Fine-Tuning Groth-Sahai Proofs

Abstract

Abstract. Groth-Sahai proofs are efficient non-interactive zero-knowledge proofs that have found widespread use in pairingbased cryptography. We propose efficiency improvements of Groth-Sahai proofs in the SXDH setting, which is the one that yields the most efficient non-interactive zero-knowledge proofs.-We replace some of the commitments with ElGamal encryptions, which reduces the prover's computation and for some types of equations reduces the proof size. -Groth-Sahai proofs are zero-knowledge when no public elements are paired to each other. We observe that they are also zero-knowledge when base elements for the groups are paired to public constants. -The prover's computation can be reduced by letting her pick her own common reference string. By giving a proof she has picked a valid common reference string this does not compromise soundness. -We define a type-based commit-and-prove scheme, which allows commitments to be reused in many different proofs.

Stretching Groth-Sahai: NIZK Proofs of Partial Satisfiability

“…Recently, Escala and Groth [11] gave a complete formulation of the GS proof system as a labeled Commit-and-Prove (CaP) scheme. The labels are meant to deal with different variable and equation types.…”

“…This formulation is really convenient for our purposes, as it allows to define in a precise way which equation types admit verifiable correlated key generation and which do not. One of our contributions (section 3) is to slightly modify the definition of labeled CaP of [11] so that it can accommodate both the GS proof system and our new proof system for partial satisfiability.…”

“…We also modify the definition to explicitly take as input a set of labels so that it fits with the GS CaP formulation of [11]. The motivation for doing so is that the same common reference string might be binding for some equation types and hiding for others.…”

“…Essentially, we take up the notation of Escala and Groth [11] for elements and operations in the bilinear group. Namely,Ĝ,Ȟ, T are written additively, elementsx ∈Ĝ are written with a hat and elements iny ∈Ȟ with an inverted hat and0,0 and 0 T denote the neutral elements in the respective groups.…”

“…This corresponds to the notion of commit-andprove (CaP) scheme ( [20,7]), although the reformulation in these terms is not straightforward, since GS Proofs allow for a flexibility (different commitment/ equation types) which is not easily captured by the standard definition of a CaP scheme. To address this issue, Escala and Groth [11] write the GS proof system as a CaP scheme with labels. The labels are meant to specify the different commitment/equation types.…”