Simple and Efficient Shuffling with Provable Correctness and ZK Privacy

Abstract

Abstract. A simple and efficient shuffling scheme containing two protocols is proposed. Firstly, a prototype, Protocol-1 is designed, which is based on the assumption that the shuffling party cannot find a linear relation of the shuffled messages in polynomial time. As application of Protocol-1 is limited, it is then optimised to Protocol-2, which does not need the assumption. Both protocols are simpler and more efficient than any other shuffling scheme with unlimited permutation. Moreover, they achieve provable correctness and ZK privacy.

Verification of a Paillier Based Shuffle Using Representations of the Symmetric Group

“…In [27], Peng et al proposed a very carefully designed, efficient proof system on mix-nets with additively homomorphic re-encryption scheme: Let E(m, r) be the encryption of the message m with randomizer r and D(c) be the decryption of ciphertext c. When c 1 , c 2 , . .…”

“…Roughly speaking, there are two kinds of proof system of mix-nets; one is optimistic and the other is verifiable proof system. The correctness of the shuffling of the whole mix-net is verified after the mix-net outputs the shuffling results in plain texts in optimistic proof system [17], while in verifiable proof system each mix server provides proofs of correctness of the shuffling [28,14,1,18,22,23,27,33].…”

“…In sender verifiable mix-net based on ElGamal encryption by Wikström, no re-encryption is needed. In [28], Peng et al applied the idea of Abe [1] to design a proof system for mix-nets employing ElGamal re-encryption system and a very carefully designed proof system by Peng et al [27] assumes the additively homomorphic (re-)encryption schemes. A recent work by Groth and Lu [19] is based on the homomorphic encryption scheme also, in which computational complexity has been dramatically reduced.…”

“…Our main concern is to implement a verification for a shuffle in a re-encryption mix-net implemented with Paillier encryption scheme: We extend the idea of [27] for the verification of a shuffle by considering pairs of messages rather than single messages. This enables us to do the verification in reduced number of communication rounds than four rounds as in [27].…”

“…This enables us to do the verification in reduced number of communication rounds than four rounds as in [27]. Computationally improved protocol is also suggested using the idea of λ-designs.…”