WO2015055765A1 - Method for generating a quasi-adaptive non-interactive zero-knowledge proof and corresponding electronic device - Google Patents

Abstract

In one embodiment, it is proposed a method for generating a quasi-adaptive non- interactive zero-knowledge proof, said proof assessing a membership of a first vector to a hard language, which is a subspace of G ⁿ , where G is a group and n is an integer. The method is executed by an electronic device, and is remarkable in that it comprises: generating a derived linearly homomorphic signature on a second vector, said second vector being defined as a function of said first vector, from a linearly homomorphic signatures comprised in a common reference string and a witness associated with said first vector; and generating a non-malleable element by using a public evaluation function of a smooth projective hash function, in combination with a hash function, said first vector, said witness and elements comprised in said common reference string, said proof being a combination of said derived linearly homomorphic signature and said non-malleable element.

Description

Method for generating a quasi-adaptive non-interactive zero-knowledge proof and corresponding electronic device

Technical Field

The disclosure relates to cryptography, and more specifically, with the development of efficient non-interactive zero-knowledge (e.g. "NIZK") proofs of membership in hard languages.

Background

This section is intended to introduce the reader to various aspects of art, which may be related to various aspects of the present invention that are described and/or claimed below. This discussion is believed to be helpful in providing the reader with background information to facilitate a better understanding of the various aspects of the present invention. Accordingly, it should be understood that these statements are to be read in this light, and not as admissions of prior art. In the rest of the document, the following acronyms, which are well known for one skilled in the art of cryptography, are used: PPT means Probabilistic polynomial time; CRS means Common Reference String; NIZK means Non-interactive zero-knowledge (as already mentioned); QA-NIZK means Quasi-adaptive non-interactive zero-knowledge; DLIN means Decision Linear; SDP means Simultaneous Double Pairing; /c-SDP means Simultaneous k -wise Pairing; SXDH means Symmetric external Diffie-Hellman; GS means Groth-Sahai and SPHF means Smooth Projective Hash Function. Some reminders on the concepts of Quasi-Adaptive NIZK Proofs, Simulation-Soundness and Relative Soundness, Bilinear Maps and Hardness Assumptions, Linearly Homomorphic Structure-Preserving Signatures, Smooth Projective Hash functions are described in the section "Detailed description of embodiments" of the present document, before the description of the figures.

Non-interactive zero-knowledge (NIZK) proofs play a central role in cryptography. Until recently, the most efficient way to non-interactively prove membership in the linear subspace spanned by vectors of group elements was to use the Groth-Sahai proof systems (the Groth-Sahai proof systems are detailed in the article "Efficient non-interactive proof systems for bilinear groups" by J. Groth, and A. Sahai, published in the conference proceedings of Eurocrypt'08, LNCS 4965, pp. 415-432, 2008).

Indeed, \f A E Έρ^Χη is a matrix of rank t < n (where t and n are integers, and Έ_ρ is the additive group of integers modulo a prime number p), in order to prove membership in the language L = E Gⁿ \ 3x E Έρ s. t. v^* = g^{x A}], where G is a group, and g an element of G , using NIZK proofs, the Groth-Sahai techniques require 0(n + t) group elements in their basic form.

They can be made simulation-sound by using techniques suggested in the following articles: "Simulgtion-sound NIZK proofs for g prgcticgl Igngugge gnd constgnt size group signgtures" , by J. Groth, published in the conference proceedings of Asiacrypt 2006, LNCS 4284, pp. 444-459, 2006, "A public key encryption scheme secure ggginst key dependent chosen plgintext gnd gdgptive chosen ciphertext gttgcks" by J. Camenisch et al., published in the conference proceedings of Eurocrypt'09, LNCS 5479, pages 351-368, 2009, and "Tightly Secure Public-Key Encryption" , by D. Hofheinz, T. Jager., published in the conference proceedings of Crypto 2012, LNCS series, pp. 590-607,2012.

However, these techniques involve Groth-Sahai proofs for quadratic pairing product equations, which results in rather long proofs. One-time simulation-soundness can be more efficiently achieved using techniques suggested in the following articles: "Round-Optimgl Pgssword-Bgsed Authenticgted Key Exchgnge", by J. Katz and V. Vaikuntanathan, published in the conference proceedings of TCC'll, LNCS 6597, pp. 293-310, 2011, and "Non-Interactive CCA2-Secure Threshold Cryptosystems with Adgptive Security: New Fmmework gnd Constructions" , by B. Libert, M. Yung, published in the conference proceedings of TCC 2012, LNCS 7194, pp. 75-93, Springer, 2012.

