Efficient ZeroKnowledge Proofs Jens Groth University College London

Efficient Zero-Knowledge Proofs Jens Groth University College London

Zero-knowledge proof Zero-knowledge: Witness Nothing but truth revealed Prover Statement Soundness: Statement is true Verifier

Internet voting Encryption: The vote Zero-knowledge: private Witness: The vote remains secret. The vote isis valid vote, r Is the vote Soundness: The encrypted valid? vote is valid Encpk(vote; r) Voter Election authorities

Multi-party computation Zero-knowledge: Peggy’s input x remains secret I followed the protocol correctly Did you follow Soundness: thefollowed protocol y protocol Peggy correctly? zk proof Peggy f(x, y) Victor

Signatures vk = f(x) sk = x I know x and m Fiat-Shamir heuristic: If ZK proof is public coin make it non-interactive by using hash-function to compute challenges Signsk(m) Signer Verifier

Statements Circuit Satisfiability is an NP -complete language • Statements of the form x L – L is an NP-language – Prover’s witness is w such that (x, w) RL • Examples – The plaintext of c using public key pk is m • Witness is r such that c = Encpk(m; r) – The circuit C is satisfiable • Witness w input to circuit such that C(w)=1

Interactive proof system for L • Efficient interactive algorithms P, V – The prover algorithm P takes as initial input a statement x and a witness w such that (x, w) RL – The verifier algorithm V takes as initial input a statement x • P and V interact and afterwards V returns a bit b – b = 1 corresponds to accept – b = 0 corresponds to reject • Completeness: – Honest P on (x, w) RL always makes honest V accept

Soundness x L b Adversary Soundness: Pr[ x L and b=1] 0 Verifier

Proof or argument • Proof (statistical/perfect soundness): – (P, V) is a proof system for L if an unbounded adversary has negligible chance of convincing the verifier on a false statement • Argument (computational soundness): – (P, V) is an argument system for L if a non-uniform polynomial time adversary has negligible chance of convincing the verifier on a false statement

Zero-knowledge • Zero-knowledge: – The proof only reveals the statement is true, it does not reveal anything else • Defined by simulation: – The adversary can simulate the proof without knowing the prover’s witness x L

Efficiency • Parameters – – Communication Verifier computation. Fiat-Shamir heuristic: Prover computation coin protocol where verifier Number of rounds of. Public interaction just sends random challenges. Can replace verifier with cryptographic hash-function Gives non-interactive protocol that may be verified many times.

Our goal • • Sublinear communication Linear computation for verifier Quasi-linear computation for prover Cannot leak many bits about Constant round complexity witness. Zero-knowledge easy. Must convince verifier using less bits than the witness. Soundness hard.

Example Soundness: x. A = (Gu)x. Ga = Gux+a = Gf It is not. Uzero-knowledge Completeness: Vx. B = (Hv)x. Hb = Hvx+b = Hf x. Gverifier r = which f It is special zero-knowledge: =honest (G w)vx+b, Gwx+r = Gvery So • Language LUx=Aux+a {(p, G, G, H, U, V) |is w: U=Gw, V=Hw} w)xa. Hrandomly rsimulate wx+r =by fpicking Givenunlikely x. Vxin advance B = (H = H H for chosen x f at – G is a prime order p group, G, H, U, V G random computing Soand verifier unless u = accepts v and a. A=G = b f. U-x, B=Hf. V-x A=G A, r, BB=Hr Accept if U x. A = G f V x. B = H f x f f wx+r Prover Verifier

Batch proofs Soundness: A Uixi = Ga (Gui)xi = Ga+ uixi = Gf B Vixi = Hb (Hvi)xi = Hb+ vixi = Hf i i , which is very • Language So L =a+ u {(p, G, G, H, U , V ix b+ vix 1 1, …, Un, Vn) | w 1, …, U wnx wn} randomly chosen 1, Va=H w 1, …, wn: unlikely U 1=Gwfor =G , V =H 1 n n unless a = b and ui = vi A=G A, r, BB=Hr Accept if A Uixi = Gf B Vixi = Hf x i f f r+ w ix Prover Verifier

