Lattice-Based Zero-Knowledge Proofs: New Techniques for Shorter and Faster Constructions and Applications

Esgin, Muhammed F.; Steinfeld, Ron; Liu, Joseph K.; Liu, Dongxi

doi:10.1007/978-3-030-26948-7_5

Cited by 63 publications

(34 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The starting point of recent lattice-based constructions that implicitly construct a multiplicative proof system (c.f. [6,[14][15][16]31]) is the commitment scheme from [2], which has a ZK proof that is fairly efficient for proving linear relations among committed polynomials over the ring R q = Z q [X]/(X d + 1), where q is prime. All of the aforementioned schemes require that the challenge set in the zeroknowledge proof is such that all pairwise differences of elements are invertible.…”

Section: Results Overview and Related Workmentioning

confidence: 99%

“…Prior works performed this proof by sending masked openings of the committed polynomials and committing to the lower-degree terms of the δ-degree polynomial function (c.f. [6,[14][15][16]31]). In our work we show additional properties of the ZK proof in [2] that imply that it is not necessary to send the masked message openings.…”

Section: Results Overview and Related Workmentioning

confidence: 99%

“…[8,Table 2]), but is shorter than any quantum-safe proof system (e.g. [4,14,16,19]). In particular, the proofs implicit in [14,Protocol 2] and [16,Section 1.3] used a similar approach of putting elements into NTT coefficients, and had 32-bit proof sizes of around 9 KB [30].…”

Section: Results Overview and Related Workmentioning

confidence: 99%

“…[4,14,16,19]). In particular, the proofs implicit in [14,Protocol 2] and [16,Section 1.3] used a similar approach of putting elements into NTT coefficients, and had 32-bit proof sizes of around 9 KB [30]. For such range proofs, one only needs to commit to a few polynomials, and so the advantage of our proof system which saves on not sending masked polynomials doesn't manifest itself too much.…”

Section: Results Overview and Related Workmentioning

confidence: 99%

See 3 more Smart Citations

Practical Product Proofs for Lattice Commitments

Attema

Lyubashevsky

Seiler

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We construct a practical lattice-based zero-knowledge argument for proving multiplicative relations between committed values. The underlying commitment scheme that we use is the currently most efficient one of Baum et al. (SCN 2018), and the size of our multiplicative proof (9 KB) is only slightly larger than the 7 KB required for just proving knowledge of the committed values. We additionally expand on the work of Lyubashevsky and Seiler (Eurocrypt 2018) by showing that the abovementioned result can also apply when working over rings Zq[X]/(X d +1) where X d + 1 splits into low-degree factors, which is a desirable property for many applications (e.g. range proofs, multiplications over Zq) that take advantage of packing multiple integers into the NTT coefficients of the committed polynomial.

show abstract

Section: Results Overview and Related Workmentioning

confidence: 99%

Section: Results Overview and Related Workmentioning

confidence: 99%

Section: Results Overview and Related Workmentioning

confidence: 99%

Section: Results Overview and Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Practical Product Proofs for Lattice Commitments

Attema

Lyubashevsky

Seiler

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Beyond basic cryptographic schemes such as encryption and signature, lattice-based cryptography also supports advanced schemes such as zero-knowledge proofs (ZKP), which play a crucial role in blockchain applications. For example, advanced ZKPs have recently been studied in [12,13] and there are even recent efforts in constructing blockchain-specific applications based on lattice assumptions [14,30].…”

Section: Introductionmentioning

confidence: 99%

Post-Quantum Adaptor Signatures and Payment Channel Networks

Esgin

Ersoy

Erkin

2020

Computer Security – ESORICS 2020

Self Cite

View full text Add to dashboard Cite

Adaptor signatures, also known as scriptless scripts, have recently become an important tool in addressing the scalability and interoperability issues of blockchain applications such as cryptocurrencies. An adaptor signature extends a digital signature in a way that a complete signature reveals a secret based on a cryptographic condition. It brings about various advantages such as (i) low on-chain cost, (ii) improved fungibility of transactions, and (iii) advanced functionality beyond the limitation of the blockchain's scripting language. In this work, we introduce the first post-quantum adaptor signature, named LAS. Our construction relies on the standard lattice assumptions, namely Module-SIS and Module-LWE. There are certain challenges specific to the lattice setting, arising mainly from the so-called knowledge gap in lattice-based proof systems, that makes the realization of an adaptor signature and its applications difficult. We show how to overcome these technical difficulties without introducing additional on-chain costs. Our evaluation demonstrates that LAS is essentially as efficient as an ordinary lattice-based signature in terms of both communication and computation. We further show how to achieve post-quantum atomic swaps and payment channel networks using LAS.

show abstract