WO2008022158A2

WO2008022158A2 - System for non-interactive zero-knowledge proofs

Info

Publication number: WO2008022158A2
Application number: PCT/US2007/075940
Authority: WO
Inventors: Jens Groth; Rafail Ostrovsky; Amit Sahai; Brent Waters
Original assignee: The Regents Of The University Of California; Sri International
Priority date: 2006-08-14
Filing date: 2007-08-14
Publication date: 2008-02-21
Also published as: WO2008022158A3

Abstract

Systems and methods for generating non-interactive zero-knowledge (NIZK) proofs. A homomorphic commitment scheme provides a NIZK proof that a commitment contains 0 or 1. A NIZK proof that a triple of wire assignments satisfies a NAND-gate is generated relying on the homomorphic property of the commitment scheme. A NIZK proof of circuit satisfiability is provided that uses NIZK proofs of NAND-gate satisfiability and the homomorphic commitment scheme.

Description

SYSTEM FOR NON-INTERACTIVE ZERO-KNOWLEDGE PROOFS

CROSS REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority under 35 U.S.C. § 119(e) from U.S. Provisional Patent Application No. 60/822,365, entitled "SYSTEM FOR NON-INTERACTIVE ZERO- KNOWLEDGE PROOFS" filed on 08/14/2006, which is incorporated herein by reference in its entirety.

FIELD

[0002] The technical field generally relates to cryptographic systems and specifically relates to non-interactive zero-knowledge proofs.

BACKGROUND

[0003] Non-interactive zero-knowledge (NIZK) proofs allow a prover to create a proof of membership of an NP language. The proof can be used to convince another that a statement in question belongs to the language, but the zero-knowledge property ensures that the proof will reveal nothing but the truth of the statement. NIZK proofs are fundamental cryptographic primitives used in many constructions, including CCA2-secure cryptosystems, digital signatures, and various cryptographic protocols. Some embodiments disclosed herein are new techniques for constructing NIZK proofs based on groups with a bilinear map. In comparison with previous constructions of NIZK proofs, the techniques disclosed herein yield significant reductions in the length of the common reference string and the size of the proofs. The techniques disclosed herein allow us to answer long standing open questions in the theory of non-interactive zero-knowledge. We construct a perfect NIZK argument system for all NP languages.

[0004] Blum, Feldman, and Micali, in Non-interactive zero-knowledge and its applications in the proceedings of STOC '88, pp. 103-112, 1988, introduced the notion of NIZK in the common random string model and showed how to construct computational NIZK proof systems for proving a single statement about any NP language. The fist computational NIZK proof system for multiple theorems was constructed by Blurn, De Santis, Micali, and Persiano in N oninter active zeroknowledge in SIAM Journal of Computation, 20(6), pp.1084-1118, 1991. Both papers based their NIZK systems on certain number-theoretic assumptions (specifically, the hardness of deciding quadratic residues modulo a composite number). Feige, Lapidot, and Shamir in Multiple non-interactive zero knowledge proofs under general assumptions in SIAM Journal of Computing, 29(1), pp. 1-28, 1999, showed how to construct computational NIZK proofs based on any trapdoor permutation. Much research has been devoted to the construction of efficient NIZK proofs, but until now the only known method to do so has been the hidden random bits method. By this we mean a method wherein the prover has a string of random bits, which are secret to the verifier. By revealing a subset of these bits, and keeping the rest secret, the prover can convince the verifier of the truth of the statement in question. Improvements in the efficiency of NIZK proofs have come in the form of various ways to set up a hidden random bits model and how to use it optimally.

SUMMARY

[0005] We disclose herein a set of completely different techniques to construct NIZK proofs. We describe special types of commitment schemes, where it is possible to prove that a commitment contains 0 or 1. The commitment schemes can be used to generate a NIZK proof that three elements bo, b_\, b₂ e {0,1 } represent valid inputs bo, b_\ and output b₂ for a NAND-gate, i.e., that b₂ = -i(bo A b_\). This yields very simple and efficient NIZK proof systems. We show that these proof commitments can be constructed from specific number theoretic assumptions related to groups equipped with a bilinear map. For comparison of the techniques described herein with the most efficient previous techniques for generating NIZK proofs of the satisfiability of a circuit C, please see Table 1. A security parameter k represents the length of the order of a group used to generate a NIZK proof, i.e., k = TlOg₂ IGl], where G is a group used to generate the NIZK proof. Importantly, the size of the common reference sting (CRS) used to generate the NIZK proof using the techniques described herein is proportionate to k, and the size of the NIZK proof generated is proportionate to the product of the circuit size ICI and k. Thus, the techniques disclosed herein are significantly more efficient that previously known techniques.

