Zero-Knowledge Argument for Polynomial Evaluation with Application to Blacklists

Abstract

Abstract. Verification of a polynomial's evaluation in a secret committed value plays a role in cryptographic applications such as non-membership or membership proofs. We construct a novel special honest verifier zero-knowledge argument for correct polynomial evaluation. The argument has logarithmic communication cost in the degree of the polynomial, which is a significant improvement over the state of the art with cubic root complexity at best. The argument is relatively efficient to generate and very fast to verify compared to previous work. The argument has a simple public-coin 3-move structure and only relies on the discrete logarithm assumption.The polynomial evaluation argument can be used as a building block to construct zero-knowledge membership and non-membership arguments with communication that is logarithmic in the size of the blacklist. Non-membership proofs can be used to design anonymous blacklisting schemes allowing online services to block misbehaving users without learning the identity of the user. They also allow the blocking of single users of anonymization networks without blocking the whole network.

One-Out-of-Many Proofs: Or How to Leak a Secret and Spend a Coin

“…This efficiency compares favorably with the membership proof in Bayer and Groth [BG13]. They prove membership by demonstrating the committed value is a root in the polynomial P (u) = N −1 i=0 (u − λ i ) but the initial step of computing the coefficients of the polynomial requires O(N log 2 N ) multiplications (and only if the modulus q is of a form suitable for using the Fast Fourier Transform).…”

“…, c N −1 we get very efficient computation of 2N log N and 2N multiplications in Z q for the prover and verifier, respectively. This is an improvement over the membership proofs of Bayer and Groth [BG13] that use O(N log 2 N ) multiplications for both the prover and verifier.…”

“…There has been works on related types of statements to the one we consider, i.e., proving something about one out of N elements [Gro09,CGS07,BDD07] that could be potentially be used to get a square root complexity although we are not aware of this actually having been done. Bayer and Groth [BG13] give logarithmic size arguments for proving membership in a list, i.e., having values λ 0 , . .…”

Attribute-based versions of Schnorr and ElGamal

“…The linear dependence on M in the efficiency of our zeroknowledge proof of knowledge protocol can be reduced to √ M or even log(M ), by using the techniques in [21,3] for the polynomial evaluation part of the resulting zero-knowledge proof of knowledge.…”

“…In the M central blocks of columns of A (3) , with Vandermonde vectors, we can reorder the rows in order to get (1, . .…”