Making the Best of a Leaky Situation: Zero-Knowledge PCPs from Leakage-Resilient Circuits

Abstract

A Probabilistically Checkable Proof (PCP) allows a randomized verifier, with oracle access to a purported proof, to probabilistically verify an input statement of the form "x ∈ L" by querying only few bits of the proof. A zero-knowledge PCP (ZKPCP) is a PCP with the additional guarantee that the view of any verifier querying a bounded number of proof bits can be efficiently simulated given the input x alone, where the simulated and actual views are statistically close.Originating from the first ZKPCP construction of Kilian et al. (STOC '97), all previous constructions relied on locking schemes, an unconditionally secure oracle-based commitment primitive. The use of locking schemes makes the verifier inherently adaptive, namely, it needs to make at least two rounds of queries to the proof.Motivated by the goal of constructing non-adaptively verifiable ZKPCPs, we suggest a new technique for compiling standard PCPs into ZKPCPs. Our approach is based on leakage-resilient circuits, which are circuits that withstand certain "side-channel" attacks, in the sense that these attacks reveal nothing about the (properly encoded) input, other than the output. We observe that the verifier's oracle queries constitute a side-channel attack on the wire-values of the circuit verifying membership in L, so a PCP constructed from a circuit resilient against such attacks would be ZK. However, a leakage-resilient circuit evaluates the desired function only if its input is properly encoded, i.e., has a specific structure, whereas by generating a "proof" from the wirevalues of the circuit on an ill-formed "encoded" input, one can cause the verification to accept inputs x / ∈ L with probability 1. We overcome this obstacle by constructing leakage-resilient circuits with the additional guarantee that ill-formed encoded inputs are detected. Using this approach, we obtain the following results:• We construct the first witness-indistinguishable PCPs (WIPCP) for NP with non-adaptive verification. WIPCPs relax ZKPCPs by only requiring that different witnesses be indistinguishable. Our construction combines strong leakage-resilient circuits as above with the PCP of Arora and Safra (FOCS '92), in which queries correspond to side-channel attacks by shallow circuits, and with correlation bounds for shallow circuits due to Lovett and Srivinasan (RANDOM '11).• Building on these WIPCPs, we construct non-adaptively verifiable computational ZKPCPs for NP in the common random string model, assuming that one-way functions exist.

Correction to: Unconditionally Secure Computation Against Low-Complexity Leakage

“…For instance, this scenario can apply to zero-knowledge authentication by a hardware device, or computations performed by payment terminals and access control readers (see [29] for further discussion). In a more theoretical context, stateless LRCCs have also been applied towards constructing different zero-knowledge flavors of probabilistically checkable proofs [36,47]. The stateful variant of LRCCs captures a system (such as a personal computer or an IoT device) with persistent memory that may store secrets.…”

“…In the stateful case, an additional difficulty stems from the need to prove simulation-based security rather than mere indistinguishability by AC 0 circuits. The efficient simulation requirement poses a major challenge in some related contexts [36].…”

On Probabilistic Checking in Perfect Zero Knowledge

“…Recent work explores alternative approaches but these constructions suffer from other limitations: (i) [IWY16] apply PCPs to leakage-resilient circuits, and obtain PCPs for NP with a non-adaptive verifier but they are only witness (statistically) indistinguishable; (ii) [BCGV16] exploit algebraic properties of PCPs and obtain 2-round IOPs that are perfect zero knowledge but only for NP.…”

Shielding Probabilistically Checkable Proofs: Zero-Knowledge PCPs from Leakage Resilience

“…The focus on these parameters in ZK-PCP constructions stems from their effect on the properties and parameters of cryptographic systems using ZK-PCPs. Specifically, the query complexity and adaptivity of the honest verifier translates into communication and round complexities; the query-bound on malicious verifiers corresponds to the privacy guarantee of the resultant system; and in distributed proof systems (as in, e.g., [ 8 ]) the proof length and query bound translate into the total number of parties and the number of corrupted parties, respectively.…”

“…The question of designing non-adaptive ZK-PCPs had remained open for nearly 20 years, until Ishai, Weiss and Yang [ 8 ] gave the first construction of a non-adaptive ZK-PCP, which was followed by the non-adaptive ZK-PCP of Hazay, Venkitasubramaniam and Weiss [ 13 ]. The focus of this survey is on describing and comparing these constructions.…”