Zero-Knowledge Sets with Short Proofs

Zero knowledge sets is a new cryptographic primary in- troduced by Micali, Rabin, and Kilian in FOCS 2003. It is intensively investigated recently. However all schemes follow the basic frame by Micali et al. That is, the schemes employ Merkle tree as basic frame and mercurial com- mitments as commitment units to nodes of the tree. The proof for any query constitutes of an authentication chain. We propose in this paper a new algebraic scheme that is completely different from all existing schemes. The new scheme is computationally secure under standard assump- tion: Strong RSA assumption. It employs neither mercurial commitments nor tree frame as all previous schemes did. In fact, the prover (also as the committer) in our construc- tion commits the desired set without trapdoor information, which is another important difference from the previous ap- proaches.

Verification of a polynomial’s evaluation in a secret committed value plays a role in cryptographic applications such as non-membership or membership proofs. We construct a novel special honest verifier zero-knowledge argument for correct polynomial evaluation. The argument has logarithmic communication cost in the degree of the polynomial, which is a significant improvement over the state of the art with cubic root complexity at best. The argument is relatively efficient to generate and very fast to verify compared to previous work. The argument has a simple public-coin 3-move structure and only relies on the discrete logarithm assumption. The polynomial evaluation argument can be used as a building block to construct zero-knowledge membership and non-membership arguments with communication that is logarithmic in the size of the blacklist. Non-membership proofs can be used to design anonymous blacklisting schemes allowing online services to block misbehaving users without learning the identity of the user. They also allow the blocking of single users of anonymization networks without blocking the whole network.

We construct a publicly verifiable protocol for proving computational work based on collision-resistant hash functions and a new plausible complexity assumption regarding the existence of hash functions. Our protocol is based on a novel construction of puzzles. Given a sampled P getsr Dn, where $n$ is the security parameter and Dn is the distribution of the puzzles, a corresponding can be generated using N evaluations of the sequential hash function, where N>n is another parameter, while any feasible adversarial strategy for generating valid solutions must take at least as much time as Ω(N) serial evaluations of the hash function after receiving $P$. Thus, valid solutions constitute a proof that Ω(N) parallel time elapsed since p was received. Solutions can be publicly and efficiently verified in time poly(n) ⋅ polylog(N). Applications of these time-lock include noninteractive timestamping of documents (where the distribution over the possible documents corresponds to the puzzle distribution Dn) and universally verifiable CPU benchmarks. Our construction is secure in the standard model under complexity assumptions (collision-resistant hash functions and inherently sequential hash functions), and makes black-box use of the underlying primitives. Consequently, the corresponding construction in the random oracle model is secure unconditionally. Moreover, as it is a public-coin protocol, it can be made non-interactive in the random oracle model using the Fiat-Shamir Heuristic.Our construction makes a novel use of depth-robust directed acyclic graphs---ones whose depth remains large even after removing a constant fraction of vertices---which were previously studied for the purpose of complexity lower-bounds. The construction bypasses a recent lower-bound of Mahmoody, Moran, and Vadhan (CRYPTO '11) for puzzles in the random oracle model, which showed that it is impossible to have puzzles like ours in the random oracle model if the puzzle generator also computes a solution together with the puzzle.

The notion of forward-secure sequential aggregate message authentication was introduced by Ma and Tsudik in 2007. It is suitable for applications such as audit logging systems and wireless sensor networks. Ma and Tsudik also constructed a scheme with a MAC function and a collision resistant hash function. However, the notion has not been fully formalized and the security of the scheme has not been confirmed. In this paper, forward-secure sequential aggregate message authentication schemes and their security are formalized. Then, a generic construction with a MAC function and a pseudorandom generator is presented. It is also shown that the construction is secure if the underlying primitives are secure.

We introduce the use of Fourier analysis on lattices as an integral part of a lattice based construction. The tools we develop provide an elegant description of certain Gaussian distributions around lattice points. Our results include two cryptographic constructions which are based on the worst-case hardness of the unique shortest vector problem. The main result is a new public key cryptosystem whose security guarantee is considerably stronger than previous results (O(n1.5) instead of O(n7)). This provides the first alternative to Ajtai and Dwork's original 1996 cryptosystem. Our second result is a collision resistant hash function which, apart from improving the security in terms of the unique shortest vector problem, is also the first example of an analysis which is not based on Ajtai's iterative step. Surprisingly, the two results are derived from the same tool which presents two indistinguishable distributions on the segment [0,1]. It seems that this tool can have further applications and as an example we mention how it can be used to solve an open problem related to quantum computation.

Cryptographic hash functions are efficiently computable functions that shrink a long input into a shorter output while achieving some of the useful security properties of a random function. The most common type of such hash functions is collision resistant hash functions (CRH), which prevent an efficient attacker from finding a pair of inputs on which the function has the same output.

This paper presents a fully secure (adaptive-predicate unforgeable and private) attributebased signature (ABS) scheme in the standard model. The security of the proposed ABS scheme is proven under standard assumptions, the decisional linear (DLIN) assumption and the existence of collision resistant (CR) hash functions. The admissible predicates of the proposed ABS scheme are more general than those of the existing ABS schemes, i.e., the proposed ABS scheme is the first to support general non-monotone predicates, which can be expressed using NOT gates as well as AND, OR, and Threshold gates, while the existing ABS schemes only support monotone predicates. The proposed ABS scheme is comparably as efficient as (several times worse than) one of the most efficient ABS schemes, which is proven to be secure in the generic group model.