Schwartz-Zippel lemma • Given two different polynomials p(X) q(X) in Zp[X] of degree n, the chance over random x Zp that p(x)=q(x) is at most n/p • In our batch proof, the probability of a+ uixi b+ vixi is at most n/p for random x unless a = b and ui = vi

Pedersen commitment • Commitment key ck = (p, G, G, H) • Commit(a; r) = Ga. Hr where r Zp • Opening of commitment C is (a, r) such that C=Ga. Hr • Computationally binding: – Cannot find a b, r, s such that Ga. Hr = Gb. Hs • Perfectly hiding: – No matter what a is we get random group element C

Generalized Pedersen commitment • Commitment key ck = (p, G, G 1, …, Gn, H) • Commit(a 1, …, an; r) = Hr Giai where r Zp • Computationally binding: – Cannot find (a 1, …, an, r) (b 1, …, bn, s) for same C • Perfectly hiding: – For all (a 1, …, an) we get random group element C

Generalized Pedersen commitment • Commit(a 1, …, an; r) = Hr Giai • Length-reducing: where r Zp – A single group element even for large vectors (a 1, …, an) • Homomorphic: Commit(a 1, …, an; r)∙Commit(b 1, …, bn; s) = Commit(a 1+b 1, …, an+bn; r+s)

Identical committed matrices A=B Soundness: A 1=commit(a 1; r 1) C Aixi = com(t+ a i; r) = com(f; r) Completeness: B 1=commit(b x 1; s 1) i xi = com(t’+ b C=commit(t; r ), D=commit(t; s 0 0) D B … …ixi; s) = com(f; s) i So t+ aixi = t’+ bixi, which is very A ; r i, r=r + r i ) s=s + s xi B =commit(b ; s ) m=commit(a m n f=t+ a x x m nx i 0 i , unlikely 0 i am for randomly chosen unless ai=bi and hence A=B C, D Accept if C Aixi=com(f; r) D Bixi=com(f; s) x f, r, s Prover Verifier

Efficiency • • Communication: 2 m+n group and field elements Verifier computes: 2 m exponentiations Prover computes: 2 mn exponentiations Rounds: 3 • Compare to O(mn) complexity using standard Pedersen commitments and no batching

Circuit Satisfiability a 1 b 1 NAND a 2 NAND b 2 • General: NP-complete • Model: Resembles real computation • Benchmark: Widely used in ZK proofs 1

Standard zero-knowledge argument for CSAT Committed a {0, 1} Committed a, b, c such that c= (a b) Commit(a 1; r 1) Commit(a 2; r 2) property gives 1 -c Homomorphic Multiplication proof a∙a=a Multiplication proof for 1 -c=ab NAND for Commit(b 1; s 1) Commit(1; 0) Cost O(1) group and. Cost field. O(1) elements group and field elements NAND Commit(b 2; s 2) O(1) exponentiations O(1) for prover exponentiations for prover O(1) exponentiations. O(1) for verifier exponentiations for verifier • Prove committed a 1, a 2, b 1, b 2 {0, 1} • Prove committed a 2= (a 1 b 1), 1= (a 2 b 2) • Total cost for N-gate circuit: – O(N) group and field elements – O(N) exponentiations for both prover and verifier

Batch proof for Circuit Satisfiability a 2 a 1 b 1 NAND b 2 • Commit(a 1, a 2; r), Commit(b 1, b 2; s) • Batch proof for a 1, a 2, b 1, b 2 {0, 1} Batch proof for a 2= (a 1 b 1), 1= (a 2 b 2) • Total cost for N-gate circuit: – O( N) group and field elements – O(N) multiplications for both prover and verifier

