Compact Group Signatures Without Random Oracles

Boyen, Xavier; Waters, Brent

doi:10.1007/11761679_26

Cited by 184 publications

(164 citation statements)

References 25 publications

Supporting

Mentioning

162

Contrasting

Unclassified

Order By: Relevance

“…Proof systems for NP that satisfy the zero knowledge and proof of knowledge properties are a powerful tool that enables a party to prove that he or she "knows" a secret satisfying certain properties, without revealing anything about the secret itself. Such proofs are important building blocks of many cryptographic tools, including secure computation [GMW87,BGW88], group signatures [BW06,Gro06], malleable proof systems [CKLM12], anonymous credentials [BCKL08], delegatable credentials [BCC + 09], electronic voting [KMO01, Gro05,Lip11], and many others. Known constructions of zero-knowledge proofs of knowledge are practical only when proving statements of special form that avoid generic NP reductions (e.g., proving pairing-product equations [Gro06]).…”

Section: Introductionmentioning

confidence: 99%

SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge

Ben–Sasson

Chiesa²,

Genkin

et al. 2013

Lecture Notes in Computer Science

420

259

View full text Add to dashboard Cite

Abstract. An argument system for NP is a proof system that allows efficient verification of NP statements, given proofs produced by an untrusted yet computationally-bounded prover. Such a system is non-interactive and publiclyverifiable if, after a trusted party publishes a proving key and a verification key, anyone can use the proving key to generate non-interactive proofs for adaptivelychosen NP statements, and proofs can be verified by anyone by using the verification key.We present an implementation of a publicly-verifiable non-interactive argument system for NP. The system, moreover, is a zero-knowledge proof-ofknowledge. It directly proves correct executions of programs on TinyRAM, a nondeterministic random-access machine tailored for efficient verification. Given a program P and time bound T , the system allows for proving correct execution of P , on any input x, for up to T steps, after a one-time setup requiringÕ(|P |·T ) cryptographic operations. An honest prover requiresÕ(|P |·T ) cryptographic operations to generate such a proof, while proof verification can be performed with only O(|x|) cryptographic operations. This system can be used to prove the correct execution of C programs, using our TinyRAM port of the GCC compiler.This yields a zero-knowledge Succinct Non-interactive ARgument of Knowledge (zk-SNARK) for program executions, in the preprocessing model -a powerful solution for delegating NP computations, with several features not achieved by previously-implemented primitives.Our approach builds on recent theoretical progress in the area. We present efficiency improvements and implementations of two main ingredients: 1. Given a C program, we produce a circuit whose satisfiability encodes the correctness of execution of the program. Leveraging nondeterminism, the generated circuit's size is merely quasilinear in the size of the computation. In particular, we efficiently handle arbitrary and data-dependent loops, control flow, and memory accesses. This is in contrast with existing "circuit generators", which in the general case produce circuits of quadratic size. 2. Given a linear PCP for verifying satisfiability of circuits, we produce a corresponding SNARK. We construct such a linear PCP (which, moreover, is zero-knowledge and very efficient) by building and improving on recent work on quadratic arithmetic programs.

show abstract

Section: Introductionmentioning

confidence: 99%

SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge

Ben–Sasson

Chiesa²,

Genkin

et al. 2013

Lecture Notes in Computer Science

420

259

View full text Add to dashboard Cite

show abstract

“…Although these schemes are secure in the random oracle model, Boyen-Waters [10,11] and Groth [25] proposed group signature schemes in the standard model. In particular, the Groth scheme applies efficient zero-knowledge proofs for bilinear groups, which are known as Groth-Sahai proofs [26].…”

Section: Related Workmentioning

confidence: 99%

Group Signature with Deniability: How to Disavow a Signature

Ishida

Emura

Hanaoka³

et al. 2016

Cryptology and Network Security

View full text Add to dashboard Cite

Group signatures are a class of digital signatures with enhanced privacy. By using this type of signature, a user can sign a message on behalf of a specific group without revealing his identity, but in the case of a dispute, an authority can expose the identity of the signer. However, in some situations it is only required to know whether a specific user is the signer of a given signature. In this case, the use of a standard group signature may be problematic since the specified user might not be the signer of the given signature, and hence, the identity of the actual signer will be exposed.Inspired by this problem, we propose the notion of a deniable group signature, where, with respect to a signature and a user, the authority can issue a proof showing that the specified user is NOT the signer of the signature, without revealing the actual signer. We also describe a fairly practical construction by extending the Groth group signature scheme (ASIACRYPT 2007). In particular, a denial proof in our scheme consists of 96 group elements, which is about twice the size of a signature in the Groth scheme. The proposed scheme is provably secure under the same assumptions as those of the Groth scheme.

show abstract

“…The situation changed radically when in 2008, after some promising advances towards making non-interactive proofs practical, ( [5,14]), Groth and Sahai ([16]) gave efficient non-interactive proofs of membership in the language of satisfiable quadratic equations in bilinear groups. Compared to previous work, their proposal had the advantage of considering a language which is both very natural and very general.…”

Section: Introductionmentioning

confidence: 99%

Stretching Groth-Sahai: NIZK Proofs of Partial Satisfiability

Ràfols

2015

Theory of Cryptography

View full text Add to dashboard Cite

Groth, Ostrovsky and Sahai constructed a non-interactive Zap for NP-languages by observing that the common reference string of their proof system for circuit satisfiability admits what they call correlated key generation. The latter means that it is possible to create from scratch two common reference strings in such a way that it can be publicly verified that at least one of them guarantees perfect soundness while it is computationally infeasible to tell which one. Their technique also implies that it is possible to have NIWI Groth-Sahai proofs for certain types of equations over bilinear groups in the plain model. We extend the result of Groth, Ostrovsky and Sahai in several directions. Given as input some predicate P computable by some monotone span program over a finite field, we show how to generate a set of common reference strings in such a way that it can be publicly verified that the subset of them which guarantees perfect soundness is accepted by the span program. We give several different flavors of the technique suitable for different applications scenarios and different equation types. We use this to stretch the expressivity of Groth-Sahai proofs and construct NIZK proofs of partial satisfiability of sets of equations in a bilinear group and more efficient Groth-Sahai NIWI proofs without common reference string for a larger class of equation types. Finally, we apply our results to significantly reduce the size of the signatures of the ring signature scheme of Chandran, Groth and Sahai or to have a more efficient proof in the standard model that a commitment opens to an element of a public list.

show abstract

Compact Group Signatures Without Random Oracles

Cited by 184 publications

References 25 publications

SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge

SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge

Group Signature with Deniability: How to Disavow a Signature

Stretching Groth-Sahai: NIZK Proofs of Partial Satisfiability

Contact Info

Product

Resources

About