TY - GEN
T1 - Making the best of a leaky situation
T2 - 13th International Conference on Theory of Cryptography, TCC 2016
AU - Ishai, Yuval
AU - Weiss, Mor
AU - Yang, Guang
N1 - Publisher Copyright:
© International Association for Cryptologic Research 2016.
PY - 2016
Y1 - 2016
N2 - A Probabilistically Checkable Proof (PCP) allows a randomized verifier, with oracle access to a purported proof, to probabilistically verify an input statement of the form “x ∈ L” by querying only few bits of the proof. A zero-knowledge PCP (ZKPCP) is a PCP with the additional guarantee that the view of any verifier querying a bounded number of proof bits can be efficiently simulated given the input x alone, where the simulated and actual views are statistically close. Originating from the first ZKPCP construction of Kilian et al. [21], all previous constructions relied on locking schemes, an unconditionally secure oracle-based commitment primitive. The use of locking schemes makes the verifier inherently adaptive, namely, it needs to make at least two rounds of queries to the proof. Motivated by the goal of constructing non-adaptively verifiable ZKPCPs, we suggest a new technique for compiling standard PCPs into ZKPCPs. Our approach is based on leakage-resilient circuits, which are circuits that withstand certain “side-channel” attacks, in the sense that these attacks reveal nothing about the (properly encoded) input, other than the output. We observe that the verifier’s oracle queries constitute a side-channel attack on the wire-values of the circuit verifying membership in L, so a PCP constructed from a circuit resilient against such attacks would be ZK. However, a leakage-resilient circuit evaluates the desired function only if its input is properly encoded, i.e., has a specific structure, whereas by generating a “proof” from the wire-values of the circuit on an ill-formed “encoded” input, one can cause the verification to accept inputs x ∉ L with probability 1. We overcome this obstacle by constructing leakage-resilient circuits with the additional guarantee that ill-formed encoded inputs are detected. Using this approach, we obtain the following results:– We construct the first witness-indistinguishable PCPs (WIPCP) for NP with non-adaptive verification. WIPCPs relax ZKPCPs by only requiring that different witnesses be indistinguishable. Our construction combines strong leakage-resilient circuits as above with the PCPof Arora and Safra [2], in which queries correspond to side-channel attacks by shallow circuits, and with correlation bounds for shallow circuits due to Lovett and Srivinasan [22]. – Building on these WIPCPs, we construct non-adaptively verifiable computational ZKPCPs for NP in the common random string model, assuming that one-way functions exist. – As an application of the above results, we construct 3-round WI and ZK proofs for NP in a distributed setting in which the prover and the verifier interact with multiple servers of which t can be corrupted, and the total communication involving the verifier consists of poly log(t) bits.
AB - A Probabilistically Checkable Proof (PCP) allows a randomized verifier, with oracle access to a purported proof, to probabilistically verify an input statement of the form “x ∈ L” by querying only few bits of the proof. A zero-knowledge PCP (ZKPCP) is a PCP with the additional guarantee that the view of any verifier querying a bounded number of proof bits can be efficiently simulated given the input x alone, where the simulated and actual views are statistically close. Originating from the first ZKPCP construction of Kilian et al. [21], all previous constructions relied on locking schemes, an unconditionally secure oracle-based commitment primitive. The use of locking schemes makes the verifier inherently adaptive, namely, it needs to make at least two rounds of queries to the proof. Motivated by the goal of constructing non-adaptively verifiable ZKPCPs, we suggest a new technique for compiling standard PCPs into ZKPCPs. Our approach is based on leakage-resilient circuits, which are circuits that withstand certain “side-channel” attacks, in the sense that these attacks reveal nothing about the (properly encoded) input, other than the output. We observe that the verifier’s oracle queries constitute a side-channel attack on the wire-values of the circuit verifying membership in L, so a PCP constructed from a circuit resilient against such attacks would be ZK. However, a leakage-resilient circuit evaluates the desired function only if its input is properly encoded, i.e., has a specific structure, whereas by generating a “proof” from the wire-values of the circuit on an ill-formed “encoded” input, one can cause the verification to accept inputs x ∉ L with probability 1. We overcome this obstacle by constructing leakage-resilient circuits with the additional guarantee that ill-formed encoded inputs are detected. Using this approach, we obtain the following results:– We construct the first witness-indistinguishable PCPs (WIPCP) for NP with non-adaptive verification. WIPCPs relax ZKPCPs by only requiring that different witnesses be indistinguishable. Our construction combines strong leakage-resilient circuits as above with the PCPof Arora and Safra [2], in which queries correspond to side-channel attacks by shallow circuits, and with correlation bounds for shallow circuits due to Lovett and Srivinasan [22]. – Building on these WIPCPs, we construct non-adaptively verifiable computational ZKPCPs for NP in the common random string model, assuming that one-way functions exist. – As an application of the above results, we construct 3-round WI and ZK proofs for NP in a distributed setting in which the prover and the verifier interact with multiple servers of which t can be corrupted, and the total communication involving the verifier consists of poly log(t) bits.
UR - http://www.scopus.com/inward/record.url?scp=84954121525&partnerID=8YFLogxK
U2 - 10.1007/978-3-662-49099-0_1
DO - 10.1007/978-3-662-49099-0_1
M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???
AN - SCOPUS:84954121525
SN - 9783662490983
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 3
EP - 32
BT - Theory of Cryptography - 3th International Conference, TCC 2016-A, Proceedings
A2 - Kushilevitz, Eyal
A2 - Malkin, Tal
Y2 - 10 January 2016 through 13 January 2016
ER -