Batched commitment to wires of circuit • Public commitment key (p, G, H, G 1, …, Gn) • Commit to a 1, …, a. N, where N=mn, as A 1 = Commit(a 11, …, a 1 n; r 1) … Am = Commit(am 1, …, amn; rm) • Cost of committing to N=mn field elements – – Commitment key has n group elements There are m commitments Batched openings contain n field elements Setting m=n the cost is O( N) group and field elements

Batch argument for committed wires being 0/1 • Want to show Commit(a 11, …, a 1 n; r 1) … satisfy aij {0, 1} Commit(am 1, …, amn; rm) • Equivalent to showing aij(aij-1)=0 • Define bij=aij-1 and si=ri and compute Commit(b 11, …, b 1 n; s 1) = Commit(a 1; r 1) Commit(-1; 0) … Commit(bm 1, …, bmn; sm)=Commit(am; rm)Commit(-1; 0) • Now need to show aijbij=0

Batch product argument • Want to show aijbij=0 for committed values Commit(a 11, …, a 1 n; r 1) Commit(b 11, …, b 1 n; s 1) … Commit(am 1, …, amn; rm) Commit(bm 1, …, bmn; sm) • Let verifier pick random y, z Zp • Will demonstrate i jyiaijbijzj=0 • Schwartz-Zippel tells us unless for all i, j: aijbij=0 negligible probability this is true

Simplifying the batch product argument • Given y, z prover will demonstrate i jyiaijbijzj=0 for commitments Commit(ai 1, …, ain; ri) Commit(bi 1, …, bin; si) • Defining (u 1, …, un) (v 1, …, vn)= jujvjzj the prover’s task is to demonstrate iyiai bi=0 • Using the homomorphic property we have i i i y Commit(y ai; y ri) = Commit(ai; ri) • This simplifies reduces the prover’s task to show Commit(ai’; ri’) Commit(bi; si) contains values that satisfy iai’ bi=0

Idea behind batch ZK argument b 1 b 2 b 3 a 1 b 1 a 1 b 2 a 1 b 3 a 2 b 1 a 2 b 2 a 2 b 3 a 3 b 1 a 3 b 2 a 3 b 3 a 1 b 1+a 2 b 2+a 3 b 3

Idea behind batch ZK argument x-1 b 1 x 1 a 1 + x 2 a 2 + x 3 a 3 a 1 b 1 + x 1 a 2 b 1 x 2 a 3 b 1 x 2(a 3 b 1) x-2 b 2 x-1 a 1 b 2 a 2 b 2 x 1 a 3 b 2 + x-3 b 3 x-2 a 1 b 3 x-1 a 2 b 3 a 3 b 3 x 1(a 2 b 1+a 3 b 2) x-2(a 1 b 3) x-1(a 1 b 2+a 2 b 3) a 1 b 1+a 2 b 2+a 3 b 3

Main part of the batch product argument • Use Given commitments and to weighted Soundness: homomorphic properties compute inner product xi =; r ia ; x ir ) ; s ) Commit(a Look A =at A coefficient x 0. The equation 1) for. Commit(b i 1 Commit( x i i 1 1 -j -j gives B = B …jx = Commit( x-jb… j; x sj) k i-j xx kc=; x kt 0 C = C = a Commit( x b = a b c = ) ) i-j=0 k i j i i i k 0 Commit(am; rm) Commit(bmk; s m The finalthey ZK argument costs O(n) show contain values thatfield satisfy iai bi=0 elements By theand Schwartz-Zippel O(n) exponentiations lemma negligible for • prover Prover sends commitments Ctrue probability and verifier over x for this being -m, …, C-1, C 1, …, Cm Ck = Commit(c ; tkwe ) wanted ck= ai bj unless iai bi = 0 kas toi-j=k show • Verifier sends random challenge x Zp* • Prover gives zero-knowledge argument for ( xiai) ( x-jbj) = xkck

Total batch proof • Goal: Prove N=mn committed aij {0, 1} • Method: aijbij=0 where bij=aij-1 – – Verifier sends challenges y, z Prover sends C-m, …, C-1, C 1, …, Cm Verifier sends challenge x Prover argues A, B, C contains aj, bj, cj such that ajbj=cj • Cost: – Communicates O(m+n) group and field elements – Verifier uses O(m+n) exponentiations

