An Alternative Approach to Non-black-box Simulation in Fully Concurrent Setting

Abstract

We give a new proof of the existence of public-coin concurrent zero-knowledge arguments for NP in the plain model under the existence of collision-resistant hash function families, which was originally proven by Goyal (STOC'13). In the proof, we use a new variant of the non-black-box simulation technique of Barak (FOCS'01). An important property of our simulation technique is that the simulator runs in a straight-line manner in the fully concurrent setting. Compared with the simulation technique of Goyal, which also has such a property, the analysis of our simulation technique is (arguably) simpler.

Concurrent non-malleable zero-knowledge and simultaneous resettable non-malleable zero-knowledge in constant rounds

“…Below, we first recall the techniques in (Barak 2001;Chung et al 2015;Kiyoshima 2015) and then give an overview of our construction approach.…”

“…k-round protocols. In the protocol (Kiyoshima 2015), because their goal is to implement a statistically CNMZK argument system, instead of using a non-malleable commitment to commit the witness, they commit a random string (e.g., 0 n ). Thus, in their simulation-extractability proof, they can not directly use the extractability of the commitment scheme, instead they have to rewind the sWIAOK proof to extract the witness in the right.…”

“…Because our goal is to construct the constant-round concurrent non-malleable zero-knowledge protocol, so the non-malleable commitment scheme should be constant rounds, here we use the constant-round 4-robust one-one CCA-secure commitment scheme which first appeared in (Kiyoshima 2015) based Canetti et al (2010). Such commitment scheme can be based on the minimum assumption of the existence of one way functions.…”

“…Such commitment scheme can be based on the minimum assumption of the existence of one way functions. The difference from (Kiyoshima 2015) is that our protocol use the CCA-secure commitment scheme to commit the witness not the random string.…”

“…In their protocol, they used a special kind of commitment scheme called "mixed non-malleable commitment" scheme based on the DDH assumptions. Very recently, Kiyoshima (2015) achieved a poly(n) rounds statistical CNMZK argument system only assuming the existence of one-way functions. In their protocol, instead of using a non-malleable commitment to commit the real witness (see (Barak et al 2006;Lin et al 2010)), they used a constant-round k-robust one-one CCA-secure commitment (Canetti et al 2010;Lin and Pass 2012;Kiyoshima 2014;Goyal et al 2015) to commit a random string (e.g., 0 n ).…”