Table 1 References:

[Dam92] Ivan Damgard, Non-interactive circuit based proofs and non-interactive perfect zero- knowledge with preprocessing. Proceedings of EUROCRYPT '92, LNCS series, volume 658, pp. 341- 355, 1992.

[KP98] Joe Kilian and Erez Petrank, An efficient noninter active zero-knowledge proof system for np with general assumptions, Journal of Cryptology, 11(1), pp.1-27, 1998. [DDP99] Alfredo De Santis, Giovanni Di Crescenzo, and Giuseppe Persiano, Non-interactive zeroknowledge: A low -randomness characterization ofnp, Proceedings of ICALP '99, LNCS series, v. 1644, pp. 271-280, 1999.

[DDPOS] Alfredo De Santis, Giovanni Di Crescenzo, and Giuseppe Persiano. Randomness- optimal characterization of two np proof systems, Proceedings of RANDOM '02, LNCS series, v. 2483, pp. 179-193, 2002. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The foregoing summary, as well as the following detailed description, is better understood when read in conjunction with the appended drawings. For the purpose of illustrating non-interactive zero knowledge proofs, there is shown in the drawings exemplary constructions thereof; however, the generation and application of non-interactive zero- knowledge proofs is not limited to the specific methods and instrumentalities disclosed.

[0007] Figure 1 is a flow diagram of an example method for generating a common reference string;

[0008] Figure 2 is a flow diagram of an example method for generating a non- interactive zero-knowledge proof that a message encrypts a 0 or a 1;

[0009] Figure 3 is a flow diagram of an example method for verifying a non-interactive zero-knowledge proof such as described in Figure 2;

[0010] Figure 4 is a flow diagram of an example method for generating a common reference string using a perfectly binding key;

[0011] Figure 5 is a flow diagram of an example method for generating a common reference string using a perfectly hiding key;

[0012] Figure 6 is a flow diagram of an example method for generating a non- interactive zero-knowledge proof that a message encrypts a 0 or a 1;

[0013] Figure 7 is a flow diagram of an example method for verifying a non-interactive zero-knowledge proof such as described in Figure 6;

[0014] Figure 8 is a flow diagram of an example method for generating a common reference string using a perfectly binding key and a group of prime order;

[0015] Figure 9 is a flow diagram of an example method for generating a common reference string using a perfectly hiding key and a group of prime order;

[0016] Figure 10 is a flow diagram of an example method for generating a non- interactive zero-knowledge proof that a message encrypts a 0 or a 1;

[0017] Figure 11 is a flow diagram of an example method for verifying a non- interactive zero-knowledge proof such as described in Figure 10;

[0018] Figure 12 is a flow diagram of an example method for generating a non- interactive zero-knowledge proof of circuit satisfiability; and

[0019] Figure 13 is a flow diagram of an example method for verifying a non- interactive zero-knowledge proof of circuit satisfiability. DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

[0020] The inventive subject matter is described with specificity to meet statutory requirements. However, the description itself is not intended to limit the scope of this patent. Rather, the inventor has contemplated that the claimed subject matter might also be embodied in other ways, to comprise different steps or combinations of steps similar to the ones described in this document, in conjunction with other present or future technologies. Moreover, although the term "step" may be used herein to connote different elements of methods employed, the term should not be interpreted as implying any particular order among or between various steps herein disclosed unless and except when the order of individual steps is explicitly described.

[0021] Let R be an efficiently computable binary relation. For pairs (x,w) e R we call x the statement and w the witness. Let L be the language consisting of statements in R. A non- interactive proof system for a relation R consists of a common reference string generation algorithm K, a prover P and a verifier V. Typically, K, P, and V will all be probabilistic polynomial time algorithms. The common reference string generation algorithm K produces a common reference string σ of length Ω,(k). The prover P takes as input (σ, x, w) and produces a proof π. The verifier V takes as input (σ, x, π) and outputs 1 if the proof is acceptable and 0 if rejecting the proof.