However, in recent results, Jutla and Roy gave significantly more efficient solutions for quasi-adaptive NIZK proofs (OA-NIZK), where the common reference string (CRS) may depend on the language of which membership is being proved. While malleable in their original form (just like the Groth-Sahai proofs), the Jutla Roy OA-NIZK proofs can be modified to achieve a weak form of non-malleability called relative simulation-soundness, which is sufficient for many applications like password-authenticated key exchange protocols and chosen-ciphertext-secure non-interactive threshold encryption.

Indeed, Jutla and Roy suggested an even more efficient way to achieve single-theorem relative soundness in the article : "Relatively-Sound NIZKs and Password-Based Key-Exchange" by C. Jutla and A. Roy published in the conference proceedings of PKC'12, LNCS series, pp. 485- 503, 2012. More recently in the article "Shorter Quasi-Adaptive NIZK Proofs for Linear Subspaces" , by C. Jutla, A. Roy, published in the conference proceedings of Asiacrypt'13, LNCS series, 2013 and in the Cryptology ePrint Archive: Report 2013/109, 2013, C. Jutla and A. Roy showed how to make the proofs more compact at the expense of settling for computational soundness (rather than perfect soundness described in the previous mentioned article "Efficient non-interactive proof systems for bilinear groups"). Still, in their most efficient variant, the Jutla-Roy proofs still require 0(n— t) group elements, which remains linear in n and results in long proofs when t « n. Hence, to prove membership in a linear subspace of dimension t spanned by vectors of dimension n, the relatively sound Q.A-NIZK proofs of Jutla and Roy require 0(n— t) group elements.

The proposed technique aims to reduce the number of group elements in relatively sound Q.A-NIZK proofs. More precisely, the proposed technique aims to obtain a size of a proof that does not depend on the dimension of a considered subspace.

Indeed, the proposed technique aims to construct a relatively Q.A-NIZK proof system for a language corresponding to the following set: [v^* E Gⁿ \ x E Έρ s. t. v^* = g^xA] by using proofs made of a constant number of group elements. In other words, one goal of the proposed technique is to obtain a size of the proof that should not depend on the number of equations n or on the number of variables t. At first, this goal seems very difficult to achieve given that it would even outperforms Fiat-Shamir-like proofs derived from∑ protocols in the random oracle model, as explained in the article "Random oracles are practical: A paradigm for designing efficient protocols" by M. Bellare and P. Rogaway, and published in the ACM CCS, pp. 62-73, 1993. Indeed, the Fiat-Shamir heuristic would give 0(t) size proofs here, as the length of proofs is inevitably linear in the number of variables. Summary of invention

References in the specification to "one embodiment", "an embodiment", "an example embodiment", indicate that the embodiment described may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.

The present invention is directed to a method for generating a quasi-adaptive non- interactive zero-knowledge proof, said proof assessing a membership of a first vector to a hard language, which is a subspace of Gⁿ, where G is a group and n is an integer. The method is executed by an electronic device, and it comprises: generating a derived linearly homomorphic signature on a second vector, said second vector being defined as a function of said first vector, a linearly homomorphic signatures comprised in a common reference string and a witness associated with said first vector; and generating a non-malleable element by using a public evaluation function of a smooth projective hash function, in combination with a hash function, said first vector, said witness and elements comprised in said common reference string, said proof being a combination of said derived linearly homomorphic signature and said non-malleable element. In a preferred embodiment, the method for generating is remarkable in that said hard language corresponds to a set which is equal to E Gⁿ \ x E Έρ s. t. v^* = g^{x A}], where p is a prime number, t is an integer, g is a generator of said group G, and A is a t x n matrix of rank t whose elements are comprised in Έ_ρ.

In a preferred embodiment, the method for generating according is remarkable in that said witness x belongs to Έ_ρ, and is associated with said first vector ^~v by a relationship ^~v = g^xA.

In a preferred embodiment, the method for generating is remarkable in that said linearly homomorphic signatures comprised in a common reference string comprise 2t elements, each element being defined by a vector (z, r_lt ... , r_k) , where k is a integer greater or equal to two, corresponding to a linearly homomorphic signature on independent vectors, which are obtained from rows of a matrix g^A.

