A new notion of soundness in bare public-key model

SHC Cheung,XT Deng,CH Lee,YL Zhao

2003-01-01

Abstract:A new notion of soundness in bare public-key (BPK) model is presented. This new notion just lies in between one-time soundness and sequential soundness and its reasonableness is justified in the context of resettable zero-knowledge when resettable zero-knowledge prover is implemented by smart card.

What problem does this paper attempt to address?

A New Notion of Soundness in Bare Public-Key Model.

Shirley H. C. Cheung,Xiaotie Deng,Chan H. Lee,Yunlei Zhao

DOI: https://doi.org/10.1007/3-540-36413-7_23

2002-01-01

Abstract:A new notion of soundness in bare public-key (BPK) model is presented. This new notion just lies in between one-time soundness and sequential soundness and its reasonableness is justified in the context of resettable zero-knowledge when resettable zero-knowledge prover is implemented by smart card.
Resettable Zero Knowledge with Concurrent Soundness in the Bare Public-Key Model under Standard Assumption

Yi Deng,Dongdai Lin

DOI: https://doi.org/10.1007/978-3-540-79499-8_11

2008-01-01

Abstract:In this paper we present the first constant round resettable zero knowledge arguments with concurrent soundness for $\mathcal{NP}$ in the bare public-key (BPK for short) model assuming only collision-resistant hash functions against polynomial-time adversaries. This resolves the problem whether there exist such protocols for $\mathcal{NP}$ in BPK model without assuming sub-exponential hardness. In our protocol, the resettable zero knowledge is demonstrated via a black-box simulator, while the concurrent soundness is proved by using the malicious prover strategy in non-black-box manner.
Concurrent/Resettable Zero-Knowledge with Concurrent Soundness in the Bare Public-Key Model and Its Applications.

Yunlei Zhao

DOI: https://doi.org/10.1007/3-540-39200-9_8

2003-01-01

Abstract:In this work, we investigate concurrent knowledge-extraction (CKE) and concurrent non-malleability (CNM) for concurrent (and stronger, resettable) ZK protocols in the bare public-key model. We formulate, driven by concrete attacks, and achieve CKE for constant-round concurrent/resettable arguments in the BPK model under standard polynomial assumptions. We get both generic and practical implementations. Here, CKE is a new concurrent verifier security that is strictly stronger than concurrent soundness in public-key model. We investigate, driven by concrete attacks, and clarify the subtleties in formulating CNM in the public-key model. We then give a new (augmented) CNM formulation in the public-key model and a construction of CNMZK in the public-key model satisfying the new CNM formulation.
Resettable Zero-Knowledge In The Weak Public-Key Model

Yl Zhao,Xt Deng,Ch Lee,H Zhu

DOI: https://doi.org/10.1007/3-540-39200-9_8

2003-01-01

Abstract:A new public-key model for resettable zero-knowledge (rZK) protocols, which is an extension and generalization of the upper-bounded public-key (UPK) model introduced by Micali and Reyzin [EuroCrypt'01, pp. 373-393], is introduced and is named weak public-key (WPK) model. The motivations and applications of the WPK model are justified in the distributed smart-card/server setting and it seems more preferable in practice, especially in E-commerce over Internet. In this WPK model a 3-round (optimal) black-box resettable zero-knowledge argument with concurrent soundness for NP is presented assuming the security of RSA with large exponents against subexponential-time adversaries. Our result improves Micali and Reyzin's result of resettable zero-knowledge argument with concurrent soundness for NP in the UPK model. Note that although Micali and Reyzin' protocol satisfies concurrent soundness in the UPK model, but it does not satisfy even sequential soundness in our WPK model.Our protocol works in a somewhat "parallel repetition" manner to reduce the error probability and the black-box zero-knowledge simulator works in strict polynomial time rather than expected polynomial time. The critical tools used are: verifiable random functions introduced by Micali, Rabin and Vadhan [FOCS'99, pp. 120-130], zap presented by Dwork and Naor [FOCS'00, pp. 283-293] and complexity leveraging introduced by Canetti, Goldreich, Goldwasser and Micali [STOC'00, pp. 235-244].
Generic and Practical Resettable Zero-Knowledge in the Bare Public-Key Model

