Skip to main content
SpringerLink
Log in

Zero-Knowledge Proofs for Set Membership: Efficient, Succinct, Modular

  • Conference paper
  • First Online:
Financial Cryptography and Data Security (FC 2021)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 12674))

Included in the following conference series:

Abstract

We consider the problem of proving in zero knowledge that an element of a public set satisfies a given property without disclosing the element, i.e., for some u, “\(u \in S\) and P(u) holds”. This problem arises in many applications (anonymous cryptocurrencies, credentials or whitelists) where, for privacy or anonymity reasons, it is crucial to hide certain data while ensuring properties of such data.

We design new modular and efficient constructions for this problem through new commit-and-prove zero-knowledge systems for set membership, i.e. schemes proving \(u \in S\) for a value u that is in a public commitment \(c_u\). We also extend our results to support non-membership proofs, i.e. proving \(u \notin S\). Being commit-and-prove, our solutions can act as plug-and-play modules in statements of the form “\(u \in S\) and P(u) holds” by combining our set (non-)membership systems with any other commit-and-prove scheme for P(u). Also, they work with Pedersen commitments over prime order groups which makes them compatible with popular systems such as Bulletproofs or Groth16.

We implemented our schemes as a software library, and tested experimentally their performance. Compared to previous work that achieves similar properties—the clever techniques combining zkSNARKs and Merkle Trees in Zcash—our solutions offer more flexibility, shorter public parameters and \(3.7 \times \)–\(30\times \) faster proving time for a set of size \(2^{64}\).

The full version of the paper can be found at https://eprint.iacr.org/2019/1255.pdf.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 99.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 129.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    We can include under this class currently known lattice-based accumulators such as [29, 36].

  2. 2.

    The group \(\mathbb {G}\) is typically \(\mathbb {Z}^*_N\) where N is an RSA modulus. The size of an element in this group for a standard 128-bit security parameter is of 3072 bits.

  3. 3.

    For instance, one can plug a proof system for matrix product \(C = A\cdot B\) in any larger context of computation involving matrix multiplication. This regardless of whether, say, we then hash C or if A, B are in turn the output of a different computation.

  4. 4.

    More specifically: the elements of a set need to be prime numbers in a range (A, B) such that \(q/ 2> A^{2} -1 > B \cdot 2^{2\lambda _{st} + 2}\). If aiming at 128 bits of security level one can meet this constraint by choosing for example \(A = 2^{259}\), \(B=2^{260}\) and \(q > 2^{519}\).

  5. 5.

    When prime representation is suitable for the application, distinct primes can be generated without a hash fuction (e.g. even sequential primes).

  6. 6.

    For the implementation we focused on schemes where the public parameters do not depend on the set size; hence, we did not implement the pairing-based solutions.

  7. 7.

    For our experiments we consider Merkle Trees using Pedersen Hash over JubJub [27].

  8. 8.

    We stress the proving time for our construction does not vary when the set grows. On the other hand this time varies for solutions based on Merkle trees.

  9. 9.

    These ratios refer to a comparison against Interval Merkle Trees which require opening two paths to prove non-membership. When compared against Sparse Merkle Trees, our solutions show similar improvement ratios.

  10. 10.

    As discussed in the introduction, CP-SNARKs for set membership are a different lens on accumulators that support (non-)membership proofs on committed values. In the full version we formally construct a CP-SNARK for set membership from any accumulator scheme that has a zero-knowledge proof for committed values. This formalization captures existing schemes, such as [11] and [34].

  11. 11.

    Briefly, this means the CP-SNARK extractor is not required to extract the set from its commitment, as this is assumed to be opened by the adversary (see the full version for a formal definition).

  12. 12.

    The restriction \(\eta < \nu \) is for simplicity; in the full version we discuss how to avoid it.

  13. 13.

    Here is why: finding two different sets of primes \(P,P', P\ne P'\) such that \(G^{\mathsf {prod}_{P}} = \mathsf {Acc}= G^{\mathsf {prod}_{P'}}\) implies finding an integer \(\alpha = \mathsf {prod}_{P}-\mathsf {prod}_{P'} \ne 0\) such that \(G^\alpha =1\). This is known to lead to an efficient algorithm for factoring N.

  14. 14.

    For specific instantiations of \(\mathsf {H}\), \(\iota \) can be set so that \(\perp \) is returned with negligible probability.

