Magic Adversaries Versus Individual Reduction: Science Wins Either Way

27 Pages·2016·0.44 MB·English

Magic Adversaries Versus Individual Reduction:
Science Wins Either Way (cid:63)
YiDeng1,2
1SKLOIS,InstituteofInformationEngineering,CAS,Beijing,P.R.China
2StateKeyLaboratoryofCryptology,P.O.Box5159,Beijing,100878,China
[email protected]
Abstract. Weprovethat,assumingthereexistsaninjectiveone-wayfunctionf,atleastone
ofthefollowingstatementsistrue:
– (Infinitely-often)Non-uniformpublic-keyencryptionandkeyagreementexist;
– TheFeige-Shamirprotocolinstantiatedwithf isdistributionalconcurrentzeroknowledge
for a large class of distributions over any OR NP-relations with small distinguishability
gap.
Thequestionsofwhetherwecanachievethesegoalsareknowntobesubjecttoblack-boxlim-
itations.Ourwin-winresultalsoestablishesanunexpectedconnectionbetweenthecomplexity
ofpublic-keyencryptionandtheround-complexityofconcurrentzeroknowledge.
Asthemaintechnicalcontribution,weintroduceadissectionprocedureforconcurrentad-
versaries,whichenablesustotransformamagicconcurrentadversarythatbreaksthedistribu-
tionalconcurrentzeroknowledgeoftheFeige-Shamirprotocolintonon-black-boxconstruc-
tionsof(infinitely-often)public-keyencryptionandkeyagreement.
Thisdissectionofcomplexalgorithmsgivesinsightintothefundamentalgapbetweenthe
knownuniversalsecurityreductions/simulations,inwhichasinglereductionalgorithmorsimu-
latorworksforalladversaries,andthenaturalsecuritydefinitions(thataresufficientforalmost
all cryptographic primitives/protocols), which switch the order of qualifiers and only require
thatforeveryadversarythereexistsanindividualreductionorsimulator.
1 Introduction
TheseminalworkofImpagliazzoandRudich[IR89]providesamethodologyforstudyingthelim-
itationsofblack-boxreductions.Followingthismethodology,plentyofblack-boxbarriers,toward-
s building cryptographic systems on simpler primitives/assumptions and achieving more efficient
constructions, have been found in the last three decades. These findings have long challenged us
todevelopnewreductionmethodsandgetaroundthelimitationsofblack-boxreduction,however,
theprogresstowardsthisgoalisquiteslow,andformostoftheknownblack-boxbarriers,itisstill
unclearwhethertheyevenholdforarbitraryreductions.
We revisit two seemingly unrelated fundamental problems, for both of which the black-box
impossibilityresultsarewellknown.
Thefirstproblemistoidentifytheweakestcomplexityassumptionsrequiredforpublic-keyen-
cryption. Ever since the invention of public key cryptography by Diffie and Hellman [DH76], the
complexity of public-key cryptography, i.e., lowering the underlying complexity assumptions for
cryptographicprimitives/protocols,isoneofthemostbasicproblems.Inthepastfourdecades,for
some primitives, including pseudorandom generators, signatures and statistically-hiding commit-
ments,wewitnessedhugesuccessonthislineofresearchandcannowbasethemontheexistence
(cid:63)“Sciencewinseitherway”iscreditedtoSilvioMicali.ThisworkwassupportedbytheNationalNaturalSci-
enceFoundationofChina(GrantNo.61379141),andtheOpenProjectProgramoftheStateKeyLaboratory
ofCryptology.
ofone-wayfunctions[Rom90,HILL99,HR07],whichistheminimumassumptioninthesensethat,
asshowedby [IL89],almostallcryptographicprimitives/protocolsimplytheexistenceofone-way
functions.
But for public-key encryption and key agreement– the concepts that were conceived in the o-
riginalpaperofDiffieandHellman,wedidnotmakethatsuccessfulprogressyet.Impagliazzoand
Rudichprovedintheirseminalwork[IR89]thatthereisnoblack-boxreductionofone-waypermu-
tations to key agreement, and since public-key encryption implies key agreement, their result also
separatesone-waypermutationsfrompublic-keyencryptionwithrespecttoblack-boxreduction.
In [Imp95]Impagliazzodescribesfivepossibleworldsofcomplexitytheory.Thetoptwoworlds
amongthemareCryptomania,wherepublic-keycrypgraphyexists,andMinicryptwherethereare
one-way functions but no public-key cryptography. Though the above black-box separation pro-
videssomestrongnegativeevidences,theydonotruleoutthepossibilityofconstructingpublic-key
encryptionfromone-wayfunctions,i.e.,donotprovethatweliveinMinicrypt.
The other fundamental problem we consider is that of the round-complexity of concurrent ze-
ro knowledge. The notion of concurrent zero-knowledge, put forward by Dwork, Naor and Sa-
hai [DNS98], extends the standard-alone zero-knowledge security notion [GMR89] to the case
where multiple concurrent executions of the same protocol take place and an adversarial verifier
maycorruptmultipleverifiersandcontroltheschedulingofthemessages.