Moti Yung,Yunlei Zhao

DOI: https://doi.org/10.1007/978-3-540-72540-4_8

2007-01-01

Abstract:We present a generic construction for constant-round concurrently sound resettable zero-knowledge (rZK-CS) arguments for NP in the bare public-key (BPK) model under any (sub-exponentially strong) one-way function (OWF), which is a traditional assumption in this area. The generic construction in turn allows round-optimal implementation for NP still under general assumptions, and can be converted into a highly practical instantiation (under specific number-theoretic assumptions) for any language admitting Sigma-protocols. Further, the rZK-CS arguments developed in this work also satisfy a weak (black-box) concurrent knowledge-extract ability property as proofs of knowledge, in which case some super-polynomial-time assumption is intrinsic.
Concurrently Knowledge-Extractable Resettable-ZK in the Bare Public-Key Model

Moti Yung,Yunlei Zhao

2006-01-01

Abstract:We present constant-round concurrently knowledge-extractable black-box resettable zero-knowledge (rZK-CKE) arguments forNP in the bare public-key (BPK) model. We give minimal (sub-exponential) hardness assumption based protocols as well as round-optimal protocols (still under general hardness assumptions). To our knowledge, our protocols are the first ZK protocols that provably provide both resettable/concurrent prover security and concurrent verifier security in public-key models. Here, the notion of concurrent knowledge-extractability roughly means that no malicious polynomial-time prover can convince an honest verifier of any (whether false or true) statement without “knowing” a corresponding NP-witness even by concurrently interleaving interactions in public-key models when verifiers register public-keys. We show that concurrent knowledge-extractability is strictly stronger than “concurrent soundness” (under any sub-exponentially strong one-way permutation) for concurrently proving NP statements to honest verifiers with public-keys. In particular, we show that previous concurrent zero-knowledge protocols in the BPK model that achieved concurrent soundness security and are also traditional arguments of knowledge actually fail to satisfy this stronger security notion (this is demonstrated by concrete attacks). Our work deepens the understanding of the subtleties of concurrent verifier security in public-key settings, and may serve as building blocks in designing other round-efficient concurrently secure protocols in public-key models that use, in particular, argument of knowledge (AOK) protocols as building blocks. RSA Laboratories and Department of Computer Science, Columbia University, New York, NY, USA. moti@cs.columbia.edu Software School, School of Information Science and Engineering, Fudan University, Shanghai 200433, China.
Constant-Round Concurrently-Secure Rzk in the (real) Bare Public-Key Model

Moti Yung,Yunlei Zhao

2005-01-01

Abstract:We present constant-round concurrently secure (sound) resettable zero-knowledge (rZK-CS) arguments in the bare public-key (BPK) model. Our constructions deal with general NP ZK-arguments as well as with highly efficient ZK-arguments for number-theoretic languages, most relevant to identification scenarios. These are the first constant-round protocols of this type in the original real BPK model, where nothing is assured about public-keys generated by malicious verifiers. As part of this work, we develop a one-round trapdoor commitment scheme that is based on any one-way permutation, which is of independent interest and, in particular, can be used to reduce the round-complexity of other cryptographic protocols involving trapdoor commitments.
Concurrently Non-malleable Black-Box Zero Knowledge in the Bare Public-Key Model

