Removing the Strong RSA Assumption from Arguments over the Integers

Couteau, Geoffroy; Peters, Thomas; Pointcheval, David

doi:10.1007/978-3-319-56614-6_11

Cited by 28 publications

(46 citation statements)

References 40 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As a future work, we would like to investigate other possible ways to improve the efficiency of these two non-membership zero-knowledge protocols (the one in [20] and the one proposed here); a promising approach may be the use of the techniques recently introduced in [12]. However, these techniques seem to require a strong interaction between the prover and the verifier, which would limit the use of the resulting revocation mechanisms to interactive authentication systems.…”

Section: Discussionmentioning

confidence: 99%

“…Under the assumption that factoring an RSA modulus is hard and if N is the product of two safe primes, the Strong QR-RSA Assumption is equivalent (see for instance [13,12]) to the (more commonly used) Strong RSA Assumption, related to the Strong RSA problem, which only differs to the Strong QR-RSA problem in the fact that ω…”

Section: Mathematical Setting and Building Blocksmentioning

confidence: 99%

“…Although we have proved the soundness property of the new zero-knowledge protocol with respect to the Strong (QR) RSA Assumption, it is possible to use the recent techniques developed in [12] to obtain a proof of soundness with respect to the (weaker and more standard) RSA Assumption.…”

Section: E (4)mentioning

confidence: 99%

See 2 more Smart Citations

On the Efficiency of Revocation in RSA-Based Anonymous Systems

Fueyo

Herranz

2016

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

Abstract. The problem of revocation in anonymous authentication systems is subtle and has motivated a lot of work. One of the preferable solutions consists in maintaining either a whitelist LW of non-revoked users or a blacklist LB of revoked users, and then requiring users to additionally prove, when authenticating themselves, that they are in LW (membership proof) or that they are not in LB (non-membership proof). Of course, these additional proofs must not break the anonymity properties of the system, so they must be zero-knowledge proofs, revealing nothing about the identity of the users. In this paper we focus on the RSA-based setting and we consider the case of non-membership proofs to blacklists L = LB. The existing solutions for this setting rely on the use of universal dynamic accumulators [20]; the underlying zero-knowledge proofs are a bit complicated and thus their efficiency, although being independent from the size of the blacklist L, seems to be improvable. Peng and Bao [21] already tried to propose simpler and more efficient zeroknowledge proofs for this setting, but we prove in this paper that their protocol is not secure. We fix the problem by designing a new protocol and formally proving its security properties. We then compare the efficiency of the new zero-knowledge non-membership protocol with that of the protocol in [20], when they are integrated with anonymous authentication systems based on RSA (notably, the IBM product Idemix for anonymous credentials). We discuss for which values of the size k of the blacklist L one protocol is preferable to the other one and we propose different ways to combine and implement the two protocols.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Mathematical Setting and Building Blocksmentioning

confidence: 99%

See 1 more Smart Citation

On the Efficiency of Revocation in RSA-Based Anonymous Systems

Fueyo

Herranz

2016

IEEE Trans.Inform.Forensic Secur.

View full text Add to dashboard Cite

show abstract

“…Many are based on the strong RSA assumption, and use Lagrange's Four-Square Theorem. Couteau et al show that this assumption can be replaced by an RSA-variant which is much closer to the standard RSA assumption [17]. Examples are [27,38].…”

Section: Referencementioning

confidence: 99%

Efficient Batch Zero-Knowledge Arguments for Low Degree Polynomials

Bootle

Groth

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Bootle et al. (EUROCRYPT 2016) construct an extremely efficient zero-knowledge argument for arithmetic circuit satisfiability in the discrete logarithm setting. However, the argument does not treat relations involving commitments, and furthermore, for simple polynomial relations, the complex machinery employed is unnecessary. In this work, we give a framework for expressing simple relations between commitments and field elements, and present a zero-knowledge argument which, by contrast with Bootle et al., is constant-round and uses fewer group operations, in the case where the polynomials in the relation have low degree. Our method also directly yields a batch protocol, which allows many copies of the same relation to be proved and verified in a single argument more efficiently with only a square-root communication overhead in the number of copies. We instantiate our protocol with concrete polynomial relations to construct zero-knowledge arguments for membership proofs, polynomial evaluation proofs, and range proofs. Our work can be seen as a unified explanation of the underlying ideas of these protocols. In the instantiations of membership proofs and polynomial evaluation proofs, we also achieve better efficiency than the state of the art.

show abstract

“…While these problems received much attention in the literature, the most efficient solutions [49,35,21] handling large integers appeal to integer commitments [26,22] based on hidden-order groups (e.g., RSA groups), which are vulnerable to quantum computing. In particular, designing a solution based on mild assumptions in standard lattices is a completely open problem to our knowledge.…”

Section: Introductionmentioning

confidence: 99%

Lattice-Based Zero-Knowledge Arguments for Integer Relations

Libert

Ling

Nguyen

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We provide lattice-based protocols allowing to prove relations among committed integers. While the most general zero-knowledge proof techniques can handle arithmetic circuits in the lattice setting, adapting them to prove statements over the integers is non-trivial, at least if we want to handle exponentially large integers while working with a polynomialsize modulus q. For a polynomial L, we provide zero-knowledge arguments allowing a prover to convince a verifier that committed L-bit bitstrings x, y and z are the binary representations of integers X, Y and Z satisfying Z = X + Y over Z. The complexity of our arguments is only linear in L. Using them, we construct arguments allowing to prove inequalities X < Z among committed integers, as well as arguments showing that a committed X belongs to a public interval [α, β], where α and β can be arbitrarily large. Our range arguments have logarithmic cost (i.e., linear in L) in the maximal range magnitude. Using these tools, we obtain zero-knowledge arguments showing that a committed element X does not belong to a public set S using O(n · log |S|) bits of communication, where n is the security parameter. We finally give a protocol allowing to argue that committed L-bit integers X, Y and Z satisfy multiplicative relations Z = XY over the integers, with communication cost subquadratic in L.To this end, we use our protocol for integer addition to prove the correct recursive execution of Karatsuba's multiplication algorithm. The security of our protocols relies on standard lattice assumptions with polynomial modulus and polynomial approximation factor.

show abstract

Removing the Strong RSA Assumption from Arguments over the Integers

Cited by 28 publications

References 40 publications

On the Efficiency of Revocation in RSA-Based Anonymous Systems

On the Efficiency of Revocation in RSA-Based Anonymous Systems

Efficient Batch Zero-Knowledge Arguments for Low Degree Polynomials

Lattice-Based Zero-Knowledge Arguments for Integer Relations

Contact Info

Product

Resources

About