As observed in [DNS98], the traditional black-box simulator does not work for the classic
constant-roundprotocols(includingtheFeige-Shamirtypeprotocol[FS89]andtheGoldreich-Kahan
typeprotocol[GK96])intheconcurrentsetting.Indeed,Canettietal.[CKPR01]provedthatcon-
currentzero-knowledgewithblack-boxsimulationrequiresalogarithmicnumberofroundsforlan-
guages outside BPP. Prabhakaran et al. [PRS02] later refined the analysis of the Kilian and Pe-
trank’s[KP01]recursivesimulatorandgavean(almost)logarithmicroundconcurrentzeroknowl-
edgeprotocolforNP.
Inhisbreakthroughwork,Barak[Bar01]introducedanon-black-boxsimulationtechniquebased
onPCPmechanismandconstructedaconstant-roundpublic-coinbounded-concurrentzeroknowl-
edge protocol for NP, which breaks several known lower bounds for black-box zero knowledge.
Therehasbeenavastbodyofwork(seeSection1.4)sincethenondevelopingnewnon-black-box
techniquesandreducingtheround-complexityofzeroknowledgeprotocolintheconcurrentsetting.
However,Theproblemofwhetherwecanachieveconstant-roundconcurrentzeroknowledgebased
onstandardassumptionsisstillleftopen.
Note also that the known constructions that beat the lower bound on the black-box round-
complexity are rather complicated and therefore impractical. Given the current state of the art, a
more ambitious question is whether we can prove the concurrent zero knowledge property of the
classic4-roundprotocols(suchastheFeige-Shamirprotocol),althoughitisknowntobeimpossible
togivesuchaproofforthesesimpleandelegantconstructionsviablack-boxsimulations.
1.1 UniversalSimulator“∃S∀A”VersusIndividualSimulator“∀A∃S”
We observe that almost all known reduction and simulation techniques are universal in the sense
that, in the security proof of a protocol/premitive, the reduction R (or simulator S) works for all
possibleefficientadversariesandturnthepowerofagivenadversaryAintothepowerofbreaking
theunderlyingassumptions(i.e.,“∃RorS ∀A”).However,formostnaturalsecuritydefinitions,it
isonlyrequiredthatforeveryadversaryAthereexistsanindividualreductionR(orasimulatorS)
thatworksforA(i.e.,“∀A∃RorS”).
ThismotivatesustostepbackandlookattheconcurrentsecurityofthesimplestFeige-Shamir
protocol.Wewillshowthatthereisanindividualsimulatorforthespecificadversarialverifier(and
thus it is not a concrete “attacker”) constructed by Canetti et al. [CKPR01], though it was shown
that for such an adversary the known black-box simulator fails. Sure, showing the existence of a
2
simulator for a specific verifier does not mean that the Feige-Shamir protocol is concurrent zero
knowledge, but this example does reveal a gap between the universal simulation “∃S∀A” and the
individualsimulation“∀A∃S”.
TheFeige-Shamirprotocolforprovingx∈Lproceedsasfollows.Inthefirstphase,theverifier
pickstworandomstringsα andα ,computestwoimages,β =f(α ),β =f(α ),ofaone-way
1 2 1 1 2 2
functionf,andthenprovestotheproverviaaconstant-roundwitnessindistinguishabilityprotocol
thatheknowseitherα orα ;inthesecondphase,theproverprovesthateitherx∈Lorheknows
1 2
one of α , α . The adversary V∗ constructed in [CKPR01] adopts a delicate scheduling strategy,
1 2
andwhencomputingaverifiermessage,itappliesahashfunctionhwithhighindependencetothe
historyhistsofarandgeneratestherandomnessr = h(hist)forcomputingthecurrentmessage.In
ourcase,therandomnessforthefirstverifierstepofasessionincludesthetwopre-imagesα and
1
α .
2
Canettietal.showedthatitisimpossibleforanefficientsimulatortosimulateV∗’sviewwhen
treating it as a black-box1. However, as mentioned before, the natural concurrent zero knowledge
conditiondoesnotrequireauniversal(orblack-box)simulatorthatworksforalladversarialverifiers,
butjustrequiresthatforeveryspecificV∗thereexistsanindividualsimulator.
Note that the individual simulator may depends on the specific verifier, and more importantly,
sinceweareonlyrequiredtoshowthemereexistenceofsuchasimulator,wecanassumethatthe
individualsimulatorknows(orequivalently,takesasinput)theverifier’sfunctionality,randomness,
etc.
Indeed, for the adversary V∗ of [CKPR01], there exists, albeit probably not efficiently con-
structiblefromagiven(possiblyobfuscated)codeofV∗,asimplesimulatorfortheabovespecific
V∗: Note that there exists an adversary V(cid:48) that acts exactly in the same way as V∗ except that at
each step V(cid:48) outputs r = h(hist) together with the current message, and thus a trivial simulator
Sim(V(cid:48)),incorporatingV(cid:48) andusingthefakewitness(oneofα andα 2)outputbyV(cid:48) atthefirst
1 2
verifierstepofeachsession,caneasilygenerateatranscriptthatisindistinguishablefromthereal
interactionbetweenV∗andhonestprovers.