Yi Deng,Giovanni Crescenzo,Dongdai Lin,Dengguo Feng

DOI: https://doi.org/10.1007/978-3-642-03351-3_10

2009-01-01

Abstract:In this paper we study the possibility of reducing the setup assumptions under which concurrent non-malleable zero knowledge protocol can be realized. A natural model choice is the bare public-key (BPK) model of [6], a model with very minimal setup assumptions. Our main contribution is to show in this model the following about constant-round concurrent non-malleable black-box zero-knowledge arguments. They can be constructed from any one-way function for any language in $\mathcal{NP}$. Here, our construction takes 5 rounds, and we can reduce it to a 4-round (round-optimal) argument under existence of one-way permutations. Under number-theoretic assumptions, they admit a time-efficient instantiation for some specific $\mathcal{NP}$ languages (e.g., all languages having efficient Σ protocols, for which we can implement our construction using only $\mathcal{O}(1)$ modular exponentiations). Compared to the non-black-box construction in a concurrent work of [OPV, ICALP 2008] in this model, our protocol (even the construction from one-way function) is significantly more time- and round-efficient and can be based on more general assumptions.
Improvements on Non-Interactive Zero-Knowledge Proof Systems Related to Quadratic Residuosity Languages.

Wei Liu,Jian Weng,Bingsheng Zhang,Kai He,Junjie Huang

DOI: https://doi.org/10.1016/j.ins.2022.09.026

IF: 8.1

2022-01-01

Information Sciences

Abstract:Non-interactive zero-knowledge (NIZK) proof systems are very useful for statement verification without interaction in cryptography; they entail just one message, called the proof, that convinces the verifier of the truth of the statement without leaking any extra information. Many NIZK proof systems are related to quadratic residuosity languages and follow three main steps. First, the prover and the verifier sample a common reference string (CRS) in some particular form. Second, the prover proves that n is a Blum integer (BL , n = p 1 t 1 · p 2 t 2, where p 1 and p 2 are different primes both congruent to 3 modulo 4, and t 1 and t 2 are odd). Third, various statements (e.g., NQR n , OR n , AND n , T ( k , t ), and 3 SAT) can be proven by the prover based on the properties of BL . In this study, we improve the NIZK proof system for n ∈ BL based on the special distribution of the square roots modulo n and embed this proof in the third step. Moreover, we show that the CRS can be sampled more efficiently using the improved process.
Resettable cryptography in constant rounds --- the case of zero knowledge

Yi Deng,Dengguo Feng,Vipul Goyal,Dongdai Lin,Amit Sahai,Moti Yung

DOI: https://doi.org/10.1007/978-3-642-25385-0_21

2011-01-01

Abstract:A fundamental question in cryptography deals with understanding the role that randomness plays in cryptographic protocols and to what extent it is necessary. One particular line of works was initiated by Canetti, Goldreich, Goldwasser, and Micali (STOC 2000) who introduced the notion of resettable zero-knowledge, where the protocol must be zero-knowledge even if a cheating verifier can reset the prover and have several interactions in which the prover uses the same random tape. Soon afterwards, Barak, Goldreich, Goldwasser, and Lindell (FOCS 2001) studied the setting where the verifier uses a fixed random tape in multiple interactions. Subsequent to these works, a number of papers studied the notion of resettable protocols in the setting where only one of the participating parties uses a fixed random tape multiple times. The notion of resettable security has been studied in two main models: the plain model and the bare public key model (also introduced in the above paper by Canetti et. al.). In a recent work, Deng, Goyal and Sahai (FOCS 2009) gave the first construction of a simultaneous resettable zero-knowledge protocol where both participants of the protocol can reuse a fixed random tape in any (polynomial) number of executions. Their construction however required O(nε) rounds of interaction between the prover and the verifier. Both in the plain as well as the BPK model, this construction remain the only known simultaneous resettable zero-knowledge protocols. In this work, we study the question of round complexity of simultaneous resettable zero-knowledge in the BPK model. We present a constant round protocol in such a setting based on standard cryptographic assumptions. Our techniques are significantly different from the ones used by Deng, Goyal and Sahai.
Concurrently Non-Malleable Zero Knowledge in the Authenticated Public-Key Model