In a preferred embodiment, the method for generating according is remarkable in that generating a derived linearly homomorphic signature, and generating a non-malleable element further use a label.

In another embodiment, it is proposed a method for ciphering in an non-interactive and adaptively secure threshold cryptosystems with chosen-ciphertext security. Such method is executed by an electronic device, and is remarkable in that it comprises executing a method for generating a quasi-adaptive non-interactive zero knowledge proof as mentioned previously.

According to an exemplary implementation, the different steps of the method are implemented by a computer software program or programs, this software program comprising software instructions designed to be executed by a data processor of a relay module according to the disclosure and being designed to control the execution of the different steps of this method.

Consequently, an aspect of the disclosure also concerns a program liable to be executed by a computer or by a data processor, this program comprising instructions to command the execution of the steps of a method as mentioned here above. This program can use any programming language whatsoever and be in the form of a source code, object code or code that is intermediate between source code and object code, such as in a partially compiled form or in any other desirable form.

The disclosure also concerns an information medium readable by a data processor and comprising instructions of a program as mentioned here above.

The information medium can be any entity or device capable of storing the program. For example, the medium can comprise a storage means such as a ROM (which stands for "Read Only Memory"), for example a CD-ROM (which stands for "Compact Disc - Read Only Memory") or a microelectronic circuit ROM or again a magnetic recording means, for example a floppy disk or a hard disk drive.

Furthermore, the information medium may be a transmissible carrier such as an electrical or optical signal that can be conveyed through an electrical or optical cable, by radio or by other means. The program can be especially downloaded into an I nternet-type network.

Alternately, the information medium can be an integrated circuit into which the program is incorporated, the circuit being adapted to executing or being used in the execution of the method in question.

According to one embodiment, an embodiment of the disclosure is implemented by means of software and/or hardware components. From this viewpoint, the term "module" can correspond in this document both to a software component and to a hardware component or to a set of hardware and software components.

A software component corresponds to one or more computer programs, one or more sub-programs of a program, or more generally to any element of a program or a software program capable of implementing a function or a set of functions according to what is described here below for the module concerned. One such software component is executed by a data processor of a physical entity (terminal, server, etc.) and is capable of accessing the hardware resources of this physical entity (memories, recording media, communications buses, input/output electronic boards, user interfaces, etc.). Similarly, a hardware component corresponds to any element of a hardware unit capable of implementing a function or a set of functions according to what is described here below for the module concerned. It may be a programmable hardware component or a component with an integrated circuit for the execution of software, for example an integrated circuit, a smart card, a memory card, an electronic board for executing firmware etc.

It should also be noted that a step of obtaining an element/value in the present document can be viewed either as a step of reading such element/value in a memory unit of an electronic device or a step of receiving such element/value from another electronic device via communication means. In another embodiment, the present invention is directed to an electronic device comprising a module configured to generate a quasi-adaptive non-interactive zero-knowledge proof, said proof assessing a membership of a first vector to a hard language, which is a subspace of Gⁿ, where G is a group and n is an integer. Such electronic device comprises: a module configured to generate a derived linearly homomorphic signature on a second vector, said second vector being defined as a function of said first vector, a linearly homomorphic signatures comprised in a common reference string and a witness associated with said first vector;

a module configured to generate a non-malleable element by using a public evaluation function of a smooth projective hash function, in combination with a hash function, said first vector, said witness and elements comprised in said common reference string, said proof being a combination of said derived linearly homomorphic signature and said non-malleable element.

In a preferred embodiment, the electronic device is remarkable in that said hard language corresponds to a set which is equal to E Gⁿ \ x E Έρ s. t. v^* = g^{x A}], where p is a prime number, t is an integer, g is a generator of said group G, and A is a t x n matrix of rank t whose elements are comprised in TL_V . In a preferred embodiment, the electronic device is remarkable in that said witness x belongs to Έρ, and is associated with said first vector ^~v by a relationship ^~v = g^xA.

In a preferred embodiment, the electronic device is remarkable in that said linearly homomorphic signatures comprised in a common reference string comprise 2t elements, each element being defined by a vector (z, r_lt ... , r_k) , where k is a integer greater or equal to two, corresponding to a linearly homomorphic signature on independent vectors, which are obtained from rows of a matrix g^A.