1.2 OurWork
Weproveanunexpectedconnectionbetweenthecomplexityofpublic-keyencryptionandtheround-
complexityofconcurrentzeroknowledge.Specifically,weshowhowtotransformanattackerthat
canbreakaweakversionofdistributionalconcurrentzeroknowledgeoftheFeige-Shamirprotocol
instantiatedwithinjectiveone-wayfunctionsinto(infinitely-often)constructionsofpublic-keyen-
cryptionandkeyagreement.Thismeansatleastoneofthetwoproblems(withrespecttoinfinitely-
oftenversionanddistributionalversionrespectively)mentionedabovehasapositiveanswer.
A formal statement of our result. Let L and R be an arbitrary NP language and its associated
L
NPrelationrespectively.TheORlanguageL∨L3andthecorrespondingrelationR aredefined
LOR
inanaturalway.
Given an arbitrary efficiently samplable distribution ensemble D = {D } over R (each
n n∈N L
D is over Rn := {(x,w) : (x,w) ∈ R ∧ |x| = n}), and an arbitrary efficiently samplable
n L L
distribution Z over {0,1}∗4, we define the joint distribution {(X ,W ,Z )} over R ×
n n n n n∈N LOR
{0,1}∗ inthefollowingway:Sample(x ,w ) ← D ,(x ,w ) ← D ,z ← Z ,b ← {1,2},and
1 1 n 2 2 n n
output((x ,x ),w ).
1 2 b
1I.e.,thesimulatorisgivenonlyoracleaccesstoV∗,anddoesnothaveknowledgeaboutitscode,running
time,etc.
2Notethatα andα arepartoftherandomnessrusedinthefirstverifiermessageofasession.
1 2
3Forsimplicity,weconsideronlytheORcompositionofthesameNPlanguageL,butourresultholdswith
respecttotheORcompositionofanytwoNPlanguages.
4TheelementzfromZ willbegivenasauxiliaryinputtotheverifierofFeige-Shamirprotocol.
n
3
Theorem1. Assume that there exists an injective one-way function f. Then, at least one of the
followingstatementsistrue:
– (Infinitely-often)Non-uniformpublic-keyencryptionandkeyagreementexist;
– Foreveryinversepolynomial(cid:15),theFeige-Shamirprotocolinstantiatedwithf isdistributional
concurrent zero knowledge on {(X ,W ,Z )} defined as above with distinguishability
n n n n∈N
gapboundedby(cid:15).
In an infinitely-often version of a primitive, the correctness and security of a construction are
requiredtoholdonlyforinfinitelymanysecurityparametern.Thenotionof(cid:15)-distributionalcon-
currentzeroknowledge(firstdefinedin [CLP15b])differsfromthetraditionalzeroknowledgein
thatitszeroknowledgepropertyholdsonaverage(i.e.,holdsfordistributionsoverthestatements),
andthattheindistinguishabilitygapforanyefficientdistinguisherisboundedbyanarbitraryinverse
polynomial(insteadofanegligiblyfunction).
Veryroughly,Theorem1saystheFeige-ShamirprotocolisconcurrentsecureintheMinicrypt:
In the world where there are injective one-way functions but no public-key encryption, the Feige-
Shamirprotocolsatisfiescertainversionofconcurrentzeroknowledge.
Remark1. We note that the black-box lower bounds [IR89, CKPR01] also hold for the infinitely-
often version of public-key encryption and the (cid:15)-distributional concurrent zero knowledge5. We
stress that our public-key encryption (and the key agreement) is based on the injective one-way
functionf andthespecificattackeragainsttheFeige-Shamirprotocol,andisnon-uniformandnon-
black-box in nature: The key generation, encryption and decryption algorithms in our public-key
encryptionschemeareallnon-unform,andmakenon-black-boxusageoftheunderlyingfunctionf
andtheattacker.
Dissectingacomplexadversary:RevealingtheCreationofaMagicTrapdoor.Thebasicproof
strategyofTheorem1istotransformamagicverifieragainsttheFeige-Shamirprotocolintocon-
structionsfor(infinitely-often)public-keyencryptionandkeyagreement.Thisproofideaissome-
whatsimilarinspirittotheoneappearedin [DNRS03]butstillquiteunusualincryptography.Inour
setting,formalizingsuchaproofideaisverycomplicatedandrequiressubstantiallynewtechniques.
Todealwiththecomplexconcurrentadversary,weintroduceadissectionproceduretopinpoint
where a supposed successful adversary magically endow a set of images of the injective one-way
functionf withatrapdoor,whichisthekeysteptowardsourconstructionofpublic-keyencryption
viatheGoldreich-LevinTheorem.Ontheveryhighlevel,ifanadversarialverifierV∗thatcanbreak
concurrentzeroknowledgeoftheFeige-Shamirprotocol,thenintherealinteractiontheremustexist
astepi(verifierstepsareorderedaccordingtotheirappearanceintheconcurrentsetting)suchthat:
– Withhighprobability,V∗ willoutputapairofimagesβ andβ ,i.e.,thefirstverifiermessage
1 2
ofsomesessionj atthisstepi,andatalatertimeitwillreachitssecondstepofsessionj,i.e.,
completesits3-roundproofthatitknowsonepre-imageofβ andβ underf.