References

  1. Cpsnarks-set. https://github.com/kobigurk/cpsnarks-set

  2. Agrawal, S., Ganesh, C., Mohassel, P.: Non-interactive zero-knowledge proofs for composite statements. In: Shacham, H., Boldyreva, A. (eds.) CRYPTO 2018. LNCS, vol. 10993, pp. 643–673. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-96878-0_22

  3. Barić, N., Pfitzmann, B.: Collision-free accumulators and fail-stop signature schemes without trees. In: Fumy, W. (ed.) EUROCRYPT 1997. LNCS, vol. 1233, pp. 480–494. Springer, Heidelberg (1997). https://doi.org/10.1007/3-540-69053-0_33

    Chapter  Google Scholar 

  4. Ben-Sasson, E., et al.: Zerocash: decentralized anonymous payments from bitcoin. In: 2014 IEEE Symposium on Security and Privacy, pp. 459–474. IEEE Computer Society Press, May 2014

    Google Scholar 

  5. Benaloh, J.C., de Mare, M.: One-way accumulators: a decentralized alternative to digital sinatures (extended abstract). In: Helleseth, T. (ed.) EUROCRYPT’93. LNCS, vol. 765, pp. 274–285. Springer, Heidelberg (1994)

    Google Scholar 

  6. Benarroch, D., Campanelli, M., Fiore, D., Gurkan, K., Kolonelos, D.: Zero-knowledge proofs for set membership: efficient, succinct, modular. Cryptology ePrint Archive, Report 2019/1255, 2019. https://eprint.iacr.org/2019/1255

  7. Boneh, D., Bünz, B., Fisch, B.: Batching techniques for accumulators with applications to iops and stateless blockchains. IACR Cryptology ePrint Archive 2018, 1188 (2018)

    MATH  Google Scholar 

  8. Bünz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., Maxwell, G.: Bulletproofs: short proofs for confidential transactions and more. In: 2018 IEEE Symposium on Security and Privacy, pp. 315–334. IEEE Computer Society Press, May 2018

    Google Scholar 

  9. Cachin, C., Micali, S., Stadler, M.: Computationally private information retrieval with polylogarithmic communication. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 402–414. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48910-X_28

    Chapter  Google Scholar 

  10. Camenisch, J., Kohlweiss, M., Soriente, C.: An accumulator based on bilinear maps and efficient revocation for anonymous credentials. In: Jarecki, S., Tsudik, G. (eds.) PKC 2009. LNCS, vol. 5443, pp. 481–500. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-00468-1_27

    Chapter  Google Scholar 

  11. Camenisch, J., Lysyanskaya, A.: Dynamic accumulators and application to efficient revocation of anonymous credentials. In: Yung, M. (ed.) CRYPTO 2002. LNCS, vol. 2442, pp. 61–76. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45708-9_5

    Chapter  Google Scholar 

  12. Campanelli, M., Fiore, D., Querol, A.: Legosnark: modular design and composition of succinct zero-knowledge proofs. To appear at ACM CCS 2019. IACR Cryptology ePrint Archive (2019)

    Google Scholar 

  13. Canetti, R., Lindell, Y., Ostrovsky, R., Sahai, A.: Universally composable two-party and multi-party secure computation. In: 34th ACM STOC, pp. 494–503. ACM Press, May 2002

    Google Scholar 

  14. Chaum, D.: Security without identification: transaction systems to make big brother obsolete. Commun. ACM 28(10), 1030–1044 (1985)

    Article  Google Scholar 

  15. Chepurnoy, A., Papamanthou, C., Zhang, Y.: Edrax: a cryptocurrency with stateless transaction validation (2018)

    Google Scholar 

  16. Couteau, G., Peters, T., Pointcheval, D.: Removing the strong RSA assumption from arguments over the integers. In: Coron, J.-S., Nielsen, J.B. (eds.) EUROCRYPT 2017. LNCS, vol. 10211, pp. 321–350. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-56614-6_11

  17. Cramer, R., Shoup, V.: Signature schemes based on the strong RSA assumption. In: Motiwalla, J., Tsudik, G. (eds.) ACM CCS 99, pp. 46–51. ACM Press, Nov. (1999)

