We revisit the lattice-based verifiable oblivious PRF construction from PKC’21 and remove or mitigate its central three sources of inefficiency . First, applying Rényi divergence arguments, we eliminate one superpolynomial factor from the ciphertext modulus \(q\) , allowing us to reduce the overall bandwidth consumed by RLWE samples by about a factor of four. This necessitates us introducing intermediate unpredictability notions to argue PRF security of the final output in the Random Oracle model. Second, we remove the reliance on the 1D-SIS assumption, which reduces another superpolynomial factor, albeit to a factor that is still superpolynomial. Third, by applying the state-of-the-art in zero-knowledge proofs for lattice statements, we achieve a reduction in bandwidth of several orders of magnitude for this material. Finally, we give a \(t\) -out-of- \(n\) threshold variant of the VOPRF for constant \(t\) and with trusted setup, based on a \(n\) -out-of- \(n\) distributed variant of the VOPRF (and without trusted setup) .

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Verifiable Oblivious Pseudorandom Functions from Lattices: Practical-Ish and Thresholdisable

  • Martin R. Albrecht,
  • Kamil Doruk Gur

摘要

We revisit the lattice-based verifiable oblivious PRF construction from PKC’21 and remove or mitigate its central three sources of inefficiency . First, applying Rényi divergence arguments, we eliminate one superpolynomial factor from the ciphertext modulus \(q\) , allowing us to reduce the overall bandwidth consumed by RLWE samples by about a factor of four. This necessitates us introducing intermediate unpredictability notions to argue PRF security of the final output in the Random Oracle model. Second, we remove the reliance on the 1D-SIS assumption, which reduces another superpolynomial factor, albeit to a factor that is still superpolynomial. Third, by applying the state-of-the-art in zero-knowledge proofs for lattice statements, we achieve a reduction in bandwidth of several orders of magnitude for this material. Finally, we give a \(t\) -out-of- \(n\) threshold variant of the VOPRF for constant \(t\) and with trusted setup, based on a \(n\) -out-of- \(n\) distributed variant of the VOPRF (and without trusted setup) .