1 2
– ButforanyefficientalgorithmT,eventakingthecodeofV∗andthehistoryprefixuptoitsi-th
step,theprobabilitythatT invertsanyoneofthesetwoimagesβ andβ isboundedawayfrom
1 2
1.
Theintuitionbehindthisobservationisasfollows.Iftheabovetwoitemsdoesnotholdsimul-
taneously, then at each verifier step, either V∗ does not output a pair of images of a session, or it
outputsapairofimagesofsessionjbutwillneverreachitssecondmessageofsessionj,orthereis
5OurresultholdswithrespecttodistributionsthatarenotalwaysoverYESinstances.Byapplyingthelower-
boundproofstrategyof[CKPR01],weconcludethattheFeige-Shamirprotocolcannotbe(cid:15)-distributional
concurrentblack-boxzeroknowledgeforanynon-trivialdistributionoverhardproblems,seeAppendixA
formoredetails.
4
anefficientalgorithmthatcanfindoneofthecorrespondingpre-images.Ineachcasewewillhave
asimplesimulatorthatcansimulatetheviewoftheV∗,whichleadstoacontradiction.
Thus,foragivensuccessfuladversaryV∗ theabovetwoitemsmustholdsimultaneously.This
means V∗ magically endow the images β and β output at its step i with a trapdoor (i.e., the
1 2
witness w to the common input x): With the trapdoor w, one can play the role of honest prover
untilV∗ completeshis3-roundproof,thenusingstandardrewindingtechniquetoobtainoneofthe
pre-images;while,withouttheknowledgeofw,noefficientalgorithmcaninvertanyoneofβ and
1
β with overwhelming probability. This is the key observation that enables us to construct public
2
keyencryptionandkeyagreementfromtheinjectiveone-wayf.
Themajorchallengeintheactualdissectionistoshowtheexistenceofinfinitelymanysecurity
parameternforeachofwhichtheaboveconditionshold(asrequiredbyinfinitely-oftenpublickey
encryption and key agreement). To cope with this difficulty, we develop a set of techniques that
convertconcretesecurityintoasymptoticsecurity,whichmaybeofindependentinterest.
ExploitingtheMagicTrapdoor.Withatrapdoor,anapproachtopublic-keyencryptionthatcomes
tomindisthewell-knowparadigmviatheGoldreich-Levintheorem.Inthisparadigm,thepublic-
key is an injective one-way function f, and the secret key is its trapdoor. To encrypt a bit m, one
(cid:76)
picksarandomstringsandcomputesthecypher-text(f(s),h(s) m),wherehistheGoldreich-
Levinhardcoreforf.Thereceivercanusethetrapdooroff todecryptthecypher-text.
Acloserlookatthetrapdoorendowedbythemagicadversarysuggeststhatthisapproachdoes
not work. Observe that, given a supposed magic adversary V∗, a witness w to x can serve as the
trapdoor for the possible set of images output by V∗ at its step i (under the same common input
x),butnotthetrapdoorof f.Thus,ifwefollowtheaboveparadigmandletx6 bethepublic-key,
then, in order to enable decryption, some image of f output by V∗ must be the first part of the
cypher-text.However,inthisscenario,anhonestsenderwithoutknowingwwillbeunabletoobtain
the corresponding pre-image of that image and therefore cannot compute the second part of the
cypher-text.
To overcome this difficulty, we assume V∗ breaks the (cid:15)-distributional zero knowledge of the
Feige-Shamir protocol on OR NP-statements of the form (x ∨ x ), and have an honest sender
1 2
generateastatementanditswitness(x ,w )(notethatw isanwitnessto(x ∨x ))onhisown
2 2 2 1 2
whencomputingacypher-textunderthepublic-keyx .Seebelowfordetails.
1
AnOverviewoftheProof.Wedividetheproofintofoursteps,whichwillbepresentedinsections
3to6respectively.Roughly,theproofproceedsasfollows.
STEPI: We introduce a dissection procedure and prove that there must be infinitely many n, for
each of which there exists a step i of V∗, such that the above two items hold simultaneously.
ThisillustratesthepowerofV∗ thatmagicallyendowstheimagesoff outputbyV∗ atitsstep
iwithasortoftrapdoor.
STEPII: NotethatV∗ outputsapairofimagesoff atitsstepi.Toavoidthatthesenderandthe
receiver (both with a witness to x) may recover different pre-images from V∗, we construct
a pair of non-interactive algorithms C and E from the code of V∗ such that for each (n,i)
obtainedintheabovestep:
– C(withknowledgeofawitnesswtox)outputsasingleimageβoff withhighprobability;
– E (withknowledgeofawitnesswtox)willextractthepre-imageofβ outputbyC;
– Noefficientalgorithmcancomputethepre-imageofβ withprobabilitycloseto1.
