A Sender Verifiable Mix-Net and a New Proof of a Shuffle

Abstract

Abstract. We introduce the first El Gamal based mix-net in which each mix-server partially decrypts and permutes its input, i.e., no reencryption is necessary. An interesting property of the construction is that a sender can verify non-interactively that its message is processed correctly. We call this sender verifiability. The mix-net is provably UC-secure against static adversaries corrupting any minority of the mix-servers. The result holds under the decision Diffie-Hellman assumption, and assuming an ideal bulletin board and an ideal zero-knowledge proof of knowledge of a correct shuffle. Then we construct the first proof of a decryption-permutation shuffle, and show how this can be transformed into a zero-knowledge proof of knowledge in the UC-framework. The protocol is sound under the strong RSA-assumption and the discrete logarithm assumption. Our proof of a shuffle is not a variation of existing methods. It is based on a novel idea of independent interest, and we argue that it is at least as efficient as previous constructions.

Verification of a Paillier Based Shuffle Using Representations of the Symmetric Group

“…There are more recent works other than [27], where better efficiencies has been achieved ( [19,33]) in computation. In [19], the comparison in efficiency has been made among verification protocols including the one by Peng et al [27] and the one by Groth and Lu [19].…”

“…Roughly speaking, there are two kinds of proof system of mix-nets; one is optimistic and the other is verifiable proof system. The correctness of the shuffling of the whole mix-net is verified after the mix-net outputs the shuffling results in plain texts in optimistic proof system [17], while in verifiable proof system each mix server provides proofs of correctness of the shuffling [28,14,1,18,22,23,27,33].…”

Malleable Proof Systems and Applications

“…Related Work on Shuffling Ciphertexts. Shuffles and mixing in general were introduced by Chaum in 1981 [16], and the problem of verifiable shuffles was introduced by Sako and Kilian in 1995 [38]; the work on verifiable shuffles in the ensuing sixteen years has been extensive and varied [2,26,6,34,29,25,41,31]. In 1998, Abe [1] considered the problem of compact proofs of shuffles.…”

A Commitment-Consistent Proof of a Shuffle

“…The first rigorous definition of security was given by Abe and Imai [1], but they did not construct a scheme satisfying their construction. Wikström [29] gives the first definition of a universally composable (UC) mix-net, the first UC-secure construction, and also a more efficient UC-secure scheme [30]. An important building block in the construction of a mix-net is a so called proof of a shuffle that allows the mix-servers to prove that they follow the protocol.…”