How Not to Prove Yourself: Pitfalls of the Fiat-Shamir Heuristic and Applications to Helios

Abstract

Abstract. The Fiat-Shamir transformation is the most efficient construction of non-interactive zero-knowledge proofs. This paper is concerned with two variants of the transformation that appear but have not been clearly delineated in existing literature. Both variants start with the prover making a commitment. The strong variant then hashes both the commitment and the statement to be proved, whereas the weak variant hashes only the commitment. This minor change yields dramatically different security guarantees: in situations where malicious provers can select their statements adaptively, the weak Fiat-Shamir transformation yields unsound/unextractable proofs. Yet such settings naturally occur in systems when zero-knowledge proofs are used to enforce honest behavior. We illustrate this point by showing that the use of the weak Fiat-Shamir transformation in the Helios cryptographic voting system leads to several possible security breaches: for some standard types of elections, under plausible circumstances, malicious parties can cause the tallying procedure to run indefinitely and even tamper with the result of the election. On the positive side, we define a form of adaptive security for zeroknowledge proofs in the random oracle model (essentially simulationsound extractability), and show that a variant which we call strong FiatShamir yields secure non-interactive proofs. This level of security was assumed in previous works on Helios and our results are then necessary for these analyses to be valid. Additionally, we show that strong proofs in Helios achieve non-malleable encryption and satisfy ballot privacy, improving on previous results that required CCA security.

On the Hardness of Proving CCA-Security of Signed ElGamal

“…paper result model [6] NM-CPA secure ROM [16] obvious CCA proof fails ROM [14] not PA2 unless CDH easy ROM [5] no adaptive extractor under OMDL ROM this work no CCA reduction under IES ROM [1] CCA ROM vs. algebraic adv. [13,18] CCA ROM+GGM Although CCA security of Signed ElGamal has sometimes been claimed informally, the strongest formal result in the ROM to date [6] only shows the weaker non-malleability (NM-CPA). If one extends the ROM to include either the generic group model [13], a generic knowledge assumption [18] or restricts to algebraic adversaries [1] then one can prove CCA security.…”

Formal Analysis of Chaumian Mix Nets with Randomized Partial Checking

“…Analogously, here we formalize privacy of RPC mix nets as the inability of an adversary to distinguish whether some sender under observation submitted plaintexts p or p , when running her honest program. While this definition is quite strong (see, e.g., the discussion in [2]), simulation-based definitions [12] are stronger (see also [3] for a related game-based definition). Roughly speaking, simulation-based definitions imply that an adversary should not be able to distinguish between two (different) vectors of honest inputs.…”

“…This security requirement corresponds to the central property in the context of e-voting, already sketched above, and it is what our privacy notion for RPC mix nets, which we define precisely below, is therefore supposed to capture. 3 In the analysis of privacy of RPC mix nets, it turns out that it is useful to distinguish between risk-avoiding and venturesome adversaries, i.e., between adversaries that try to avoid being caught (i.e., blamed by the judge for misbehavior) and those that do not care. The class of venturesome adversary is simply the class of all probabilistic polynomial-time adversaries.…”

Election Verifiability or Ballot Privacy: Do We Need to Choose?

“…More detailed definitions, as well as techniques for making these proofs non-interactive are available in [9] for instance.…”

“…Different strategies for improving the accountability in the case of Helios have been explored in [3,27]. A rigorous cryptographic analysis of verifiability/accountability of a fully-fledged voting system is an open problem (note that all current works on Helios [26,27] abstracted the cryptographic aspects and, as result, overlooked the recently found attacks on the verifiability of Helios [9]), and is out of our scope.…”