More Efficient Commitments from Structured Lattice Assumptions

Lattice-Based Proof of a Shuffle

“…Strand [32] presents a verifiable shuffle for the GSW cryptosystem using homomorphic commitment schemes. Using the latticebased commitment scheme [4] makes the proof fully post-quantum. Additionally, there have been some proposals for a lattice-based universal re-encryption for mix-nets [30] but none of them give a proof of a shuffle.…”

“…The first requires Pedersen commitments (based on the DL problem). The latter requires a Fully Homomorphic Encryption scheme, and works with any homomorphic commitment scheme, that is, using the lattice-based commitment scheme presented in [4] their proof is fully post-quantum.…”

RLWE-Based Zero-Knowledge Proofs for Linear and Multiplicative Relations

“…It is also important to mention the contributions of Benhamouda et al [3] and Baum et al [2], who generalized the commitment idea of [26] without using Stern's approach. They instead use Fiat-Shamir with aborts, a technique that requires relaxing the definition of commitment (so that the set of valid openings is larger than the set of openings generated by an honest prover, with more elements and less tighter bounds for the error terms) obtaining more efficient proofs with the cost of having stronger restrictions that require larger parameters.…”

“…Then the pigeonhole principle ensures that we can find six pairs (α (1) , β (1) ), (α (2) , β (2) ), (α (3) , β (3) ), (α (4) , β (4) ), (α (5) , β (5) ), (α (6) , β (6) ), with all α (l) different for l ∈ {1, 2, 3}, all α (l) different for l ∈ {4, 5, 6} and β (1) = β (2) = β (3) = β (4) = β (5) = β (6) that induce accepted answers for both b = 0 and b = 1.…”

“…If we restrict ourselves to the cases with equal β we can see this expression as a two degree polynomial in α (the coefficients were committed before the challenges were chosen), that is equal to 0 for three evaluations α (1) , α (2) , α (3) or α (4) , α (5) , α (6) . This implies that it is the 0 polynomial and that all its coefficients are 0, providing us with the equalities µ 3 −µ 3 +β (l) (m 1 m 2 −m 3 ) = 0.…”