STEPIII: Usingstandardtechniques,weamplifythegapbetweenthesuccessprobabilityofEand
thesuccessprobabilityofanyefficientinvertingalgorithmwithoutknowingawitnesstox,and
obtain two algorithms M and Find, where M takes a sequence of (x,w) as input and outputs
asequenceofimagesβ off,andFindtakesthesamesequenceof(x,w)andoutputsallpre-
imagescorrespondingtothesequenceofimagesβ,bothwithprobabilitynegligiblycloseto1;
6Herewefixthefunctionf andtheadversaryV∗,whichcanbeviewedaspartofthepublickey.
5
further,thereisnoefficientalgorithmthatcaninvertalltheimagesoutputbyMsimultaneously
withnon-negligibleprobability.
STEPIV: NotethattheFeige-Shamirprotocolisconcurrentlywitnessindistinguishable,andthus
the above holds when M and Find use different witnesses. Starting with a magic adversary
V∗ that breaks the distributional concurrent zero knowledge of the Feige-Shamir protocol for
distributionoverORNP-statementsoftheform(x ∨x ),weconstructthepublic-keyencryp-
1 2
tion scheme (and key-exchange scheme) in a natural way: The receiver generates a sequence
of (x ,w ) as the public/secret key pair; to encrypt a bit, the sender generates a sequence of
1 1
(x ,w )andrunsMoninputthesequenceofORstatements(x ∨x )andtheircorresponding
2 2 1 2
witnesses w to generate a set of images of f, computes the hard-core of the corresponding
2
pre-imagesandXORtheplaintextbitwiththehardcore;todecrypt,thereceiverrunsFindon
inputtheciphertextandthesequenceofwitnessesw toobtainthecorrespondingpre-images,
1
andthencomputesthehardcoreandgetstheplaintext.
Remark2. WeusethecodeofV∗inourfinalconstructionofpublic-keyencryption.However,what
weactuallyneedtoconstructpublic-keyencryptionisthefunctionalityofV∗,thatis,wecanreplace
thecodeofV∗ withanycode7 ofthesamefunctionalityintheintermediatealgorithmsineachof
abovestepsalongtheway.
1.3 AWidePerspectiveonReductions
Asmentioned,themostlycommonusedsecurityprooftechniques–black-boxtechniques(see[RTV04,
BBF13]forrefinedtreatments)andtheknownnon-black-boxtechniques[Bar01,DGS09,BP15]–
areuniversal,whereasingleuniversalreductionalgorithmworksforallpossibleadversaries.Here
in this section we abuse the term reduction and view simulation as a type of reduction. Note that
thedescriptionofanadversarythatthereductionalgorithmhasaccesstoprobablyisanobfuscated
code.Thiscausesatroubleincaseswherethefunctionalityoftheadversaryiscrucialforthereduc-
tiontogothrough(asshowedintheaboveexampleofsimulationfortheadversaryin [CKPR01],
andseealso [DGL+16]),sincewecannotexpecttheefficientreductionalgorithmtofigureoutthe
functionalityfromagivenobfuscatedcodeofanarbitraryadversary.
However, in almost all cases, in a security proof the reduction can be arbitrary. This means
the reduction is allowed to depend not only on the code of the adversary, but also on any “nice”
properties of the adversary (if exist), such as functionality, good random tapes, etc. Furthermore,
to show the mere existence of such an arbitrary reduction, we do not need to care about whether
such properties can be efficiently extracted from the code of the adversary, but just assume that
the reduction takes these properties as input. We refer to an arbitrary reduction as individual re-
duction,whichisalsocallednon-constructivereductionornon-uniformreductioninsomeprevious
work[BU08,CLMP13].Westressthatitisnotalwayspossibletoturnanindividualreductioninto
a universal reduction with a non-uniform advice because, in many cases, even if we can prove all
possibleadversariesshareacertainproperty,thispropertymaynothaveashortdescription.(This
willbeclearinthefollowingexample.)
Recallthat,tocompleteasecurityproof,wehavetoshowforeveryadversarythereisanindi-
vidual reduction. This would be impossible unless we can prove that all possible adversaries have
certain properties in common. Indeed, we observe that a few exceptional individual reductions in
complexity (e.g., [Adl78]) and hardness amplification (e.g., [GNW95, CHS05, HS11]) literature
arebasedonaproperty–theexistenceof“good”randomtapes–sharedbyallpossibleadversaries.
Let’s take the reduction for BPP ⊆ P/poly [Adl78] as an example. The first step of the proof of
[Adl78]istoshowacommonpropertythateverymachinedecidingalanguageL∈BPPmusthave
at least one good random tape on which this machine will make correct decisions on all instances
7Aslongasitisofpolynomialsize.
6
ofagivensize.Usingthemereexistenceofagoodrandomtape,wecanthensimplyhardwirethis
good random tape into the circuit family that decide the language L deterministically. This circuit
familycanbethoughtofasareduction,whichvariesdependingonthespecificBPPmachinesince
differentmachinesmayhavedifferentgoodrandomtaps.