Homomorphic Proof Commitments / Encryptions

[0022] We disclose herein a non-interactive commitment scheme with some special properties. The teachings herein may be also be applied to an encryption scheme and the properties of commitment schemes described herein may be extended to encryption schemes. In a non-interactive commitment scheme there is a key generator, which generates a public commitment key ck. The commitment key ck defines a message space M_ck, a randomizer space R_ck and a commitment space C_ck. The key generation algorithm is probabilistic polynomial time and outputs keys of length θ(n).In the following discussions, it will in general be obvious which key we are using, so we will sometimes omit it in our notation. There is an efficient commitment algorithm com that takes as input the commitment key, a message and a randomizer and outputs a commitment, c =com(m; r). We call (m, r) an opening of c.

[0023] The commitment scheme must be binding and hiding. Binding means that it is infeasible to find two openings with different messages of the same commitment. Hiding means that given a commitment it is infeasible to guess which message is inside the commitment. Some embodiments have a commitment scheme that has two different flavors of keys. The commitment key can be perfectly binding, in which case a valid commitment uniquely defines one possible message. Alternatively, the commitment key can be perfectly hiding, in which case the commitment reveals no information whatsoever about the message. In fact, we can create perfect hiding keys together with some trapdoor information such that we can open a commitment to any message. We require that these two kinds of keys are computationally indistinguishable.

[0024] We will consider commitments, where the message space (M, +,0), the randomizer space (R, +,0) and the commitment space (C, ■, 1) are finite abelian groups. The commitment scheme should be homomorphic, i.e., for all messages and randomizers we have com(mi + m₂; T₁ + r₂) = com(mi; r\) com(m2; r₂).

[0025] We will require that the message space has a generator 1, and also that it has order at least 3. The property that sets proof commitments apart from other commitments, is that there is a way to prove that a commitment contains 0 or 1. More precisely, if the key is of the perfect binding type, then it is possible to prove that there exists an opening (m, r) e {0,1} x R. On the other hand, if it is a perfect hiding key, then the proof will be perfectly witness- indistinguishable, i.e., it is impossible to tell whether the message is 0 or 1.

[0026] A commitment scheme is a method that allows a user to commit to a value without revealing the value and preserving the user's ability to reveal the committed value at a later time. For example, a ciphertext value encrypting the value is sent by the user to a receiver, committing the user to the value encrypted but hiding the value from the receiver. A proof scheme is a method that allows the user to provide information that will convince a receiver that a ciphertext encrypts a valid value without revealing any information about the encrypted value. Methods and systems for implementing commitment and proof schemes are described below.

The Boneh-Goh-Nissim (BGN) Cryptosystem

[0027] Boneh, Goh and Nissim have suggested a cryptosystem with homomorphic properties useful for bit commitment and proof schemes. Their system is described in Dan Boneh, Eu- Jin Goh, and Kobbi Nissim, Evaluating 2 -dnf formulas on ciphertexts in the proceedings of TCC '05, LNCS series, volume 3378, pp. 325-341, 2005. The BGN-cryptosystem is an important tool for the systems and methods disclosed below and makes use of bilinear groups as follows. The system uses two cyclic groups G, and Gi, of composite order n, where n = pq and p,q are primes, and a bilinear map e '. G X G — > Gi. Thus, for all u,v e G and α, b e Z (where Z is the integers), we have e(u^α, v^b) = e(u, v) ^αb. It is required the bilinear map e have the property that e(g, g) is a generator of Gj if g is a generator of G. It is also required that group operations, group membership, the sampling of a random generator for G and the bilinear map be efficiently computable. The following example was suggested in "Evaluating 2 -dnf formulas on ciphertexts." Pick large primes p, q and let n = pq. Find the smallest / so P = In - 1 is prime and congruent to 2 modulo 3. Consider the points on the elliptic curve y² = x + 1 over F_p, the Galois field withp elements. This curve has P + 1 = In points, so it necessarily has a subgroup G of order n. Let Gi be the order n subgroup of F ^* ₂ and e '. G X G — > Gi be the modified Weil- pairing. This example is provided for illustrative purposes only and is not intended to be limiting. As may be appreciated, any two cyclic groups of suitable orders admitting a bilinear map may be used.

