Improved OR-Composition of Sigma-Protocols

Abstract

In [18] Cramer, Damgård and Schoenmakers (CDS) devise an OR-composition technique for Σ-protocols that allows to construct highly-efficient proofs for compound statements. Since then, such technique has found countless applications as building block for designing efficient protocols. Unfortunately, the CDS OR-composition technique works only if both statements are fixed before the proof starts. This limitation restricts its usability in those protocols where the theorems to be proved are defined at different stages of the protocol, but, in order to save rounds of communication, the proof must start even if not all theorems are available. Many round-optimal protocols ([21, 30,41,44]) crucially need such property to achieve round-optimality, and, due to the inapplicability of CDS's technique, are currently implemented using proof systems that requires expensive NP reductions, but that allow the proof to start even if no statement is defined (a.k.a., LS proofs from Lapidot-Shamir [31]). In this paper we show an improved OR-composition technique for Σ-protocols, that requires only one statement to be fixed when the proof starts, while the other statement can be defined in the last round. This seemingly weaker property is sufficient for the applications, where typically one of the theorems is fixed before the proof starts. Concretely, we show how our new OR-composition technique can directly improve the round complexity of the efficient perfect quasi-polynomial time simulatable argument system of Pass [38] (from four to three rounds) and of efficient resettable WI arguments (from five to four rounds).

Sigma protocol for faster proof of simultaneous homomorphism relations

“… is a delayed‐input protocol if prover can compute the announcement value without knowing x . The Schnorr protocol is a delayed‐input protocol [18]. It can be verified that the considered protocols in this paper enjoy this property.…”

Formalising $$\varSigma $$-Protocols and Commitment Schemes Using CryptHOL

“…There are different definitions of Σ-protocols presented in the literature [5,20,21,23,31]. We now discuss their differences and the consequences of Cramer's additional HVZK requirement (Condition 2 in Definition 3).…”

“…i.e., that both inputs x 0 and x 1 are in the language. Ciampi et al [20] use the same definition in their paper proofs. In contrast, our definition (and Damgard's, Hazay's and Lindell's, and Cramer's) requires only one input x 0 or x 1 to be in the language; the other need only meet syntactic constraints as formalised by valid-pub.…”

“…With (12), the languages for the constituent Σ-protocols must be efficiently decidable. Indeed, Ciampi et al "implicitly assume that the verifier of a protocol for relation R executes the protocol only if the common input x belongs to L R and rejects immediately common inputs not in L R " [19]. For relations like the discrete logarithm, this is not a problem because every group element has a discrete logarithm; the hard part is computing it.…”

Crowd Verifiable Zero-Knowledge and End-to-End Verifiable Multiparty Computation

“…In our CVZK construction, we utilize a special class of Σ-protocols where both the prover and the simulator do not need to know the proof statement in the first move. Such "input-delayed" protocols (at least for the prover side) have been studied in the literature (e.g., [48,20,21,36]). To stress the input-delayed property for both prover and simulator, we name these protocols fully inputdelayed and provide their definition below.…”