Besidesthestructure(success/failure)oftherandomtapes,thereseemstobeamoreimportant
structureoftheadversaries,i.e.,thestructureoftheadversary’scomputation,thatwouldempower
the individual reduction greatly. In cryptography, we actually already exploited structures of this
type, such as the knowledge of exponent assumption and extractable one-way functions [Dam91,
BCPR14],butmostofthemareviewedasjustnon-standardassumption.Ourworkseemstoraise
somehopethatwemaybeabletoprovehighlynon-trivialstructuresoftheadversary’scomputation
insomesettingsunderstandardassumptionsinthefuture.
1.4 RelatedWork
Therehavebeennumerousefficientconstructions([RSA78,Rab79,GM82,CS99,Reg09,HKS03],
tonameafew)forpublic-keyencryptionwithvarioussecuritynotionsbasedonspecificassumption-
swithvariousalgebraicstructures,andsomelessefficientconstructions[NY90,BHSV98,Sah99,
Lin03a]basedonmoreabstractassumptions–enhancedtrapdoorpermutationsortrapdoorfunctions
withpolynomialpre-imagesize.Sincepublic-keyencryptionimplieskeyagreement(secureagainst
eavesdroppingadversaries),thesameassumptionsaresufficientforthelatter.Onthenegativeside,
therecentworkof [DS16]strengthenstheblack-boxseparationofpublic-keyencryptionandgener-
alone-wayfunctionsin[IR89]byallowingthereductiontotakethecodeoftheunderlyingprimitive
asinput.
Inthelineofresearchonconcurrentzeroknowledge,Goyal[Goy13]extendedBarak’sideato
achieve fully concurrent zero knowledge in polynomial rounds. In the globe hash model, Canetti
etal.[CLP13a]showedthatpublic-coinconcurrentzeroknowledgecanbeobtainedwithlogarith-
mic round-complexity. Recently, Chung et al. [CLP15a] (based on [CLP13b]) presented the first
constant-roundconcurrentzeroknowledgeprotocolbasedonindistinguishabilityobfuscationwith
super-polynomialsecurity.Assumingtheexistencepublic-coininput-differingobfuscation,Pandey
etal.[PPS15]presenteda4-roundconcurrentzeroknowledgeprotocol.Overthelasttwodecades,
concurrent zero knowledge protocols have been used as a key building block in the construction
of generally composable cryptographic protocols [CLOS02, PR03, Lin03b, PR05, Pas04, Lin08,
GGJ13,GGJS12,GGS15,GLP+15].
2 Preliminaries
Afunctionnegl(n)iscallednegligibleifitvanishesfasterthananyinversepolynomial.
If D is a distribution (or random variable), we denote by x ← D the process of sampling x
according to D, and by {x }k ← D(cid:78)k the process of sampling k times x from D indepen-
i i=1
dently. Similarly, for a function f : {0,1}n → {0,1}(cid:96)(n), f(cid:78)k denotes the function that maps
(x ,x ,...,x )to(f(x ),f(x ),...,f(x )).
1 2 k 1 2 k
We abbreviate probabilistic polynomial-time with PPT. Throughout this paper, all PPT algo-
rithms/Turing machines are allowed to be non-uniform, and we use non-uniform PPT algorithm-
s/Turing machines interchangeably with circuit families of polynomial size. In our default setting,
thecircuitfamiliesarealsoprobabilistic.
Givenatwo-partyprotocolΠ =(P ,P ),fori∈{1,2},wedenotebyTrans (P (x),P (y))
1 2 Pi 1 2
thetranscriptofanexecutionofΠ (includingtheinputtoP )whenP ’sinputisxandP ’sinput
i 1 2
isy.Forajointdistribution(X,Y)overthetwoparties’inputs,Trans (P (X),P (Y))naturally
Pi 1 2
definesthedistributionoverallpossibleviewofP .
i
7
We refer readers to [Gol01, KL07] for formal definitions of basic notions and primitives such
ascomputationalindistinguishability,one-wayfunctions,pseudorandomgeneratorandcommitment
scheme.
c
Throughout the paper, we let n be the security parameter. We write {Xn}n∈N ≈ {Yn}n∈N to
indicate that the two distribution ensembles {Xn}n∈N and {Yn}n∈N are computationally distin-
guishable.
Public-KeyEncryptionandKeyAgreement.Inthispaperweconsideronlythemostbasicsecurity
notionsforpublic-keyencryptionandkeyagreement,i.e.,semanticsecurityunderchosen-plaintext-
attack(forpublic-keyencryption)andsecurityagainsteavesdropping(forkeyagreement).Formal
descriptionsofthesenotionscanbefoundonthetextbook[KL07]andweomitthemhere.
Arguments, WI and Distributional CZK. Fix an NP language L and its associated relation R .
L
Aninteractiveargumentsystem(P,V)forLisapairofinteractiveTuringmachines,inwhichthe
proverP wantstoconvincetheverifierV ofsomestatementx∈L.
Definition1 (Interactive Argument [BCC88]). A pair of interactive Turing machines (P,V) is
called an interactive argument system for language L if the machine V is a PPT machine and the
followingconditionshold:
– Completeness:Foreveryx∈L,w ∈R (x),V acceptsthetranscriptsattheendofinteraction
L
withP(x,w)withprobabilitynegligiblycloseto1.
