On Non-Black-Box Simulation and the Impossibility of Approximate Obfuscation

Abstract

Abstract. The introduction of a non-black-box simulation technique by Barak (FOCS 2001) has been a major landmark in cryptography, breaking the previous barriers of black-box impossibility. Barak's technique has given rise to various powerful applications and is a key component in all known protocols with non-black-box simulation. We present the first non-black-box simulation technique that does not rely on Barak's technique (or on nonstandard assumptions). Invoking this technique, we obtain new and improved protocols resilient to various resetting attacks. These improvements include weaker computational assumptions and better round complexity. A prominent feature of our technique is its compatibility with rewinding techniques from classic black-box zero-knowledge protocols. The combination of rewinding with non-black-box simulation has proven instrumental in coping with challenging goals such as simultaneously resettable zero-knowledge, proofs of knowledge, and resettable security from one-way functions. While previous works required tailored modifications to Barak's technique, we give a general recipe for combining our technique with rewinding. This yields simplified resettable protocols in the above settings, as well as improvements in round complexity and required computational assumptions. The main ingredient in our technique is a new impossibility result for general program obfuscation. The results extend the impossibility result of Barak et al. (CRYPTO 2001) to the case of obfuscation with approximate functionality, thus settling a question left open by Barak et al. In the converse direction, we show a generic transformation from any resettably sound zero-knowledge protocol to a family of functions that cannot be obfuscated.

Concurrent non-malleable zero-knowledge and simultaneous resettable non-malleable zero-knowledge in constant rounds

“…Finally, following the general transformation of (Deng et al 2009), they obtained a simultaneously-resettable ZK protocol. We stress that, to the best of our knowledge, this transformation is the most direct route to achieve simultaneously-resettable zero-knowledge argument system (see also (Bitansky and Paneth 2015;Chung et al 2013a;Canetti et al 2013)). In this paper, we observe that this construction actually preserves non-malleability: If the original protocol is a constant-round concurrent non-malleable zero-knowledge argument system, then the new one is a constant-round resettably-sound concurrent nonmalleable zero-knowledge argument.…”

“…It requires the soundness condition holds even when the prover can reset the verifier to use the same random tape in multiple concurrent executions. Following the two works above, a number of works have investigated the resettable security in zero-knowledge protocols (Deng et al 2009;Cho et al 2012;Garg et al 2012;Chung et al 2013bChung et al , 2014Bitansky and Paneth 2015;Ostrovsky et al 2015), which focused on either reducing the complexity assumptions or reducing the round complexity and so on. Recently, Chung et al (2013a) presented a construction of the simultaneous resettable zero-knowledge protocol with polynomial rounds based on the minimal assumption of one-way functions.…”

A novel approach to public-coin concurrent zero-knowledge and applications on resettable security

“…Finally, we use the transformation of [30] to construct resettably-sound protocol [4,31,32]. Roughly speaking, for each message from the verifier in our original protocol, we replace the randomness needed by the verifier by applying a pseudo-random function f s to the messages that the verifier has received so far.…”

Non-black-box Simulation in the Fully Concurrent Setting, Revisited

“…, ρ head(k+1)−1 (which are computed in Step 1), find the randomness R 1 that was used for generating C i 1 , −1 . 10 Then, compute a PCP proof π s for statement Case 2. ctr s = 1, and trans k contains a UA-slot of the sth session. /*Computing WIPOK witness*/ Let sl denote the UA-slot that is contained by trans k .…”

“…An important step toward obtaining non-black-box simulation in the fully concurrent setting was made by Deng et al [17], who used Barak's technique in the fully concurrent setting by combining it with a black-box simulation technique (specifically, with the recursive rewinding technique of Richardson and Kilian [34]). Another important step was made by Bitansky and Paneth [8][9][10], who developed a new non-black-box simulation technique (which is not based on that of Barak) that can handle fully concurrent execution when being combined with a black-box simulation technique (again, the recursive rewinding technique of [34]). The simulation techniques of these works are powerful enough to allow us to overcome another black-box impossibility result (the impossibility of simultaneously resettable ZK protocols [6,12]).…”