Statistical Zero-Knowledge Proofs with Efficient Provers: Lattice Problems and More

Abstract

Abstract. We construct several new statistical zero-knowledge proofs with efficient provers, i.e. ones where the prover strategy runs in probabilistic polynomial time given an NP witness for the input string. Our first proof systems are for approximate versions of the Shortest Vector Problem (SVP) and Closest Vector Problem (CVP), where the witness is simply a short vector in the lattice or a lattice vector close to the target, respectively. Our proof systems are in fact proofs of knowledge, and as a result, we immediately obtain efficient lattice-based identification schemes which can be implemented with arbitrary families of lattices in which the approximate SVP or CVP are hard. We then turn to the general question of whether all problems in SZK ∩ NP admit statistical zero-knowledge proofs with efficient provers. Towards this end, we give a statistical zero-knowledge proof system with an efficient prover for a natural restriction of Statistical Difference, a complete problem for SZK. We also suggest a plausible approach to resolving the general question in the positive.

Concurrent Zero Knowledge Without Complexity Assumptions

“…To achieve concurrent security without relying on unproven assumptions, we observe that the standard verifier's commitments used in [28] can be replaced by instance-dependent commitments [36] (cf., [34]). A instance-dependent commitment, roughly speaking, is a commitment protocol that takes the problem instance x as an additional input, is binding on the yes instances (x ∈ Π Y ), and is hiding on the no instances (x ∈ Π N ).…”

“…One of the main tools for constructing zero-knowledge proofs are commitment schemes, and indeed the only use of complexity assumptions in the construction of zero-knowledge proofs for all of NP [5] is to obtain a commitment scheme (used by the prover to commit to the NP witness, encoded as, e.g., a 3-coloring of a graph). Our results rely on a relaxed notion of commitment, called an instance-dependent commitment scheme, 4 which is implicit in [35] and formally defined in [36,34,19]. Roughly speaking, for a language L (or, more generally, a promise problem), a instance-dependent commitment scheme for L is a commitment protocol where the sender and receiver algorithms also depend on the instance x.…”

“…Since, by definition, the zero-knowledge property is only required when the input x is in the language, and the soundness condition is only required when x is not in the language, it suffices to use a instance-dependent commitment scheme. Specifically, if a language L ∈ NP (or even L ∈ IP) has a instancedependent commitment scheme, then L has a zero-knowledge proof [36] (see also [34,19]). …”

“…The recent works of Micciancio and Vadhan [34] and Vadhan [19] hypothesized that every problem that has a statistical (resp., computational) zero-knowledge proof has a instance-dependent commitment scheme. 5 There are several pieces of evidence pointing to this possibility:…”

“…A restricted form of a complete problem for statistical zero knowledge has a instance-dependent commitment scheme [34]. 2.…”