– Soundness: For every x ∈/ L, and every non-uniform PPT prover P∗, V rejects at the end of
interactionwithP∗withprobabilitynegligiblycloseto1.
Definition2 (Witness Indistinguishability). An interactive argument (P,V) for language L is
said to be witness indistinguishable (WI) if for every non-uniform PPT V∗, every auxiliary input
z ∈{0,1}∗toV∗,every{(x,w ,w )} suchthatboth(x,w )and(x,w )∈R ,itholdsthat
0 1 x∈L 0 1 L
{Trans (P(x,w ),V∗(z))} ≈c {Trans (P(x,w ),V∗(z))} ,
V∗ 0 x∈L,z∈{0,1}∗ V∗ 1 x∈L,z∈{0,1}∗
wherebothdistributionsareovertherandomtapesofP andV∗.
Azeroknowledgeargumentsystemisaninteractiveargumentforwhichtheviewofthe(even
malicious)verifierinaninteractioncanbeefficientlyreconstructed.Inthispaper,weconsiderdistri-
butionalzeroknowledge,definedbyGoldreich[Gol93],forwhichtheindistinguishabilitybetween
the real interaction and the simulation is only required to hold for any distribution over the inputs
toeachparty,ratherthantoholdforeveryindividualinputs.Wefollowthedefinitionof[CLP15b],
which departs from the one of [Gol93] in that it only requires that for each distribution over the
inputs there exists an efficient simulator8, and consider the case (following [DNRS03, CLP15b])
where the indistinguishability gap between the simulation and the real interaction is less than any
inversepolynomial(cid:15)(insteadofanegligiblefunction).Aswewillshow,thesizeofencryptional-
gorithmofourencryptionschemeispolynomialinthevalue 1,whichneedstobeupper-bounded
(cid:15)
byafixed(butarbitrary)polynomial.
StepsoftheConcurrentVerifierandStepsofaSession.WealsoallowtheadversaryV∗tolaunch
aconcurrentattack[DNS98,PRS02]inwhichitinteractswithapolynomialnumberofindependent
provers over an asynchronous network, and fully controls over the scheduling of all messages in
theseinteractions.
WerefertotheactionofsendingamessagebyV∗ asastep(ofV∗).Inarealconcurrentinter-
action,weorderthestepsofV∗ accordingtotheirappearance.Notethatintheconcurrentsetting,
sessionsoftheFeige-Shamirprotocolareexecutedininterleavingway,andthus,“thesecondverifi-
erstepofasession”referstothesecondverifierstepthatappearsinthisspecificsession,nottothe
secondstepofV∗intherealconcurrentinteraction.
8Instead,thedefinitionof[Gol93]requiresanefficientsimulatorforalldistributionsovertheinputs.
8
Definition3 ((cid:15)-DistributionalConcurrentzeroknowledge).Wesaythataninteractiveargument
(P,V)forlanguageLis(cid:15)-distributionalconcurrentzeroknowledgeifforeveryconcurrentadver-
sary V∗, and every distribution ensemble {(Xn,Wn,Zn)}n∈N over RLn ×{0,1}∗, there exists a
non-uniformPPTSimsuchthatforallnon-uniformPPTDandsufficientlargenitholdsthat
Pr[D(Trans (P(X ,W ),V∗(Z )),Z )=1]−Pr[D(Sim(V∗,X ,Z ),Z )=1]<(cid:15)(n),
V∗ n n n n n n n
wherebothdistributionsareover(X ,W ,Z )andtherandomtapesofP andV∗.
n n n
ParallelizedBlum’sWIProofsforNP.ThebasicbuildingblockoftheFeige-Shamirprotocolsis
witnessindistinguishableproofs.Forourpurpose,wewillusetheparallelized3-roundBlum’sproof
systembasedoninjectiveone-wayfunctions[Blu86]9.
Denote by (a,e,t) the three messages exchanged by the prover and the verifier in a execution
of the n-parallel-repetition of the 3-round Blum’s protocol. Our results rely on the following nice
propertiesofthisprotocol:
– Witnessindistinguishabilitywhenthecommoninputxhastwodifferentwitnesses;
– Special soundness: the soundness error is 1 , and from any common input x and any pair of
2n
acceptingtranscripts(a,e,t)and(a,e(cid:48),t(cid:48))withthesamefirstmessageabutdifferentchallenges
e(cid:54)=e(cid:48),onecanefficientlycomputewsuchthat(x,w)∈R .
L
The Feige-Shamir ZK Argument for NP. We here describe the Feige-Shamir constant-round10
zeroknowledgeargumentforNPbasedonaninjectiveone-wayfunctionf :{0,1}n →{0,1}(cid:96)(n).
PROTOCOLFEIGE-SHAMIR
Commoninput:x∈L.
TheproverP’sinput:wsuchthat(x,w)∈R .