In a preferred embodiment, the electronic device is remarkable in that the module configured to generate a derived linearly homomorphic signature, and the module configured to generate a non-malleable element further use a label.

In another embodiment, the present invention is directed to an, an electronic device comprising a module configured to cipher in an non-interactive and adaptively secure threshold cryptosystems with chosen-ciphertext security. The electronic device comprises a module configured to generate a quasi-adaptive non-interactive zero-knowledge proof, said proof assessing a membership of a first vector to a hard language, which is a subspace of Gⁿ, where G is a group and n is an integer, that comprises: a module configured to generate a derived linearly homomorphic signature on a second vector, said second vector being defined as a function of said first vector, a linearly homomorphic signatures comprised in a common reference string and a witness associated with said first vector; and

a module configured to generate a non-malleable element by using a public evaluation function of a smooth projective hash function, in combination with a hash function, said first vector, said witness and elements comprised in said common reference string, said proof being a combination of said derived linearly homomorphic signature and said non-malleable element. Brief description of the figures

The above and other aspects of the invention will become more apparent by the following detailed description of exemplary embodiments thereof with reference to the attached drawings in which: - Figures l(a)-(d) present a relatively sound QA-NIZK proof system according to one embodiment of the invention;

Figures 2(a)-(f) present a non-interactive threshold cryptosystem according to one embodiment of the invention;

Figure 3 presents an example of an electronic device that can be used to perform one or several steps of methods disclosed in the present document.

Detailed description of embodiments

First of all, before describing in details some embodiments of the invention, some reminders related to concepts related to the background of the present technique are detailed: a) Reminders on Quasi-Adaptive NIZK Proofs Let l be a relation that takes as input a statement x and a witness w such that l(x, w) = 1 if and only if x belongs to the language £. It should be noted that only languages £ where it may be hard to distinguish random elements of £ from elements outside £ are considered for cryptographic purposes. For example, consider an abelian group G =< g > of prime order p where the discrete logarithm problem is hard. If A E Ί ^η is a matrix of rank t < n, deciding the membership of a linear subspace g^A E G^txn is believed to be hard for carefully chosen groups: in other words, the language

L = {v^* E Gⁿ \ 3x E TL_v ^t s. t. ^'v = g^{i A}] is not efficiently recognizable. For such languages, proving the membership of a candidate x E £ is non-trivial. Whenever x E £, any element w such that l(x, w) = 1 is called a witness for the membership of x in £. A non-interactive zero-knowledge (NIZK) proof for a relation R " usually consists of three algorithms or methods noted (K, P, V), where K is a randomized algorithm (or method) that takes as input a security parameter 1 £ N (in unary) and outputs a common reference string (CRS); P is a randomized algorithm (or method) used by the prover on input of a statement x and a witness w such that l(x, w) = 1 to generate a proof for the statement x E L; and the algorithm (or method) V is a deterministic algorithm (or method) which is run by the verifier to output a binary value (which is 1 if and only if the verifier is convinced that E L; and 0 otherwise) on input of the CRS, a statement x and a proof π. The CRS should be seen as a set of common public parameters generated by some trusted party. The zero-knowledge property usually refers to the existence of a simulator S that takes as input a true statement x E L but no witness. Instead of a witness, the simulator S uses a trapdoor τ associated with the CRS to generate simulated proofs π whose distribution is indistinguishable from real proofs π produced by the actual algorithm P using the witness. The intuition is that a proof π leaks nothing beyond the validity of the statement x E L. Quasi-Adaptive NIZK (Q.A-NIZK) proofs are NIZK proofs where the CRS is allowed to depend on the specific language for which proofs have to be generated. The CRS is divided into a fixed part Γ, produced by an algorithm K₀, and a language-dependent part ψ, produced by an algorithm However, there should be a single simulator for the entire class of languages.

More formally, let λ E N be a security parameter. For public parameters Γ produced by algorithm K₀ , let T>_r be a probability distribution over a collection of relations R = {ftp} parameterized by a string p with an associated language L_p = [x\ 3w s. t. lp (x, w) = l).

