Concurrent Knowledge Extraction in the Public-Key Model

Abstract

Knowledge extraction is a fundamental notion, modelling machine possession of values (witnesses) in a computational complexity sense. The notion provides an essential tool for cryptographic protocol design and analysis, enabling one to argue about the internal state of protocol players without ever looking at this supposedly secret state. However, when transactions are concurrent (e.g., over the Internet) with players possessing public-keys (as is common in cryptography), assuring that entities "know" what they claim to know, where adversaries may be well coordinated across different transactions, turns out to be much more subtle and in need of re-examination. Here, we investigate how to formally treat knowledge possession by parties (with registered public-keys) interacting over the Internet. Stated more technically, we look into the relative power of the notion of "concurrent knowledge-extraction" (CKE) in the concurrent zero-knowledge (CZK) bare public-key (BPK) model.We show the potential vulnerability of man-in-the-middle (MIM) attacks turn out to be a real security threat to existing natural protocols running concurrently in the public-key model, which motivates us to introduce and formalize the notion of CKE. Then, both generic (based on standard polynomial assumptions) and efficient (employing complexity leveraging in a novel way) implementations for N P are presented for constant-round (in particular, round-optimal) concurrently knowledge-extractable concurrent zero-knowledge (CZK-CKE) arguments in the BPK model. The efficient implementation can be further high practically instantiated for specific number-theoretic language. Along the way, we discuss and clarify the various subtleties surrounding the security formulation and analysis, which provides insights into the complex CZK-CKE setting.

On Round-Optimal Zero Knowledge in the Bare Public-Key Model

“…In this paper we show subtle problems concerning security proofs of various cZK and rZK arguments in the BPK model [18,32,7,9,27,31,6,29], including all round-optimal constructions published so far.…”

“…We have given details to explain the problem with the simulation of Π MR , and under minor variations, all other results [18,32,7,9,27,31,6,29] suffer of similar problems. We will now focus on protocols that however could have a different simulation.…”

“…In the very specific case of rZK, since soundness is proved through complexity leveraging, the proof of soundness could go through. [29,28]. In the concurrently sound cZK protocol presented in [29,28], the simulator is required to commit in the second round to one of the two secret keys of the verifier.…”

“…A more recent result [6] obtains both round optimality and optimal complexity assumptions (i.e., OWFs) in a concurrently sound cZK AoK. More sophisticated notions of arguments of knowledge have been given in [10] and in [29,28]. Indeed these papers focus on concurrent knowledge extraction (under different formulations).…”

Constant-Round Concurrent Zero Knowledge in the Bounded Player Model

“…The bare public key model was proposed in [5] where, before any interaction starts, every player is required to declare a public key and store it in a public file (which never changes once the sessions start). In this model it is known how to obtain constant-round concurrent zero knowledge with concurrent soundness under standard assumptions [13,35,36,34]. This model has also been used for constant-round concurrent non-malleable zero knowledge [25] and various constant-round resettable and simultaneously resettable protocols [22,39,11,9,10,38,37,7].…”