[PDF] Top 20 Relaxed Lattice-Based Signatures with Short Zero-Knowledge Proofs

... find short vectors in a lattice is the BKZ algorithm, whose latest version was published by Chen and Nguyen ...the lattice basis into blocks of size b and then calls an SVP (Shortest Vector Problem) ... See full document

... Our construction basically follows the approach discussed above to reduce sig- nature size. However, in contrast to Dodis et al., besides targeting the post- quantum setting, we (1) do not require a trusted setup 7 , and ... See full document

... is based on post-quantum safe assump- tions are required. Code-based and lattice-based cryptography are two families of primitives widely believed to be quantum-resistant, and extensively used ... See full document

... efficient zero-knowledge arguments for intervals, unions of intervals, exponential relations and gcd rela- ...scheme based on the Strong RSA assumption [4] which, like [26,22], relies on groups of ... See full document

... constructions based on the Learning With Errors assumption (Regev, STOC ...of lattice-based cryptography and are extremely important due to their potential role in post-quantum cryp- ...adversary’s ... See full document

... Zero-knowledge proofs and proofs of knowledge are fundamental notions and powerful tools in ...a zero-knowledge proof system [GMR89], a prover convinces a verifier that ... See full document

... Our main contribution is not to show the theoretical feasibility of a SNARK lifting transforma- tion, but to carefully select and optimize these constructions for concrete efficiency, and offer com- posable NIZKs as a ... See full document

... first lattice-based group signature scheme whose cryptographic artifacts are of size small enough to be usable in practice: for a group of 2 25 users, signatures take 910 kB and public keys are 501 ... See full document

... creating zero-knowledge proofs is the “Fiat-Shamir with Aborts” approach [Lyu09, Gro10b, ...of knowledge of a vector ¯ s with small coefficients (though larger than those in s) and a ring ... See full document

... in lattice-based ...compact lattice-based ring signature is then provided in Section ...ring signatures in Appendix D. Some of the proofs of our new results are deferred to ... See full document

... is based on the Ring-SIS ...is based on the hardness of the Ring-LWE problem, and it does not appear that this has been accounted for in the parameter ... See full document

... these zero-knowledge proofs can incur a large communication cost, which in- creases the overall communication complexity of the MPC protocol in which they are ...is based on the hardness of ... See full document

... shorter proofs than prior work for a large range of circuit ...scheme based only on symmetric-key primitives (and hence offering “post-quantum” security); performance of this scheme is discussed in Section ... See full document

... knowledge proof system with sublinear communication and efficient verification. The prover time, however, would incur at least a logarithmic overhead compared to the time to execute the TinyRAM program. First, the ... See full document

... A comparison. Consider the proof of security of the identification schemes presented in [1]. Briefly, their proof technique relies on a collision resistant hash (CRH) function and the identifica- tion scheme is a proof ... See full document

... Quantum NIZK proofs. However, if we want security against quantum adversaries, the situation becomes worse. Groth-Sahai proofs are not secure because they are based on hardness assumptions in ... See full document

... A caveat of Falcon comes from its complicated implementation, as its efficiency relies on several technical routines and the deep exploitation of the structures of the underlying mathematical objects. In particular, the ... See full document

... – Regarding efficiency, our construction is as efficient as the state-of-the-art lattice-based blind signature scheme in [50], both in terms of key sizes (ours are slightly smaller) and in computational ... See full document

... is based on the learning parity with noise (LPN) assump- tion, or equivalently, the hardness of decoding random linear ...efficient zero-knowledge proof of knowledge for committed values ... See full document

... public-coin zero-knowledge (ZK) ...ZK proofs that admit a universal simulator (which handles all malicious verifiers), and show a connection between the existence of such proof systems and a ... See full document