    Chapter  Google Scholar 

  18. Damgård, I., Fujisaki, E.: A statistically-hiding integer commitment scheme based on groups with hidden order. In: Zheng, Y. (ed.) ASIACRYPT 2002. LNCS, vol. 2501, pp. 125–142. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-36178-2_8

    Chapter  Google Scholar 

  19. I. Damgård and N. Triandopoulos. Supporting non-membership proofs with bilinear-map accumulators. Cryptology ePrint Archive, Report 2008/538, 2008. http://eprint.iacr.org/2008/538

  20. Escala, A., Groth, J.: Fine-tuning groth-sahai proofs. In: Krawczyk, H. (ed.) PKC 2014. LNCS, vol. 8383, pp. 630–649. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-642-54631-0_36

    Chapter  Google Scholar 

  21. Fouque, P.-A., Tibouchi, M.: Close to uniform prime number generation with fewer random bits. In: Esparza, J., Fraigniaud, P., Husfeldt, T., Koutsoupias, E. (eds.) ICALP 2014. LNCS, vol. 8572, pp. 991–1002. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-43948-7_82

    Chapter  Google Scholar 

  22. Fujisaki, E., Okamoto, T.: Statistical zero knowledge protocols to prove modular polynomial relations. In: Kaliski, B.S. (ed.) CRYPTO 1997. LNCS, vol. 1294, pp. 16–30. Springer, Heidelberg (1997). https://doi.org/10.1007/BFb0052225

    Chapter  Google Scholar 

  23. Gennaro, R., Halevi, S., Rabin, T.: Secure hash-and-sign signatures without the random oracle. In: Stern, J. (ed.) EUROCRYPT 1999. LNCS, vol. 1592, pp. 123–139. Springer, Heidelberg (1999). https://doi.org/10.1007/3-540-48910-X_9

    Chapter  Google Scholar 

  24. Goldwasser, S., Micali, S., Rackoff, C.: The knowledge complexity of interactive proof systems. SIAM J. Comput. 18(1), 186–208 (1989)

    Article  MathSciNet  Google Scholar 

  25. Groth, J.: On the size of pairing-based non-interactive arguments. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016. LNCS, vol. 9666, pp. 305–326. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49896-5_11

    Chapter  Google Scholar 

  26. Groth, J., Sahai, A.: Efficient non-interactive proof systems for bilinear groups. In: Smart, N. (ed.) EUROCRYPT 2008. LNCS, vol. 4965, pp. 415–432. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-78967-3_24

    Chapter  Google Scholar 

  27. Hopwood, D., Bowe, S., Hornby, T., Wilcox, N.: Zcash protocol specification. Technical report 2016–1.10. Zerocoin Electric Coin Company, Tech. Rep. (2016). https://github.com/zcash/zips/blob/master/protocol/sapling.pdf

  28. Li, J., Li, N., Xue, R.: Universal accumulators with efficient nonmembership proofs. In: Katz, J., Yung, M. (eds.) ACNS 2007. LNCS, vol. 4521, pp. 253–269. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-72738-5_17

    Chapter  Google Scholar 

  29. Libert, B., Ling, S., Nguyen, K., Wang, H.: Zero-knowledge arguments for lattice-based accumulators: logarithmic-size ring signatures and group signatures without trapdoors. In: Fischlin, M., Coron, J.-S. (eds.) EUROCRYPT 2016. LNCS, vol. 9666, pp. 1–31. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-49896-5_1

    Chapter  Google Scholar 

  30. Lipmaa, H.: Secure accumulators from euclidean rings without trusted setup. In: Bao, F., Samarati, P., Zhou, J. (eds.) ACNS 2012. LNCS, vol. 7341, pp. 224–240. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31284-7_14

    Chapter  Google Scholar 

  31. Lovecruft, I.A., de Valence, H.: curve25519-dalek: a pure-rust implementation of group operations on ristretto and curve25519. https://github.com/dalek-cryptography/curve25519-dalek

  32. Merkle, R.C.: A digital signature based on a conventional encryption function. In: Pomerance, C. (ed.) CRYPTO 1987. LNCS, vol. 293, pp. 369–378. Springer, Heidelberg (1988). https://doi.org/10.1007/3-540-48184-2_32

    Chapter  Google Scholar 

  33. Miers, I., Garman, C., Green, M., Rubin, A.D.: Zerocoin: anonymous distributed E-cash from Bitcoin. In: 2013 IEEE Symposium on Security and Privacy, pp. 397–411. IEEE Computer Society Press, May 2013

