Succinct Malleable NIZKs and an Application to Compact Shuffles

Abstract

Abstract. Depending on the application, malleability in cryptography can be viewed as either a flaw or -especially if sufficiently understood and restricted -a feature. In this vein, Chase, Kohlweiss, Lysyanskaya, and Meiklejohn recently defined malleable zero-knowledge proofs, and showed how to control the set of allowable transformations on proofs.As an application, they construct the first compact verifiable shuffle, in which one such controlled-malleable proof suffices to prove the correctness of an entire multi-step shuffle.Despite these initial steps, a number of natural problems remained: (1) their construction of controlled-malleable proofs relies on the inherent malleability of Groth-Sahai proofs and is thus not based on generic primitives; (2) the classes of allowable transformations they can support are somewhat restrictive.In this paper, we address these issues by providing a generic construction of controlled-malleable proofs using succinct non-interactive arguments of knowledge, or SNARGs for short. Our construction can support very general classes of transformations, as we no longer rely on the transformations that Groth-Sahai proofs can support.

Malleable Signatures: New Definitions and Delegatable Anonymous Credentials

“…While the result of Chase et al [24] therefore assures us that we can construct a cm-NIZK supporting T dac . One might also wish to instantiate our cm-NIZK using their first, more efficient, construction.…”

“…We instantiate malleable signatures generically based on malleable zero-knowledge proofs which can be instantiated either very succinctly using SNARGS [24] or using GrothSahai proofs [12]. An interesting open question is the relationship between this new instantiation of the above primitives and existing constructions.…”

“…Two constructions of cm-NIZKs exist within the literature, both due to Chase et al: their original construction [12] based on Groth-Sahai proofs [39], and a more recent construction [24] based on succinct non-interactive arguments of knowledge (SNARGs) and homomorphic encryption. While the latter construction is less efficient, showing that it supports the class of transformations T dac is relatively straightforward: all we need to show is that the language and class of transformations are what is called t-tiered, meaning that (1) every instance x in the language can be labeled with an integer i = tier(x), and (2) every transformation T ∈ T dac is such that tier(T (x)) > tier(x) for all x ∈ L such that tier(x) < t, and…”

“…In addition to satisfying this new definition, our construction provides several desirable functional features (non-interactive delegation and the ability to delegate polynomially many times). Our construction is generic and can be instantiated either using succinct non-interactive arguments of knowledge (SNARGs) and homomorphic encryption [24], or using Groth-Sahai proofs [12]. The latter relies only on standard assumption (e.g., Decision Linear [25]).…”

Verifiable Elections That Scale for Free

“…The CKLM solution is therefore asymptotically superior only in the case where there are more mix servers than voters. In recent follow-up work, CKLM extended their results [10] in a way that would allow permutations to be represented as lists rather than matrices, but the extension does not apply for the scenario at hand because it can only tolerate a constant number of mix servers. A natural question, therefore, is the following: Is it possible to combine the CKLM techniques with the Groth-Lu techniques to get a cm-NIZK for the correctness of a shuffle of size Θ(k(L + M ))?…”