[PDF] Top 20 On Constant-Round Concurrent Zero-Knowledge from a Knowledge Assumption

... of zero-knowledge proofs contemplated a single prover and a single verifier executing a single protocol session in ...isolation. Concurrent zero-knowledge [DNS98] (cZK) extends ... See full document

... use. From a result shown in [GLP + 15], we can obtain a constant-round κ-robust one-one CCA-secure commitment scheme from one-way functions for every constant κ ∈ N as fol- ...scheme ... See full document

... the zero-knowledge to the hiding property of the commitments made by the ...different from those presented in [PW09] in that the verifier only reveals a subset of the challenges, where essentially ... See full document

... linear assumption or symmetric external Diffie-Hellman assumption over bilinear groups [GOS12]) or from indistinguishability obfuscation [SW14, BP15] (see Section ...the assumption that ... See full document

... switch from using real honest inputs (in an intermedi- ate hybrid) to random inputs on the look-ahead threads, the probability of extraction of adversary’s inputs and trapdoors remains ...switch from real ... See full document

... We now describe a prior system that implements VSMs; our goal is to introduce concepts necessary to describe Spice and to highlight why prior systems are inefficient. We focus on Pantry [25]; Section 8 discusses other ... See full document

... a constant number of levels by using identity based broadcast encryption with key ...suffered from exponential degradation in the depth of the hierarchy, so these systems were only proven fully secure for ... See full document

... of zero-knowledge proofs, called instance- dependent zero-knowledge, and show that it suffices for the [8] approach when constructing a compiler from honest-verifier statistical ... See full document

... all zero knowledge protocols are black-box zero ...bounded concurrent constant-round zero knowledge ar- gument for NP which was proved not to exist in black-box ... See full document

... of concurrent sessions are ...of concurrent sessions is bounded (even when there is a single identity), but instead our goal is to obtain unbounded concurrent zero ... See full document

... interactive constant-round public-coin honest-verifier zero-knowledge (HVZK) proof system and in making it a NIZK argument through the so called Fiat-Shamir (FS) transform ...indistinguishable ... See full document

... the knowledge extractor: The latter is only guaranteed to be O(n) e larger than the former in the case of the infinity norm, where n denotes the dimension of the corresponding worst-case lattice ...security ... See full document

... Zero Knowledge and ...efficient zero-knowledge ...first zero-knowledge argument for circuit-satisfiability with poly-logarithmic com- munication complexity, but with high ... See full document

... Our requirements from obfuscation are actually weaker than stated above. We do not need obfuscation for the class of all (polynomial size and running time) Turing machines; instead we only require the obfus- ... See full document

... To illustrate the techniques used, we sketch the proof of a slightly simplified ver- sion of Theorem 1.1. Specifically, we construct a PKE given a cryptographically hard language L with a single-round ... See full document

... Authentication protocols are ubiquitous in everyday computing. They are present when checking email, making monetary transactions, connecting to a mobile/wireless network, and so on. From one point of view, the ... See full document

... for Zero-knowledge are starting to ...for Zero-knowledge proofs of generic ...for Zero-knowledge ...small constant of bits by And gate (roughly ... See full document

... original constant-round 2PC protocol where the GC constructor has no input; this yields full malicious secu- rity at little overhead over the semi-honest case as Yao’s protocol in this case is already ... See full document

... In a private coin protocol, however, this notion of bad α’s does not work. In fact in a private coin protocol, for any α and any random tape, an accepting γ may always exist! Indeed, any three-round proof system ... See full document

... follows from the global proof of knowledge property of WIUA, that the witness of each WIUA is well-defined, therefore, we can refer to the machine M committed in Phase 1, the statement q committed in Phase ... See full document