QA-NIZK Arguments in Asymmetric Groups: New Tools and New Constructions

Abstract

A sequence of recent works have constructed constant-size quasi-adaptive (QA) NIZK arguments of membership in linear subspaces ofĜ m , whereĜ is a group equipped with a bilinear map e :Ĝ ×Ȟ → T. Although applicable to any bilinear group, these techniques are less useful in the asymmetric case. For example, Jutla and Roy (Crypto 2014) show how to do QA aggregation of Groth-Sahai proofs, but the types of equations which can be aggregated are more restricted in the asymmetric setting. Furthermore, there are natural statements which cannot be expressed as membership in linear subspaces, for example the satisfiability of quadratic equations. In this paper we develop specific techniques for asymmetric groups. We introduce a new computational assumption, under which we can recover all the aggregation results of Groth-Sahai proofs known in the symmetric setting. We adapt the arguments of membership in linear spaces of G m to linear subspaces ofĜ m ×Ȟ n . In particular, we give a constantsize argument that two sets of Groth-Sahai commitments, defined over different groupsĜ,Ȟ, open to the same scalars in Zq, a useful tool to prove satisfiability of quadratic equations in Zq. We then use one of the arguments for subspaces inĜ m ×Ȟ n and develop new techniques to give constant-size QA-NIZK proofs that a commitment opens to a bit-string. To the best of our knowledge, these are the first constant-size proofs for quadratic equations in Zq under standard and falsifiable assumptions. As a result, we obtain improved threshold Groth-Sahai proofs for pairing product equations, ring signatures, proofs of membership in a list, and various types of signature schemes.

The Kernel Matrix Diffie-Hellman Assumption

“…Theorem 2 supports the intuition that there is a tradeoff between the size of the matrix -which typically results in less efficiency -and the hardness of the KerMDH Problems, and justifies the generalization of several protocols to different choices of k given in [17,[24][25][26].…”

“…The discussion of our results given so far should already highlight some of the advantages of using the new Kernel family of assumptions and the power of these new assumptions, which have already been used in compelling applications in follow-up work in [17,25,26]. To further illustrate the usefulness of the new framework, we apply it to the study of trapdoor commitments.…”

“…At Eurocrypt 2015, our KerMDH Assumptions were applied to design simpler QA-NIZK proofs of membership in linear spaces [26]. They have also been used to give more efficient constructions of structure preserving signatures [25], to generalize and simplify the results on quasi-adaptive aggregation of Groth-Sahai proofs [17] (given originally in [24]) and to construct a tightly secure QA-NIZK argument for linear subspaces with unbounded simulation soundness in [15]. The power of a KerMDH Assumption is that it allows to guarantee uniqueness.…”

“…We have already mentioned that the Kernel Matrix Diffie-Hellman Assumptions have already found applications in follow-up work, more concretely: a) to generalize and improve previous constructions of QA-NIZK proofs for linear spaces [26], b) to construct more efficient structure preserving signatures starting from affine algebraic MACS [25], c) to improve and generalize aggregation of GrothSahai proofs [17] or d) to construct a tightly secure QA-NIZK argument for linear subspaces with unbounded simulation soundness [15].…”

New Techniques for Structural Batch Verification in Bilinear Groups with Applications to Groth-Sahai Proofs

“…Many of the equations in bilinear groups one wants to batch verify are very structured (e.g. GS proofs [35], structure preserving cryptography [1,41] or the protocols [33,42]). For instance, many of them consist simply of matrix-vector multiplication in the exponent.…”