A language-dependent cryptographic primitive

Concurrent Zero Knowledge Without Complexity Assumptions

“…To achieve concurrent security without relying on unproven assumptions, we observe that the standard verifier's commitments used in [28] can be replaced by instance-dependent commitments [36] (cf., [34]). A instance-dependent commitment, roughly speaking, is a commitment protocol that takes the problem instance x as an additional input, is binding on the yes instances (x ∈ Π Y ), and is hiding on the no instances (x ∈ Π N ).…”

“…All the problems listed-SD 1 1/2 , Quadratic Nonresiduosity, Graph NonIsomorphism, co-GapCVP γ and co-GapSVP γ , for γ = Ω( (n/ log n)) -have honest-verifier statistical zero-knowledge proofs [2,5,42,33], which can be made public-coin by [17]. In addition, they all have instance-dependent commitments [36,34].…”

“…One of the main tools for constructing zero-knowledge proofs are commitment schemes, and indeed the only use of complexity assumptions in the construction of zero-knowledge proofs for all of NP [5] is to obtain a commitment scheme (used by the prover to commit to the NP witness, encoded as, e.g., a 3-coloring of a graph). Our results rely on a relaxed notion of commitment, called an instance-dependent commitment scheme, 4 which is implicit in [35] and formally defined in [36,34,19]. Roughly speaking, for a language L (or, more generally, a promise problem), a instance-dependent commitment scheme for L is a commitment protocol where the sender and receiver algorithms also depend on the instance x.…”

“…As observed in [36], many natural problems, such as Graph Isomorphism and Quadratic Residuosity, have simple, unconditional instance-dependent commitment schemes. This is useful because in many constructions of zeroknowledge proofs (such as that of [5]), the hiding property of the commitment scheme is only used to establish the zero-knowledge property and the binding property of the commitment scheme is only used to establish soundness.…”

“…Since, by definition, the zero-knowledge property is only required when the input x is in the language, and the soundness condition is only required when x is not in the language, it suffices to use a instance-dependent commitment scheme. Specifically, if a language L ∈ NP (or even L ∈ IP) has a instancedependent commitment scheme, then L has a zero-knowledge proof [36] (see also [34,19]). …”