[0028] A public key may be generated by first running an algorithm, such as known in the art, that takes a security parameter as an input and outputs (p, q, G, Gi, e) such thatp and q are primes, G and Gi are descriptions of groups of order n = pq, and e: G X G — > Gi is a bilinear map. A random generator g of G is selected, and a random generator h of G_q, the subgroup of G of order q. The public key is (n, G, Gi, e, g, h). The decryption key is p and q.

[0029] To encrypt a message m using randomness r e Z ^* , compute the ciphertext c = g^mK . To decrypt, compute c^q = g^mqh^rq= (g^q)^m and exhaustively search for m using knowledge of g and q. Note that h^rq = (h^q)^r = 1 since h has order q.

NIZK Proofs that a Ciphertext Encrypts a 0 or 1 Using the BGN Cryptosystem

[0030] We describe below an embodiment of the construction of a non-interactive zero- knowledge proof that a ciphertext encrypted with the BGN cryptosystem encrypts a message that is either 0 or 1. A common reference string is generated such as described below and in Figure 1, for example. A message is encrypted using the BGN cryptosystem, and a proof is generated as described below and in Figure 2. The proof may be used to convince a verifier that the ciphertext encrypts a 0 or a 1 without revealing to the verifier which, as described below and in Figure 3. Note that if the message m is 1, then the ciphertext is c = gh^r and so cg^Λ = K is a member of G_q the subgroup of G of order q. If m is 0, then the ciphertext is c = h^r which is a member of G_q.

[0031] Figure 1 describes the generation of a common reference string that will be made known to all parties. Large primes p and q are selected 101, preferably by a random process. Let n = pq. Descriptions of cyclic groups G and Gi of order n are generated 102. Random generators g of G and h of G_q, the subgroup of G of order q are selected 103 and a bilinear map e: G X G — > Gi is identified 104. The common reference string σ = (n, G, Gi, e, g, h) is generated 105 and is made known to all parties. The generation of this common reference string σ may be accomplished by a random key generation algorithm such as known in the art and described above in connection with the BGN cryptosystem. [Can we say more about this algorithm?]

[0032] Figure 2 describes the generation of a proof π that a message m encrypts a 0 or a 1. A message m e {0,1 } and an integer witness w are received 201. A ciphertext of the message, c = g^mh^w, is computed 202. A value r is randomly selected from Z^* , the units of Z_n (i.e., the elements of X_n that are not divisible by p or q) 203. The proof string π = (π_l5π₂,π₃) is computed 204 where: π_λ = h^r

π₃ = g^r The string π provides a zero-knowledge proof that c encrypts "0" or "1".

[0033] Figure 3 describes the verification process. A verifier receives 301 the common reference string σ, such as generated in the process described in Figure 1, a ciphertext ce G, and a proof string π e G x G x G. The bilinear map e from the common reference string is used to check 302 whether e(c, cg^~l) = e(%ι, π₂). If not, the verification process is terminated and a failure indication is returned 303. If the check succeeds, the process then checks 304 whether e{K_\, g) = e(h, π₃). If the second check fails, the verification process is terminated and a failure indication is returned 305. If the second check succeeds, a success indication is returned 306 and the verifier is convinced that the ciphertext encrypts either a 0 or a 1. Note that if the message m is 1, then the ciphertext is c = gh^r and so eg ¹ = K is a member of G_q the subgroup of order q. If m is 0, then the ciphertext is c = K which is a member of G_q.

NIZK Proofs that a Ciphertext Encrypts a 0 or 1 Based on the Subgroup Decision Problem

[0034] We describe embodiments of proof schemes based on the subgroup decision problem. Let G_BGN be a randomized algorithm that outputs (p, q, G, G_T, e, g) such thatp < q are primes and n =pq is a fc-bit number, G and Gj are descriptions of groups of order n, e : G x G — > G_T is a bilinear map and g is a random generator for G. Let Gq be the subgroup of G of order q. The subgroup decision problem is to distinguish elements of G from elements of Gq. [0035] We say that a key is "perfectly binding" if a prover cannot generate a false proof using the key, even if given infinite computing resources. It may be the case that a verifier may be able to decrypt the witness if given sufficiently large computing resources.

[0036] We say that a key is "perfectly hiding" if a verifier cannot decrypt the witness even if given infinite computing power. It may be the case that the prover could prove a false proof using the key, but generating such a false proof may require substantial computing resources.