Security amplification is an important problem in Cryptography: starting with a secure variant of some cryptographic primitive, the goal is to build a strongly secure variant of the same primitive. This question has been successfully studied for a variety of important cryptographic primitives, such as one-way functions, collision-resistant hash functions, encryption schemes and weakly verifiable puzzles. However, all these tasks were non-interactive. In this work we study security amplification of interactive cryptographic primitives, such as message authentication codes (MACs), digital signatures (SIGs) and pseudorandom functions (PRFs). In particular, we prove direct product theorems for MACs/SIGs and an XOR lemma for PRFs, therefore obtaining nearly optimal security amplification for these primitives. Our main technical result is a new Chernoff-type theorem for what we call Dynamic Weakly Verifiable Puzzles , which is a generalization of ordinary Weakly Verifiable Puzzles which we introduce in this paper.

Nominative signature is an useful cryptographic primitive to limit the publicly verifiable property of ordinary digital signature. In a nominative signature scheme, a nominator and a nominee jointly generate a signature in such a way that only the nominee can check the validity of the signature and further convince a third party of the fact. An extended concept, convertible nominative signature, equips the nominee with the additional ability to convert a nominative signature into a publicly verifiable one. In this paper, we propose a generic construction for convertible nominative signature. Our construction is based on selectively convertible undeniable signature and collision-resistant hash function. Next, we prove our construction is secure assuming the security of the underlying building blocks. Finally, we can apply our generic construction to obtain the first provable secure convertible nominative signature in the standard model.

Error-correcting codes that admit local decoding and correcting algorithms have been the focus of much recent research due to their numerous applications. An important goal is to obtain the best possible tradeoffs between the number of symbols of the codeword that the local decoding algorithm must examine (the locality of the task), and the amount of redundancy in the encoding (the information rate).In Hamming’s classical adversarial channel model, the current tradeoffs are dramatic, allowing either small locality, but superpolynomial blocklength, or small blocklength, but high locality. However, in the computationally bounded, adversarial channel model, proposed by Lipton (STACS 1994), constructions of locally decodable codes suddenly exhibit small locality and small blocklength, but these constructions require strong trusted setup assumptions e.g., Ostrovsky, Pandey and Sahai (ICALP 2007) construct private locally decodable codes in the setting where the sender and receiver already share a symmetric key.We study variants of locally decodable and locally correctable codes in computationally bounded, adversarial channels, in a setting with no public-key or private-key cryptographic setup. The only setup assumption we require is the selection of the public parameters (seed) for a collision-resistant hash function. Specifically, we provide constructions of relaxed locally correctable and relaxed locally decodable codes over the binary alphabet, with constant information rate, and poly-logarithmic locality.Our constructions, which compare favorably with their classical analogs, crucially employ collision-resistant hash functions and local expander graphs, extending ideas from recent cryptographic constructions of memory-hard functions.

Undeniable signatures are classic digital signatures which are not universally verifiable and can only be verified with the help of the signer. Its extended version, convertible undeniable signatures, equips the signer with the additional ability to make his undeniable signatures universally verifiable whenever required. A selectively-convertible undeniable signature scheme allows the signer to convert a single signature into a universally verifiable signature by releasing a selective proof in a later time, while "universally-convertible" refers to the case where the signer has the additional ability to generate a universal proof which can finally convert all his undeniable signatures into universally verifiable signatures. In this paper, we propose a generic construction for universally-convertible undeniable signatures. Our construction is based on three building blocks: a strongly unforgeable classic signature scheme, a selectively-convertible undeniable signature scheme and a collisionresistant hash function. Formal proofs guarantee that our construction has a tight security reduction to the underlying security assumptions. As one of the applications of our generic construction, one can obtain the first provable secure universally-convertible undeniable signature scheme in the standard model.

The security of many emph{efficient} cryptographic constructions, e.g.~collision-resistant hash functions, digital signatures, and identification schemes, has been proven assuming the hardness of emph{worst-case} computational problems in ideal lattices. These lattices correspond to ideals in the ring of integers of some fixed number field $K$. In this paper we show that the density of $n$-dimensional ideal lattices with determinant $le b$ among all lattices under the same bound is in $O(b^{1-n})$. So for lattices of dimension $> 1$ with bounded determinant, the subclass of ideal lattices is always vanishingly small.

We give a simple and efficient construction of a verifiable random function (VRF) on bilinear groups. Our construction is direct. In contrast to prior VRF constructions [14,15], it avoids using an inefficient Goldreich-Levin transformation, thereby saving several factors in security. Our proofs of security are based on a decisional bilinear Diffie-Hellman inversion assumption, which seems reasonable given current state of knowledge. For small message spaces, our VRF’s proofs and keys have constant size. By utilizing a collision-resistant hash function, our VRF can also be used with arbitrary message spaces. We show that our scheme can be instantiated with an elliptic group of very reasonable size. Furthermore, it can be made distributed and proactive.

For data storage outsourcing services, it is important to allow data owners to efficiently and securely verify that the storage server stores their data correctly. To address this issue, several proof-of-retrievability (POR) schemes have been proposed wherein a storage server must prove to a verifier that all of a client's data are stored correctly. While existing POR schemes offer decent solutions addressing various practical issues, they either have a non-trivial (linear or quadratic) communication complexity, or only support private verification, i.e., only the data owner can verify the remotely stored data. It remains open to design a POR scheme that achieves both public verifiability and constant communication cost simultaneously.

We answer the question of Reyhanitabar et al. from FSE’09 of constructing a domain extension scheme for enhanced target collision-resistant (eTCR) hash functions with sublinear key expansion. The eTCR property, introduced by Halevi and Krawczyk [1], is a natural fit for hash-and-sign signature schemes, offering an attractive alternative to collision-resistant hash functions. We prove a new composition theorem for eTCR, and demonstrate that eTCR compression functions exist if and only if one-way functions do.