    Google Scholar 

  34. Nguyen, L.: Accumulators from bilinear pairings and applications. In: Menezes, A. (ed.) CT-RSA 2005. LNCS, vol. 3376, pp. 275–292. Springer, Heidelberg (2005). https://doi.org/10.1007/978-3-540-30574-3_19

    Chapter  Google Scholar 

  35. Ozdemir, A., Wahby, R.S., Whitehat, B., Boneh, D.: Scaling verifiable computation using efficient set accumulators. Cryptology ePrint Archive, Report 2019/1494 (2019). https://eprint.iacr.org/2019/1494

  36. Papamanthou, C., Shi, E., Tamassia, R., Yi, K.: Streaming authenticated data structures. In: Johansson, T., Nguyen, P.Q. (eds.) EUROCRYPT 2013. LNCS, vol. 7881, pp. 353–370. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-38348-9_22

    Chapter  Google Scholar 

  37. Parno, B., Howell, J., Gentry, C., Raykova, M.: Pinocchio: nearly practical verifiable computation. In: 2013 IEEE Symposium on Security and Privacy, pp. 238–252. IEEE Computer Society Press, May 2013

    Google Scholar 

  38. SCIPR Lab. Zexe (zero knowledge execution). https://github.com/scipr-lab/zexe

  39. Yap, R.: Cryptographic description of zerocoin attack (2019). https://zcoin.io/cryptographic-description-of-zerocoin-attack/

  40. Zhang, J., Xie, T., Zhang, Y., Song, D.: Transparent polynomial delegation and its applications to zero knowledge proof. In: IEEE Symposium on Security and Privacy (2020)

    Google Scholar 

  41. Zhang, Y., Genkin, D., Katz, J., Papadopoulos, D., Papamanthou, C.: A zero-knowledge version of vSQL. Cryptology ePrint Archive, Report 2017/1146 (2017). https://eprint.iacr.org/2017/1146

  42. Zhang, Y., Katz, J., Papamanthou, C.: An expressive (zero-knowledge) set accumulator. In: 2017 IEEE European Symposium on Security and Privacy (EuroS P), pp. 158–173, April 2017

    Google Scholar 

Download references

Acknowledgements

Research leading to these results has been partially supported by the Spanish Government under projects SCUM (ref. RTI2018-102043-B-I00), CRYPTOEPIC (ref. EUR2019-103816), and SECURITAS (ref. RED2018-102321-T), by the Madrid Regional Government under project BLOQUES (ref. S2018/TCS-4339), and by research grants from Protocol Labs, and Nomadic Labs and the Tezos Foundation. Matteo Campanelli worked on this project as a post-doc at the IMDEA Software Institute.

Author information

Authors and Affiliations

  1. QEDIT, Tel Aviv-Yafo, Israel

    Daniel Benarroch

  2. Aarhus University, Aarhus, Denmark

    Matteo Campanelli

  3. IMDEA Software Institute, Madrid, Spain

    Dario Fiore & Dimitris Kolonelos

  4. Ethereum Foundation and cLabs, Netanya, Israel

    Kobi Gurkan

  5. Universidad Politécnica de Madrid, Madrid, Spain

    Dimitris Kolonelos

Authors
  1. Daniel Benarroch
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Matteo Campanelli
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Dario Fiore
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Kobi Gurkan
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Dimitris Kolonelos
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Dimitris Kolonelos .

Editor information

Editors and Affiliations

  1. University of Illinois at Urbana-Champaign, Urbana, IL, USA

    Nikita Borisov

  2. KU Leuven, Leuven, Belgium

    Claudia Diaz

Rights and permissions

Reprints and permissions

Copyright information

© 2021 International Financial Cryptography Association

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Benarroch, D., Campanelli, M., Fiore, D., Gurkan, K., Kolonelos, D. (2021). Zero-Knowledge Proofs for Set Membership: Efficient, Succinct, Modular. In: Borisov, N., Diaz, C. (eds) Financial Cryptography and Data Security. FC 2021. Lecture Notes in Computer Science(), vol 12674. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-64322-8_19

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-64322-8_19

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-64321-1

  • Online ISBN: 978-3-662-64322-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation