1. Efficient Zero-Knowledge Proof Systems Jens Groth University College London

2. 3-move proof systems Complete Special soundness Special honest verifier zero-knowledge Σ-protocols Public coin: Random challenge, verifier does not store private information about challenge

3. Special soundness

4. Special soundness is a form of proof of knowledge Proof of knowledge –Not just that the statement is true, but that the prover “knows” the witness Defined through extraction –The prover “knows” the witness if we can extract the witness from the prover Extraction through rewinding –Consider prover in the state after the initial message has been sent. Rewind it many times to this state giving it different challenges. Once we have answers to two different challenges, we can extract the witness

5. Honest verifier zero-knowledge ZK HVZK

6. Special honest verifier zero-knowledge

7. Equivalence of discrete logarithms

8. Multiple Σ-protocols can be composed with each other using the same challenge

9. Non-interactive commitment

10. Pedersen commitments

11. ElGamal type commitments

12. Addition gates

13. Multiplication gates

14. Σ-protocol for arithmetic circuit Pedersen commitments Computational special soundness Perfect special honest verifier zero-knowledge Communication –1 group element per committed value –2 group elements and 3 field elements per multiplication gate –Addition gates for free ElGamal commitments Statistical special soundness Comp. special honest verifier zero-knowledge Communication –2 groups elements per committed value –4 group elements and 3 field elements per multiplication gate –Addition gates for free

15. Communication: O(|C|) commitments Prover computation: O(|C|) exponentiations Verifier computation: O(|C|) exponentiations

16. How efficient can arguments be? Zero-knowledge proofs in general have linear or superlinear communication in witness size –Unless SAT-solving has sublinear complexity Zero-knowledge arguments can have sublinear communication –Kilian 1992 gave a sublinear zero-knowledge argument for NP-complete language Commit to a probabilistically checkable proof using a hash-tree Verifier makes queries to probabilistically checkable proof Answer queries from verifier by revealing paths in hash-tree

17. Knowledge of opening of commitment to 0

18. Σ-protocol for commitment to 0

19. Batch-proof for commitments containing 0 Communication: O(1) elements Prover: O(n) multiplications Verifier: O(n) exponentiations

20. Generalized Pedersen commitment

22. Cost for N-gate arithmetic circuit Standard argument –O(N) elements –O(N) verifier expos –O(N) prover expos –3 rounds Batch argument –O(  N) elements –O(N) verifier mults –O(N) prover expos –7 rounds