Zero-knowledge simulators, initially developed for proving the security of proof systems, turned out to be also useful in constructing advanced protocols from simple three-move interactive proofs. However, in the context of multi-round public-coin protocols, the interfaces of these auxiliary algorithms become more complex, introducing a range of technical challenges that hinder the generalization of these constructions. We introduce a framework to enhance the usability of zero-knowledge simulators in multi-round argument systems for protocol designs. Our main conceptual contribution is critical-round zero-knowledge, which refers to the ability to perform complete zero-knowledge simulations by knowing the challenge of just one specific round in advance. We show that this notion is satisfied by diverse protocols based on MPC-in-the-Head, interactive oracle proofs, and split-and-fold arguments. We demonstrate the usefulness of the critical round zero-knowledge notion by constructing proofs of partial knowledge (Cramer, Damgård, and Schoenmakers, CRYPTO’94) and trapdoor commitments (Damgård, CRYPTO’89) from critical-round multi-round proofs.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Critical Rounds in Multi-round Proofs: Proof of Partial Knowledge and Trapdoor Commitments

  • Masayuki Abe,
  • David Balbás,
  • Dung Bui,
  • Miyako Ohkubo,
  • Zehua Shang,
  • Akira Takahashi,
  • Mehdi Tibouchi

摘要

Zero-knowledge simulators, initially developed for proving the security of proof systems, turned out to be also useful in constructing advanced protocols from simple three-move interactive proofs. However, in the context of multi-round public-coin protocols, the interfaces of these auxiliary algorithms become more complex, introducing a range of technical challenges that hinder the generalization of these constructions. We introduce a framework to enhance the usability of zero-knowledge simulators in multi-round argument systems for protocol designs. Our main conceptual contribution is critical-round zero-knowledge, which refers to the ability to perform complete zero-knowledge simulations by knowing the challenge of just one specific round in advance. We show that this notion is satisfied by diverse protocols based on MPC-in-the-Head, interactive oracle proofs, and split-and-fold arguments. We demonstrate the usefulness of the critical round zero-knowledge notion by constructing proofs of partial knowledge (Cramer, Damgård, and Schoenmakers, CRYPTO’94) and trapdoor commitments (Damgård, CRYPTO’89) from critical-round multi-round proofs.