[0037] Figure 4 describes the generation of a common reference string using a perfectly binding key. Large primes p and q are selected 401, preferably by a random process. Let n = pq. Descriptions of cyclic groups G and G_T of order n are generated 402. A random generator g of G is selected 403. A random generator h of G_q, the subgroup of G of order q, is determined 404 by randomly selecting a value x in Z_? (i.e., x is not divisible by q) and defining h = _$f^x . A bilinear map e: G X G — > Gi is identified 405. The common reference string σ = (n, G, G_T, e, g, K) is generated 406 and is made known to all parties.

[0038] Figure 5 describes the generation of a common reference string using a perfectly hiding key. Large primes p and q are selected 501, preferably by a random process. Let n = pq. Descriptions of cyclic groups G and G_T of order n are generated 502. A random generator g of G is selected 503. A second random generator h of G is determined 504 by randomly selecting a value x in Z_n ^* (i.e., x is not divisible by p or q) and defining h = g^x. A bilinear map e: G x G — > G_T is identified 505. The common reference string σ = (n, G, G_T, e, g, K) is generated 506 and is made known to all parties.

[0039] Figure 6 describes the reception of a message m and the generation of a proof π that m G {0,1 }. A message m G {0,1 } and a random integer r e Z_n are received 601. A ciphertext of the message, c = g^m K, is computed 602. The proof π = ( g^2mΛ K f is computed 603. The value π provides a zero-knowledge proof that c encrypts a 0 or a 1.

[0040] Figure 7 describes the verification process. A verifier receives 701 the common reference string σ, such as generated in the process described in Figure 4 or 5, a ciphertext ce G, and a proof value π e G. The bilinear map e from the common reference string is used to check 702 whether e(c, cg^~l) = e(h, π). If not, the verification process is terminated and a failure indication is returned 703. If the check succeeds, a success indication is returned 704 and the verifier is convinced that the ciphertext encrypts either "0" or "1". NIZK Proofs that a Ciphertext Encrypts a 0 or 1 Using Groups of Prime Order

[0041] We describe embodiments of proof schemes based on the decisional linear assumption. The decisional linear assumption introduced by Boneh, Boyen and Shacham in "Short group signatures", Proceedings of CRYPTO '04, LNCS series, v. 3152, pp. 41-55, 2004. Let G_DLIN be a randomized algorithm that outputs (p, G, G_T, e, g) such that p is prim, G and G_T are descriptions of groups of order p, e i G x G ^ G^ is a bilinear map and g is a random generator for G.

[0042] Figure 8 describes the generation of a common reference string using a perfectly binding key. Large prime p is selected 801, preferably by a random process. Descriptions of cyclic groups G and G_T of order p are generated and a bilinear map e: G X G — > Gi is identified 802. A random generator g of G is selected and random generators /and h oi G are determined by selecting random values x and y in Z_p and computing /= g^x and h = ^ in step 803. Random elements a and b in Z_p and an arbitrary element z in Z_p are selected 806 and the triple (u, v, w) = (f^a, h ^h, g ^{a + h + z} ) is computed 804. The common reference string σ = (p, G, G_T, e, g, / h, u, v, w) is generated 805 and is made known to all parties.

[0043] Figure 9 describes the generation of a common reference string using a perfectly hiding key. Large prime p is selected 901, preferably by a random process. Descriptions of cyclic groups G and G_T of order p are generated and a bilinear map e\ G X G — > Gi is identified 902. A random generator g of G is selected and random generators /and h oi G are determined by selecting random values x and y in Z_p ^* and computing /= g^x and h = g^y in step 903. Random elements a and b in X_p and arbitrary element z in Z_p ^* are selected 906 and the triple (u, v, w) = (f^a, h ^b, g ^a+h ) is computed 904. The common reference string σ = (p, G, G_T, e, g, / h, u, v, w) is generated 905 and is made known to all parties.