Yi Deng,Giovanni Di Crescenzo,Dongdai Lin

2006-01-01

Abstract:We consider a type of zero-knowledge protocols that are of interest for their practical applications within networks like the Internet: efficient zero-knowledge arguments of knowledge that remain secure against concurrent man-in-the-middle attacks. In an effort to reduce the setup assumptions required for efficient zero-knowledge arguments of knowledge that remain secure against concurrent man-in-the-middle attacks, we consider a model, which we call the Authenticated Public-Key (APK) model. The APK model seems to significantly reduce the setup assumptions made by the CRS model (as no trusted party or honest execution of a centralized algorithm are required), and can be seen as a slightly stronger variation of the Bare Public-Key (BPK) model from , and a weaker variation of the registered public-key model used in . We then define and study man-in-the-middle attacks in the APK model. Our main result is a constant-round concurrent non-malleable zero-knowledge argument of knowledge for any polynomial-time relation (associated to a language in 𝒩𝒫), under the (minimal) assumption of the existence of a one-way function family. Furthermore,We show time-efficient instantiations of our protocol based on known number-theoretic assumptions. We also note a negative result with respect to further reducing the setup assumptions of our protocol to those in the (unauthenticated) BPK model, by showing that concurrently non-malleable zero-knowledge arguments of knowledge in the BPK model are only possible for trivial languages.
Concurrent Knowledge Extraction in the Public-Key Model

Andrew C. Yao,Moti Yung,Yunlei Zhao

DOI: https://doi.org/10.1007/s00145-014-9191-z

2014-01-01

Journal of Cryptology

Abstract:Knowledge extraction is a fundamental notion, modeling machine possession of values (witnesses) in a computational complexity sense and enabling one to argue about the internal state of a party in a protocol without probing its internal secret state. However, when transactions are concurrent (e.g., over the Internet) with players possessing public-keys (as is common in cryptography), assuring that entities "know" what they claim to know, where adversaries may be well coordinated across different transactions, turns out to be much more subtle and in need of re-examination. Here, we investigate how to formally treat knowledge possession by parties (with registered public-keys) interacting over the Internet. Stated more technically, we look into the relative power of the notion of "concurrent knowledge-extraction" (CKE) in the concurrent zero-knowledge (CZK) bare public-key (BPK) model where statements being proven can be dynamically and adaptively chosen by the prover.We show the potential vulnerability of man-in-the-middle (MIM) attacks turn out to be a real security threat to existing natural protocols running concurrently in the public-key model, which motivates us to introduce and formalize the notion of CKE, alone with clarifications of various subtleties. Then, both generic (based on standard polynomial assumptions), and efficient (employing complexity leveraging in a novel way) implementations for NP are presented for constant-round (in particular, round-optimal) concurrently knowledge-extractable concurrent zero-knowledge (CZK-CKE) arguments in the BPK model. The efficient implementation can be further practically instantiated for specific number-theoretic language.
A More Efficient Computationally Sound Non-Interactive Zero-Knowledge Shuffle Argument

Helger Lipmaa,Bingsheng Zhang

DOI: https://doi.org/10.1007/978-3-642-32928-9_27

2013-01-01

Journal of Computer Security

Abstract:We propose a new non-interactive perfect zero-knowledge NIZK shuffle argument that, when compared with the only previously known efficient NIZK shuffle argument by Groth and Lu, has a small constant factor times smaller computation and communication, and is based on more standard computational assumptions. Differently from Groth and Lu who only prove the co-soundness of their argument under purely computational assumptions, we prove computational soundness under a necessary knowledge assumption. We also present a general transformation that results in a shuffle argument that has a quadratically smaller common reference string CRS and a small constant factor times longer argument than the original shuffle. This can be interpreted as a general technique of decreasing the offline cost of an arbitrary shuffle argument.
A note on the cramer-damgård identification scheme

