Shorter Quadratic QA-NIZK Proofs

Abstract

Despite recent advances in the area of pairing-friendly Non-Interactive Zero-Knowledge proofs, there have not been many efficiency improvements in constructing arguments of satisfiability of quadratic (and larger degree) equations since the publication of the Groth-Sahai proof system (JoC'12). In this work, we address the problem of aggregating such proofs using techniques derived from the interactive setting and recent constructions of SNARKs. For certain types of quadratic equations, this problem was investigated before by González et al. (ASI-ACRYPT'15). Compared to their result, we reduce the proof size by approximately 50% and the common reference string from quadratic to linear, at the price of using less standard computational assumptions. A theoretical motivation for our work is to investigate how efficient NIZK proofs based on falsifiable assumptions can be. On the practical side, quadratic equations appear naturally in several cryptographic schemes like shuffle and range arguments.

Shorter Pairing-Based Arguments Under Standard Assumptions

“…For instance, a natural strategy would be to commit to wires with shrinking commitments and use any constant-size QA-NIZK argument of membership in linear spaces (e.g. [26]) to give an aggregated proof that the affine constraints hold and use "aggregated" variants of GS Proofs [19] such as [14,2] for the quadratic constraints.…”

“…The cost of giving the committed secret inputs and a proof that they open to {0, 1} using the GS proof system is (6(n 0 − n pub ), 6(n 0 − n pub )) group elements. It can be reduced to (2(n 0 − n pub ) + 10, 10) group elements under standard assumptions using the results of González and Ràfols [14], but at the price of having a crs quadratic in n 0 and to (2n 0 +4, 6) with a linear crs under a non-standard (falsifiable) (n 0 −n pub )assumption similar to the q-Target Strong Diffie-Hellman Assumption using the results of Daza et al [2].…”

Signatures of Knowledge for Boolean Circuits Under Standard Assumptions

“…The observation that to add unbounded simulation soundness to NIZK arguments which prove both quadratic and linear equations it suffices to have USS in the linear part can have other applications. For example, a direct application is to give USS to the construction of Daza et al [7], which gives a compact proof that a set of perfectly binding commitments open to 0 or 1. Second, we observe that the advantage of our approach is that to get tight security we only need to construct a tight USS for promise problems in bilateral linear spaces, which we leave for future work.…”

“…For the scheme described above, one can take as Input, and Π Q the same building blocks as [11], namely the bitstring argument of Daza et al [7] and the argument described in Sect. 2.3.…”

“…Then, the building blocks (1), (2) of our instantiation are exactly the same as in González and Ràfols [11]. The cost of committing to the input plus proving it is boolean with the argument of [7] is (2n s + 4)|G 1 | + 6|G 2 |. We take the same quadratic constraints proof from [11] with Zero-Knowledge that is 12d|G 1 | + 4d|G 2 | for the commitments and 8d|G 1 | + 4d|G 2 | for the GS proofs.…”