[0044] Figure 10 describes the selection of a message m and the generation of a proof π that a ciphertext encrypts m e {0,1 }. Note that the proof technique described here will work with either the perfectly binding key as described above in connection with Figure 8 or the perfectly hiding key as described above in connection with Figure 9. A message m e {0,1 } and random integers r, s e X_p are selected 1001. A ciphertext of the message, c = (C₁, C₂, C₃) = (u ^mf^r, v ^mh ^s, w ^mg ^{r + s} ) is computed 1002. A proof π = (π_{l ls} π₁₂, π₁₃, π₂₁, π₂₂, π₂₃) is determined 1003 by selecting a arbitrary value t e X_p and computing:

[0045] Figure 11 describes the verification process for the proof generated by the process of Figure 10. A verifier receives 1101 the common reference string σ, such as generated in the process described in Figure 8 or 9, a ciphertext ce G x G x G and a proof value π as described above in connection with Figure 10. For convenience in the computations that follow, we first compute 1102:

Tt₃₁ = TE₁₁ TE₂₁ 7C₃₂ = TC₁₂ TC₂₂ TC₃₃ = 7E₁₃ TC₂₃

The bilinear map e from the common reference string is used to check 1103 whether the following six conditions all hold:

If any of the equalities do not hold, the verification process is terminated and a failure indication is returned 1104. If the checks succeed, a success indication is returned 1105 and the verifier is convinced that the ciphertext encrypts either "0" or "1".

NIZK Proofs for Circuit Satisfiability

[0046] We describe below an embodiment of a NIZK proof for Circuit Satisfiability (C-SAT). We use a public key for a homomorphic proof commitment scheme as the common reference string. In an embodiment, the common reference string is a perfectly binding string such as described above. The prover gets as input a circuit C which, without loss of generality, consists of NAND-gates. He also gets a witness w, consisting of wires W₁,. ..,w_out such that the wires respect the circuit and the output wire is true, w_out= 1 • We write C(w) = 1 when this is the case.

[0047] The prover's strategy is straightforward. He commits to each wire and for each commitment makes a proof that it contains 0 or 1. This way, the verifier is guaranteed that the prover has committed to truth values for each wire. The prover makes a trivial commitment to the output wire, using randomness r = 0, so the verifier can easily check that indeed the output is 1. What remains is to convince the verifier that the committed wires respect the NAND-gates of the circuit. [0048] The following will be useful. Let M be a finite cyclic group with neutral element

0 and generator 1. Let bo, b\, b₂ e { 0, 1 } . If the order of the group is at least 4, then b₂ = ^~"(bo ^Λ bi) if and only if bo + b\ +2(b₂ - 1 ) e {0,1 }. If the order of the group is 3 , then b₂ = -i(bo A

if and only if bo +b_\ + 2(b₂ -1) e {0,1} and bo + b_\ + b₂ -1 e {0,1 }. In the following, we focus on the case where the message space of the commitment scheme has order at least 4. Given commitments CQ>, C₁, C₂ containing plaintexts bo, b_\, b₂ the homomorphic property of the commitment scheme implies that Co C₁ C₂ ² com(-l;0)² is a commitment to bo +b_\ +2(b₂ -1). A proof that this commitment contains 0 or 1 shows that b2 = -ι(bo Λ b_\) . The prover may make such a proof for each NAND-gate in the circuit.

[0049] Figure 12 describes an embodiment of a NIZK proof of circuit satisfiability. A prover receives 1201 as input (σ, C, w), comprising a common reference string σ, a circuit C, and a set of wire assignments w = (w_\, ..., W_d, w_out) for which C(w) = 1. For each i = \, ..., d, generate a commitment C₁ = COm(W₁, r_t) to wire assignment W₁ using random element r_r and a method such as described above 1202. For the output wire, w_out, use randomness r_out = 0 and generate the commitment c_out = com(l; 0) 1203. For each commitment C₁, generate a proof π_r of the existence of an opening (W₁, r_t) so W₁ e {0,1 } and C₁ = COm(W₁, r_t) 1204.

[0050] For each NAND-gate, do the following: Suppose the input wires to the NAND- gate are numbered i andj and the output wire k. Using message w_t + W_j + 2w_t - 2 and randomness r_t + r_} + 2n, make a proof π_υk for C₁ c_} Ck com(-l;0)² containing message 0 or 1. Step 1205. A proof π comprising all of the commitments and proofs for the wires and NAND-gates is generated and may be communicated to a computing entity 1205.

