Efficient Set Membership Proofs using MPC-in-the-Head

Abstract

Set membership proofs are an invaluable part of privacy preserving systems. These proofs allow a prover to demonstrate knowledge of a witness w corresponding to a secret element x of a public set, such that they jointly satisfy a given NP relation, i.e. ℛ(w, x) = 1 and x is a member of a public set {x 1, . . . , x𝓁}. This allows the identity of the prover to remain hidden, eg. ring signatures and confidential transactions in cryptocurrencies. In this work, we develop a new technique for efficiently adding logarithmic-sized set membership proofs to any MPC-in-the-head based zero-knowledge protocol (Ishai et al. [STOC’07]). We integrate our technique into an open source implementation of the state-of-the-art, post quantum secure zero-knowledge protocol of Katz et al. [CCS’18].We find that using our techniques to construct ring signatures results in signatures (based only on symmetric key primitives) that are between 5 and 10 times smaller than state-of-the-art techniques based on the same assumptions. We also show that our techniques can be used to efficiently construct post-quantum secure RingCT from only symmetric key primitives.

gOTzilla: Efficient Disjunctive Zero-Knowledge Proofs from MPC in the Head, with Application to Proofs of Assets in Cryptocurrencies

“…In a work concurrent to ours, Goel et al [27] provided a membership proof protocol towards building a ring signature, which is equivalent to our observation discussed above (i.e. restructuring a disjunctive proof statement to a disjunction of equalities).…”

“…In addition, Mac'n'cheese can handle only Boolean or arithmetic circuits, therefore as an example, a mixed statement in the form of SHA256(g x ) = y would need around 250 million gates (as shown in Appendix B), while gOTzilla is compatible with techniques combining algebraic and non-algebraic statements similar to the work by Chase et al [19] as discussed in Section 5, and therefore we don't need to covert between circuit types. Finally, in comparison to the concurrent work of [27], and based on their reported numbers our protocol ¶ These estimates were provided by Mac'n'cheese [10] authors assuming cost per gate is 120ns. is roughly 6x more efficient in computational costs (assuming the reported runtime t in Table 2 of [27] only takes the prover's or the verifier's costs into account, but not both simultaneously as we do), namely for 2 13 elements our total runtime for 256 bits of statistical security (which implies a parameter τ = 80) is 644ms while the total runtime for [27] in an equivalent system would be 3960ms.…”

“…Finally, in comparison to the concurrent work of [27], and based on their reported numbers our protocol ¶ These estimates were provided by Mac'n'cheese [10] authors assuming cost per gate is 120ns. is roughly 6x more efficient in computational costs (assuming the reported runtime t in Table 2 of [27] only takes the prover's or the verifier's costs into account, but not both simultaneously as we do), namely for 2 13 elements our total runtime for 256 bits of statistical security (which implies a parameter τ = 80) is 644ms while the total runtime for [27] in an equivalent system would be 3960ms. However, our protocol has higher communication costs, primarily because of the required proof of bounded Ring-LWE noise.…”

“…There is no available implementation of Stacking Sigmas [28] for a direct comparison, however Stacking sigmas is expected to be more expensive than Mac'n'Cheese concretely due to its underlying techniques (Stacking sigmas relies on commitments with elliptic curve operations which are more expensive than VOLE used in Mac'n'cheese). Also, there is no available implementation for Goel et al [27] therefore our comparison is based on their evaluation. We note that a caveat of our approach is that we generally have larger memory requirements as opposed to Mac'n'Cheese where the prover and verifier are not required to store the entire proof statement in memory.…”