Skip to main content
SpringerLink
Log in
Book cover

Theory of Cryptography Conference

TCC 2021: Theory of Cryptography pp 435–465Cite as

Acyclicity Programming for Sigma-Protocols

Part of the Lecture Notes in Computer Science book series (LNSC,volume 13042)

Abstract

Cramer, Damgård, and Schoenmakers (CDS) built a proof system to demonstrate the possession of subsets of witnesses for a given collection of statements that belong to a prescribed access structure \(\mathcal {P}\) by composing so-called sigma-protocols for each atomic statement. Their verifier complexity is linear in the size of the monotone span program representation of \(\mathcal {P}\).

We propose an alternative method for combining sigma-protocols into a single non-interactive system for a compound statement in the random oracle model. In contrast to CDS, our verifier complexity is linear in the size of the acyclicity program representation of \(\mathcal {P}\), a complete model of monotone computation introduced in this work. We show that the acyclicity program size of a predicate is polynomially equivalent to the branching-program size of its monotone dual and hence polynomially incomparable to its monotone span program size. We additionally present an extension of our proof system, with verifier complexity linear in the monotone circuit size of \(\mathcal {P}\), in the common reference string model.

Finally, considering the types of statement that naturally reduce to acyclicity programming, we discuss several applications of our new methods to protecting privacy in cryptocurrency and social networks.

Keywords

  • sigma-protocols
  • Zero-knowledge proofs
  • Random oracles

This is a preview of subscription content, access via your institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    To highlight the role of \(a_1\) and \(a_2\), we use this shorthand in this section. We however remind readers the importance of including instances \(x_1\) and \(x_2\) as pointed out in [BPW12, BDG20].

  2. 2.

    A topological sort is a linear ordering of the vertices of the graph satisfying that for every edge (u, v), u comes before v in the ordering.

  3. 3.

    This is a slight abuse of terminology for the sake of readability as validity is not determined by \(\boldsymbol{x}\) and \(\pi \) only, but may also depend on \(\boldsymbol{h}\).

  4. 4.

    For \(\pi = ((a_1, e_1, z_1), \dots , (a_N, e_N, z_N))\) and \(\pi ' = ((a'_1, e'_1, z'_1), \dots , (a'_N, e'_N, z'_N))\).

  5. 5.

    Both \( mF \) and \( mSP \) [KW93] are in fact invariant under taking monotone duals, but \( mBP \) is not [GS92].

  6. 6.

    The simulator may alternatively choose input \(( pp , 1)\), in both cases the simulation is perfect due to the witness independence property of \(\varUpsilon \).

References

  • Abe, M., Ambrona, M., Bogdanov, A., Ohkubo, M., Rosen, A.: Non-interactive composition of sigma-protocols via Share-then-Hash. In: Moriai, S., Wang, H. (eds.) ASIACRYPT 2020. LNCS, vol. 12493, pp. 749–773. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-64840-4_25

    CrossRef  Google Scholar 

  • Alon, N., Boppana, R.B.: The monotone circuit complexity of Boolean functions. Combinatorica 7(1), 1–22 (1987)

    CrossRef  MathSciNet  Google Scholar 

  • Ames, S., Hazay, C., Ishai, Y., Venkitasubramaniam, M.: Ligero: lightweight sublinear arguments without a trusted setup. In: Thuraisingham, B.M., Evans, D., Malkin, T., Xu, D. (eds.) ACM CCS 2017, pp. 2087–2104. ACM Press, October/November 2017

    Google Scholar 

  • Abe, M., Ohkubo, M., Suzuki, K.: 1-out-of-n signatures from a variety of keys. In: Zheng, Y. (ed.) ASIACRYPT 2002. LNCS, vol. 2501, pp. 415–432. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-36178-2_26

    CrossRef  Google Scholar 

  • Bünz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., Maxwell, G.: Bulletproofs: short proofs for confidential transactions and more. In: 2018 IEEE Symposium on Security and Privacy, pp. 315–334. IEEE Computer Society Press, May 2018

    Google Scholar 

  • Bootle, J., Cerulli, A., Chaidos, P., Ghadafi, E., Groth, J., Petit, C.: Short accountable ring signatures based on DDH. In: Pernul, G., Ryan, P.Y.A., Weippl, E. (eds.) ESORICS 2015. LNCS, vol. 9326, pp. 243–265. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-24174-6_13