[0051] Figure 13 describes an embodiment of a process for verifying a NIZK proof of circuit satisfiability such as described in Figure 12. A verifier receives the common reference string σ, a circuit C, and a proof π 1301. The verifier checks whether all wires have a corresponding commitment and c_out = com(l;0) 1302. If not, the verification process is terminated and a failure indication is returned 1303. If the check succeeds, the process then checks 1304 whether all NAND-gates in C with input wires /, j, k have a proof %φ for C₁ c_} Cu com(-l;0) containing message 0 or 1. If the second check fails, the verification process is terminated and a failure indication is returned 1305. If the second check succeeds, a success indication is returned 1306 and the verifier is convinced that π provides a proof of circuit satisfiability of circuit C.

[0052] The various techniques described herein may be implemented with hardware or software or, where appropriate, with a combination of both. Thus, the methods and apparatus of the present invention, or certain aspects or portions thereof, may take the form of program code

(i.e., instructions) embodied in tangible media, such as floppy diskettes, CD-ROMs, hard drives, or any other machine-readable storage medium, wherein, when the program code is loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the invention. In the case of program code execution on programmable computers, the computer will generally include a processor, a storage medium readable by the processor (including volatile and non- volatile memory and/or storage elements), at least one input device and at least one output device. One or more programs are preferably implemented in a high level procedural or object oriented programming language to communicate with a computer system. However, the program(s) can be implemented in assembly or machine language, if desired. In any case, the language may be a compiled or interpreted language, and combined with hardware implementations .

[0053] Reference in the specification to "an embodiment," "one embodiment," "some embodiments," or "other embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiments is included in at least some embodiments, but not necessarily all embodiments, of the invention. The various appearances "an embodiment," "one embodiment," or "some embodiments" are not necessarily all referring to the same embodiments.

[0054] If the specification states a component, feature, structure, or characteristic "may", "might", or "could" be included, that particular component, feature, structure, or characteristic is not required to be included. If the specification or claim refers to "a" or "an" element, that does not mean there is only one of the element. If the specification or claims refer to "an additional" element, that does not preclude there being more than one of the additional element.

[0055] While the present disclosure has been described in connection with various embodiments, illustrated in the various figures, it is understood that similar aspects may be used or modifications and additions may be made to the described aspects of the disclosed embodiments for performing the same function of the present disclosure without deviating therefrom. Therefore, the present disclosure should not be limited to any single aspect, but rather construed in breadth and scope in accordance with the appended claims.

Claims

What is Claimed:

1. A method for generating a proof for the satisfiability of a circuit, the method comprising: identifying common reference string containing a predetermined number of elements of a group, said predetermined number being determined independent of the order of the group and independent of the size of a circuit to be proven satisfiable; and generating a proof of satisfiability of the circuit, the size of said proof being proportionate to the product of the size of the circuit and the length of the order of the group.

2. A method for generating a proof, the method comprising: receiving a common reference key comprising a group order, a description of a first group having the group order, a description of a second group having the group order, a description of a bilinear map from the first group to the second group, a first generator of the first group, and a second generator of a proper nontrivial subgroup of the first group; receiving a message from a first computing entity; identifying a ciphertext encrypting the message; determining a proof value comprising a triple of values from the first group, said triple of values generated using a unit from the group of integers modulo the group order, the first generator, the second generator, the message, and the secret integer value; and communicating the proof value to a second computing entity.

3. The method as recited in claim 2, wherein identifying a ciphertext comprises receiving the ciphertext from the first computing entity.

4. The method as recited in claim 2, wherein identifying a ciphertext comprises computing the ciphertext using at least the first generator, the message, the second generator, and a secret integer value.

5. A proof system comprising: a common reference key comprising a group order, a description of a first group having the group order, a description of a second group having the group order, a description of a bilinear map from the first group to the second group, a first generator of the first group, and a second generator of a proper nontrivial subgroup of the first group; a message, said message having been generated by a first computing entity; a ciphertext representing an encryption of the message, said ciphertext having been generated using elements of the common reference key and a secret integer value; a proof value comprising a tuple of values from the first group, said tuple of values generated using a unit from the group of integers modulo the group order, the first generator, the second generator, the message, and the secret integer value; and a communications module for communicating the proof value to a second computing entity.

6. The system of claim 5 wherein the tuple is a triple.

7. The system of claim 5, further comprising: a verifier configured to receive the common reference key, the ciphertext, and the proof value and to verify that predetermined relationships hold when the bilinear map is applied to preselected elements of the common reference key, the ciphertext, and the proof value.

