ie400 course document ie400 course document, Summaries of Engineering

Download ie400 course document ie400 course document and more Summaries Engineering in PDF only on Docsity!

Abdullah Talayhan - 26.11.

CS470/

Introduction to Applied Cryptography

Week10b

Zero Knowledge Proofs

(cont’d)

P(x, w) V(x)

a

c

z

A Sigma Protocol is a specific type of interactive protocol (3-move) with the following properties: Completeness Special Soundness (Knowledge Soundness) Honest Verifier Zero-Knowledge

c

$

← R

Completeness

V(x)

a

c

z

A Sigma Protocol is complete if given an honest execution of the protocol (a, c, z). V(x, a, c, z) = 1

c

$

← R

If the prover is honest, then it should be able to convince the verifier. P(x, w)

Honest Verifier Zero Knowledge

V(x)

a

c

z

A Sigma Protocol is HVZK (Honest Verifier Zero Knowledge) if we can build a polynomial time simulator that outputs without knowing such that and is indistinguishable from a valid protocol execution. 𝒮 (a, c, z) w V(x, a, c, z) = 1 (a, c, z)

c

$

← R

P(x, w) If we can create that looks like an honest transcript without knowing and if is accepted by the verifier. Then the verifier doesn’t learn anything about (a, c, z) w (a, c, z) w.

Example - Schnorr DLOG proof

I know w such that y = g w mod p Witness w Statement x : (g, q, p, y) r $ ← ℤ* q a ← g r

a

c

$

q

c

z

z ← r + c ⋅ w

g

z ?

= a ⋅ y

c P(x, w) (^) V(x)

Schnorr DLOG proof - Special Soundness

10 I know w such that y = g w mod p Statement x : (g, q, p, y) Witness w P(x, w) r $ ← ℤ* q a ← g

r a

c

$

q

c

z

z ← r + c ⋅ w

g

z ?

= a ⋅ y

c V(x) g z = a ⋅ y c g z−z′ = y c−c′ g (z−z′)/(c−c′) g = y z′ = a ⋅ y c′ ℰ(x, a, c, z, c′, z′) : w = (z − z′) ⋅ (c − c′) − 1 mod q Valid (a, c, z) and (a, c′, z′)

Schnorr DLOG proof - HVZK

I know w such that y = g w mod p Statement x : (g, q, p, y) Witness w S(x) z, c $ ← ℤ* q a ← g z ⋅ y −c

(a, c, z)

g

z ?

= a ⋅ y

c V(x) Notice that S doesn’t know w. Distribution of (a, c, z) = (random group element, random exponent, random exponent) We are able to construct (a, c, z) that is indistinguishable from a valid protocol execution.

Non-interactive Schnorr DLOG proof

I know w such that y = g w mod p Witness w Statement x : (g, q, p, y) P(x, w) r $ ← ℤ* q a ← g r

a

c

$

q

c

z ← r + c ⋅ w z

g

z ?

= a ⋅ y

c V(x) P(x, w) r $ ← ℤ* q a ← g r

c ← H(a, g, q, p, y)

a, z

z ← r + c ⋅ w

g

z ?

= a ⋅ y

c V(x)

c ← H(a, g, q, p, y)

From Non-interactive Sigma Protocol to a Signature Schnorr Signature 14 I know w such that y = g w mod p Witness w Statement x : (g, q, p, y) 𝖲𝖼𝗁𝗇𝗈𝗋𝗋. 𝖲𝗂𝗀𝗇(x, sk, m) r $ ← ℤ* q a ← g r

c ← H(a, g, q, p, y, m)

σ = (a, z)

z ← r + c ⋅ sk

g

z ?

= a ⋅ y

c 𝖲𝖼𝗁𝗇𝗈𝗋𝗋. 𝖵𝖾𝗋𝗂𝖿𝗒(x, m)

c ← H(a, g, q, p, y, m)

Intuition: This is a signature because someone who knows the private key approves m.

Chaum-Pedersen DLEQ proof

I know w such that y = g w mod p, t = h w mod p Statement x : (g, h, q, p, y, t) Witness w P(x, w) r $ ← ℤ* q a g ← g

r ag,^ ah

c

$

q

c

z

z ← r + c ⋅ w

g

z ?

= a

g

⋅ y

c V(x) a h ← h r

h

z ?

= a

h

⋅ t

c

Chaum-Pedersen DLEQ proof - Completeness

17 I know w such that y = g w mod p, t = h w mod p Statement x : (g, h, q, p, y, z) Witness w P(x, w) r $ ← ℤ* q a g ← g

r ag,^ ah

c

$

q

c

z

z ← r + c ⋅ w

g

z ?

= a

g

⋅ y

c V(x) a h ← h r

h

z ?

= a

h

⋅ t

g c z? = a g ⋅ y c g r+c⋅w? = g r ⋅ (g w ) c g r+c⋅w = g r+c⋅w h z? = a h ⋅ t c h r+c⋅w ? = h r ⋅ (h w ) c h r+c⋅w = h r+c⋅w

Chaum-Pedersen DLEQ proof - HVZK

I know w such that y = g w mod p, t = h w mod p Statement x : (g, h, q, p, y, t) Witness w S(x) c, z $ ← ℤ* q a g ← g z ⋅ y −c

(a

g

, a

h

, c, z)

g

z ?

= a

g

⋅ y

c V(x) a h ← h z ⋅ t −c

h

z ?

= a

h

⋅ t

c

Pedersen Commitment proof

I know (w, s) such that 𝖼𝗈𝗆 = g w ⋅ h s mod p Statement x : (g, h, q, p, 𝖼𝗈𝗆) Witness w, s P(x, w) r 1 , r 2 $ ← ℤ* q a ← g r 1 ⋅ h r

2 a

c

$

q

c

z

1

, z

2 z 1 ← r 1

• c ⋅ w g z 1 ⋅ h z 2 = a ⋅ 𝖼𝗈𝗆 c V(x) z 1 ← r 2
• c ⋅ s I know the opening value (w, s) for the commitment 𝖼𝗈𝗆