    CrossRef  Google Scholar 

  • Bootle, J., Cerulli, A., Ghadafi, E., Groth, J., Hajiabadi, M., Jakobsen, S.K.: Linear-time zero-knowledge proofs for arithmetic circuit satisfiability. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. Part III, volume 10626 of LNCS, pp. 336–365. Springer, Heidelberg (2017)

    CrossRef  Google Scholar 

  • Ben-Sasson, E., Chiesa, A., Riabzev, M., Spooner, N., Virza, M., Ward, N.P.: Aurora: transparent succinct arguments for R1CS. In: Ishai, Y., Rijmen, V. (eds.) EUROCRYPT 2019. LNCS, vol. 11476, pp. 103–128. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-17653-2_4

    CrossRef  Google Scholar 

  • Bellare, M., Davis, H., Günther, F.: Separate your domains: NIST PQC KEMs, oracle cloning and read-only indifferentiability. In: Canteaut, A., Ishai, Y. (eds.) EUROCRYPT 2020. LNCS, vol. 12106, pp. 3–32. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45724-2_1

    CrossRef  Google Scholar 

  • Babai, L., Gál, A., Wigderson, A.: Superpolynomial lower bounds for monotone span programs. In: Combinatorica, vol. 19, pp. 301–319 (1999). https://doi.org/10.1007/s004930050058

  • Bellare, M., Micali, S.: Non-interactive oblivious transfer and applications. In: Brassard, G. (ed.) CRYPTO 1989. LNCS, vol. 435, pp. 547–557. Springer, New York (1990). https://doi.org/10.1007/0-387-34805-0_48

    CrossRef  Google Scholar 

  • Bellare, M., Neven, G.: Multi-signatures in the plain public-key model and a general forking lemma. In: Juels, A., Wright, R.N., De Capitani di Vimercati, S. (eds.) ACM CCS 2006, pp. 390–399. ACM Press, October/November 2006

    Google Scholar 

  • Bernhard, D., Pereira, O., Warinschi, B.: How not to prove yourself: pitfalls of the fiat-Shamir heuristic and applications to Helios. In: Wang, X., Sako, K. (eds.) ASIACRYPT 2012. LNCS, vol. 7658, pp. 626–643. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-34961-4_38

    CrossRef  Google Scholar 

  • Bellare, M., Rogaway, P.: Random oracles are practical: a paradigm for designing efficient protocols. In: Denning, D.E., Pyle, R., Ganesan, R., Sandhu, R.S., Ashby, V. (eds.) ACM CCS 93, pp. 62–73. ACM Press, November 1993

    Google Scholar 

  • Bresson, E., Stern, J., Szydlo, M.: Threshold ring signatures and applications to ad-hoc groups. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 465–480. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45708-9_30

    CrossRef  Google Scholar 

  • Cramer, R., Damgård, I., MacKenzie, P.: Efficient zero-knowledge proofs of knowledge without intractability assumptions. In: Imai, H., Zheng, Y. (eds.) PKC 2000. LNCS, vol. 1751, pp. 354–372. Springer, Heidelberg (2000). https://doi.org/10.1007/978-3-540-46588-1_24

    CrossRef  Google Scholar 

  • Cramer, R., Damgård, I., Schoenmakers, B.: Proofs of partial knowledge and simplified design of witness hiding protocols. In: Desmedt, Y.G. (ed.) CRYPTO 1994. LNCS, vol. 839, pp. 174–187. Springer, Heidelberg (1994). https://doi.org/10.1007/3-540-48658-5_19

    CrossRef  Google Scholar 

  • Campanelli, M., Fiore, D., Querol, A.: LegoSNARK: modular design and composition of succinct zero-knowledge proofs. In: Cavallaro, L., Kinder, J., Wang, X., Katz, J. (eds.) ACM CCS 2019, pp. 2075–2092. ACM Press, November 2019

    Google Scholar 

  • Ciampi, M., Persiano, G., Siniscalchi, L., Visconti, I.: A transform for NIZK almost as efficient and general as the Fiat-Shamir transform without programmable random oracles. In: Kushilevitz, E., Malkin, T. (eds.) TCC 2016. LNCS, vol. 9563, pp. 83–111. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49099-0_4

    CrossRef  MATH  Google Scholar 

  • Cramer, R.: Modular Design of Secure yet Practical Cryptographic Protocols. PhD thesis, University of Amsterdam, January 1997

