Abstract:A recent line of works on zero-knowledge (ZK) protocols with a vector oblivious linear function evaluation (VOLE)-based offline phase provides a new paradigm for scalable ZK protocols featuring fast proving and small prover memory. Very recently, Baum et al. (Crypto'23) proposed the VOLE-in-the-head technique, allowing such protocols to become publicly verifiable. Many practically efficient protocols for proving circuit satisfiability over any Galois field are implemented, while protocols over rings Z(2k) are significantly lagging behind, with only a proof-of-concept pioneering work called Appenzeller to Brie (CCS'21) and a first proposal called MozZ(2k) arella (Crypto'22). The ring Z(232) or Z(264), though highly important (it captures computation in real-life programming and the computer architectures such as CPU words), presents non-trivial difficulties because, for example, unlike Galois fields F-2k, the fraction of units in Z(2k) is 1/2. In this work, we first construct ZK protocols over a high degree Galois ring extension of Z(2k) (fraction of units close to 1) and then convert them to Z(2k) efficiently using amortization techniques. Our results greatly change the landscape of ZK protocols over Z(2k). (1) We propose a competing ZK protocol that has many advantages over the state-of-the-art MozZ(2k) arella. We remove the undesirable dependence of communication complexity on the security parameter, and achieve communication complexity strictly linear in the circuit size. Furthermore, our protocol has better concrete efficiency. For 40, 80 bits soundness on circuits over Z(232) and Z(264), we offer 1.15x-2.9x improvements in communication. (2) Inspired by the recently proposed interactive message authentication code technique (Weng et al., CCS'22), we construct a constant round ZK protocol over Z(2k) with sublinear (in the circuit size) communication complexity, which was previously achieved only over fields. (3) We show that the pseudorandom correlation generator approach can be adapted to efficiently implement VOLE over Galois rings, with analysis of the hardness of underlying LPN assumptions over Galois rings. (4) We adapt the VOLE-in-the-head technique to make it work for Z(2k), yielding publicly verifiable non-interactive ZK protocols over Z(2k) which preserve most of the efficiency metrics of the VOLE-based ZK protocols.

Generic Yet Practical ZK Arguments from Any Public-Coin HVZK

Generic yet Practical ( Statistical ) Zero-Knowledge from any Public-Coin HVZK ∗ †

Practical zero-knowledge arguments from ∑-protocols

Practical Zero-Knowledge Arguments from Σ-Protocols

Generic and Practical Resettable Zero-Knowledge in the Bare Public-Key Model

Efficient Concurrent Zero Knowledge Arguments for NP in the Bare Public-Key Model

Constant-Round Concurrently-Secure Rzk in the (real) Bare Public-Key Model

Unbounded Non-Malleable Non-Interactive Zero Knowledge Protocols for NP

More Efficient Zero-Knowledge Protocols over $$\mathbb {z}_{2^k}$$ Via Galois Rings

Interactive zero-knowledge with restricted random oracles

Oblivious Transfer from Zero-Knowledge Proofs, or How to Achieve Round-Optimal Quantum Oblivious Transfer and Zero-Knowledge Proofs on Quantum States

Indistinguishable Proofs of Work or Knowledge.

A Two-Round Honest-Verifier Zero-Knowledge Protocol

Benchmarking ZK-Friendly Hash Functions and SNARK Proving Systems for EVM-compatible Blockchains

Efficient Modular NIZK Arguments from Shift and Product

On Zero-Knowledge With Strict Polynomial-Time Simulation And Extraction From Differing-Input Obfuscation For Circuits

Experimental relativistic zero-knowledge proofs

A More Efficient Computationally Sound Non-Interactive Zero-Knowledge Shuffle Argument

Some Observations on Zap and Its Applications

Delegable Zk-Snarks with Proxies

Horst Meets Fluid-SPN: Griffin for Zero-Knowledge Applications.