Constant Round Concurrent Zero-Knowledge in the Bounded Player Model

1. Constant Round Concurrent Zero-Knowledge in the Bounded Player Model Vipul Goyal Abhishek Jain Rafail Ostrovsky Silas Richelson Ivan Visconti Microsoft Research India MIT and BU UCLA UCLA University of Salerno, Italy

2. Zero-Knowledge Protocols • Prove trying to prove x is in L to the verifier • Meet • (P, V) is zero knowledge if: there exists which can emulate ’s interaction with prover and

3. Concurrent Zero Knowledge [DNS98] • (P, V) is concurrent zero knowledge if ZK holds when V* may run many instances of protocol concurrently. P P P

4. Concurrent ZK (plain model) General feasibility result first given by Richardson and Kilian [RK’99] Since then, a body of literature has developed studying the round complexity Construction with almost logarithmic round complexity [PRS02, KP01] Shown to be almost optimal using “black-box simulation” [R00, CKPR01] No constant round protocols known under standard assumptions

5. Bounded Concurrency Model In a breakthrough work, Barak [Barak01] introduced the bounded concurrency model: Total number of concurrent sessions between prover and verifiers is apriori bounded (by a poly) Barak gave a constant round protocol in this model introduced non-black-box simulation in cryptography Open problem: constant round concurrent ZK without this bound? In general, what level of concurrency can we achieve in constant rounds?

6. Talk Overview Bounded player model and our results Barak’s construction: very high level overview Our construction High level idea of our non-black-box simulation strategy

7. Bounded Player (BP) Model [GJORV13] • A bounded number of players in the system • Each player may participate in an unbounded (poly) number of concurrent sessions V unbounded concurrent sessions . . . P unbounded concurrent sessions V • Example: number of machines over the network maybe known • However harder to accurately estimate how many processes (communicating over the network) each machine is running

8. BP model vs Bare Public Key (BPK) model • BP model: can ask each player to choose a fixed public key during the first session it participates in • No setup phase • Player remembers it, to be remain the same in all sessions: only difference from plain model • BPK model: setup phase involving all players • Main property: keys can’t change during rewinding • Only superficial similarity: techniques from BPK model have limited relevance here

9. BP model vs Barak’s bounded concurrency model • BP model: much closer in spirit to Barak’s bounded concurrency • Strengthening of the bounded concurrency model • Provably requires non-black-box (NBB) simulation (unlike BPK) • Goyal et al [GJORV13]: a construction with w(1) round • Open: constant round concurrent ZK in BP model? Will subsume the result of Barak

10. Our Results • Main theorem: constant round concurrent ZK in the BP model assuming a collision resistant hash function family • Positive step towards getting constant round concurrent ZK in plain model under standard assumptions • Technical contribution: new ways of performing NBB simulation • Techniques very different from the previous work of Goyal et al. [GJORV13]

11. NBB vs BB Simulation Black-box simulation: simply query the adversarial verifier machine as an Oracle (rewinding) Non-black-box simulation: uses the code of the adversary in a more non-trivial way

12. Barak’s Construction (oversimplified) Soundness: r is long and random Statement: x in L Com(M) V P Random r Verifier Prover WI: x in L or M outputs r • Simulation: if you have code/state of verifier, can construct such M • Note: For simulation, constructing fake witness wf computationally heavy/expensive • Can only simulate a bounded number of sessions in poly-time

13. Barak’s Construction: Abstraction Barak’s preamble Com(M) Random r • Can compute fake witness wf • Computationally expensive to compute • Can be done for only bounded number of sessions Use fake witness to complete rest

14. Building the Protocol Focus: single verifier, unbounded sessions pk P V Com(M) Random r wf sk Secure two party computation: If wf valid fake witness, output sk to first party x ϵ L OR “I know sk” WI PoK

15. Problem: Adversarial scheduling Say adversary leaves most sessions in middle of 2pc Simulator computes fake witness in unbounded number of sessions pk Com(M) Random r wf sk Secure two party computation: Started but didn’t finish New sessions start • [GJORV13] idea: use multiple opportunities for using fake witness (higher round complexity), complex probability distributions

16. Our Idea: simple • fake witness computed in one session useable in others pk P V z = Com(M) Random r • Certified statement = (τ, σ) • Compute fake witness wf Signature σ on τ = (z, r) sk (τ, σ), wf Secure two party computation: If valid certified statement, fake witness given, output sk x ϵ L OR “I know sk” WI PoK

17. Handling adversarial scheduling Simulator computes fake witness pair just once pk Z = Com(M) Random r Signature σ on τ sk (τ, σ), wf Secure two party computation: Started but didn’t finish New sessions start sk (τ, σ), wf Secure two party computation

18. Are we done? • This is gross oversimplification of our construction • In Barak: no such fake witnesses of polynomial size • Rather: fake witness is an accepting (encrypted) universal argument execution • Need to run 3-round UA and construct fake witness interactively

19. Our Construction pk • Adversarial scheduling: what if verifier leaves most sessions in middle of UA? Computation done, yet no fake witness! z = Com(M) P V r Signature σ heavy computation UA first message UA challenge get fake witness UA final message . .

20. Completing the construction • Use the same basic idea multiple times • Ask the verifier to sign the UA transcript as we go along • Even a partially executed (but signed) UA transcript useful • Can be completed in some other session to get a fake witness

21. Conclusions • Constant round concurrent ZK in the bounded player model • Subsumes the bounded concurrent ZK of Barak • Strongest level of concurrency in plain model in constant rounds (under standard assumptions) • Key technical contribution: new ways of performing NBB simulation • Reusing heavy computation

22. Thank You!