    Google Scholar 

  • Deshpande, A., Kalai, Y.: Proofs of ignorance and applications to 2-message witness hiding. Cryptology ePrint Archive, Report 2018/896 (2018)

    Google Scholar 

  • Fischlin, M., Harasser, P., Janson, C.: Signatures from sequential-OR Proofs. In: Canteaut, A., Ishai, Y. (eds.) EUROCRYPT 2020. LNCS, vol. 12107, pp. 212–244. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-45727-3_8

    CrossRef  Google Scholar 

  • Feige, U., Lapidot, D., Shamir, A.: Multiple non-interactive zero knowledge proofs based on a single random string (extended abstract). In: 31st FOCS, pp. 308–317. IEEE Computer Society Press, October 1990

    Google Scholar 

  • Feng, H., Liu, J., Wu, Q., Li, Y.-N.: Traceable ring signatures with post-quantum security. In: Jarecki, S. (ed.) CT-RSA 2020. LNCS, vol. 12006, pp. 442–468. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-40186-3_19

    CrossRef  Google Scholar 

  • Fiat, A., Shamir, A.: How to prove yourself: practical solutions to identification and signature problems. In: Odlyzko, A.M. (ed.) CRYPTO 1986. LNCS, vol. 263, pp. 186–194. Springer, Heidelberg (1987). https://doi.org/10.1007/3-540-47721-7_12

    CrossRef  Google Scholar 

  • Groth, J., Kohlweiss, M., Maller, M., Meiklejohn, S., Miers, I.: Updatable and universal common reference strings with applications to zk-SNARKs. In: Shacham, H., Boldyreva, A. (eds.) CRYPTO 2018. LNCS, vol. 10993, pp. 698–728. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-96878-0_24

    CrossRef  Google Scholar 

  • Goldreich, O., Micali, S., Wigderson, A.: Proofs that yield nothing but their validity and a methodology of cryptographic protocol design (extended abstract). In: 27th FOCS, pp. 174–187. IEEE Computer Society Press, October 1986

    Google Scholar 

  • Galbraith, S.D., Paterson, K.G., Smart, N.P.: Pairings for cryptographers. Discret. Appl. Math. 156(16), 3113–3121 (2008)

    CrossRef  MathSciNet  Google Scholar 

  • Gentry, C., Peikert, C., Vaikuntanathan, V.: Trapdoors for hard lattices and new cryptographic constructions. In: Ladner, R.E., Dwork, C. (eds.) 40th ACM STOC, pp. 197–206. ACM Press, May 2008

    Google Scholar 

  • Groth, J.: On the size of pairing-based non-interactive arguments. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016. LNCS, vol. 9666, pp. 305–326. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49896-5_11

    CrossRef  Google Scholar 

  • Grigni, M., Sipser, M.: Monotone complexity, pp. 57–75. In: Proceedings of the London Mathematical Society, Symposium on Boolean Function Complexity (1992)

    Google Scholar 

  • Karchmer, M., Wigderson, A.: On span programs. In: Proceedings of the Eighth Annual Structure in Complexity Theory Conference, pp. 102–111. IEEE Computer Society (1993)

    Google Scholar 

  • Lindell, Y.: An efficient transform from sigma protocols to NIZK with a CRS and non-programmable random oracle. In: Dodis, Y., Nielsen, J.B. (eds.) TCC 2015. LNCS, vol. 9014, pp. 93–109. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46494-6_5

    CrossRef  Google Scholar 

  • Libert, B., Ling, S., Nguyen, K., Wang, H.: Zero-knowledge arguments for lattice-based accumulators: logarithmic-size ring signatures and group signatures without trapdoors. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016. LNCS, vol. 9666, pp. 1–31. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49896-5_1

    CrossRef  Google Scholar 

  • Libert, B., Ling, S., Nguyen, K., Wang, H.: Zero-knowledge arguments for lattice-based PRFs and applications to E-Cash. In: Takagi, T., Peyrin, T. (eds.) ASIACRYPT 2017. LNCS, vol. 10626, pp. 304–335. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-70700-6_11

    CrossRef  Google Scholar 

  • Lai, R.W.F., Malavolta, G., Ronge, V.: Succinct arguments for bilinear group arithmetic: practical structure-preserving cryptography. In: Cavallaro, L., Kinder, J., Wang, X., Katz, J. (eds.) ACM CCS 2019, pp. 2057–2074. ACM Press, November 2019