In the following, it is considered proof systems where the prover and the verifier both take a label Ibl as additional input. For example, this label can include the message-carrying part (g^r, M. h^r) of an Elgamal-like encryption. A tuple of algorithms (K_Q, K_lt P, V) is a Q.A-NIZK proof system for R if there exists a PPT simulator (S_lt S₂), such that, for any PPT adversaries Λ₁, Λ₂ and /Z₃, the properties hereunder stands. In short, quasi-adaptive completeness means that honestly generated proofs are always accepted by the verifier. Quasi-adaptive soundness captures that it should be computationally infeasible for the prover to trick the verifier into accepting a proof for a false statement. As for the quasi-adaptive zero-knowledge property, it requires the existence of a simulator (S_ltS₂) that can emulate the behavior of the real prover P (which always generates proofs using the witnesses) without knowing the witnesses w: instead, (S_ltS₂) uses a simulation trapdoor T_sim hidden in the CRS ψ to create simulated proofs. Yet, no probabilistic polynomial time (PPT) adversary should be unable to see the difference.

Quasi-Adaptive Completeness:

Pr[ Γ <- K₀(A); ρ^ν_ν;ψ ^ Κ^Γ,ρ);

(x,w,lbl) <- Λ^Υ,-φ,ρ); π <- P(ip,x,w,lbl) s.t. V(ip,x,n,lbl) = 1 ί!Μ_ρ(χ, w) = 1] = 1.

Quasi-Adaptive Soundness:

Pr[ Γ <- K„(A); p <- D_r; ip <- Κ^Γ,ρ); {x,w,lbl) <- <A₂(T,xp,p) s.t. V(xp,x,n,lbl) = 1 Λ -i (3w s. t. Kp(x, w) = 1] Enegl( ) .

Quasi-Adaptive Zero-Knowledge:

Pr[ Γ <- K₀(l) ; p <- 2)_r ; ψ <-

= 1] * ΡΓ[Γ <- Κ„(λ) ; ρ <- D_r; (ip,T_sim) <- S^p) s. t «Ζ₃ ^¾(ψ'^τ*™'-'^,^ρ) = 1, where:

Ρ(ψ,.,.) emulates the actual prover and outputs a proof π on input of (x,w) £ l_p, and ZM.

S₂(ip,T_sim,.,.) is an oracle that takes as input x E L_p (i.e. for which there exists w such that (x,w) £ 52p ) as well as a label Ibl , and outputs a simulated proof π <- Ο/'» ^Tst?m x,lbfy. It is assumed that the CRS ψ contains an encoding of p, which is thus available to V. The definition of Quasi-Adaptive Zero-Knowledge requires a single simulator for the entire family of relations R. b) Reminders on Simulation-Soundness and Relative Soundness It is often useful to have a property called simulation-soundness, which requires that the adversary be unable to prove false statements even after having seen simulated proofs for possibly false statements.

Unbounded Simulation-Soundness: For any PPT adversary Λ , it holds that

Pr[ r ^ K₀(l) ; ^ 2)_Γ ; (ψ, τ_είιη) <- S₁(r, p) ; {x, w, Ibl) <- Λ^^τ - r, xp, p) s. t. V(ip, x, π, Ibl) = 1 Λ -i (3w s. t. Jl_p (x, w) = 1) A(x, π, Ibl) g Q] E negl( ) . where the adversary is allowed unbounded access to an oracle S₂ ( p, T_sirn, . , . ) that takes as input statement-label pairs x, Ibl) (where x may be outside L_p) and outputs simulated proofs π <- S₂ (ip, T_sim, x, Ibl), before updating the set Q = Q\J{(x, n, Ibl)} which is initially empty. In the weaker notion of one-time simulation-soundness, only one query to the S₂ oracle is allowed. In some applications (such as password-authenticated key exchange and chosen- ciphertext secure public-key encryption with publicly verifiable ciphertexts), one may settle for a weaker notion, called relative soundness by Jutla and Roy and described in the previous mentioned article entitled: "Relatively-Sound NIZKs and Password-Based Key-Exchange" , which allows for more efficient proofs, especially in the single theorem case. Informally, relatively sound proof systems involve both a public verifier and a private verification algorithm, which has access to a trapdoor. For hard languages, the two verifiers should almost always agree on any adversarially-created proof.

