Probabilistically Checkable Proofs of Proximity with Zero-Knowledge

Ishai, Yuval; Weiss, Mor

doi:10.1007/978-3-642-54242-8_6

Cited by 22 publications

(30 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This overview is an over-simplification of the construction: the verification procedure of the WIPCP (respectively, CZKPCP) cannot be used as-is since it only guarantees soundness when the verification is performed with a proof oracle, whereas corrupted servers can determine their answers after seeing the queries of the verifier. We overcome this by using techniques of [21].…”

Section: Distributed Zero-knowledge and Witness-indistinguishable Proofsmentioning

confidence: 99%

“…Previous ZKPCP constructions [24,19,21] are obtained from standard (i.e., non-ZK) PCPs in two steps. First, the standard PCP is transformed into a PCP with a weaker "honest-verifier" ZK guarantee (which is much easier to achieve than full-fledged ZK).…”

Section: Introductionmentioning

confidence: 99%

“…Unlike the ZKPCP model, the answers of malicious servers may depend on the identity of the verifier's queries, but this can be overcome using techniques of[21].…”

mentioning

confidence: 99%

See 2 more Smart Citations

Making the Best of a Leaky Situation: Zero-Knowledge PCPs from Leakage-Resilient Circuits

Ishai

Weiss

Yang

2015

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

A Probabilistically Checkable Proof (PCP) allows a randomized verifier, with oracle access to a purported proof, to probabilistically verify an input statement of the form "x ∈ L" by querying only few bits of the proof. A zero-knowledge PCP (ZKPCP) is a PCP with the additional guarantee that the view of any verifier querying a bounded number of proof bits can be efficiently simulated given the input x alone, where the simulated and actual views are statistically close.Originating from the first ZKPCP construction of Kilian et al. (STOC '97), all previous constructions relied on locking schemes, an unconditionally secure oracle-based commitment primitive. The use of locking schemes makes the verifier inherently adaptive, namely, it needs to make at least two rounds of queries to the proof.Motivated by the goal of constructing non-adaptively verifiable ZKPCPs, we suggest a new technique for compiling standard PCPs into ZKPCPs. Our approach is based on leakage-resilient circuits, which are circuits that withstand certain "side-channel" attacks, in the sense that these attacks reveal nothing about the (properly encoded) input, other than the output. We observe that the verifier's oracle queries constitute a side-channel attack on the wire-values of the circuit verifying membership in L, so a PCP constructed from a circuit resilient against such attacks would be ZK. However, a leakage-resilient circuit evaluates the desired function only if its input is properly encoded, i.e., has a specific structure, whereas by generating a "proof" from the wirevalues of the circuit on an ill-formed "encoded" input, one can cause the verification to accept inputs x / ∈ L with probability 1. We overcome this obstacle by constructing leakage-resilient circuits with the additional guarantee that ill-formed encoded inputs are detected. Using this approach, we obtain the following results:• We construct the first witness-indistinguishable PCPs (WIPCP) for NP with non-adaptive verification. WIPCPs relax ZKPCPs by only requiring that different witnesses be indistinguishable. Our construction combines strong leakage-resilient circuits as above with the PCP of Arora and Safra (FOCS '92), in which queries correspond to side-channel attacks by shallow circuits, and with correlation bounds for shallow circuits due to Lovett and Srivinasan (RANDOM '11).• Building on these WIPCPs, we construct non-adaptively verifiable computational ZKPCPs for NP in the common random string model, assuming that one-way functions exist.

show abstract

Section: Distributed Zero-knowledge and Witness-indistinguishable Proofsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Making the Best of a Leaky Situation: Zero-Knowledge PCPs from Leakage-Resilient Circuits