Yunlei Zhao,Shirley H. C. Cheung,Binyu Zang,Bin Zhu

DOI: https://doi.org/10.1007/11600930_38

2005-01-01

Abstract:In light of the recent work of Micali and Reyzin on showing the subtleties and complexities of the soundness notions of zero-knowledge (ZK) protocols when the verifier has his public-key, we re-investigate the Cramer-Damgård intended-verifier identification scheme and show two man-in-the-middle attacks in some reasonable settings: one simple replaying attack and one ingenious interleaving attack. Our attacks are independent of the underlying hardness assumptions assumed.
Stronger Security Model for Public-Key Encryption with Equality Test

Yao Lu,Rui Zhang,Dongdai Lin

DOI: https://doi.org/10.1007/978-3-642-36334-4_5

2013-01-01

Abstract:In CT-RSA 2010, Yang et al. suggested a new category of probabilistic public-key encryption (PKE) schemes, called public-key encryption with equality test (PKET), which supports searching on ciphertexts without decrypting them. Typical applications include management of encrypted data in an outsourced database. They presented a construction in bilinear groups, and proved that it is one-way against chosen ciphertext attack (OW-CCA) in the random oracle model. We argue that OW-CCA security may be too weak for database applications, because partial information leakage from the ciphertext is not considered in the model. In this paper, we revisit the security models for PKET, and introduce a number of new security definitions. To remark, the weakest of our definitions is still stronger than OW-CCA. We then investigate relations among these security definitions. Finally, to illustrate the usefulness of our definitions, we analyze the security of a PKET scheme [24], showing the scheme actually provides much stronger security than that was proven previously.
A New Zero Knowledge Proof Protocal for Knowledge of SDH Pair(A,b)

陈鑫,王占君

DOI: https://doi.org/10.3969/j.issn.1009-3044.2010.21.053

2010-01-01

Abstract:This paper presents a new zero-knowledge protocol for SDH pair,which based on TOO/BB-E encryption from DBDH as-sumption.This protocal's security is stronger than reference[1].
Amortized Complexity of Zero-Knowledge Proofs Revisited: Achieving Linear Soundness Slack

Ronald Cramer,Ivan Damgard,Chaoping Xing,Chen Yuan

DOI: https://doi.org/10.1007/978-3-319-56620-7_17

2017-01-01

Abstract:We propose a new zero-knowledge protocol for proving knowledge of short preimages under additively homomorphic functions that map integer vectors to an Abelian group. The protocol achieves amortized efficiency in that it only needs to send O(n) function values to prove knowledge of n preimages. Furthermore we significantly improve previous bounds on how short a secret we can extract from a dishonest prover, namely our bound is a factor O(k) larger than the size of secret used by the honest prover, where k is the statistical security parameter. In the best previous result, the factor was O(k(log k) n). Our protocol can be applied to give proofs of knowledge for plaintexts in (Ring-) LWE-based cryptosystems, knowledge of preimages of homomorphic hash functions as well as knowledge of committed values in some integer commitment schemes.
Security Analysis and Improvement of A Zero-knowledge Proof Identification Scheme

Zhang Huqiang,Hong Peilin,Li Jinsheng

DOI: https://doi.org/10.3969/j.issn.1009-8054.2006.11.064

2006-01-01

Abstract:We point out secure weakness of the Zero-knowledge proof scheme proposed by Sultan Almuhammadi and Clifford Neuman[1] in parameter selecting of public key, and analyze it from calculation of discrete logarithm. Then we propose a new Zero-knowledge proof identification scheme by combining with the effectual cipher key selection method in DSA. The analysis shows that the new scheme is secure, efficient and 1/3 faster than Schnorr's.
Efficient Concurrent Zero Knowledge Arguments for NP in the Bare Public-Key Model