Moreover, the private verifier should not accept a non-trivial proof for a false statement, even if the adversary has already seen proofs for false statements. A labeled single-theorem relatively sound Q.A-NIZK proof system is comprised of a quasi- adaptive labeled proof system (Ko,K_ltP, V) along with an efficient private verifier W and an efficient simulator (S_ltS₂). Moreover, the following properties should hold for any PPT adversaries (Λ₁,Λ₂,Λ₃,,Λ ). Quasi Adaptive Relative Single-Theorem Zero-Knowledge:

Pr[ Γ <- K„(A);p <- Z>_r; ψ <-

P x ,p,x,w,lbl) s.t^₂ -^:) i,s = 1] « Pr[T <- K„(A); p <- D_r;

(ψ,τ) <- SiCr. ) ; (x,w,ZM,s) <- Λ ^^^'^ίΥ,ψ,ρ ; = 1;

π <- 5₂ p, τ, x, ZM) s. t. ,/^ ^·-) _s) = i], Quasi Adaptive Relative Single-Theorem Simulation-Soundness:

S₂ (^,p, τ, x, IbQ s. t. (χ', M, π') <- «^«^-Ό with (χ,π,ΙΜ) ≠ (χ',π',ΙΜ') A3w's.t.¾(i ') = 1 AW(xp,T,x' ,ΙΜ' ,π') = 1] Enegl(X). c) Reminders on Bilinear Maps and Hardness Assumptions For simplicity, symmetric bilinear maps e: G x G→ G_T over groups of prime order p are used, but extensions to the asymmetric setting e: G x G→ G_T are possible if an efficiently computable isomorphism Ψ: G→ G is available. Modulo slight changes, the proposed technique can also work without such an isomoprhism but, in this case, they rely on somewhat less standard cryptographic assumptions. The following definition of the Decision Linear Problem (DLIN) in the group G of order p, also described in the article "Short group signatures" , by D. Boneh et al., published in the conference proceedings of Crypto'04, LNCS 3152, pp.41-55, 2004, can be stated as follows: the Decision Linear Problem (DLIN) is to distinguish between the distributions

R R

{g>g^a>g^b>g^ac>g^bd>g^c+d) and {g,g^a,g^b,g^ac,g^bd,g^z), with a,b,c,d <- TL_V, Z <- TL_V, and g a generator of the group G. The Decision Linear Assumption is the intractability of DLIN for any PPT distinguisher Ί .

The DLIN problem can be viewed as the problem of deciding whether three vectors (g^a> 1G> 9 > G> 9^b> g)> (g^ab> g^cd> g^z) f°^{rm a} subspace of dimension two (which is the case when z = c + d) or three. Sometimes it is used in the present document the notion of Simultaneous Double

Pairing (SDP) assumption, which is weaker than DLIN. As noted in the article "Group Encryption: Non-Interactive Realization in the Standard Model" by J. Cathalo et al., and published in the conference proceedings of Asiacrypt'09, LNCS 5912, pp. 179-196, 2009, any algorithm solving SDP immediately yields a DLIN distinguisher. The following definition of the Simultaneous Double Pairing problem (SDP) in (G, G_R) can be formulated as follows: given group elements (g_z, g_r , h_z, h_u) E G⁴, the SDP problem is to find a non-trivial triple {z, r, u) E G³\{(1_Gj 1_Gj such that e(g_z, z). e(g_r, r) = 1_G and e(h_z, z). e h_u, u) = l_Gr.

The DLIN and the SDP problems can both be generalized to dimensions higher than three.

Indeed, as described in the article "A Cramer-Shoup encryption scheme from the linear assumption and from progressively weaker linear variants" by H. Shacham, published in the Cryptology ePrint Archive: Report 2007/074, 2007, the k -Linear Problem (/ -LIN) in G is the problem of distinguishing the distributions

£>i = {(gi> - > gk> g> gi^ai> - , #/ , g^^{=1 i} ) e G^2k+2 \g_lt ... , g_k, g *- G, ¾, ... , a_k t- z_p} and

£>2 = {(gi> - , gu> g. gi^ai> - , gu^ak. g^z ) &^2k+2

TL_V j.

For each k≥ 2, the k -Linear Problem is known to remain generically hard even in the presence of an oracle that solves the (/c— 1) linear problem. The following assumption which is implied by the k -LIN assumption can be stated: The Simultaneous k -wise Pairing ( k -SDP) problem is, given a random tuple ({di,z'— ' 9k,z_> 9i,r_>— ' 9k,r ) ^es <^^2/£ _> ^t0 find a non-trivial vector (z, r_lt ... , r_k ) E G^k+1 such that e(g_j>z,z).e(g_j>r,rj) = l_Gr with £ {1, ...,k}, and z ≠ 1_G.

