Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols

Abstract

Suppose we are given a proof of knowledge P in which a prover demonstrates that he knows a solution to a given problem instance. Suppose also that we have a secret sharing scheme S on n participants. Then under certain assumptions on P and S, we show how to transform P into a witness indistinguishable protocol, in which the prover demonstrates knowledge of the solution to a subset of n problem instances corresponding to a qualified set of participants. For example, using a threshold scheme, the prover can show that he knows at least d out of n solutions without revealing which d instances are involved. If the instances are independently generated, this can lead to witness hiding protocols, even if P did not have this property. Our transformation produces a protocol with the same number of rounds as P and communication complexity n times that of P. Our results use no unproven complexity assumptions.

Commital Deniable Proofs and Electronic Campaign Finance

“…We show that every predicate has a commital deniable proof, using techniques of Cramer et al [13,12]. That is, we show that the protocol from [12] has our new property of commital deniability.…”

“…This fairly general construction seems to be applicable in many situations in which provability and deniability should be combined. Our protocol builds on ideas of Cramer and Damgard [12] for efficient zero-knowledge proofs, which in turn builds on ideas of Cramer, Damgard, and Schoenmakers [13]. In essence, we show that these earlier protocols have our new property of commital deniability.…”

An Efficient Two-Party Public Key Cryptosystem Secure against Adaptive Chosen Ciphertext Attack

“…Our two-party decryption system in Section 5 uses special types of Σ-protocols to deal with malicious adversaries, so here we overview the basic definitions and properties of Σ-protocols [14,13]. (This section may be skipped if one is only interested in the high-level design of our two-party decryption system, and in particular, a design that is only secure against so-called "honest-but-curious" adversaries.…”

“…A simple but important fact (see [14]) is that if a Σ-protocol is HVZK, the protocol is perfectly witness indistinguishable (WI) [22]. Although HVZK by itself is defined with respect to a very much restricted verifier, i.e.…”

Oblivious Transfer with Adaptive Queries

“…It is very attractive to use in these protocols the non-interactive OT 2 1 protocols of Bellare and Micali [1]. The combination of these protocols with the proof techniques of [9] yields a very efficient OT 2 1 protocol which is based on the Decisional Diffie-Hellman assumption.…”