DENG Yi,LIN Dong-Dai

DOI: https://doi.org/10.3724/sp.j.1001.2008.00468

2008-01-01

Journal of Software

Abstract:This paper shows how to efficiently transform any 3-round public-coin honest verifier zero knowledge argument system for any language in NP into a 4 round (round-optimal) concurrent zero knowledge argument for the same language in the bare public-key model. The transformation has the following properties: 1) incurs only O(1) (small constant, about 20) additional modular exponentiations. Compared to the concurrent zero knowledge protocol proposed by Di Crescenzo and Visconti in ICALP 2005, in which their transformation requires an overhead of Θ(n), the protocol is significantly more efficient under the same intractability assumptions; 2) yields a perfect zero knowledge argument under DL assumption. Note that the Di Crescenzo, et al.’s argument system enjoys only computational zero knowledge property. The transformation relies on a specific 3-round honest verifier zero knowledge proof of knowledge for committed discrete log. Such protocols that require only O(1) modular exponentiations based on different kinds of commitment scheme are developed and they may be of independent interest.
Public Key Cryptosystems Secure Against Memory Leakage Attacks

Shi-Feng Sun,Shuai Han,Dawu Gu,Shengli Liu

DOI: https://doi.org/10.1049/iet-ifs.2015.0195

2016-01-01

IET Information Security

Abstract:The authors present a new general construction of public key encryption (PKE) based on the restricted subset membership (RSM) assumption, which can achieve the bounded-memory leakage resilient security and the auxiliary-input leakage resilient security simultaneously. The construction is BHHO-type, as Brakerski et al. work, but the message space is much larger and the proof is more concise benefiting from the RSM assumption. Instantiating the construction with the QR assumption, the authors get the first QR-based auxiliary-input secure PKE with a larger message space than {0,1}. Moreover, the authors generalise the Goldreich-Levin theorem to large rings. This theorem helps to improve the construction to achieve the same security level with fewer public parameters and shorter ciphertexts compared with Brakerski et al. work. For the bounded-memory leakage resilient security, the construction can achieve leakage rate of 1-o(1) and avoid the dependence between the message length and the amount of leakage. Based on the general construction, the authors also can achieve both bounded-memory leakage resilient chosen ciphertext attack (CCA) security and the auxiliary-input leakage resilient CCA security via the well-known Naor-Yung paradigm.

A new notion of soundness in bare public-key model

A New Notion of Soundness in Bare Public-Key Model.

Resettable Zero Knowledge with Concurrent Soundness in the Bare Public-Key Model under Standard Assumption

Concurrent/Resettable Zero-Knowledge with Concurrent Soundness in the Bare Public-Key Model and Its Applications.

Resettable Zero-Knowledge In The Weak Public-Key Model

Generic and Practical Resettable Zero-Knowledge in the Bare Public-Key Model

Concurrently Knowledge-Extractable Resettable-ZK in the Bare Public-Key Model

Constant-Round Concurrently-Secure Rzk in the (real) Bare Public-Key Model

Concurrently Non-malleable Black-Box Zero Knowledge in the Bare Public-Key Model

Improvements on Non-Interactive Zero-Knowledge Proof Systems Related to Quadratic Residuosity Languages.

Resettable cryptography in constant rounds --- the case of zero knowledge

Concurrently Non-Malleable Zero Knowledge in the Authenticated Public-Key Model

Concurrent Knowledge Extraction in the Public-Key Model

A More Efficient Computationally Sound Non-Interactive Zero-Knowledge Shuffle Argument

A note on the cramer-damgård identification scheme

Stronger Security Model for Public-Key Encryption with Equality Test

A New Zero Knowledge Proof Protocal for Knowledge of SDH Pair(A,b)

Amortized Complexity of Zero-Knowledge Proofs Revisited: Achieving Linear Soundness Slack

Security Analysis and Improvement of A Zero-knowledge Proof Identification Scheme

Efficient Concurrent Zero Knowledge Arguments for NP in the Bare Public-Key Model

Public Key Cryptosystems Secure Against Memory Leakage Attacks