Considerer a /c-linar instance (g_lir,—,gk,r>9i,r^ai _>—>9k ,r^a _> V ) ^e G^2k+1 , where the goal is to decide if η = t. For any non-trivial tuple z,r, ...,r_k ) E G^k+1 satisfying the equalities e(gj_iZ ^aj,

= 1_G for each j E {1, ... ,k], the following relationship stands:

Hence, any algorithm solving k -SDP with non-negligible probability immediately implies a k -linear distinguisher. d) Linearly Homomorphic Structure-Preserving Signatures

Linearly homomorphic SPS schemes are homomorphic signatures where messages and signatures live in the domain group G of a bilinear map. The authors of this report recently described in the article "Linearly Homomorphic Structure-Preserving Signatures and their Applicgtions" by B. Libert et al., and published in the conference proceedings of Crypto 2013, the following one-time construction and proved its security under the SDP assumption.

Keygen(A, n): given a security parameter and the dimension n E N of vectors to be

, R

signed, (G,G_T) of prime order p > 2 . Choose g_z,g_r,h_z,h_u <-G. Then, for i = 1 to n, pick Χί,Υί,δι <-Έ_ρ, and compute g_i = g_z ^Xig_r ^Yi and h_t = h_z ^lh_u ¹. The private key sk = (fey SJUi) while the public key is pk =

Sign(sfc, (Afi,

compute and return

SignDerive(p/c, {ο)₍,σ^}.__ι ): given a public key p/c as well as £ pairs (ω_£, σ^), where ω_£ ε Έ_ρ for each i, parse σ*·¹-¹ as σ*·¹-¹ = (z_£jr_{£j £}) £ G³ for i £ {1, ...,- }. Then, compute and return σ = {z,r,u), where z =

Verify(p/c, σ, (Μ_1; ...,M_n)): given a purposed signature σ = {z,r,u) £ G³, and a vector (M_1; ...,M_n), return 1 if and only if (M_1; ...,M_n)≠ (1_G, ...,1c)_/ ^and (z,r, ) satisfy

IG_T = e(^_z,z).e(^_r,r).nf=ie(^,M_i);and l_Gr = e{h_z,z).e h_u,u).\[l₌₁e{h_i,M_i).

One particularity of this scheme is that, even if the private key is available, it is difficult to find two distinct signatures on the same vector if the SDP assumption holds: by dividing out the two signatures, one obtains the solution of an SDP instance (g_z, g_r, h_z, h_u) contained in the public key.

Under the /c-SDP assumption, the one-time linearly homomorphic structure-preserving signature previously described can be extended as follows.

Keygen(A, n): given a security parameter and the dimension n E N of vectors to be

, R signed, (G, G_T) of prime order p > 2 . For j = 1 to k, choose generators g_{j z}, g_{j r} <- G. Then,

R

fori = lton, = 1 to k pick χι,Υα <- Έ_ρ, and compute g_ji = g_jiZ ^Xig_j,r^Yi,i- The private key sk =

Sign( sk,(M_lt ...,M_n) ): to sign a vector ( _1; ...,M_n) E Gⁿ using sk = z,r_lt ...,r_k) E G^k+1, where

with; £ {1, ...,/c}. SignDerive(p/c, {ω_ί(σ^} ): given a public key p/c as well as £ pairs (ω_£, σ^), where ω_£ £ Έ_ρ for each ί, parse as = (z_it r_{i lt} ... , r_{i k}) E G^k+1 for i E {1, ... , £}. Then, compute and return σ = {z,r ,—,r_k), where z =

for j E {1, ...,k}. Verify(p/c, σ, (M_1} ...,M_n)): given σ = (z,r_1} ...,r_k)) E G^k+1, and a vector (M_1; ...,M_n), return 1 if and only if (Μ_1; ... , M_n)≠ ... , and, for each j E {1, ... , k], the following equation holds:

IG_T = ^ε(¾ζ- ^e(_.9j,r>^ri)- Π?=ι e(gj,i,Mi). ej Smooth Projective Hash functions

