From extractable collision resistance to succinct non-interactive arguments of knowledge, and back again

Abstract

The existence of non-interactive succinct arguments (namely, non-interactive computationally-sound proof systems where the verifier's time complexity is only polylogarithmically related to the complexity of deciding the language) has been an intriguing question for the past two decades. The question has gained renewed importance in light of the recent interest in delegating computation to untrusted workers. Still, other than Micali's CS proofs in the Random Oracle Model, the only existing candidate construction is based on an elaborate assumption that is tailored to the specific proposal [Di Crescenzo and Lipmaa, CiE '08]. We modify and re-analyze that construction:• We formulate a general and relatively mild notion of extractable collision-resistant hash functions (ECRHs), and show that if ECRHs exist then the modified construction is a non-interactive succinct argument (SNARG) for NP. Furthermore, we show that (a) this construction is a proof of knowledge, and (b) it remains secure against adaptively chosen instances. These two properties are arguably essential for using the construction as a delegation of computation scheme.• We show that existence of SNARGs of knowledge (SNARKs) for NP implies existence of ECRHs, as well as extractable variants of some other cryptographic primitives. This provides further evidence ECRHs are necessary for the existence of SNARKs.• Finally, we propose several quite different candidate ECRHs.Similarly to other extractability (or "knowledge") assumptions, the assumption that ECRHs exist does not fit into the standard mold of cryptographic assumptions. Still, ECRH is a natural and basic primitive that may deserve investigation in of itself. Indeed, we demonstrate its power in obtaining a goal that is provably out of reach in more traditional methods [Gentry and Wichs, STOC '10].

Succinct Malleable NIZKs and an Application to Compact Shuffles

“…This construction closely follows the intuition above (which is itself inspired by the "targeted malleability" construction of Boneh et al [6]): malleability is achieved by proving knowledge of either a fresh witness or a previous instance and proof, and a transformation from that instance to the current one. As observed by Bitansky et al [3,4], care must be taken with this kind of recursive composition of SNARGs, as the size of the extractor can quickly blow up as we continue to extract proofs from other proofs; we can therefore construct t-tiered malleable SNARGs (i.e., SNARGs malleable with respect to the class of all t-tiered transformations) for only constant t. Furthermore, a formal treatment of our particular recursive technique reveals that a stronger notion of extraction, in which the extractor gets to see not only the random tape but also the code for the adversary, is necessary for both our construction and the original one of Boneh et al…”

“…Proofs of this kind were first shown to exist by Micali in 2000 [26], who used the Fiat-Shamir heuristic [15] to eliminate the interaction in previous succinct arguments. More recently, Groth provided a construction using pairings [22] which was improved by Lipmaa [25], Bitansky et al [3] constructed designated-verifier SNARGs using the new notion of extractable collision-resistant hash functions, and Gennaro et al [17] constructed constant-sized SNARGs with a relatively short common reference string. Our definition is based primarily on that of Boneh et al [6], although for the succinctness property we incorporate the definition of Gentry and Wichs [19] as well.…”

Multiparty Computation with Low Communication, Computation and Interaction via Threshold FHE

“…However, in the fully malicious setting, we would also require P * to prove that the resulting ciphertext is the correct one, using a computationally-sound proof system with a fixed polynomial (in the security parameter) verification complexity. Such non-interactive proofs are known to exist in the random-oracle model or under strong assumptions [27,7,20,14].…”

“…Moreover, the protocol consists of only two rounds of interaction, which is optimal (matching [34]). 7 MPC via Threshold FHE. Since FHE solves the secure computation problem for two semi-honest parties, it is natural to ask whether we can extend the above template to the general case of many fully malicious parties.…”

Signatures of Correct Computation

“…Our SCC model is strongly related to the model of computationallysound proofs, introduced by Micali in 1994 [29], and to the subsequent works on succinct non-interactive arguments (SNARGs) by Groth [23], Bitansky et al [4,5] and Gennaro et al [16]. The main connection is that both SCC and SNARGs models are non-interactive and publicly verifiable (CS proofs can also be non-interactive in the random oracle model), i.e., a publicly verifiable proof can be computed independently from (and with no communication with) the verifier.…”