Uni Paderborn Germany Never Trust Victor An alternative resettable zero-knowledge proof system Olaf Müller Michael Nüsken.

Slides:

Advertisements

Similar presentations

Variations of the Turing Machine

Advertisements

Secure Composition of Cryptographic Protocols

Slide 1 Insert your own content. Slide 2 Insert your own content.

Copyright © 2002 Pearson Education, Inc. Slide 1.

Secret Sharing Protocols [Sha79,Bla79]

Combining Like Terms. Only combine terms that are exactly the same!! Whats the same mean? –If numbers have a variable, then you can combine only ones.

and 6.855J Cycle Canceling Algorithm. 2 A minimum cost flow problem , $4 20, $1 20, $2 25, $2 25, $5 20, $6 30, $

Exponents You will have 20 seconds to complete each of the following 16 questions. A chime will sound as each slide changes. Read the instructions at.

MULTIPLYING MONOMIALS TIMES POLYNOMIALS (DISTRIBUTIVE PROPERTY)

Teacher Name Class / Subject Date A:B: Write an answer here #1 Write your question Here C:D: Write an answer here.

CS4026 Formal Models of Computation Running Haskell Programs – power.

Short Non-interactive Zero-Knowledge Proofs

A Verifiable Secret Shuffle of Homomorphic Encryptions Jens Groth UCLA On ePrint archive:

Empty Box Problems Subtraction = 3 If you start on 6 and jump back 3 spaces you land on

On the (Im)Possibility of Arthur-Merlin Witness Hiding Protocols Iftach Haitner, Alon Rosen and Ronen Shaltiel 1.

Reductions Complexity ©D.Moshkovitz.

Lower Bounds for Non-Black-Box Zero Knowledge Boaz Barak (IAS*) Yehuda Lindell (IBM) Salil Vadhan (Harvard) *Work done while in Weizmann Institute. Short.

Coin Tossing With A Man In The Middle Boaz Barak.

Finding Collisions in Interactive Protocols A Tight Lower Bound on the Round Complexity of Statistically-Hiding Commitments Iftach Haitner, Jonathan Hoch,

Measuring Time Complexity

Strict Polynomial-Time in Simulation and Extraction Boaz Barak & Yehuda Lindell.

6/3/2014 IENG 471 Facilities Planning 1 IENG Lecture Schedule Design: The Sequels Sequel.

Topology in Distributed Computing: A Primer 1 / 16 Sergey Velder SPbSU ITMO.

Wonders of the Digital Envelope

5.9 + = 10 a)3.6 b)4.1 c)5.3 Question 1: Good Answer!! Well Done!! = 10 Question 1:

Statistical Zero-Knowledge Arguments for NP from Any One-Way Function Salil Vadhan Minh Nguyen Shien Jin Ong Harvard University.

Past Tense Probe. Past Tense Probe Past Tense Probe – Practice 1.

Properties of Exponents

X-box Factoring. Warm-Up Please complete these individually. 1. Fill in the following X-solve problems. a. b. c. 2. Write the general form of a quadratic.

On the Amortized Complexity of Zero-Knowledge Proofs Ronald Cramer, CWI Ivan Damgård, Århus University.

Addition 1’s to 20.

Test B, 100 Subtraction Facts

Click your mouse to move the card ahead! Work with a buddy using two Abacuses. First click and follow along using your abacus. After each click talk about.

EOC Practice #19 SPI

Bottoms Up Factoring. Start with the X-box 3-9 Product Sum

FIND THE AREA ( ROUND TO THE NEAREST TENTHS) 2.7 in 15 in in.

X-box Factoring. X- Box 3-9 Product Sum Factor the x-box way Example: Factor 3x 2 -13x (3)(-10)= x 2x 3x 2 x-5 3x +2.

EXAMPLE 3 Use synthetic division

Zero Knowledge Proofs(2) Suzanne van Wijk & Maaike Zwart

Rafael Pass Cornell University Concurrency and Non-malleability.

Efficient Zero-Knowledge Proof Systems Jens Groth University College London.

Distributed Systems Overview Ali Ghodsi

Lecture 15 Zero-Knowledge Techniques. Peggy: “I know the password to the Federal Reserve System computer, the ingredients in McDonald’s secret sauce,

1 Vipul Goyal Microsoft Research India Non-Black-Box Simulation in the Fully Concurrent Setting.

Isolated PoK and Isolated ZK Ivan Damgård, Jesper Buus Nielsen and Daniel Wichs.

Optimistic Concurrent Zero-Knowledge Alon Rosen IDC Herzliya abhi shelat University of Virginia.

1 Vipul Goyal Abhishek Jain Rafail Ostrovsky Silas Richelson Ivan Visconti Microsoft Research India MIT and BU UCLA University of Salerno, Italy Constant.

Slide 1 Vitaly Shmatikov CS 380S Introduction to Zero-Knowledge.

Impossibility Results for Concurrent Two-Party Computation Yehuda Lindell IBM T.J.Watson.

CS426Fall 2010/Lecture 351 Computer Security CS 426 Lecture 35 Commitment & Zero Knowledge Proofs.

