Efficient Lattice-Based Zero-Knowledge Arguments with Standard Soundness: Construction and Applications

Lattice-Based E-Cash, Revisited

“…We indeed note that, as of writing, most of our building blocks (zero-knowledge proofs, PRFs, etc) remain complex tools that can hardly compete with their pairing-based counterparts. This is highlighted by the recent paper by Yang et al [38] showing that existing (insecure) lattice e-cash constructions [27,38], which use building blocks similar to ours, generate transactions ranging from 260 MB to 720 TB. Fortunately, any future improvements of these tools could easily be leveraged by our construction.…”

“…Actually, two spendings from different users may even be considered as a double-spending by the system. As a consequence, the security proofs of the e-cash construction of Libert et al [27] and of a subsequent improvement by Yang et al [38] (the only schemes relying on quantum-resistant computational assumptions) are invalid and there is no known simple fix.…”

“…As of today, instantiating the Bourse et al framework [10] from lattices would thus require to translate all statements to be proved into Boolean circuits. This would be much more expensive (by several orders of magnitude) than what we can hope for by leveraging the most efficient zero-knowledge techniques in standard lattices [38,9].…”

“…Indeed, NIZK proofs are notoriously hard to produce in the lattice setting, at least compared to their counterparts in cyclic groups. We start from a very recent result by Yang et al [38] which provides a protocol capturing many interesting lattice-related relations and show that it can be used to prove the statements required by our e-cash system. This is far from trivial as, in particular, spenders need to prove their correct composed evaluation of a pseudo-random function and a lossy trapdoor function using different parameters for the two primitives.…”

RLWE-Based Zero-Knowledge Proofs for Linear and Multiplicative Relations

“…Exact Lattice-Based ZKPoK are therefore an active field of research, with very recent efficient constructions for some lattice statements including linear equations with short solutions and matrix-vector relations [27] by Yang et al, new techniques when a cyclotomic polynomial fully splits in linear factors [5] by Bootle et al and new recent Stern-based contributions for proving integer relations [15] and matrix-vector relations [16] by Libert et al…”