fmouhart/thesis
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

WI and Proof of knowledge

Browse Source
This commit is contained in:
Fabrice Mouhartem 2018-06-19 13:22:22 +02:00
parent b57293c56f
commit 0db1043246
2 changed files with 27 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
chap-ZK.tex
View File

@ -37,6 +37,31 @@ In this section, we first present the general principles and basic tools to hand
If the two ensembles in the definition of \textit{zero-knowledge} are the same, then the proof is \textit{perfect zero-knowledge}.
\end{definition}
\begin{definition}[Proof of knowledge \cite{GMR85,BG92}]
\index{Zero Knowledge!Proof of knowledge}
Let $\kappa$ be a function from $\bit^\star$ to $[0,1]$. A complete interactive proof system $(P,V)$ is said to be a \textit{proof of knowledge} for the relation $R$ with knowledge error $\kappa$ if it verifies the knowledge soundness property.
\begin{description}
\item[Knowledge soundness.] There exists a $\ppt$ algorithm $\mathcal E$, called the knowledge extractor. This algorithm takes as input $x$ and rewindable black-box access to the prover, and targets to compute a $w$ such that $(x,w) \in R$.
For any prover $\hat{P}$, let $\varepsilon(x)$ be the probability that $V$ accepts on input $x$.
There exists a constant $c$ such that, whenever $\varepsilon(x) > \kappa(x)$, $M$ will output a correct $w$ with expected time at most $\frac{|x|^c}{\varepsilon(x) - \kappa(x)},$ where access to $\hat{P}$ counts as one step.
\end{description}
\end{definition}
This extractor represents the fact that an effective prover actually knows the secret (while a zero-knowledge proof only attests the existence of a witness $w$).
In the following, $\ZKAoK$ denotes \textit{Zero-Knowledge Argument of Knowledge}.
Another useful property that a proof system can have in the context of privacy-preserving cryptography is witness indistinguishability (\textsf{WI}).
This property states that if a proof system has multiple witnesses, it is impossible to tell apart which one has been used during the proof.
\begin{definition}[Witness indistinguishable proofs~\cite{FS90}]
Let $(P,V)$ be a complete interactive proof system for relation $R$. It is said to be \textit{witness indistinguishable} if, for every $\ppt$ algorithm $\hat{V}$ and every two sequences $\{w_x\}_{(x, w_x) \in R}$, $\{w'_x\}_{(x,w'_x) \in R}$, the following ensembles are computationally indistinguishable:
\begin{align*}
\{ \trans(P(x, w_x), \hat{V}(x) \}_x && \mbox{and} && \{ \trans( P(x, w'_x), \hat{V}(x) \}_x.
\end{align*}
\end{definition}
The \textsf{WI} property is implied by the zero-knowledge property. Whereas the latter, \textit{witness indistinguishability} is preserved through parallel repetitions of the protocol~\cite{FS90}.
\subsection{$\Sigma$-protocols}
\addcontentsline{tof}{subsection}{\protect\numberline{\thesubsection} Protocoles $\Sigma$}
\label{sse:sigma-protocols}
@ -311,7 +336,7 @@ For efficiency reasons, Schnorr's protocol is used along with Fiat-Shamir heuris
This methodology has also been adapted to the ideal lattice-setting by Lyubashevsky~\cite{Lyu08, Lyu09} along with a technique called \textit{rejection sampling} in order to construct ZK proofs from ideal lattice assumptions and is described in Figure~\ref{fig:schnorr-lwe}.
In this description $D_y$ and $D_c$ are the distributions from which $\mathbf{y}_1, \mathbf{y}_2$ and $\mathbf{c}$ have to be sampled respectively, and $G$ describes the set of \textit{good} responses $\mathbf{z}_1, \mathbf{z}_2$ in order not to leak informations about $\mathbf{s}_1, \mathbf{s}_2$.
The part between brackets is called the \textit{rejection} phase, and ensure that the transmitted $\mathbf{z}_1, \mathbf{z}_2$ will not leak any information about $\mathbf{s}_1, \mathbf{s}_2$ to V.
This part induced a noticeable error-rate where the prover aborts the proof. As the protocol is proven \textit{witness indistinguishable}~\cite{Lyu09}, one can run the protocol multiple times in parallel and hope that one of them will not abort~\cite{FS90} (recall that, unlike the zero-knowledge property, witness indistinguishability is preserved under parallel repetitions).
This part induced a noticeable error-rate where the prover aborts the proof. As the protocol is proven \textit{witness indistinguishable}~\cite{Lyu09}, one can run the protocol multiple times in parallel and hope that one of them will not abort~\cite{FS90}.% (recall that, unlike the zero-knowledge property, witness indistinguishability is preserved under parallel repetitions).
\begin{figure}
\textbf{Common input:} A public element $\mathbf{a} \in R$ where $R = \ZZ_p[\mathbf{x}]/\langle \mathbf{x}^n + 1 \rangle$.

1
symbols.tex
View File

@ -31,6 +31,7 @@
$\ZKAoK$ & Zero-Knowledge Argument of Knowledge \\
$\NIZK$ & Non-Interactive Zero-Knowledge \\
$\QANIZK$ & Quasi-Adaptive Non-Interactive Zero-Knowledge \\
$\textsf{WI}$ & Witness indistinguishable \\
$\OT$ & Oblivious Transfer \\
[1ex] \multicolumn{2}{l}{\scbf{Security Notions}} \\
$\advantage{\mathrm{E}}{\adv}$ & Advantage of adversary $\adv$ for experiment $\mathrm{E}$ \\