TY - GEN
T1 - Strong Batching for Non-interactive Statistical Zero-Knowledge
AU - Mu, Changrui
AU - Nassar, Shafik
AU - Rothblum, Ron D.
AU - Vasudevan, Prashant Nalini
N1 - Publisher Copyright: © International Association for Cryptologic Research 2024.
PY - 2024
Y1 - 2024
N2 - A zero-knowledge proof enables a prover to convince a verifier that x∈S, without revealing anything beyond this fact. By running a zero-knowledge proof k times, it is possible to prove (still in zero-knowledge) that k separate instances x1,⋯,xk are all in S. However, this increases the communication by a factor of k. Can one do better? In other words, is (non-trivial) zero-knowledge batch verification for S possible? Recent works by Kaslasi et al. (TCC 2020, Eurocrypt 2021) show that any problem possessing a non-interactive statistical zero-knowledge proof (NISZK) has a non-trivial statistical zero-knowledge batch verification protocol. Their results had two major limitations: (1) to batch verify k inputs of size n each, the communication in their batch protocol is roughly poly(n,logk)+O(k), which is better than the naive cost of k·poly(n) but still scales linearly with k, and, (2) the batch protocol requires Ω(k) rounds of interaction. In this work we remove both of these limitations by showing that any problem in NISZK has a non-interactive statistical zero-knowledge batch verification protocol with communication poly(n,logk).
AB - A zero-knowledge proof enables a prover to convince a verifier that x∈S, without revealing anything beyond this fact. By running a zero-knowledge proof k times, it is possible to prove (still in zero-knowledge) that k separate instances x1,⋯,xk are all in S. However, this increases the communication by a factor of k. Can one do better? In other words, is (non-trivial) zero-knowledge batch verification for S possible? Recent works by Kaslasi et al. (TCC 2020, Eurocrypt 2021) show that any problem possessing a non-interactive statistical zero-knowledge proof (NISZK) has a non-trivial statistical zero-knowledge batch verification protocol. Their results had two major limitations: (1) to batch verify k inputs of size n each, the communication in their batch protocol is roughly poly(n,logk)+O(k), which is better than the naive cost of k·poly(n) but still scales linearly with k, and, (2) the batch protocol requires Ω(k) rounds of interaction. In this work we remove both of these limitations by showing that any problem in NISZK has a non-interactive statistical zero-knowledge batch verification protocol with communication poly(n,logk).
KW - Batch Verification
KW - SZK
KW - Zero-knowledge Proofs
UR - http://www.scopus.com/inward/record.url?scp=85193637412&partnerID=8YFLogxK
U2 - https://doi.org/10.1007/978-3-031-58751-1_9
DO - https://doi.org/10.1007/978-3-031-58751-1_9
M3 - منشور من مؤتمر
SN - 9783031587504
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 241
EP - 270
BT - Advances in Cryptology – EUROCRYPT 2024 - 43rd Annual International Conference on the Theory and Applications of Cryptographic Techniques, 2024, Proceedings
A2 - Joye, Marc
A2 - Leander, Gregor
PB - Springer Science and Business Media Deutschland GmbH
T2 - 43rd Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2024
Y2 - 26 May 2024 through 30 May 2024
ER -