1. Linear Algebra with Sub-linear Zero-Knowledge Arguments Jens Groth University College London TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: A A AAAAA A A A A A A

2. Motivation PeggyVictor Why does Victor want to know my password, bank statement, etc.? Did Peggy honestly follow the protocol? Show me all your inputs! No!

3. Zero-knowledge argument Statement ProverVerifier Witness  Soundness: Statement is true Zero-knowledge: Nothing but truth revealed

4. Statements Mathematical theorem: 2+2=4 Identification: I am me! Verification: I followed the protocol correctly. Anything: X belongs to NP-language L

5. Our contribution Perfect completeness Perfect (honest verifier) zero-knowledge Computational soundness –Discrete logarithm problem Efficient RoundsCommunicationProver comp.Verifier comp. O(1)O(√N) group elementsω(N) expos/multsO(N) mults O(log N)O(√N) group elementsO(N) expos/multsO(N) mults

6. Which NP-language L? George the Generalist Sarah the Specialist Circuit Satisfiability! Anonymous Proxy Group Voting!

7. Linear algebra George the Generalist Sarah the Specialist Great, it is NP-complete If I store votes as vectors and add them...

8. Statements RoundsCommunicationProver comp.Verifier comp. O(1)O(n) group elementsω(n 2 ) exposO(n 2 ) mults O(log n)O(n) group elementsO(n 2 ) exposO(n 2 ) mults

9. Levels of statements Circuit satisfiability Known

10. Reduction 1 Circuit satisfiability See paper

11. Reduction 2 Example:

12. commit Reduction 3 Peggy Victor

13. Pedersen commitment Computationally binding –Discrete logarithm hard Perfectly hiding Only 1 group element to commit to n elements Only n group elements to commit to n rows of matrix Computational soundness Perfect zero- knowledge Sub-linear size

14. Pedersen commitment Homomorphic So

15. Example of reduction 3 commit

16. Reduction 4 commit

17. Product

18. Example of reduction 4 Statement: Commitments to Peggy → Victor: Commits to diagonal sums Peggy ← Victor: Challenge New statement: Soundness: For the s m parts to match for random s it must be that

19. Reducing prover’s computation Computing diagonal sums requires ω(mn) multiplications With 2log m rounds prover only uses O(mn) multiplications RoundsComm.Prover comp.Verifier comp. 22m groupm 2 n mult4m expo 2log m2log m group4mn mult2m expo

20. Basic step Known RoundsCommunicationProver comp.Verifier comp. 32n elements2n exposn expos

21. Conclusion RoundsComm.Prover comp.Verifier comp. 32n group2n expon expo 52n+2m groupm 2 n mult4m+n expo 2log m+32n group4mn mult2m+n expo Upper triangular64n groupn 3 add5n expo Upper triangular2log n+42n group6n 2 mult3n expo Arithmetic circuit7O(√N) groupO(N√N) multO(N) mult Arithmetic circuitlog N + 5O(√N) groupO(N) expoO(N) mult Binary circuit7O(√N) groupO(N√N) addO(N) mult Binary circuitlog N + 5O(√N) groupO(N) mult