16 research outputs found
Resettable Zero Knowledge in the Bare Public-Key Model under Standard Assumption
In this paper we resolve an open problem regarding resettable zero knowledge
in the bare public-key (BPK for short) model: Does there exist constant round
resettable zero knowledge argument with concurrent soundness for
in BPK model without assuming \emph{sub-exponential hardness}? We give a
positive answer to this question by presenting such a protocol for any language
in in the bare public-key model assuming only
collision-resistant hash functions against \emph{polynomial-time} adversaries.Comment: 19 pag
A constant-round resettably-sound resettable zero-knowledge argument in the BPK model
In resetting attacks against a proof system, a prover or a verifier is reset and enforced to use the same random tape on various inputs as many times as an adversary may want. Recent deployment of cloud computing gives these attacks a new importance. This paper shows that argument systems for any NP language that are both resettably-sound
and resettable zero-knowledge are possible by a constant-round protocol in the BPK model. For that sake, we define and construct a resettably-extractable {\em conditional} commitment scheme
Resettable Cryptography in Constant Rounds -- the Case of Zero Knowledge
A fundamental question in cryptography deals with understanding the role that randomness plays in cryptographic protocols and to what extent it is necessary. One particular line of works was initiated by Canetti, Goldreich, Goldwasser, and Micali (STOC 2000) who introduced the notion of resettable zero-knowledge, where the protocol must be zero-knowledge even if a cheating verifier can reset the prover and have several interactions in which the prover uses the same random tape. Soon afterwards, Barak, Goldreich, Goldwasser, and Lindell (FOCS 2001) studied the setting where the \emph{verifier} uses a fixed random tape in multiple interactions. Subsequent to these works, a number of papers studied the notion of resettable protocols in the setting where \emph{only one} of the participating parties uses a fixed random tape multiple times. The notion of resettable security has been studied in two main models: the plain model and the bare public key model (also introduced in the above paper by Canetti et. al.).
In a recent work, Deng, Goyal and Sahai (FOCS 2009) gave the first construction of a \emph{simultaneous} resettable zero-knowledge protocol where both participants of the protocol can reuse a fixed random tape in any (polynomial) number of executions. Their construction however required rounds of interaction between the prover and the verifier. Both in the plain as well as the BPK model, this construction remain the only known simultaneous resettable zero-knowledge protocols.
In this work, we study the question of round complexity of simultaneous resettable zero-knowledge in the BPK model. We present a \emph{constant round} protocol in such a setting based on standard cryptographic assumptions. Our techniques are significantly different from the ones used by Deng, Goyal and Sahai
Resolving the Simultaneous Resettability Conjecture and a New Non-Black-Box Simulation Strategy
Canetti, Goldreich, Goldwasser, and Micali (STOC 2000) introduced the notion of resettable zero-knowledge proofs, where the protocol must be zero-knowledge even if a cheating verifier can reset the prover and have several interactions in which the prover uses the same random tape. Soon afterwards, Barak, Goldreich, Goldwasser, and Lindell (FOCS 2001) studied the closely related notion of resettable soundness, where the soundness condition of the protocol must hold even if the cheating prover can reset the verifier to have multiple interactions with the same verifier\u27s random tape. The main problem left open by this work was whether it is possible to have a single protocol that is simultaneously resettable zero knowledge and resettably sound. We resolve this question by constructing such a protocol.
At the heart of our construction is a new non-black-box simulation strategy, which we believe to be of independent interest. This new strategy allows for simulators which ``marry\u27\u27 recursive rewinding techniques (common in the context of concurrent simulation) with non-black-box simulation. Previous non-black-box strategies led to exponential blowups in computational complexity in such circumstances, which our new strategy is able to avoid
Secure computation under network and physical attacks
2011 - 2012This thesis proposes several protocols for achieving secure com-
putation under concurrent and physical attacks. Secure computation
allows many parties to compute a joint function of their inputs, while
keeping the privacy of their input preserved. It is required that the pri-
vacy one party's input is preserved even if other parties participating
in the protocol collude or deviate from the protocol.
In this thesis we focus on concurrent and physical attacks, where
adversarial parties try to break the privacy of honest parties by ex-
ploiting the network connection or physical weaknesses of the honest
parties' machine.
In the rst part of the thesis we discuss how to construct proto-
cols that are Universally Composable (UC for short) based on physical
setup assumptions. We explore the use of Physically Uncloneable Func-
tions (PUFs) as setup assumption for achieving UC-secure computa-
tions. PUF are physical noisy source of randomness. The use of PUFs
in the UC-framework has been proposed already in [14]. However, this
work assumes that all PUFs in the system are trusted. This means
that, each party has to trust the PUFs generated by the other parties.
In this thesis we focus on reducing the trust involved in the use of such
PUFs and we introduce the Malicious PUFs model in which only PUFs
generated by honest parties are assumed to be trusted. Thus the secu-
rity of each party relies on its own PUF only and holds regardless of the
goodness of the PUFs generated/used by the adversary. We are able to
show that, under this more realistic assumption, one can achieve UC-
secure computation, under computational assumptions. Moreover, we
show how to achieve unconditional UC-secure commitments with (ma-
licious) PUFs and with stateless tamper-proof hardware tokens. We
discuss our contribution on this matter in Part I. These results are
contained in papers [80] and [28].
