Abstract In this paper, we construct a 6-round simultaneously resettable sound resettable $$(T, \epsilon )$$ ( T , ϵ ) -zero knowledge protocol for $$\mathsf {NP \cap coNP}$$ NP ∩ coNP in the Public Key model under standard assumptions, comparing with the 27-round simultaneously resettable zero knowledge protocol in the BPK model by Deng et al. in 2011, we have achieved a significant reduction in the round complexity. Our model assumes that both prover and verifier hold public keys, we call it the Public Key model. It is a variation of the traditional BPK model where only the verifier is assumed to hold public keys. In the original BPK model, under the sub-exponential hardness assumption of factoring, we construct a 2-round simultaneously resettable sound resettable $$(T,\epsilon )$$ ( T , ϵ ) -zero knowledge protocol for $$\textsf{NP}$$ NP .

CybersecurityNov 17, 20240 citations

Lecture notes in computer science

(Public) Verifiability for Composable Protocols Without Adaptivity or Zero-Knowledge

Carsten Baum, Bernardo David, Rafael Dowsley

Published Jan 1, 2022• 4 citations

Publisher

DOI: 10.1007/978-3-031-20917-8_17

Related papers

A Framework for Universally Composable Publicly Verifiable Cryptographic Protocols.

Carsten Baum, Bernardo David, Rafael Dowsley

Jan 1, 20202 citations

Trading Static for Adaptive Security in Universally Composable Zero-Knowledge

Aggelos Kiayias, Hong-Sheng Zhou

Lecture notes in computer scienceAug 25, 20072 citations

A Framework for Practical Universally Composable Zero-Knowledge Protocols

Jan L. Camenisch, Stephan Krenn, Victor Shoup

Lecture notes in computer scienceJan 1, 201154 citations

Concurrent Non-Malleable Zero Knowledge

Boaz Barak, Manoj Prabhakaran, Amit Sahai

We provide the first construction of a concurrent and non-malleable zero knowledge argument for every language in NP. We stress that our construction is in the plain model with no common random string, trusted parties, or super-polynomial simulation. That is, we construct a zero knowledge protocol Pi such that for every polynomial-time adversary that can adaptively and concurrently schedule polynomially many executions of Pi, and corrupt some of the verifiers and some of the provers in these sessions, there is a polynomial-time simulator that can simulate a transcript of the entire execution, along with the witnesses for all statements proven by a corrupt prover to an honest verifier Our security model is the traditional model for concurrent zero knowledge, where the statements to be proven by the honest provers are fixed in advance and do not depend on the previous history (but can be correlated with each other); corrupted provers, of course, can chose the statements adaptively. We also prove that there exists some functionality F (a combination of zero knowledge and oblivious transfer) such that it is impossible to obtain a concurrent non-malleable protocol for F in this model. Previous impossibility results for composable protocols ruled out existence of protocols for a wider class of functionalities {including zero knowledge!) but only if these protocols were required to remain secure when executed concurrently with arbitrarily chosen different protocols (Lindell, FOCS 2003) or if these protocols were required to remain secure when the honest parties' inputs in each execution are chosen adaptively based on the results of previous executions (Lindell, TCC2004). We obtain an Otilde(n) -round protocol under the assumption that one-to-one one-way functions exist. This can be improved to Otilde(k log n) rounds under the assumption that there exist k-round statistically hiding commitment schemes. Our protocol is a black-box zero knowledge protocolWe provide the first construction of a concurrent and non-malleable zero knowledge argument for every language in NP. We stress that our construction is in the plain model with no common random string, trusted parties, or super-polynomial simulation. That is, we construct a zero knowledge protocol Pi such that for every polynomial-time adversary that can adaptively and concurrently schedule polynomially many executions of Pi, and corrupt some of the verifiers and some of the provers in these sessions, there is a polynomial-time simulator that can simulate a transcript of the entire execution, along with the witnesses for all statements proven by a corrupt prover to an honest verifier Our security model is the traditional model for concurrent zero knowledge, where the statements to be proven by the honest provers are fixed in advance and do not depend on the previous history (but can be correlated with each other); corrupted provers, of course, can chose the statements adaptively. We also prove that there exists some functionality F (a combination of zero knowledge and oblivious transfer) such that it is impossible to obtain a concurrent non-malleable protocol for F in this model. Previous impossibility results for composable protocols ruled out existence of protocols for a wider class of functionalities {including zero knowledge!) but only if these protocols were required to remain secure when executed concurrently with arbitrarily chosen different protocols (Lindell, FOCS 2003) or if these protocols were required to remain secure when the honest parties' inputs in each execution are chosen adaptively based on the results of previous executions (Lindell, TCC2004). We obtain an Otilde(n) -round protocol under the assumption that one-to-one one-way functions exist. This can be improved to Otilde(k log n) rounds under the assumption that there exist k-round statistically hiding commitment schemes. Our protocol is a black-box zero knowledge protocol