8. A method of verifying a proof, the method comprising: receiving a common reference key comprising a group order, a description of a first group having the group order, a description of a second group having the group order, a description of a bilinear map from the first group to the second group, a first generator of the first group, and a second generator of a proper subgroup of the first group; receiving a ciphertext encrypting a message; receiving a proof value, said proof value comprising a triple of values from the first group; using the bilinear map, the first generator, the second generator, the ciphertext, and the proof value to determine whether the ciphertext encrypts a value from a predetermined set of values; and generating a signal representative of the determination.

9. A method for generating a proof, the method comprising: receiving a common reference key comprising a prime group order p, a description of a first group having the group order, a description of a second group having the group order, a description of a bilinear map from the first group to the second group, three generators of the first group, and a first tuple of values from the first group, wherein the first tuple of values from the first group have a predetermined relationship to the three generators and at least a first and a second value selected from the integers modulo p; receiving a message from a first computing entity; identifying a ciphertext encrypting the message and comprising a second tuple of values from the first group, the values of the second tuple of values from the first group determined by a predetermined relationship of the three generators, the message, and a third and a fourth value selected from the integers modulo p; determining a proof value comprising a matrix of values from the first group, said matrix of values generated using a fifth value selected from the group of integers modulo p and determined by the fifth value, the three generators, the first tuple of values from the first group, the third and fourth values, and the message; and communicating the proof value to a second computing entity.

10. The method as recited in claim 9, wherein identifying a ciphertext comprises receiving the ciphertext from the first computing entity.

11. The method as recited in claim 9, wherein identifying a ciphertext comprises computing the ciphertext.

12. A system for generating a proof, the system comprising: a common reference key comprising a prime group order p, a description of a first group having the group order, a description of a second group having the group order, a description of a bilinear map from the first group to the second group, three generators of the first group, and a first tuple of values from the first group, wherein the first tuple of values from the first group have a predetermined relationship to the three generators and at least a first and a second value selected from the integers modulo p; a message received from a first computing entity; a ciphertext encrypting the message and comprising a second tuple of values from the first group, the values of the second tuple of values from the first group determined by a predetermined relationship of the three generators, the message, and a third and a fourth value selected from the integers modulo p; a proof value comprising a matrix of values from the first group, said matrix of values generated using a fifth value selected from the group of integers modulo p and determined by the fifth value, the three generators, the first tuple of values from the first group, the third and fourth values, and the message; and a communications module for communicating the proof value to a second computing entity.

13. A method for proving that a collection of values satisfies a logical NAND-gate, the method comprising: receiving a first input value bo and a second input value b_\ for a NAND-gate and an output value b₂ for the NAND-gate; identifying ciphertexts co, C₁, and c₂ representing bo, b_\, and b₂ respectively, wherein the cyphertexts are generated using a homomorphic commitment scheme; identifying a ciphertext c₃ generated using the homomorphic commitment scheme applied to a message containing -1; generating a proof that Co c_\ C₂ ² C₃ ² contains 0 or 1.

14. A proof system for proving that a collection of values satisfies a logical NAND-gate, the system comprising: a first input value bo and a second input value b_\ for a NAND-gate; an output value b₂ for the NAND-gate; ciphertexts Co, C₁, and c₂ representing bo, b_\, and b₂ respectively, wherein the cyphertexts are generated using a homomorphic commitment scheme; a ciphertext c₃ generated using the homomorphic commitment scheme applied to a message containing -1; a proof that Co C₁ C₂ ² C₃ ² contains 0 or 1.

15. A method for proving that a collection of wire assignments satisfies a circuit description, the method comprising: identifying a circuit description; identifying a collection of wire assignments, each wire assignment being associated with an element of the circuit description; identifying a collection of commitments, each commitment being associated with a wire assignment; generating a collection of proofs, each proof being a proof that a triple of wire assignments associated with a NAND-gate of the circuit description satisfies the

NAND-gate; and communicating the collection of proofs to a computing entity.

16. A proof system for proving that a collection of wire assignments satisfies a circuit description, the system comprising: a circuit description; a collection of wire assignments, each wire assignment being associated with an element of the circuit description; a collection of commitments, each commitment being associated with a wire assignment; a collection of proofs, each proof being a proof that a triple of wire assignments associated with a NAND-gate of the circuit description satisfies the NAND-gate; and a communications module for communicating the proofs to a computing entity.