Lattice-Based Zero-Knowledge Arguments for Integer Relations

Abstract

We provide lattice-based protocols allowing to prove relations among committed integers. While the most general zero-knowledge proof techniques can handle arithmetic circuits in the lattice setting, adapting them to prove statements over the integers is non-trivial, at least if we want to handle exponentially large integers while working with a polynomialsize modulus q. For a polynomial L, we provide zero-knowledge arguments allowing a prover to convince a verifier that committed L-bit bitstrings x, y and z are the binary representations of integers X, Y and Z satisfying Z = X + Y over Z. The complexity of our arguments is only linear in L. Using them, we construct arguments allowing to prove inequalities X < Z among committed integers, as well as arguments showing that a committed X belongs to a public interval [α, β], where α and β can be arbitrarily large. Our range arguments have logarithmic cost (i.e., linear in L) in the maximal range magnitude. Using these tools, we obtain zero-knowledge arguments showing that a committed element X does not belong to a public set S using O(n · log |S|) bits of communication, where n is the security parameter. We finally give a protocol allowing to argue that committed L-bit integers X, Y and Z satisfy multiplicative relations Z = XY over the integers, with communication cost subquadratic in L.To this end, we use our protocol for integer addition to prove the correct recursive execution of Karatsuba's multiplication algorithm. The security of our protocols relies on standard lattice assumptions with polynomial modulus and polynomial approximation factor.

Truly Privacy-Preserving Federated Analytics for Precision Medicine with Multiparty Homomorphic Encryption

“…A malicious data provider can try to disrupt the federated collaboration process, i.e., by performing wrong computations or inputting wrong results. This can be partially mitigated by requiring the DPs to publish transcripts of their computations and to produce zero-knowledge proofs of range 44 , thus constraining the DPs’ possible inputs. Also, the querier can try to infer information about a DP’s local data from the final result.…”

RLWE-Based Zero-Knowledge Proofs for Linear and Multiplicative Relations

“…Exact Lattice-Based ZKPoK are therefore an active field of research, with very recent efficient constructions for some lattice statements including linear equations with short solutions and matrix-vector relations [27] by Yang et al, new techniques when a cyclotomic polynomial fully splits in linear factors [5] by Bootle et al and new recent Stern-based contributions for proving integer relations [15] and matrix-vector relations [16] by Libert et al…”

Practical Product Proofs for Lattice Commitments

“…There have also been some early lattice-based approaches proposed for this type of problem (e.g. [5,22]), but they result in proofs that are orders of magnitude longer.…”