Improved Zero-Knowledge Proofs of Knowledge for the ISIS Problem, and Applications

Abstract

Abstract. In all existing efficient proofs of knowledge of a solution to the infinity norm Inhomogeneous Small Integer Solution (ISIS ∞ ) problem, the knowledge extractor outputs a solution vector that is only guaranteed to be O(n) times longer than the witness possessed by the prover. As a consequence, in many cryptographic schemes that use these proof systems as building blocks, there exists a gap between the hardness of solving the underlying ISIS ∞ problem and the hardness underlying the security reductions. In this paper, we generalize Stern's protocol to obtain two statistical zero-knowledge proofs of knowledge for the ISIS ∞ problem that remove this gap. Our result yields the potential of relying on weaker security assumptions for various lattice-based cryptographic constructions. As applications of our proof system, we introduce a concurrently secure identity-based identification scheme based on the worstcase hardness of the SIVP O(n 1.5 ) problem (in the 2 norm) in general lattices in the random oracle model, and an efficient statistical zeroknowledge proof of plaintext knowledge with small constant gap factor for Regev's encryption scheme.

A lattice-based group signature scheme with verifier-local revocation

“…Ling et al [25] proposed a Stern-type zero-knowledge proof of knowledge for the ISIS ∞ n,m,q,β problem that enjoys a strong security guarantee: the best way to break their protocol is to solve the underlying ISIS problem. They achieve this feature by using a versatile Decomposition-Extension framework.…”

“…To prove that he is a certified group member without leaking z, the user can perform a proof of knowledge (e.g., [30,26,25]) to convince the verifier that he knows such a vector z in zero-knowledge.…”

“…. , ℓ, one of the two blocks x 0 i , x 1 i must be zero, where the arrangement of the zero-blocks is determined by d. To prove in zero-knowledge the possession of such a vector x, we adapt the 'Stern Extension' proof system from [25], where the user identity d is hidden by a "one-time pad" technique. This technique is as follows.…”

“…Putting everything together, we obtain a lattice-based VLR group signature that has several nice features, as mentioned earlier. In the process, we exploit the rich structure of the Bonsai tree [14], and the versatility of the "Stern Extension" proof system [25]. We also employ a special "one-time pad" technique, and a novel revocation mechanism.…”

Zero-Knowledge Password Policy Check from Lattices

“…However, the asymptotic efficiency does not come to the front when the underlying set has small, constant size. Here, we employ a different approach, which has linear complexity but is technically simpler and practically more efficient, based on the extend-then-permute technique for Stern's protocol, suggested by Ling et al [37]. Finally, we use a general framework for Stern-like protocols, put forward by Libert et al [34], to combine all of our sub-protocols for set membership and obtain a ZKPPC protocol.…”