Batch Range Proof For Practical Small Ranges

Transcription

1 Batch Range Proof For Practical Small Ranges Kun Peng and Feng Bao Institute for Inforcomm Research (I 2 R), Singapore 1

2 Agenda 1. Introduction 2. Range proof 3. Batch proof 4. Extended batch proof and verification 5. Application to range proof 6. Conclusion 2

3 Range Proof Knowledge of a secret integer m in an interval range R. Sealed in a ciphertext or commitment. Proof to show that it is in the range. No other information is revealed. Frequently needed in cryptographic applications. 3

4 Security Properties 4 Correctness: if the integer is in the range and the prover knows the integer and strictly follows the proof protocol, he can pass the verification in the protocol. Soundness: if the prover passes the verification in the protocol, the integer is guaranteed with an overwhelmingly large probability to be in the range. Privacy: no information about the integer is revealed in the proof except that it is in the range.

5 ZK Proof of Partial Knowledge Proposed by Cramer et al at Prove that the committed integer may be each integer in the range one by one. Link the multiple proofs with OR logic. Almost perfect in security. Drawback: its cost is linear in the size of the range. 5

6 Higher Asymptotic Efficiency 6 Respectively proposed by Boudot in 2000, Lipmaa in 2003 and Groth in Employing cyclic groups with secret orders and computations in Z. Asymptotically high efficiency. But actual cost is not so satisfying, especially for small ranges. Depending on the factorization problem. Computations in Z weakens privacy.

7 Small Ranges 7 The most recent and advanced range proof by Camenisch et al in In most practical applications the ranges are not large. Asymptotic efficiency is not so important. More efficient for small ranges. Depends on hardness of (log k )-Strong Diffie Hellman assumption.

8 Our Motivations Solutions with high security is inefficient. Asymptotically efficient solutions weaken security. Only one solution for practically small ranges. Higher efficiency is desired, especially in small ranges. High security should be maintained. 8

9 Batch Proof and Verification Firstly proposed by Bellare et al in Developed by Gennaro et al and Peng et al. Batching multiple proofs into one instance. Employing small exponents to save cost. A kind of trade-off between efficiency and security. 9

10 Batch Proof and Verification by Chida and Yamamoto 1 p, q are primes such that q p 1. G is the cyclic subgroup with order q of Z p. g and y i,1, y i,2 for i = 1,2,..., n are in G. The prover knows b i {0,1} and s i,bi such that y i,bi = g s i,b i. 10

11 Batch Proof and Verification by Chida and Yamamoto 2 The prover selects r, v, c i, bi R Z/qZ and computes R 0 = g r {i b i =1} yc i,0 i,0 R 1 = g v {i b i =0} yc i,1 i,1 c i = H(CI c i 1 c i 1,0 ) c i,bi = c i c i, bi mod q z 0 = r {i b i =0} c i,0s i,0 mod q z 1 = v {i b i =1} c i,1s i,1 mod q 11 where c 0 = R 0 and c 0,0 = R 1.

12 Batch Proof and Verification by Chida and Yamamoto 3 1. The prover sends (z 0, z 1, c 1, c 1,0,..., c n,0 ) to the verifier 2. The verifier computes 12 and verifies c i,1 = c i c i,0 mod q c i+1 = H(CI c i c i,0 ) c 1 = H(CI g z 0 n i=1 yc i,0 i,0 gz 1 n i=1 yc i,1 i,1 )

13 Our Extension 1 The parameters are the same. The number of possible discrete logarithms in each case is extended from 2 to k. g and y i,j for i = 1,2,...,n and j = 1,2,..., k are in G. The prover knows b i {1,2,..., k} and s i,bi such that y i,bi = g s i,b i mod p for i = 1,2,..., n. 13

14 Our Extension 2 The prover selects r 1, r 2,..., r k from Z q and c i,j for i = 1,2,..., n and j S i from Z 2 L and computes R 1 = g r 1 1 i n, b i =1 R 2 = g r 2 1 i n, b i = R k = g r k 1 i n, b i =k j S i y c i,j i,j j S i y c i,j i,j j S i y c i,j i,j mod p mod p mod p 14

15 Our Extension 3 The prover calculates c i = H(CI c i 1 c i 1,1 c i 1,2... c i 1,k 1 ) c i,bi = c i j S i c i,j mod q z 1 = r 1 {i b i =1} c i,1s i,1 mod q z 2 = r 2 {i b i =2} c i,2s i,2 mod q z k = r k {i b i =k} c i,ks i,k mod q where c 0 = R 0 and c 0,0 = R 1. 15

16 Our Extension 4 1. The prover sends (z 1, z 2,..., z k, c 1, c 1,1, c 1,2..., c 1,k 1, c 2,1, c 2,2..., c 2,k 1, n,1, c n,2..., c n,k 1 ) to the verifier 2. The verifier computes 16 c i,k = c i k 1 j=1 c i,j mod 2 L c i = H(CI c i 1 c i 1,1 c i 1,2... c i 1,k 1 ) and verifies c 1 = H(CI g z 1 n i=1 yc i,1 i,1 mod p gz 2 n i=1 yc i,2 i,2 modp... g z k n i=1 yc i,k i,k mod p)

17 The New Range Proof Protocol Representing the secret integer x in a base-k system. Range proof reduced to log k (b a) instances of proof that each digit of the base-k representation of x a is in Z k. The log k (b a) instances of proof can be batched using the extended batch proof and verification technique. Efficiency can be improved. 17

18 How to Prove 1. c = g x h r mod p where h is a generator of G and log g h is unknown. 2. c = c/g a mod p. 3. The prover calculates representation of x a in the base-k system (x 1, x 2,..., x n ). 4. He randomly chooses r 1, r 2,..., r n in Z q and publishes e i = g x i h r i mod p for i = 1,2,..., n. 5. He proves knowledge of r = n 18 i=1 r ik i 1 r mod q such that i mod p. h r c = n i=1 eki 1

19 How to Prove Cont 6. The range proof is reduced to n smaller-scale ranges proofs KN(log h e i ) KN(log h e i /g) KN(log h e i /g 2 ) KN(log h e i /g k 1 ) for i = 1,2,..., n where KN(z) denotes knowledge of z. 7. The proof can be implemented through batch proof and verification of knowledge of 1-out-of-k discrete logarithms. 19

20 Conclusion The batch proof and verification technique by Chida and Yamamoto is extended. The new batch proof and verification technique proposed in this paper is more general and can save more cost. The new technique is employed to improve efficiency and security of range proof in practical small ranges. 20

21 21 Questions?