ZKP11.4 Use CI to instantiate Fiat-Shamir

ZKP学习笔记

ZK-Learning MOOC课程笔记

Lecture 11: From Practice to Theory (Guest Lecturer: Alex Lombardi)

11.4 Use CI to instantiate Fiat-Shamir

  • Avoid Bad Challenges

    • Def: Given false claim x x x and a first message α \alpha α, a challenge β \beta β is "bad" if there exists a prover message g a m m a gamma gamma making V V V accept
    • We want to say: if the (3 message) interactive protocol is sound, then (for all x x x, α \alpha α) most β \beta β are not bad. True for statistically sound IPs.
    • Exactly what CI is good for! Define relation R x = α , β : β i s b a d R_x = {\alpha, \beta: \beta is bad} Rx=α,β:βisbad. Then if h h h is CI for R x R_x Rx (when x ∉ L x \notin L x∈/L), Π F S \Pi_{FS} ΠFS is sound using h h h!
    • Protocols with more than 3 messages: round-by-round soundness (each round has a type of "bad challenge" to avoid).
    • Main technical challenges:
      • Sometimes our IP doesn't have statistical soundness.
      • We can only build CI for relations R R R that can be decided efficiently
  • Important example: SNARGs via IOPs (PCPs)

    • SNARGs from PCPs [Kilian, Micali]

      • Candidate SNARG: apply Fiat-Shamir to this protocol!
      • Simplified (less efficient) version of modern SNARKs you've learned about.
      • Not statistically sound, so it's not clear how to analyze FS without random oracles.
    • SNARGs for Batch NP

    • Interactive Batch Arguments from PCPs [CJJ21]

      • SSB Commitments

      • Interactive Batch Arguments from PCPs [CJJ21]

  • Summary of Fiat-Shamir without RO

    • Use hash functions that are CI for appropriate functions/relations
      • CCHLRRW19,PS19,BKM20,JJ21,HLR21

    • Carefully show that FS-soundness for protocols of interest follows from compatible forms of CI
      • CCHLRRW19\]: (non-succinct) NIZK

      • CJJ21\]: batch NP arguments

      • Characterize which protocols can be FS-compiled (we know it doesn't work in general [Bar01, GK03])
      • SNARGs for NP from falsifiable assumptions?
相关推荐
Ysn07192 小时前
pytorch_grad_cam 库学习笔记—— Ablation-CAM 算法的基类 AblationCAM 和 AblationLayer
pytorch·笔记·学习
霜绛2 小时前
Unity笔记(七)——四元数、延迟函数、协同程序
笔记·学习·unity·游戏引擎
风和日丽 随波逐流3 小时前
java18学习笔记
笔记·学习·java18
HAORChain5 小时前
Hyperledger Fabric官方中文教程-改进笔记(十七)-编写第一个链码
笔记·区块链·fabric
喜欢你,还有大家7 小时前
Linux笔记10——shell编程基础-4
linux·运维·服务器·笔记
神齐的小马7 小时前
计算机网络学习笔记
笔记·学习·计算机网络
胡萝卜3.07 小时前
数据结构初阶:详解单链表(一)
数据结构·笔记·学习·单链表
YJlio9 小时前
第17章|PowerShell 安全警报——高分学习笔记(运维实战向)
笔记·学习·安全
牛亚肖10 小时前
plantsimulation知识点 RGV小车前端与后端区别
笔记
HAORChain10 小时前
Hyperledger Fabric官方中文教程-改进笔记(十四)-向通道中添加组织
笔记·区块链·fabric