407 research outputs found
Concurrently Non-Malleable Zero Knowledge in the Authenticated Public-Key Model
We consider a type of zero-knowledge protocols that are of interest for their
practical applications within networks like the Internet: efficient
zero-knowledge arguments of knowledge that remain secure against concurrent
man-in-the-middle attacks. In an effort to reduce the setup assumptions
required for efficient zero-knowledge arguments of knowledge that remain secure
against concurrent man-in-the-middle attacks, we consider a model, which we
call the Authenticated Public-Key (APK) model. The APK model seems to
significantly reduce the setup assumptions made by the CRS model (as no trusted
party or honest execution of a centralized algorithm are required), and can be
seen as a slightly stronger variation of the Bare Public-Key (BPK) model from
\cite{CGGM,MR}, and a weaker variation of the registered public-key model used
in \cite{BCNP}. We then define and study man-in-the-middle attacks in the APK
model. Our main result is a constant-round concurrent non-malleable
zero-knowledge argument of knowledge for any polynomial-time relation
(associated to a language in ), under the (minimal) assumption of
the existence of a one-way function family. Furthermore,We show time-efficient
instantiations of our protocol based on known number-theoretic assumptions. We
also note a negative result with respect to further reducing the setup
assumptions of our protocol to those in the (unauthenticated) BPK model, by
showing that concurrently non-malleable zero-knowledge arguments of knowledge
in the BPK model are only possible for trivial languages
Supernova neutrino physics with a nuclear emulsion detector
The existence of the coherent neutrino-nucleus scattering reaction requires
to evaluate, for any detector devoted to WIMP searches, the irreducible
background due to conventional neutrino sources and at same time, it gives a
unique chance to reveal supernova neutrinos. We report here a detailed study
concerning a new directional detector, based on the nuclear emulsion
technology. A Likelihood Ratio test shows that, in the first years of
operations and with a detector mass of several tens of tons, the observation of
the supernova signal can be achieved. The determination of the distance of the
supernova from the neutrinos and the observation of B neutrinos are also
discussed.Comment: 22 pages, 12 figure
The knowledge complexity of quadratic residuosity languages
AbstractNoninteractive perfect zero-knowledge (ZK) proofs are very elusive objects. In fact, since the introduction of the noninteractive model of Blum . (1988), the only perfect zero-knowledge proof known was the one for quadratic nonresiduosity of Blum . (1991). The situation is no better in the interactive case where perfect zero-knowledge proofs are known only for a handful of particular languages.In this work, we show that a large class of languages related to quadratic residuosity admits noninteractive perfect zero-knowledge proofs. More precisely, we give a protocol for the language of thresholds of quadratic residuosity.Moreover, we develop a new technique for converting noninteractive zero-knowledge proofs into round-optimal zero-knowledge proofs for an even wider class of languages. The transformation preserves perfect zero knowledge in the sense that, if the noninteractive proof we started with is a perfect zero-knowledge proof, then we obtain a round-optimal perfect zero-knowledge proof. The noninteractive perfect zero-knowledge proofs presented in this work can be transformed into 4-round (which is optimal) interactive perfect zero-knowledge proofs. Until now, the only known 4-round perfect ZK proof systems were the ones for quadratic nonresiduosity (Goldwasser et al., 1989) and for graph nonisomorphism (Goldreich et al., 1986) and no 4-round perfect zero-knowledge proof system was known for the simple case of the language of quadratic residues
Secure and Efficient Delegation of Elliptic-Curve Pairing
Many public-key cryptosystems and, more generally, cryp- tographic protocols, use pairings as important primitive operations. To expand the applicability of these solutions to computationally weaker devices, it has been advocated that a computationally weaker client del- egates such primitive operations to a computationally stronger server. Important requirements for such delegation protocols include privacy of the client's pairing inputs and security of the client's output, in the sense of detecting, except for very small probability, any malicious server's at- tempt to convince the client of an incorrect pairing result. In this paper we show that the computation of bilinear pairings in all known pairing-based cryptographic protocols can be eciently, privately and securely delegated to a single, possibly malicious, server. Our tech- niques provides eciency improvements over past work in all input sce- narios, regardless on whether inputs are available to the parties in an oine phase or only in the online phase, and on whether they are public or have privacy requirements. The client's online runtime improvement is, for some of our protocols almost 1 order of magnitude, no matter which practical elliptic curve, among recently recommended ones, is used for the pairing realization
Efficient and Secure Delegation of Group Exponentiation to a Single Server
We consider the problem of delegating computation of group operations from a computationally weaker client holding an input and a description of a function, to a {\em single} computationally stronger server holding a description of the same function. Solutions need to satisfy natural correctness, security, privacy and efficiency requirements. We obtain delegated computation protocols for the following functions, defined for an {\em arbitrary} commutative group:
\begin{enumerate}
\item Group inverses, with security and privacy holding against any computationally unrestricted malicious server.
\item Group exponentiation, with security and privacy holding against any computationally unrestricted ``partially honest server.
\item Group exponentiation, with security and privacy holding against any polynomial-time malicious server, under a pseudorandom generation assumption, and security holding with constant probability.
\end{enumerate
On server trust in private proxy auctions
We investigate proxy auctions, an auction model which is proving very successful for on-line businesses (e.g.http://www.ebay.com), where a trusted server manages bids from clients by continuously updating the current price of the item and the currently winning bid as well as keeping private the winning client’s maximum bid.
We propose techniques for reducing the trust in the server by defining and achieving
a security property, called server integrity. Informally, this property protects
clients from a novel and large class of attacks from a corrupted server by allowing
them to verify the correctness of updates to the current price and the currently
winning bid. Our new auction scheme achieves server integrity and satisfies two important
properties that are not enjoyed by previous work in the literature: it has minimal
interaction, and only requires a single trusted server. The main ingredients of
our scheme are two minimal-round implementations of zero-knowledge proofs for
proving lower bounds on encrypted values: one based on discrete logarithms that is
more efficient but uses the random oracle assumption, and another based on quadratic
residuosity that only uses standard intractability assumptions but is less efficient.Postprint (published version
Practical and Secure Outsourcing of Discrete Log Group Exponentiation to a Single Malicious Server
Group exponentiation is an important operation used in many public-key cryptosystems and, more generally, cryptographic protocols. To expand the applicability of these solutions to computationally weaker devices, it has been advocated that this operation is outsourced from a computationally weaker client to a computationally stronger server, possibly implemented in a cloud-based architecture. While preliminary solutions to this problem considered mostly honest servers, or multiple separated servers, some of which honest, solving this problem in the case of a single (logical), possibly malicious, server, has remained open since a formal cryptographic model was introduced. Several later attempts either failed to achieve privacy or only bounded by a constant the (security) probability that a cheating server convinces a client of an incorrect result. In this paper we solve this problem for a large class of cyclic groups, thus making our solutions applicable to many cryptosystems in the literature that are based on the hardness of the discrete logarithm problem or on related assumptions. Our main protocol satisfies natural correctness, security, privacy and efficiency requirements, where the security probability is exponentially small. In our main protocol, with very limited offline computation and server computation, the client can delegate an exponentiation to an exponent of the same length as a group element by performing an exponentiation to an exponent of short length (i.e., the length of a statistical parameter). We also show an extension protocol that further reduces client computation by a constant factor, while increasing offline computation and server computation by about the same factor
Delegating a Product of Group Exponentiations with Application to Signature Schemes
Many public-key cryptosystems and, more generally, cryptographic protocols, use group exponentiations as important primitive operations. To expand the applicability of these solutions to computationally weaker devices, it has been advocated that a computationally weaker client (i.e., capable of performing a relatively small number of modular multiplications) delegates such primitive operations to a computationally stronger server. Important requirements for such delegation protocols include privacy of the client's input exponent and security of the client's output, in the sense of detecting, except for very small probability, any malicious server's attempt to convince the client of an incorrect exponentiation result. Only recently, ecient protocols for the delegation of a xed-based exponentiation, over cyclic and RSA-type groups with certain properties, have been presented and proved to satisfy both requirements. In this paper we show that a product of many xed-base exponentiations, over a cyclic groups with certain properties, can be privately and securely delegated by keeping the client's online number of modular multiplications only slightly larger than in the delegation of a single exponentiation. We use this result to show the rst delegations of entire cryptographic schemes: the well-known digital signature schemes by El-Gamal, Schnorr and Okamoto, over the q-order subgroup in Zp, for p; q primes, as well as their variants based on elliptic curves. Previous ecient delegation results seem limited to the delegation of single algorithms within cryptographic schemes
- …