Annual Symposium on Foundations of Computer ScienceOct 1, 200686 citations

Adaptive and composable multi-media transcoders

Huafei Zhu

In this paper, a new construction of adaptive and composable transcoders from universally composabley secure (the uc-security) commitments is introduced and analyzed. Our transcoder is built on the top of scalable video coding standard, known as H.264/SVC. The idea behind of our implementation is simple: a base layer of streams is encoded by an extractable key while an enhanced layer of streams is encoded by an equivocable key of the underlying universally composable commitment scheme. We show that our construction reaches the UC-security in the presence of adaptive adversaries in the common reference string model assuming that the underlying Paillier's public-key encryption scheme is semantically secure and the Damgård-Fazio-Nicolosi's non-interactive protocol is zero-knowledge in the registered public-key model. Furthermore, if the underlying Paillier's public-key encryption scheme is replaced by Damgård-Jurik's length-flexible public key encryption scheme, then the derived adaptive and composable transcoder is length-flexible as well.In this paper, a new construction of adaptive and composable transcoders from universally composabley secure (the uc-security) commitments is introduced and analyzed. Our transcoder is built on the top of scalable video coding standard, known as H.264/SVC. The idea behind of our implementation is simple: a base layer of streams is encoded by an extractable key while an enhanced layer of streams is encoded by an equivocable key of the underlying universally composable commitment scheme. We show that our construction reaches the UC-security in the presence of adaptive adversaries in the common reference string model assuming that the underlying Paillier's public-key encryption scheme is semantically secure and the Damgård-Fazio-Nicolosi's non-interactive protocol is zero-knowledge in the registered public-key model. Furthermore, if the underlying Paillier's public-key encryption scheme is replaced by Damgård-Jurik's length-flexible public key encryption scheme, then the derived adaptive and composable transcoder is length-flexible as well.

IEEE International Conference on Ubi-Media ComputingJul 1, 20101 citation

Simultaneously resettable zero knowledge protocol in Public Key model

Wei Zhu, Yi Deng

Abstract In this paper, we construct a 6-round simultaneously resettable sound resettable $(T, \epsilon )$ ( T , ϵ ) -zero knowledge protocol for $\mathsf {NP \cap coNP}$ NP ∩ coNP in the Public Key model under standard assumptions, comparing with the 27-round simultaneously resettable zero knowledge protocol in the BPK model by Deng et al. in 2011, we have achieved a significant reduction in the round complexity. Our model assumes that both prover and verifier hold public keys, we call it the Public Key model. It is a variation of the traditional BPK model where only the verifier is assumed to hold public keys. In the original BPK model, under the sub-exponential hardness assumption of factoring, we construct a 2-round simultaneously resettable sound resettable $(T,\epsilon )$ ( T , ϵ ) -zero knowledge protocol for $\textsf{NP}$ NP .Abstract In this paper, we construct a 6-round simultaneously resettable sound resettable $$(T, \epsilon )$$ ( T , ϵ ) -zero knowledge protocol for $$\mathsf {NP \cap coNP}$$ NP ∩ coNP in the Public Key model under standard assumptions, comparing with the 27-round simultaneously resettable zero knowledge protocol in the BPK model by Deng et al. in 2011, we have achieved a significant reduction in the round complexity. Our model assumes that both prover and verifier hold public keys, we call it the Public Key model. It is a variation of the traditional BPK model where only the verifier is assumed to hold public keys. In the original BPK model, under the sub-exponential hardness assumption of factoring, we construct a 2-round simultaneously resettable sound resettable $$(T,\epsilon )$$ ( T , ϵ ) -zero knowledge protocol for $$\textsf{NP}$$ NP .

CybersecurityNov 17, 20240 citations

Abstract In this paper, we construct a 6-round simultaneously resettable sound resettable

(T, \epsilon )

( T , ϵ ) -zero knowledge protocol for

\mathsf {NP \cap coNP}

NP ∩ coNP in the Public Key model under standard assumptions, comparing with the 27-round simultaneously resettable zero knowledge protocol in the BPK model by Deng et al. in 2011, we have achieved a significant reduction in the round complexity. Our model assumes that both prover and verifier hold public keys, we call it the Public Key model. It is a variation of the traditional BPK model where only the verifier is assumed to hold public keys. In the original BPK model, under the sub-exponential hardness assumption of factoring, we construct a 2-round simultaneously resettable sound resettable

(T,\epsilon )

( T , ϵ ) -zero knowledge protocol for

\textsf{NP}

NP .