Compact Zero-Knowledge Proofs of Small Hamming Weight

Abstract

We introduce a new technique that allows to give a zeroknowledge proof that a committed vector has Hamming weight bounded by a given constant. The proof has unconditional soundness and is very compact: It has size independent of the length of the committed string, and for large fields, it has size corresponding to a constant number of commitments. We show five applications of the technique that play on a common theme, namely that our proof allows us to get malicious security at small overhead compared to semi-honest security: (1) actively secure k-out-of-n OT from black-box use of 1-out-of-2 OT, (2) separable accountable ring signatures, (3) more efficient preprocessing for the TinyTable secure two-party computation protocol, (4) mixing with public verifiability, and (5) PIR with security against a malicious client.

Efficient Cloud-based Secret Shuffling via Homomorphic Encryption

“…The first efficient non-interactive zero-knowledge proof for proving that a mix shuffled correctly is proposed in [19]. A description of how the permutation used by a mix can be constructed by multiple parties is given in [10].…”

“…These rerandomized ciphertexts E ′ 1 (x ′ ρi ) form sequence X = (..., E ′ 1 (x ′ ρi ), ...). From ( 9), (10), and (11), it follows that these ciphertexts encrypt the same plaintexts as the ciphertexts E 1 (x ′ ρi ) ∈ X ′ and therefore also the same plaintexts as the ciphertexts E 1 (x i ) ∈ X. From (10), it follows that the rerandomized ciphertexts E ′ 1 (x i ) ∈ X and the non-rerandomized ciphertexts E 1 (x i ) ∈ X that encrypt the same secret input x i are different from each other, i.e., E ′…”