Public-Coin Concurrent Zero-Knowledge in the Global Hash Model

Abstract

Public-coin zero-knowledge and concurrent zero-knowledge (cZK) are two classes of zero knowledge protocols that guarantee some additional desirable properties. Still, to this date no protocol is known that is both public-coin and cZK for a language outside BPP. Furthermore, it is known that no such protocol can be black-box ZK [Pass et.al, Crypto 09].We present a public-coin concurrent ZK protocol for any NP language. The protocol assumes that all verifiers have access to a globally specified function, drawn from a collision resistant hash function family. (This model, which we call the Global Hash Function, or GHF model, can be seen as a restricted case of the non-programmable reference string model.) We also show that the impossibility of black-box public-coin cZK extends also to the GHF model.Our protocol assumes CRH functions against quasi-polynomial adversaries and takes O(log 1+ n) rounds for any > 0, where n is the security parameter. Our techniques combine those for (non-public-coin) blackbox cZK with Barak's non-black-box technique for public-coin constantround ZK. As a corollary we obtain the first simultaneously resettable zero-knowledge protocol with O(log 1+ n) rounds, in the GHF model.

An Alternative Approach to Non-black-box Simulation in Fully Concurrent Setting

“…Our public-coin concurrent ZK protocol is based on the publiccoin concurrent ZK protocol of Canetti, Lin, and Paneth (CLP) [CLP13a], which is secure in the global hash function model. Below, we give a brief overview of our technique under the assumptions that the readers are familiar with Barak's non-black-box simulation technique and the techniques of CLP.…”

“…Because of this problem, the length of the PCP proofs can be rapidly blowing up in the concurrent setting and therefore the size of the simulator cannot be bounded by a polynomial. In [CLP13a], CLP solved this problem in the global hash function model by cleverly using the global hash function in UA.…”

“…As mentioned in Section 1.1, our protocol is based on the protocol of Canetti et al [CLP13a], which in turn is based on Barak's non-black-box zero-knowledge protocol [Bar01]. Below, we first recall the protocols of [Bar01,CLP13a] and then give an overview of our protocol.…”

“…Thus, the running time of S becomes super-polynomial when m = ω(log n). Protocol of Canetti et al [CLP13a]. To avoid the blow-up of the simulator's running time, Canetti, Lin, and Paneth (CLP) [CLP13a] used the "multiple slots" approach that was originally used in the black-box concurrent zero-knowledge protocols of [RK99,KP01,PRS02].…”

“…Furthermore, they showed that with their extended simulation techniques of Barak, it is possible to overcome the black-box impossibility results of o(log n/ log log n)-round concurrent ZK protocols and public-coin concurrent ZK protocols. For example, Canetti et al [CLP13a] constructed a public-coin concurrent ZK protocol in the global hash function (GHF) model, where a single hash function is used in all concurrent sessions. Also, Chung et al [CLP13b] constructed a constant-round concurrent ZK protocol by assuming the existence of P-certificates (i.e., "succinct" non-interactive proofs/arguments for P), Pandey et al [PPS13] constructed a constant-round concurrent ZK protocols by assuming the existence of differing-input indistinguishability obfuscations, and Chung et al [CLP15] constructed a constant-round concurrent ZK protocols by assuming the existence of indistinguishability obfuscations.…”