations of Σ-Protocols for Group Homomorphisms Revisited

Abstract

Abstract. We study the problem of constructing efficient proofs of knowledge of preimages of general group homomorphisms. We simplify and extend the recent negative results of Bangerter et al. (TCC 2010) to constant round (from three-message) generic protocols over concrete (instead of generic) groups, i.e., we prove lower bounds on both the soundness error and the knowledge error of such protocols. We also give a precise characterization of what can be extracted from the prover in the direct (common) generalization of the Guillou-Quisquater and Schnorr protocols to the setting of general group homomorphisms.Then we consider some settings in which these bounds can be circumvented. For groups with no subgroups of small order we present: (1) a three-move honest verifier zero-knowledge argument under some set-up assumptions and the standard discrete logarithm assumption, and (2) a Σ-proof of both the order of the group and the preimage. The former may be viewed as an offline/online protocol, where all slow cut-andchoose protocols can be moved to an offline phase.

Two-Party ECDSA from Hash Proof Systems and Efficient Instantiations

“…Moreover, the bottleneck of our instantiation is the use of binary challenges in a zero knowledge proof of knowledge, used during key generation, in order to cope with the fact we are working in a cyclic subgroup of a group of unknown order and that we can not check that elements belong to the subgroup. There have been many proposals to deal with generalized Schnorr proofs in groups of unknown order (see for instance the framework of [CKY09] using safeguard groups, or [TW12]). For the case of subgroups of (Z/nZ) × , efficient solutions for this type of proofs enlarge the challenge space, and rely on variants of the strong RSA assumption.…”

Zero-Knowledge Arguments for Subverted RSA Groups

“…For a single proof it cannot be applied. Finally, Bangerter et al [6] and Terelius et al [60] show a lower bound on soundness error for constant round sigma-like protocols in the standard model (no CRS, no RO), that translates to 1/2 for common parameters.…”

“…In this work we design efficient designated-verifier ZK protocols for knowledge and range of RSA group homomorphisms, which have negligible soundness error without repetitions even when the group is maliciously chosen. The main unifying ideas of all our techniques are (1) an alternative approach to Σ-protocols' witness extraction and (2) a careful realisation through homomorphic encryption with respect to (also potentially subverted) verifier's modulus, which allows hiding protocol challenges from the prover in a way that prevents lower-bound attacks of [6,60].…”

“…Sigma protocols enjoy negligible soundness-error in groups of known order. The story is different in groups of hidden order where negligible soundness can only be achieved by running O(λ) sigma protocols in parallel [6,60], thus multiplying the prover, proof size, and verifier costs by O(λ).…”

Improvements in Everlasting Privacy: Efficient and Secure Zero Knowledge Proofs

“…In the context of verifiable electronic voting mix-nets are also required to be verifiable. This is achieved by proving the correctness of the shuffle using a ZKP, of which two techniques are dominant; namely those of Bayer and Groth [4] and that of Terelius and Wikström [23]. Both techniques are general in nature and tend to be optimised for the particularities of the system in which they are used.…”