[PDF] Top 20 Towards Non-Interactive Zero-Knowledge for NP from LWE

... constructing non-interactive zero-knowledge proofs is via the Fiat-Shamir heuristic [FS86], for reducing interaction in (public-coin) interactive ...to interactive proofs ... See full document

... model non-interactive ZK proofs, ...common) interactive ZK proofs thus requires a conceptually different approach, as such proofs cannot be replayed, put into other terms, ...ideas from a ... See full document

... 0), from which she can extract d = x · e + r mod M (note that the verifier only needs to know e; unlike in previous work, she does not need to know the decryption key of ... See full document

... being zero or one using bilinear groups with composite ...any NP language and the first universal composability secure NIZK argument for any NP language in the presence of a dynamic/adaptive ... See full document

... Multiplex every access. Computers are universal random-access machines (RAMs), so one approach of designing a universal circuit is to mimic a computer’s execution, building a layered circuit as follows. The i-th layer ... See full document

... constructions from [CDS94]), thus losing one of the main advantages of sigma-protocols for efficient protocol ...of knowledge in the random oracle ... See full document

... Nevertheless, as we will explain further, some of NP-complete problems have a real simililarity with the Rubik’s cubes puzzles. So we can con- sider that these problems, used in this article for authentication, ... See full document

... Overview. Recall from Section 1.2 that, because we rely on an MPC protocol Π designed in the preprocessing model, we modify the “MPC-in-the-head” approach and construct a 5-round proof of the following format: ... See full document

... 3-round zero knowledge ...Naor’s non-interactive commitment scheme to compute its ...use non-black-box methods. In this approach, however, black-box knowledge extractors K cannot ... See full document

... We therefore use a different approach; we set up an “intermediate statement” which is selected by the prover, and require the prover to provide a WIPOK of its correctness. The verifier then proves that either this ... See full document

... constructing zero-knowledge SNARKs, and (c) for constructing succinct non-interactive secure computation (in the common reference string ...concurrent zero-knowledge (ZK) ... See full document

... statistical zero-knowledge arguments, first presented by Bras- sard, Chaum, and Crepeau in ...perfect zero-knowledge protocol for any statement in NP with constant rounds, which is a ... See full document

... Proof of Solvency. Consider privacy-preserving proofs of solvency for Bitcoin exchanges [Wil, DBB + 15]. Here an exchange wants to prove to its customers that it has enough reserves to cover its liabilities, or, in ... See full document

... node from a common edge, or twice the same ...provide Zero-Knowledge ...not zero-knowledge follows from the undesirable fact that dishonest verifiers can discover the (random) ... See full document

... receiver non-malleable commitment, a new primitive of independent ...PKE from general zero-knowledge proof of knowledge and non-malleable non-interactive ... See full document

... this from any “hard” NP-relation with a Sigma protocol (to be defined ...obtain non-interactive zero knowledge for such relations under no additional ...scheme from Sigma ... See full document

... the zero- knowledge claim in the journal version [17] of their work without any explanation as of ...drawn from Lapidot-Shamir [15], Feige-Lovasz [16] and Dwork, Feige, Kilian, Naor, and Safra, [11] ... See full document

... In cryptography, when designing privacy-sensitive applications, the use of commitments and corresponding zero- knowledge proofs is often indispensable. They allow a prover to convince a verifier that a ... See full document

... Assumptions. In summary, our construction uses a cyclic group in which the SDDH assumption holds, a probabilistic indistinguishability obfuscation scheme [CLTV15], a perfectly correct fully homomorphic encryption (FHE), ... See full document

... of Knowledge Assumptions and their ...a knowledge assumption recursively for each ...a knowledge assumption transforms an adversary circuit A into another (potentially polynomially larger) circuit A ... See full document