Slide - UCL Computer Science

advertisement
Square Span Programs with Applications to
Succinct NIZK Arguments
George Danezis, University College London
Cédric Fournet, Microsoft Research
Jens Groth, University College London
Markulf Kohlweiss, Microsoft Research
Non-interactive zero-knowledge argument
Common reference string
Statement:  ∈ 
,  ∈ 
OK
Proof: 
Zero-knowledge:
Prover
Nothing but truth revealed
Soundness:
Verifier
Statement is true
Applications
NIZK arguments guarantee
honesty (soundness), yet
also preserve privacy (zeroknowledge)
Our contribution
• NIZK argument
– Perfect correctness
– Perfect zero-knowledge
– Computational soundness
• Knowledge extractor assumptions using pairings
• Conceptually simple
– New characterization of NP as Square Span Programs
• Small size
– Four group element proofs
Technical path
• Relation  for NP-language  given by circuit 
1
2
3
4
• Characterize satisfiability of  as constraints
 ∈ {0,2}
• Rewrite constraints as square span program
 
divides
∑  
2
−1
• Succinct NIZK argument for square span program
 = (,  ,  , )
Example
• Consider circuit with single XOR-gate 0 = 1 ⊕ 2
• Satisfiability corresponds to the constraints
1 , 2 ∈ 0,1
1 + 1 + 2 ∈ {0,2}
• Which we can write
0 0 1
 = 1, 1 , 2 2 0 1 ∈ 0,2 3
0 2 1
• This is satisfied if and only if for all columns 
 − 1
2
=1
Example continued
• Define
  =  + 1  − 1  0  = − 2
1  = 1 − 
2  = 1 + 
• Chosen such that
0 −1 0 1
0 (0)
−1 −1 0
1 −1
1 1
1 (0) = 2
0 1
0
2 1
2 (−1) 2 (1) 2 (0)
• Then  − 1
  divides
2
= 1 for all  if and only if
0  + 1 1  + 2 2 
2
−1
• Using techniques presented later we can use the
latter equation in an NIZK argument
Characterizing circuit satisfiability as a set of
integer constraints

4
0
1
• Consider a circuit
2
with wires 0 , … ,  3
• The circuit is satisfiable if all wires  ∈ {0,1}, and
they respect all the gates, and the output is 1
• Write the wires as a vector  = 0 , 1 , … , 
The condition  ∈ 0,1 can be written  ∈ 0,1 +1
– Could omit trivial checks, e.g., we know 0 = 1 for satisfied
circuit and we may know some inputs 1 , … , ℓ ∈ {0,1}
Linearization of the gates
• Fan-in 2 gates can be linearized
– For the XOR-gate we have for , ,  ∈ {0,1}
 ⊕  =  if and only if  +  +  ∈ 0,2
– For the NAND-gate we have for , ,  ∈ 0,1
¬  ∧  =  if and only if  +  + 2c − 2 ∈ {0,1}
• In our paper we show that by multiplying some
equations by 2, we can write all non-trivial fan-in 2
gates on the form  +  +  +  ∈ {0,2}
Characterizing circuit satisfiability as
constraints on an affine map
• We write the gate equations in a matrix  such
that the wires respect the  gates if and only if
 ∈ 0,2 
• Combined with the constraint  ∈ {0,1}+1 we get
the circuit is satisfiable if and only if
 =  2| ∈ {0,2}++1
• The constants are small, so the equivalence with
circuit satisfiability also holds over  for  ≥ 8
Technical path
• Relation  for NP-language  given by circuit 
1
2
3
4
• Characterize satisfiability of  as constraints
 ∈ {0,2}
• Rewrite constraints as square span program
 
divides
∑  
2
−1
• Succinct NIZK argument for square span program
 = (,  ,  , )
Square span program
Quadratic span programs
• A square span program consists of polynomials
Two sequences of polynomials:
0  , … , ()
 divides
, () with
  ()
< deg   =
∑ deg
  ⋅ ∑

Quadratic arithmetic programs
sequences
polynomials
• We sayThree
a square
spanofprogram
over  accepts an
() divides ∑ℓ   ⋅ ∑   − ∑  ()
input 1 , … , ℓ ∈ 0,1 if and only if there exists
ℓ+1 , … ,  ∈  such that
2

 
divides
  
=0
−1
using 0 = 1
• We say a square span program accepts a language
From affine map constraints to SSPs
• Earlier
1
2
3
4
 ∈ {0,2} over 
• Pick distinct points 1 , … ,  ∈ 
• Define   = ∏( −  )
• Define 0′ (), 1  , … ,  () such that
0 ′ 1 … 0 ′( )
⋮
⋱
⋮
=
 (1 ) …  ( )
and 0  = 0′  − 1
Why does the square span program work?
• We want for all columns  that  ∈ {0,2} or
equivalently that  − 1 ∈ {−1,1} (over  )
• By the choice of polynomials 0  , … ,  () we
have ∑   =  − 0 1 =  − 1
• This gives us the condition ∑  
• So  ∈ 0,2

2
=1
if and only if all  are roots in the
polynomial ∑  
2
−1
• I.e.,   = ∏( −  ) divides
∑  
2
−1
Technical path
• Relation  for NP-language  given by circuit 
1
2
3
4
• Characterize satisfiability of  as constraints
 ∈ {0,2}
• Rewrite constraints as square span program
 
divides
∑  
2
−1
• Succinct NIZK argument for square span program
 = (,  ,  , )
Prime order bilinear groups
• Gen(1 ) generates (, G, G, G  , )
• G, G, G  finite cyclic groups of prime order 
• Pairing : G × G → G 
– 
 ,  
=  , 

– G =  , G =  , G  = 〈 ,  〉
• Deciding group membership, group operations,
and bilinear pairing efficiently computable
16
• Statement: (1 , … , ℓ ) accepted by SSP
• Common reference string: ,  ← 


(, , … ,  ,  , ℓ+1  , … ,   ,   , ,  )
• Argument: Pick  ←  and compute ℎ() such that
ℎ    = ∑ 

+  
2
Compute  = (,  ,  , ) as
 = (∑>ℓ    +  )  = ℎ 
 =  ∑>ℓ    + 
 =  ∑ 
−1
 + 
• Verification: Compute  =  ∑≤ℓ     and check
 ,  =  , 
  ,  =   , 

,   
= (, ) , 
−1
Succinct NIZK argument
•
•
•
•
Pinocchio
Argument: 8 elements
Perfect correctness
Computation: Better
when statements involve
Perfect zero-knowledge
Computational soundness additions or
multiplications instead of
– Assuming d-PKE, d-PDH, and d-TSDH
assumptions
fan-in 2 gates
since it is
based on quadratic
Succinct
– 4 group elements ≈ 160 bytes arithmetic programs
• Efficient
– Prover: ( log ) multiplications and 3 exponentiations
– Verifier: ℓ + 1 multiplications and 6 pairings ≈ 6ms
Summary
• Introduced square span programs
– Conceptually simple type of quadratic span programs
• Showed they are NP-complete
1
2
3
4
 ∈ {0,2}
 
divides
• Succinct NIZK argument
– 4 group elements  = (,  ,  , )
∑  
2
−1
Download
Related flashcards

Video game consoles

47 cards

Electronic circuits

13 cards

Consumer electronics

24 cards

Television technology

33 cards

Personal computers

49 cards

Create Flashcards