Ishai

Weiss

Yang

2015

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…From the perspective of zero knowledge, however, a proximity proof can be 'dangerous': a few locations of π can in principle leak a lot of information about the codeword w, and a malicious verifier could potentially learn a lot about w with only a few queries to w and π. The notion of zero knowledge for proximity proofs requires that this cannot happen: it requires the existence of an algorithm that simulates the verifier's view by making as many queries to w as the total number of verifier queries to either w or π [IW14]; intuitively, this means that any bit of the proximity proof π reveals no more information than one bit of w.…”

Section: Perfect Zero Knowledge Proximity Proofs For Reed-solomonmentioning

confidence: 99%

“…This modification ensures that there exists an algorithm that perfectly simulates the verifier's view by making as many queries to the LACSP witness as the total number of verifier queries to either the LACSP witness or other oracles used to facilitate proximity testing. At this point we have obtained a perfect zero knowledge 2-round IOP of Proximity for NEXP (analogous to the notion of a zero knowledge PCP of Proximity [IW14]); this part is where, previously, [BCGV16] were restricted to NP because their simulator only handled Reed-Solomon codes with polynomial degree while our simulator is efficient even for such codes with exponential degree. But we are not done yet: to obtain our goal, we also need to address the problem that the LACSP witness itself "leaks" when the verifier queries it, which we discuss next.…”

Section: Perfect Zero Knowledge For Nondeterministic Timementioning

confidence: 99%

On Probabilistic Checking in Perfect Zero Knowledge

Ben–Sasson¹,

Chiesa²,

Forbes³

et al. 2016

Preprint

View full text Add to dashboard Cite

We present the first constructions of single-prover proof systems that achieve perfect zero knowledge (PZK) for languages beyond NP, under no intractability assumptions:1. The complexity class #P has PZK proofs in the model of Interactive PCPs (IPCPs) [KR08], where the verifier first receives from the prover a PCP and then engages with the prover in an Interactive Proof (IP). The complexity classNEXP has PZK proofs in the model of Interactive Oracle Proofs (IOPs) [BCS16, RRR16], where the verifier, in every round of interaction, receives a PCP from the prover. Unlike PZK multi-prover proof systems [BGKW88], PZK single-prover proof systems are elusive: PZK IPs are limited to AM ∩ coAM [For87, AH91], while known PCPs and IPCPs achieve only statistical simulation [KPT97, GIMS10]. Recent work [BCGV16] has achieved PZK for IOPs but only for languages in NP, while our results go beyond it.Our constructions rely on succinct simulators that enable us to "simulate beyond NP", achieving exponential savings in efficiency over [BCGV16]. These simulators crucially rely on solving a problem that lies at the intersection of coding theory, linear algebra, and computational complexity, which we call the succinct constraint detection problem, and consists of detecting dual constraints with polynomial support size for codes of exponential block length. Our two results rely on solutions to this problem for fundamental classes of linear codes:• An algorithm to detect constraints for Reed-Muller codes of exponential length.• An algorithm to detect constraints for PCPs of Proximity of Reed-Solomon codes [BS08] of exponential degree.The first algorithm exploits the Raz-Shpilka [RS05] deterministic polynomial identity testing algorithm, and shows, to our knowledge, a first connection of algebraic complexity theory with zero knowledge. Along the way, we give a perfect zero knowledge analogue of the celebrated sumcheck protocol [LFKN92], by leveraging both succinct constraint detection and low-degree testing. The second algorithm exploits the recursive structure of the PCPs of Proximity to show that small-support constraints are "locally" spanned by a small number of small-support constraints.

show abstract

Round-Optimal Black-Box Commit-and-Prove with Succinct Communication

Kiyoshima

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Probabilistically Checkable Proofs of Proximity with Zero-Knowledge

Cited by 22 publications

References 24 publications

Making the Best of a Leaky Situation: Zero-Knowledge PCPs from Leakage-Resilient Circuits

Making the Best of a Leaky Situation: Zero-Knowledge PCPs from Leakage-Resilient Circuits

On Probabilistic Checking in Perfect Zero Knowledge

Round-Optimal Black-Box Commit-and-Prove with Succinct Communication

Contact Info

Product

Resources

About