Non-Malleable Multi-Prover Interactive Proofs and Witness Signatures
نویسندگان
چکیده
We explore a new man-in-the-middle adversarial model for multi-prover interactive proofs (MIPs), and construct round-optimal, unconditionally secure, non-malleable MIPs. We compile from a large sub-class of Σ-protocols to a non-malleable MIP, avoiding the use of expensive NP-reductions to Graph Hamiltonicity or other NP-complete problems. Our compiler makes novel use of non-malleable codes – in particular, we rely on many-many non-malleable codes constructed recently by Chattopadhyay, Goyal and Li (STOC 2016). We introduce another (seemingly unrelated) primitive – witness signatures – which are motivated by the goal of removing central trust assumptions from cryptography. Witness signatures allow any party with a valid witness to an NP statement to sign a message on behalf of that statement. These signatures must be unforgeable – that is, signing a new message, even given several signatures, should be as hard as computing a witness to the NP statement itself. We first observe that most natural notions of witness signatures are impossible to achieve in the plain model. While still wanting to avoid a central trusted setup, we turn to the tamper proof hardware token model of Katz (Eurocrypt 2007). We show that non-malleable MIPs yield efficient, unconditional witness signatures in the hardware token model. However, our construction of unconditional witness signatures only supports bounded verification. We also obtain unbounded polynomial verification assuming the existence of one-way functions. Finally, we give a matching lower bound – obtaining unconditional unbounded-verifiable witness signatures with black-box extraction, is impossible even with access to an unbounded number of stateful tamper-proof hardware tokens. ∗Microsoft Research, India. Email: [email protected]. †UCLA, USA. Email: [email protected]. Work done in part while at Microsoft Research, India. ‡UCLA, USA. Email: [email protected]. Work done in part during an internship at Microsoft Research, India.
منابع مشابه
Witness Signatures and Non-Malleable Multi-Prover Zero-Knowledge Proofs
Motivated by the goal of removing trusted setup assumptions from cryptography, we introduce the notion of witness signatures. This primitive allows any party with a valid witness to an NP statement to sign a message on behalf of that statement. We also require these signatures to be unforgeable: that is, producing a signature on a new message (even given several message, signature pairs) should...
متن کاملSnarky Signatures: Minimal Signatures of Knowledge from Simulation-Extractable SNARKs
We construct a pairing-based simulation-extractable succinct non-interactive argument of knowledge (SE-SNARK) that consists of only 3 group elements and has highly efficient verification. By formally linking SE-SNARKs to signatures of knowledge, we then obtain a succinct signature of knowledge consisting of only 3 group elements. SE-SNARKs enable a prover to give a proof that they know a witnes...
متن کاملInteractive Proofs under Continual Memory Leakage
We consider the task of constructing interactive proofs for NP which can provide meaningful security for a prover even in the presence of continual memory leakage. We imagine a setting where an adversarial verifier participates in multiple sequential interactive proof executions for a fixed NP statement x. In every execution, the adversarial verifier is additionally allowed to leak a fraction o...
متن کاملÉtudes in non-interactive zero-knowledge
N a ZERO-KNOWLEDGE PROOF [GMR85], Prover interactively convinces Verifier that theorem 7r is true in such a way that (a) a corrupt Prover cannot convince Verifier of a false theorem and (b) a corrupt Verifier cannot "learn" anything other than the fact that r is true. In a NON-INTERACTIVE ZERO-KNOWLEDGE PROOF [BFM88], the Prover must do the above by sending only a single message to Verifier! To...
متن کاملParallel Divertibility of Proofs of Knowledge (Extended Abstract)
An interactive proof is transferred if a person, while interacting with the prover, convinces a (second) verifier of the statement. Divertible proof systems, first introduced by Desmedt et al., offer a more subtle way of transferring a proof: the messages are blinded such that neither the prover nor the second verifier can ever discover what is going on. While the ability to transfer (and diver...
متن کامل