1. Client-Server Concurrent Zero Knowledge with Constant Rounds and Guaranteed Complexity Ran Canetti, Abhishek Jain and Omer Paneth 1

2. Zero-Knowledge Protocols Completeness Soundness Zero knowledge 2 [Goldwasser-Micali-Rackoff 85]

3. Completeness Accept 3

4. Soundness reject 4

5. Zero-knowledge 5

6. Why do we care about zero-knowledge? Used as a sub-protocol in larger cryptographic protocols and systems Secure composition? 6

7. Concurrent Composition Session 7

8. Concurrent Zero Knowledge [Dwork-Naor-Sahai 98] 8

9. RoundsAssumption Stand-alone zeroknowledge [Feige-Shamir 89] [Bellare-Jakobson-Yung97] 4OWF Concurrent zeroknowledge [Richardson-Kilian99] [Kilian-Petrank01] [Prabhakaran-Rosen-Sahai 02] OWF [Gupta-Sahai12] [Chung-Lin-Pass 13] [Pandey-Prabhakaran-Sahai13] Strong assumption: interactive knowledgeassumptions statistically sound P-certificates differing input obfuscation 9

10. Today Constant-round protocols from standard assumptions Weaker notions of concurrent security 10

11. Bounded Concurrent ZK [ Barak 01 ] Complexity of each session Rounds Communication Barak … 11

12. Barak’s Protocol Client Server Barak [Persiano-Visconti 05]: set the bound only at protocol run time This is too early Client Barak Client Barak The bound on the number of concurrent sessions is set at protocol design time 12

13. Standard Model for Concurrent ZK 13

14. Client-Server Concurrent ZK ServerClients [ Persiano-Visconti 05] Increase the communication as more session start 14

15. The Persiano-Visconti Protocol … Finish session … … A single session:Concurrent sessions: 15

16. Protocol Complexity Finish session Almost the same as bounded concurrent ZK! Rounds Communication 16

17. The Persiano-Visconti Protocol Client Server Persiano-Visconti This is too late Client Persiano-Visconti Client Persiano-Visconti The communication complexity is changing at protocol run time Client does not know what will be the communication complexity of the session! 17

18. Example: Call Center “All our lines are currently busy. please hold and your call will be answered shortly…” “The estimated waiting time is 7 minutes.” This work: the communication complexity is set at the beginning of every session 18

19. Our Result Assuming collision-resistant hash functions there is a concurrent zero-knowledge protocol in the client-server model with constant-rounds and guaranteed complexity. Guaranteed complexity: The communication complexity of each session is determined in the beginning of the session 19

20. determined in the beginning of the session not determined until the session terminates This work[Persiano-Visconti] Communication complexity Round complexity 6 20

21. The Protocol Start session Every session runs Barak’s protocol with some bound 21

22. The Challenge Start session … Cannot rely directly on bounded concurrency 22

23. Barak’s simulation Barak … 23

24. Barak’s simulation Barak … 24

25. Barak’s simulation Barak Other protocol … 25

26. Proof 26

27. … … 27

28. 28

29. 29

30. … 30

31. Simulation Running Time … 31

32. [slide: Mira Belenkiy] Thanks! 32