L
TheverifierV’s(auxiliary)input:z
Firstphase:
Executethen-parallel-repetitionofthe3-roundBlum’sprotocolinwhichV playstherole
oftheprover:
V −→P: Chooseα ,α ←{0,1}nindependentlyandatrandom,computeβ =f(α ),
1 2 1 1
β =f(α ),andcomputethefirstprovermessageaofthe3-roundn-parallel-
2 2
repetitionoftheBlum’sprotocolinwhichV provestoP thatheknowsoneof
α ,α .
1 2
Sendβ ,β anda.
1 2
P −→V: Sendarandomchallengee←{0,1}n.
V −→P: Sendt.
Secondphase:
P andV executethen-parallel-repetitionofthe3-roundBlum’sprotocolinwhichP proves
toV thateitherx∈Lorheknowsoneofα ,α .
1 2
9Notethatperfectbindingcommitmentschemecanbeconstructedfrominjectiveone-wayfunction.
10Bymergingthefirstandthesecondprovermessages,onecanobtaina4-roundFeige-Shamirprotocol.
9
3 TheDissectionofaConcurrentVerifier
Inthissectionwedevelopatechniquetodissectconcurrentverifiersthatrevealswhereasupposed
concreteattackeragainsttheFeige-Shamirprotocolmagicallyendowssomeimagesofaninjective
one-wayfunctionwithatrapdoor.Thisisthekeysteptowardsconstructingpublic-keyencryption
(andkeyagreement)fromaninjectiveone-wayfunction.
Asmentionedintheintroduction,weshowthatamagicadversaryV∗willendowasetofimages
off withatrapdoorinthefollowingsense:thereareinfinitelymanyn,foreachofwhichthereexists
astepindexi ,suchthattheimages(β ,β )outputbyV∗atitsstepi canonlybeinvertedbyPPT
n 1 2 n
algorithms with the trapdoor knowledge of a witness to the common input x with overwhelming
probability.
Weneedthefollowingnotationstogiveaformalstatementofourlemma:
– Transin andh←Transin:Theformerdenotesthedistributionofthehistoryprefixintheview
ofV∗uptoitsi -thstepintherealconcurrentinteractionTrans (P(X ,W ),V∗(Z ));the
n V∗ n n n
latterdenotestheeventofdrawingahistoryprefixhfromTransin,i.e.,theeventofgenerating
h in the real concurrent interaction between honest prover(s) and V∗, where h consists of the
statementx,theauxiliaryinputztoV∗andtheinteractionhistoryprefixuptothestepi ofthe
n
verifier.
– V∗| (cid:32) (j,2)denotestheeventthat,conditionedonthegivenhistoryprefixh,V∗ reachesthe
h
secondverifierstepofsessionj intherealconcurrentinteraction,i.e.,V∗ completesitsproof
ofknowledgeofonepre-imageinsessionj.
– PartR consists of the randomness used by V∗ and the partial randomness used by honest
h
proversinthoseincompletesessionsinh(i.e.,sessionsinwhichthelastprovermessagedoes
notappearinh)inarealconcurrentinteraction.
ObservethatinasessionoftheFeige-Shamirprotocol,thehonestproverusestheknowledgeof
correspondingwitnesswonlyinitslaststep,andthetranscriptofasessionbeforetheproverlast
stepisindependentofw.Thus,thetranscriptofanincompletesessiontogetherwiththeprover’s
randomnessuseddonothelprevealthewitnessw,butthisisnotthecaseforacompletesession.
Intherealconcurrentinteraction,givenahistoryprefixhuptothei -thstepofV∗,wedenote
n
by h = h(cid:48)||(βj,βj,aj) the event that V∗ outputs the first verifier message (βj,βj,aj) of some
1 2 1 2
sessionj atitsi -thstep,where“||”denotesconcatenationofmessages.
n
Let(cid:15)beanarbitraryinversepolynomial,andpoly(·)beanarbitrarypolynomial.Define
(cid:15)(·)
p(·):= .
2poly2(·)
Lemma1. Let(cid:15),p,polybeasabove,andf betheone-wayfunctionusedintheFeige-Shamirpro-
tocol. Assume that there is a non-uniform PPT verifier V∗, running in at most poly(n) steps, that
breaks(cid:15)-distributionalconcurrentzeroknowledgeoftheFeige-Shamirprotocolonajointdistribu-
tionensemble{(X ,W ,Z )} overaNPrelationR 11andauxiliaryinputs.Then,thereexists
n n n n∈N L
aninfinitesetI ={(n,i )}forwhichthefollowingtwoconditionssimultaneouslyhold:
n
1. Forarandomhistoryprefixgeneratedintherealconcurrentinteraction,
(cid:20) h=h(cid:48)||(βj,βj,aj)∧ (cid:21)
Pr h←Transin : 1 2 ≥p(n).
Pr[V∗ | (cid:32)(j,2)]≥p(n)
h
11Thoughinourfinalconstructionofpublic-keyencryptionweneedtoassumeamagicadversarialverifier
againsttheFeige-Shamirprotocolforadistribution{(X ,W )} oversomeORNP-relation,Lemma1
n n n∈N
andtheresultsinSection4and5holdwithrespecttodistribution{(X ,W )} overanyNPrelation.
n n n∈N
10