International Association for Cryptologic Research (IACR)
Doi
Abstract
We finally close the long-standing problem of constructing a
noninteractive zero-knowledge (NIZK) proof system for any NP language
with security based on the plain Learning With Errors (LWE)
problem, and thereby on worst-case lattice problems. Our proof system
instantiates the framework recently developed by Canetti
et al. [EUROCRYPT\u2718], Holmgren and Lombardi [FOCS\u2718], and Canetti
et al. [STOC\u2719] for soundly applying the Fiat--Shamir transform using
a hash function family that is correlation intractable for a
suitable class of relations. Previously, such hash families were based
either on ``exotic\u27\u27 assumptions (e.g., indistinguishability
obfuscation or optimal hardness of certain LWE variants) or, more
recently, on the existence of circularly secure fully homomorphic
encryption (FHE). However, none of these assumptions are known to be
implied by plain LWE or worst-case hardness.
Our main technical contribution is a hash family that is correlation
intractable for arbitrary size-S circuits, for any polynomially
bounded S, based on plain LWE (with small polynomial approximation
factors). The construction combines two novel ingredients: a
correlation-intractable hash family for log-depth circuits
based on LWE (or even the potentially harder Short Integer Solution
problem), and a ``bootstrapping\u27\u27 transform that uses (leveled) FHE to
promote correlation intractability for the FHE decryption circuit to
arbitrary (bounded) circuits. Our construction can be
instantiated in two possible ``modes,\u27\u27 yielding a NIZK that is either
computationally sound and statistically zero knowledge
in the common random string model, or vice-versa in the common
reference string model