advertisement

Square Span Programs with Applications to Succinct NIZK Arguments George Danezis, University College London Cédric Fournet, Microsoft Research Jens Groth, University College London Markulf Kohlweiss, Microsoft Research Non-interactive zero-knowledge argument Common reference string Statement: ∈ , ∈ OK Proof: Zero-knowledge: Prover Nothing but truth revealed Soundness: Verifier Statement is true Applications NIZK arguments guarantee honesty (soundness), yet also preserve privacy (zeroknowledge) Our contribution • NIZK argument – Perfect correctness – Perfect zero-knowledge – Computational soundness • Knowledge extractor assumptions using pairings • Conceptually simple – New characterization of NP as Square Span Programs • Small size – Four group element proofs Technical path • Relation for NP-language given by circuit 1 2 3 4 • Characterize satisfiability of as constraints ∈ {0,2} • Rewrite constraints as square span program divides ∑ 2 −1 • Succinct NIZK argument for square span program = (, , , ) Example • Consider circuit with single XOR-gate 0 = 1 ⊕ 2 • Satisfiability corresponds to the constraints 1 , 2 ∈ 0,1 1 + 1 + 2 ∈ {0,2} • Which we can write 0 0 1 = 1, 1 , 2 2 0 1 ∈ 0,2 3 0 2 1 • This is satisfied if and only if for all columns − 1 2 =1 Example continued • Define = + 1 − 1 0 = − 2 1 = 1 − 2 = 1 + • Chosen such that 0 −1 0 1 0 (0) −1 −1 0 1 −1 1 1 1 (0) = 2 0 1 0 2 1 2 (−1) 2 (1) 2 (0) • Then − 1 divides 2 = 1 for all if and only if 0 + 1 1 + 2 2 2 −1 • Using techniques presented later we can use the latter equation in an NIZK argument Characterizing circuit satisfiability as a set of integer constraints 4 0 1 • Consider a circuit 2 with wires 0 , … , 3 • The circuit is satisfiable if all wires ∈ {0,1}, and they respect all the gates, and the output is 1 • Write the wires as a vector = 0 , 1 , … , The condition ∈ 0,1 can be written ∈ 0,1 +1 – Could omit trivial checks, e.g., we know 0 = 1 for satisfied circuit and we may know some inputs 1 , … , ℓ ∈ {0,1} Linearization of the gates • Fan-in 2 gates can be linearized – For the XOR-gate we have for , , ∈ {0,1} ⊕ = if and only if + + ∈ 0,2 – For the NAND-gate we have for , , ∈ 0,1 ¬ ∧ = if and only if + + 2c − 2 ∈ {0,1} • In our paper we show that by multiplying some equations by 2, we can write all non-trivial fan-in 2 gates on the form + + + ∈ {0,2} Characterizing circuit satisfiability as constraints on an affine map • We write the gate equations in a matrix such that the wires respect the gates if and only if ∈ 0,2 • Combined with the constraint ∈ {0,1}+1 we get the circuit is satisfiable if and only if = 2| ∈ {0,2}++1 • The constants are small, so the equivalence with circuit satisfiability also holds over for ≥ 8 Technical path • Relation for NP-language given by circuit 1 2 3 4 • Characterize satisfiability of as constraints ∈ {0,2} • Rewrite constraints as square span program divides ∑ 2 −1 • Succinct NIZK argument for square span program = (, , , ) Square span program Quadratic span programs • A square span program consists of polynomials Two sequences of polynomials: 0 , … , () divides , () with () < deg = ∑ deg ⋅ ∑ Quadratic arithmetic programs sequences polynomials • We sayThree a square spanofprogram over accepts an () divides ∑ℓ ⋅ ∑ − ∑ () input 1 , … , ℓ ∈ 0,1 if and only if there exists ℓ+1 , … , ∈ such that 2 divides =0 −1 using 0 = 1 • We say a square span program accepts a language From affine map constraints to SSPs • Earlier 1 2 3 4 ∈ {0,2} over • Pick distinct points 1 , … , ∈ • Define = ∏( − ) • Define 0′ (), 1 , … , () such that 0 ′ 1 … 0 ′( ) ⋮ ⋱ ⋮ = (1 ) … ( ) and 0 = 0′ − 1 Why does the square span program work? • We want for all columns that ∈ {0,2} or equivalently that − 1 ∈ {−1,1} (over ) • By the choice of polynomials 0 , … , () we have ∑ = − 0 1 = − 1 • This gives us the condition ∑ • So ∈ 0,2 2 =1 if and only if all are roots in the polynomial ∑ 2 −1 • I.e., = ∏( − ) divides ∑ 2 −1 Technical path • Relation for NP-language given by circuit 1 2 3 4 • Characterize satisfiability of as constraints ∈ {0,2} • Rewrite constraints as square span program divides ∑ 2 −1 • Succinct NIZK argument for square span program = (, , , ) Prime order bilinear groups • Gen(1 ) generates (, G, G, G , ) • G, G, G finite cyclic groups of prime order • Pairing : G × G → G – , = , – G = , G = , G = 〈 , 〉 • Deciding group membership, group operations, and bilinear pairing efficiently computable 16 • Statement: (1 , … , ℓ ) accepted by SSP • Common reference string: , ← (, , … , , , ℓ+1 , … , , , , ) • Argument: Pick ← and compute ℎ() such that ℎ = ∑ + 2 Compute = (, , , ) as = (∑>ℓ + ) = ℎ = ∑>ℓ + = ∑ −1 + • Verification: Compute = ∑≤ℓ and check , = , , = , , = (, ) , −1 Succinct NIZK argument • • • • Pinocchio Argument: 8 elements Perfect correctness Computation: Better when statements involve Perfect zero-knowledge Computational soundness additions or multiplications instead of – Assuming d-PKE, d-PDH, and d-TSDH assumptions fan-in 2 gates since it is based on quadratic Succinct – 4 group elements ≈ 160 bytes arithmetic programs • Efficient – Prover: ( log ) multiplications and 3 exponentiations – Verifier: ℓ + 1 multiplications and 6 pairings ≈ 6ms Summary • Introduced square span programs – Conceptually simple type of quadratic span programs • Showed they are NP-complete 1 2 3 4 ∈ {0,2} divides • Succinct NIZK argument – 4 group elements = (, , , ) ∑ 2 −1