    Google Scholar 

  • Maxwell, G.: Zero knowledge contingent payment. https://en.bitcoin.it/wiki/Zero_Knowledge_Contingent_Payment (2011)

  • Maller, M., Bowe, S., Kohlweiss, M., Meiklejohn, S.: Sonic: zero-knowledge SNARKs from linear-size universal and updatable structured reference strings. In: Cavallaro, L., Kinder, J., Wang, X., Katz, J. (eds.) ACM CCS 2019, pp. 2111–2128. ACM Press, November 2019

    Google Scholar 

  • Nielsen, J.B.: Separating random oracle proofs from complexity theoretic proofs: the non-committing encryption case. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 111–126. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45708-9_8

    CrossRef  Google Scholar 

  • Nguyen, K., Tang, H., Wang, H., Zeng, N.: New code-based privacy-preserving cryptographic constructions. In: Galbraith, S.D., Moriai, S. (eds.) ASIACRYPT 2019. LNCS, vol. 11922, pp. 25–55. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-34621-8_2

    CrossRef  Google Scholar 

  • Pitassi, T., Robere, R.: Lifting nullstellensatz to monotone span programs over any field. In: Diakonikolas, I., Kempe, D., Henzinger, M. (eds.) 50th ACM STOC, pp. 1207–1219. ACM Press, June 2018

    Google Scholar 

  • Pointcheval, D., Stern, J.: Security arguments for digital signatures and blind signatures. J. Cryptol. 13(3), 361–396 (2000)

    CrossRef  Google Scholar 

  • Razborov, A.A.: Lower bounds on monotone complexity of the logical permanent. Math. Notes Acad. Sci. USSR 37(6), 485–493 (1985)

    MathSciNet  MATH  Google Scholar 

  • Rivest, R.L., Shamir, A., Tauman, Y.: How to leak a secret. In: Boyd, C. (ed.) ASIACRYPT 2001. LNCS, vol. 2248, pp. 552–565. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45682-1_32

    CrossRef  Google Scholar 

  • Stern, J.: A new paradigm for public key identification. IEEE Trans. Inf. Theory 42(6), 1757–1768 (1996)

    CrossRef  MathSciNet  Google Scholar 

  • Tardos, É.: The gap between monotone and non-monotone circuit complexity is exponential. Combinatorica 8(1), 141–142 (1988)

    CrossRef  MathSciNet  Google Scholar 

Download references

Acknowledgment

We would like to thank Gautam Prakriya for helpful discussions on monotone span programs and Gregory Neven for very fruitful discussions and all his feedback. Finally, we would like to thank all anonymous reviewers for their valuable time and useful comments. The third and fifth authors are supported by Hong Kong RGC GRF grant CUHK 14209419, and ISF grant No. 1399/17 and Project PROMETHEUS (Grant 780701), respectively.

Author information

Authors and Affiliations

  1. NTT Laboratories, Tokyo, Japan

    Masayuki Abe & Miguel Ambrona

  2. Chinese University of Hong Kong, Hong Kong, China

    Andrej Bogdanov

  3. Security Fundamentals Laboratory, CSR, NICT, Tokyo, Japan

    Miyako Ohkubo

  4. Bocconi University, Milan, Italy and IDC Herzliya, Herzliya, Israel

    Alon Rosen

Authors
  1. Masayuki Abe
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Miguel Ambrona
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Andrej Bogdanov
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Miyako Ohkubo
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Alon Rosen
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Andrej Bogdanov .

Editor information

Editors and Affiliations

  1. Georgetown University, Washington, WA, USA

    Kobbi Nissim

  2. The University of Texas at Austin, Austin, TX, USA

    Brent Waters

Rights and permissions

Reprints and Permissions

Copyright information

© 2021 International Association for Cryptologic Research

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Abe, M., Ambrona, M., Bogdanov, A., Ohkubo, M., Rosen, A. (2021). Acyclicity Programming for Sigma-Protocols. In: Nissim, K., Waters, B. (eds) Theory of Cryptography. TCC 2021. Lecture Notes in Computer Science(), vol 13042. Springer, Cham. https://doi.org/10.1007/978-3-030-90459-3_15

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-90459-3_15

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-90458-6

  • Online ISBN: 978-3-030-90459-3

  • eBook Packages: Computer ScienceComputer Science (R0)

search

Navigation