Prover’s Instead evaluate in 2 m points 1, . . . , 2 m computation and use polynomial interpolation to find 2 Naively m n multiplications coefficients of ( ai i)( bj -j) = ck k b 1 a 1 b 1 a 2 b 1 a 3 i and b -j Usingb. FFT to evaluate a b 3 i j 2 the cost is O(N log m) a 1 b 2 a 1 b 3 a 2 b 2 a 3 b 1 a 3 b 2 a 3 b 1 a 2 b 3 a 3 b 3 a 2 b 1+a 3 b 2 a 1 b 3 a 1 b 2+a 2 b 3

Batch proof for Circuit Satisfiability a 2 a 1 b 1 NAND b 2 • • Commit(a 1, a 2; r), Commit(b 1, b 2; s) Batch proof for a 1, a 2, b 1, b 2 {0, 1} Batch proof for a 2= (a 1 b 1), 1= (a 2 b 2) Batch wire consistency proof

Wire consistency (sketch) • Committed outputs of gates ai matching inputs bi to other gates in circuit • Given permutation defined by circuit wiring prover wants to show bi = a (i) • Verifier picks random challenge x • Prover demonstrates xibi = x (i)a (i) • Cost: – Communication: O(m+n) elements – Verifier computation: O(N) multiplications – Prover computation: O(N log N) multiplications

Cost for N-gate circuit • Standard argument – – O(N) elements O(N) verifier expos O(N) prover expos 3 rounds • Batch argument – – O( N) elements O(N) verifier mults O(N log N) prover mults 5 rounds

Further developments • Can they be even more efficient? • Yes, pairing-based techniques gives us communication of O(N 1/3) elements • Can they be combined with group elements? • Yes

Efficient ZK arguments over fields & groups • Can do addition using homomorphic properties • Can use our techniques to show multiplicative relationship between committed values • Gives us linear algebra over committed elements – For instance committed matrices satisfy AB=C • Statements involving group elements and exponentiations – For instance C= i j. Aijbij

Intuition x-1 b 1 A 1 x 1 ∙ A 2 x 2 ∙ A 3 x 3 + x-2 b 2 + A 1 x-1 b 2 A 1 b 1 A 2 x 1 b 1 A 3 x 2 b 1 x-3 b 3 A 1 x-2 b 3 A 2 b 2 A 3 x 1 b 2 A 2 x 1 b 1∙A 3 x 1 b 2 A 1 x-2 b 3 A 2 x-1 b 3 A 1 x-1 b 2 b∙A 2 x-1 b 3 A 3 3 A 1 b 1∙A 2 b 2 ∙A 3 b 3

Application to mix-nets Threshold decryption mπ(1) mπ(2) mπ(N) π = π1 π2 π2 m 1 m 2 m. N … π1

Problem: Corrupt mix-server Threshold decryption mπ(1) mπ(2) m´π(N) π = π1 π2 π2 m 1 m 2 m. N … π1

El. Gamal shuffle Statement (c 1, c 1’, . . . , c. N’) can be huge. For instance election with 100, 000 voters. Experimental results for N=100, 000 • Mix-server gets input ciphertexts c 1, …, c. N N=mn, where m=16, |p|=1024, |q|=160 • Permutes and. Communication: rerandomizes ciphertexts 2. 5 MB r 1, Hr 1), computation: r. N, Hr. N) c 1’=c (1)∙(GVerifier …, c. N’=c (N)52 ∙(Gseconds Prover computation: 135 seconds • Zero-knowledge argument for correct shuffle – – – Joint work with Stephanie Bayer, UCL Communication: 16 N elements Verifier computation: 4 N exponentiations Prover computation: O(N log N) exponentiations Rounds: 9

Vision • Zero-knowledge proofs should be the cheapest component in cryptographic protocols – Something you can just throw in automatically without significant overhead • Thank you!