Simultaneously Resettable Arguments of Knowledge

Cho, Chongwon; Ostrovsky, Rafail; Scafuro, Alessandra; Visconti, Ivan

doi:10.1007/978-3-642-28914-9_30

Cited by 17 publications

(14 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To guarantee that the ZAP does not reveal the secret key k, we evaluate two functions in parallel with independent keys and prove that one of them was computed correctly. The construction uses ideas from [24,16]. Now, given a program that computes the function correctly on some noticeable fraction of the inputs, we can detect when the output is computed incorrectly and replace it with ⊥.…”

Section: Constructing Verifiable Robust Unobfuscatable Functionsmentioning

confidence: 99%

“…However, to securely use rZAPs, we first need to establish a proper statement with at least two valid witnesses. We use a similar idea to that used in [24,16] of using a WI proof (or rZAPs in our case) in order to get a witness-hiding proofs for statements with two independent witnesses. Details follow.…”

Section: Theorem 53 Assuming Trapdoor Permutations and Noninteractimentioning

confidence: 99%

“…Redistribution subject to SIAM license or copyright; see http://www.siam.org/journals/ojsa.php with probability at least 1/16, S i * contains the end of the i * th slot, and an execution of C(q), performed by FORK starting from state T , and outputting a such that Ver F (vk, q, a) = 1 with probability at least 1/16. By the non-black-box learnability property of the unobfuscatable function, when FORK invokes E on C with ε = 1 16 , it outputs z such that (vk, z) ∈ R F with overwhelming probability. However, by the choice of T , the probability that Bad 3 occurs and session s is not solved on thread t must be noticeable.…”

Section: S(x)mentioning

confidence: 99%

“…As in section 5.1, our protocol will use the idea of turning a single witness statement into a two-independentwitnesses statement, as done in [24,16].…”

Section: A 3-message Simultaneous Resettable Wi Argument Of Knowledgementioning

confidence: 99%

See 3 more Smart Citations

On Non-Black-Box Simulation and the Impossibility of Approximate Obfuscation

Bitansky¹,

Paneth²

2015

SIAM J. Comput.

View full text Add to dashboard Cite

Abstract. The introduction of a non-black-box simulation technique by Barak (FOCS 2001) has been a major landmark in cryptography, breaking the previous barriers of black-box impossibility. Barak's technique has given rise to various powerful applications and is a key component in all known protocols with non-black-box simulation. We present the first non-black-box simulation technique that does not rely on Barak's technique (or on nonstandard assumptions). Invoking this technique, we obtain new and improved protocols resilient to various resetting attacks. These improvements include weaker computational assumptions and better round complexity. A prominent feature of our technique is its compatibility with rewinding techniques from classic black-box zero-knowledge protocols. The combination of rewinding with non-black-box simulation has proven instrumental in coping with challenging goals such as simultaneously resettable zero-knowledge, proofs of knowledge, and resettable security from one-way functions. While previous works required tailored modifications to Barak's technique, we give a general recipe for combining our technique with rewinding. This yields simplified resettable protocols in the above settings, as well as improvements in round complexity and required computational assumptions. The main ingredient in our technique is a new impossibility result for general program obfuscation. The results extend the impossibility result of Barak et al. (CRYPTO 2001) to the case of obfuscation with approximate functionality, thus settling a question left open by Barak et al. In the converse direction, we show a generic transformation from any resettably sound zero-knowledge protocol to a family of functions that cannot be obfuscated.

show abstract

Section: Constructing Verifiable Robust Unobfuscatable Functionsmentioning

confidence: 99%

Section: Theorem 53 Assuming Trapdoor Permutations and Noninteractimentioning

confidence: 99%

Section: S(x)mentioning

confidence: 99%

“…As in section 5.1, our protocol will use the idea of turning a single witness statement into a two-independentwitnesses statement, as done in [24,16].…”

Section: A 3-message Simultaneous Resettable Wi Argument Of Knowledgementioning

confidence: 99%

See 2 more Smart Citations

On Non-Black-Box Simulation and the Impossibility of Approximate Obfuscation

Bitansky¹,

Paneth²

2015

SIAM J. Comput.

View full text Add to dashboard Cite

show abstract

“…In this model it is known how to obtain constant-round concurrent zero knowledge with concurrent soundness under standard assumptions [13,35,36,34]. This model has also been used for constant-round concurrent non-malleable zero knowledge [25] and various constant-round resettable and simultaneously resettable protocols [22,39,11,9,10,38,37,7].…”

Section: Related Workmentioning

confidence: 99%

Constant-Round Concurrent Zero Knowledge in the Bounded Player Model

Goyal

Jain

Ostrovsky

et al. 2013

Advances in Cryptology - ASIACRYPT 2013

Self Cite

View full text Add to dashboard Cite

Abstract. In [18] Goyal et al. introduced the bounded player model for secure computation. In the bounded player model, there are an a priori bounded number of players in the system, however, each player may execute any unbounded (polynomial) number of sessions. They showed that even though the model consists of a relatively mild relaxation of the standard model, it allows for round-efficient concurrent zero knowledge. Their protocol requires a super-constant number of rounds. In this work we show, constructively, that there exists a constant-round concurrent zero-knowledge argument in the bounded player model. Our result relies on a new technique where the simulator obtains a trapdoor corresponding to a player identity by putting together information obtained in multiple sessions. Our protocol is only based on the existence of a collision-resistance hash-function family and comes with a "straight-line" simulator. We note that this constitutes the strongest result known on constantround concurrent zero knowledge in the plain model (under well accepted relaxations) and subsumes Barak's constant-round bounded concurrent zero-knowledge result. We view this as a positive step towards getting constant round fully concurrent zero-knowledge in the plain model, without relaxations.

show abstract