1 Slides by Roel Apfelbaum & Eti Ezra. Enhanced by Amit Kagan. Adapted from Oded Goldreich’s course lecture notes.

1 Zaps and Apps Cynthia Dwork Microsoft Research Moni Naor Weizmann Institute of Science.

Introduction to Modern Cryptography, Lecture 7/6/07 Zero Knowledge and Applications.

Zero Knowledge Proofs. Interactive proof An Interactive Proof System for a language L is a two-party game between a verifier and a prover that interact.

1 Cross-Domain Secure Computation Chongwon Cho (HRL Laboratories) Sanjam Garg (IBM T.J. Watson) Rafail Ostrovsky (UCLA)

Impossibility and Feasibility Results for Zero Knowledge with Public Keys Joël Alwen Tech. Univ. Vienna AUSTRIA Giuseppe Persiano Univ. Salerno ITALY Ivan.

Fall 2004/Lecture 201 Cryptography CS 555 Lecture 20-b Zero-Knowledge Proof.

Topic 23: Zero-Knowledge Proof and Cryptographic Commitment

Introduction to Modern Cryptography Sharif University Spring 2015 Data and Network Security Lab Sharif University of Technology Department of Computer.

Secure Computation (Lecture 5) Arpita Patra. Recap >> Scope of MPC > models of computation > network models > modelling distrust (centralized/decentralized.

Client-Server Concurrent Zero Knowledge with Constant Rounds and Guaranteed Complexity Ran Canetti, Abhishek Jain and Omer Paneth 1.

Generic and Practical Resettable Zero- Knowledge in the Bare Public-Key Model Moti Yung RSA Laboratories and CS Dept. of Columbia University Yunlei Zhao.

Zero Knowledge r Two parties:  All powerful prover P  Polynomially bounded verifier V r P wants to prove a statement to V with the following properties:

Topic 36: Zero-Knowledge Proofs

Zero Knowledge Anupam Datta CMU Fall 2017

New Notions of Soundness and Simultaneous Resettability in the Public-Key Model1 Yunlei Zhao2 3 Abstract In this paper, some new notions of soundness.

Impossibility of SNARGs

Presentation transcript:

Uni Paderborn Germany Never Trust Victor An alternative resettable zero-knowledge proof system Olaf Müller Michael Nüsken

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (2/35) Universität Paderborn ZK for 3-colorability PaulaVictor

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (3/35) Universität Paderborn Fast ZK for 3-colorability VictorPaula

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (4/35) Universität Paderborn Resettable ZK (1) Canetti, Goldreich, Goldwasser & Micali (1999,2000) ZK Internet: concurrent Smart cards: reset resettable ZK (rZK) Goldreich & Kahan (1996) secret dependencies constant-round resettable WI

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (5/35) Universität Paderborn Resettable ZK (2) bPaulac The resettable machine bPaulac: uses the same algorithm as Paula, contains many copies of Paula, reacts to reset( input i, randonmness j). Paula

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (6/35) Universität Paderborn Resettable ZK (3)Resettable ZK?Resettable WI Secret dependency bPaulac Victor

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (7/35) Universität Paderborn Resettable ZK (4) Canetti, Kilian, Petrank & Rosen (2001) –black-box rZK ¸ (log n) rounds Barak (2001): How to go beyond the black-box simulation barrier +constant round +strictly polynomial time simulation –only bounded-concurrency ZK –only computationally sound Richardson & Kilian (1999) concurrent n, CGGM (1999,2000) resettable, Kilian, Petrank & Richardson (2001) preliminary phase (FLS-paradigm) prove only: improbable preliminary phase OR original statement O(log(n) 2 u(n)) round concurrent ZK, even rZK

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (8/35) Universität Paderborn The Problem reset

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (9/35) Universität Paderborn Folklore Bit Commitment meantime (e,s) Problem: Can Victor learn (e,s) in the meantime? Paula(q,h,Y) E = Y e h s Victor e

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (10/35) Universität Paderborn Better Bit Commitment (q,h,Y) E = Y e h s B = Y b h t c Repeat until convinced (b,t) meantime (e,s) bPaulac Victor e If c = 0: Open B, i.e. send (b,t) If c = 1, b = e: Open E/B, i.e. send (0,s-t) If c = 1, b e: Open E B, i.e. send (1,s+t)

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (11/35) Universität Paderborn c (q,h,Y) Repeat until convinced meantime bPaulac Victor Better Bit Commitment be b e e b = b + ce

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (12/35) Universität Paderborn Our solution !8

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (13/35) Universität Paderborn Sams Success Provided Sam succeeds: Simulated preambles are perfectly indistinguishable from ideal ones. The faked transcript is computationally indistinguishable from an honest one. L 2 /2 rounds, running time O(L 4 poly(n)).

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (14/35) Universität Paderborn Knowledgeable Does Victor know a decommitment? NEVER TRUST VICTOR: require a proof of knowledge! A bit commitment is knowledgeable if it guarantees that the sender knows the content.

Olaf Müller, Michael Nüsken: Never trust Victor. 12. Februar 2014 (15/35) Universität Paderborn Resettable ZK for G3C