Efficient Modular NIZK Arguments from Shift and Product

Abstract

Abstract. We propose a non-interactive product argument, that is more efficient than the one by Groth and Lipmaa, and a novel shift argument. We then use them to design several novel non-interactive zero-knowledge (NIZK) arguments. We obtain the first range proof with constant communication and subquadratic prover's computation. We construct NIZK arguments for NPcomplete languages, Set-Partition, Subset-Sum and Decision-Knapsack, with constant communication, subquadratic prover's computation and linear verifier's computation.

Efficient Non-Interactive Zero Knowledge Arguments for Set Operations

“…We use the following ([0, k], u) trapdoor commitment scheme from [21]. For parm ← G bp (1 κ ), g z ← r G z \ {1} and the trapdoor (σ, α) ← Z 2 p (with σ = 0), let the common reference string be…”

“…As shown in [21], the ([0, k], u) trapdoor commitment scheme is perfectly hiding, and computationally binding under the Ψ k,u -PSDL assumption. Moreover, if the Ψ k,u -PKE assumption holds, then for any NUPPT A that outputs a valid commitment C, there exists a NUPPT extractor that, given A's input together with A's random coins, extracts a valid opening of C.…”

“…A computationally sound proof is also known as an argument. Succinct NIZK arguments have been proposed for languages like Circuit-SAT [28,36,24,3,37], Range [14,21], Set Partition, Subset Sum and Decision Knapsack [21]. While several of these arguments are efficient, they are all highly technical, and based on a careful combination of already complex basic arguments.…”

“…Because of such reasons, range proofs -where the prover aims to convince the verifier that the committed message belongs to some public range -have been widely studied in cryptographic literature. There are many well-known efficient range proofs, both interactive [9,38,35,10,13] and non-interactive [42,14,21].…”

“…For the rest of this introduction, we recall that sublinear NIZK proofs can only be (a) computationally sound, and (b) cannot be based on standard (falsifiable) assumptions [25]. Thus, following a long line of contemporary cryptographic research [28,14,36,24,5,3,21,37], we will construct NIZK arguments that are sound under some knowledge assumptions.…”