In the second part of the thesis we focus on the concurrent setting,
and we investigate on protocols achieving round optimality and black-
box access to a cryptographic primitive. We study two fundamental
functionalities: commitment scheme and zero knowledge, and we focus
on some of the round-optimal constructions and lower bounds con-
cerning both functionalities. We nd that such constructions present
subtle issues. Hence, we provide new protocols that actually achieve
the security guarantee promised by previous results.
Concerning physical attacks, we consider adversaries able to re-
set the machine of the honest party. In a reset attack a machine is
forced to run a protocol several times using the same randomness. In
this thesis we provide the rst construction of a witness indistinguish-
able argument system that is simultaneous resettable and argument of
knowledge. We discuss about this contribution in Part III, which is the
content of the paper. [edited by author]XI n.s
Concurrently Non-Malleable Zero Knowledge in the Authenticated Public-Key Model
We consider a type of zero-knowledge protocols that are of interest for their
practical applications within networks like the Internet: efficient
zero-knowledge arguments of knowledge that remain secure against concurrent
man-in-the-middle attacks. In an effort to reduce the setup assumptions
required for efficient zero-knowledge arguments of knowledge that remain secure
against concurrent man-in-the-middle attacks, we consider a model, which we
call the Authenticated Public-Key (APK) model. The APK model seems to
significantly reduce the setup assumptions made by the CRS model (as no trusted
party or honest execution of a centralized algorithm are required), and can be
seen as a slightly stronger variation of the Bare Public-Key (BPK) model from
\cite{CGGM,MR}, and a weaker variation of the registered public-key model used
in \cite{BCNP}. We then define and study man-in-the-middle attacks in the APK
model. Our main result is a constant-round concurrent non-malleable
zero-knowledge argument of knowledge for any polynomial-time relation
(associated to a language in ), under the (minimal) assumption of
the existence of a one-way function family. Furthermore,We show time-efficient
instantiations of our protocol based on known number-theoretic assumptions. We
also note a negative result with respect to further reducing the setup
assumptions of our protocol to those in the (unauthenticated) BPK model, by
showing that concurrently non-malleable zero-knowledge arguments of knowledge
in the BPK model are only possible for trivial languages
Concurrent Knowledge-Extraction in the Public-Key Model
Knowledge extraction is a fundamental notion, modelling machine possession of
values (witnesses) in a computational complexity sense. The notion provides an
essential tool for cryptographic protocol design and analysis, enabling one to
argue about the internal state of protocol players without ever looking at this
supposedly secret state. However, when transactions are concurrent (e.g., over
the Internet) with players possessing public-keys (as is common in
cryptography), assuring that entities ``know'' what they claim to know, where
adversaries may be well coordinated across different transactions, turns out to
be much more subtle and in need of re-examination. Here, we investigate how to
formally treat knowledge possession by parties (with registered public-keys)
interacting over the Internet. Stated more technically, we look into the
relative power of the notion of ``concurrent knowledge-extraction'' (CKE) in
the concurrent zero-knowledge (CZK) bare public-key (BPK) model.Comment: 38 pages, 4 figure
Concurrent/Resettable Zero-Knowledge With Concurrent Soundness in the Bare Public-Key Model and Its Applications
In this work, we investigate concurrent knowledge-extraction (CKE)
and concurrent non-malleability (CNM) for concurrent (and stronger,
resettable) ZK protocols in the bare public-key model.
We formulate, driven by concrete attacks, and achieve CKE for
constant-round concurrent/resettable arguments in the BPK model
under standard polynomial assumptions. We get both generic and
practical implementations. Here, CKE is a new concurrent verifier
security that is strictly stronger than concurrent soundness in
public-key model.
We investigate, driven by concrete attacks, and clarify the
subtleties in formulating CNM in the public-key model. We then give
a new (augmented) CNM formulation in the public-key model and a
construction of CNMZK in the public-key model satisfying the new
CNM formulation
Improved OR-Composition of Sigma-Protocols
In [CDS94] Cramer, Damg̊ard and Schoenmakers (CDS) devise an OR-composition technique for Σ-protocols that allows to construct highly-efficient proofs for compound statements. Since then, such technique has found countless applications as building block for designing efficient protocols. Unfortunately, the CDS OR-composition technique works only if both statements are fixed before the proof starts. This limitation restricts its usability in those protocols where the theorems to be proved are defined at different stages of the protocol, but, in order to save rounds of communication, the proof must start even if not all theorems are available. Many round-optimal protocols ([KO04, DPV04, YZ07, SV12]) crucially need such property to achieve round-optimality, and, due to the inapplicability of CDS’s technique, are currently implemented using proof systems that requires expensive NP reductions, but that allow the proof to start even if no statement is defined (a.k.a., LS proofs from Lapidot-Shamir [LS90]). In this paper we show an improved OR-composition technique for Σ-protocols, that requires only one statement to be fixed when the proof starts, while the other statement can be define