Introduced by Cramer and Shoup, in the article "Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure PublicKey Encryption" . published in the conference proceedings of Eurocrypt'02, LNCS 2332, pp.45-64, 2002, smooth projective hash functions (SPHF) are primitives where a secret key sk is mapped to a projective hashing key pk = ^λ:). Such a function involves two distinct hashing algorithms (A_sfc(. ),A_pfc(.)) such that, for any element* £ L, the action of A_sk(.) on x is completely determined bγpk = μ sk). In particular, the witness w such that l(x, w) = 1 allows publicly computing A_sk(x) as

A_sk(x) = A_pk(x,w) using the public evaluation algorithm A_pk(. ). However, for any x g L, the action of A_sk(. ) on x is completely undetermined. For anyx g L, given pk = ^λ:), the value A_sfc(x) should be statistically indistinguishable from a random value. The intuition is that, for a given pk = ^λ:), there are many equally likely private keys sk, each of which gives a different private evaluation A_Sk(^x) when x g L.

A simple example of SPHF based on the DLIN assumption works as follows. The private key is of the form sk = (x₀,x₁,x₂ ) E Έ_ρ ³ and the projective key is

where f,g,h E G are public generators. The language L_DLIN is the set of

£DLIN = {(f^r,h^s,g^r+s) E G³\r,s Έ_ρ} of vectors that live in a two-dimensional subspace. Under the DLIN assumption, this language is clearly indistinguishable from random vectors of G³. For any (V_lt V₂, V₃) E L_DLIN, the private evaluation is computed as A_sk(y_lt V₂, V₃) = V₁ ^XlV₂ ^X2V₃ ^x° . This private evaluation is publicly computable by anyone who knows the witness w = (r, s) E Έ_ρ ² such (f^r, h^s, g^r+s) E G³. Indeed, it equals Λ^, Ι^) = Α₃Μ,ν₂, ν₃, (r, s)) = Y^Y ^S .

In contrast, if (V₁, V₂, V₃ £ £>DLIN _> ^tne private evaluation Λ^Ι^, V₂, V₃) = V^ ^W ⁰ is completely undetermined from pk = μθ/c) = (Y₁, Y₂ ) = (f^Xlg^x°, h^X2g^x°) , because pk leaks no information about x. The latter SPHF readily extends to the language of k - linear tuples.

As in the Cramer-Shoup cryptosystem, described in the article "A practical public key cryptosystem provably secure against adaptive chosen ciphertext attack", published in the conference proceedings of Crypto'98, LNCS 1462, pp. 13-25, 1998, 2-universal SPHFs are used in the following: given pk = ^λ:) , for any distinct χ, χ' g £ the joint distribution of {A_sk(x), A_sk (x')} is statistically indistinguishable from a pair of random values in the range of A_Sk (^x)- This is typically achieved by combining an ordinary SPHF with a collision-resistant hash function. f) After having given some reminders that are going to ease the understanding of embodiments of the invention, gnd before describing the Figures, the genergl concept of the invention can be described gs follows:

In the previous mentioned article "Relgtively-Sound NIZKs gnd Pgssword-Bgsed Key- Exchgnge", Jutla and Roy described a single-theorem relatively sound NIZK proof system that combines the Groth-Sahai proofs and the smooth projective hash functions of Cramer and Shoup. Smooth projective hash functions can be seen as designated verifier non-interactive zero-knowledge proofs: while they are only convincing to a specific verifier (as the verification algorithm requires the knowledge of the private verification trapdoor), they do provide a form of onetime simulation-soundness. In contrast, the Groth-Sahai (GS) proofs are publicly verifiable but they are malleable and do not provide relative soundness. However, Jutla and Roy showed that GS proofs become relatively sound if they are suitably combined with a smooth- projective hash function. The relatively sound proofs can thus be seen as a clever combination of malleable publicly verifiable proofs and privately verifiable non-malleable proofs. The proposed technique relies on the idea of modifying the Jutla-Roy relatively sound proofs described in the previous mentioned articles "Relatively-Sound NIZKs and Password-Based Key- Exchange" and "Shorter Quasi-Adaptive NIZK Proofs for Linear Subspaces" , by modifying their underlying malleable components and replacing them by one-time linearly homomorphic signatures. However, combining one-time linearly homomorphic signatures and smooth projective hash functions is non-trivial, as explained in the present document. The present technique is built on the homomorphic signature as the ones depicted in the section "d) Linearly Homomorphic Structure-Preserving Signgtures" in the present document. Specifically, the language-dependent CRS contains one-time linearly homomorphic signatures on the rows of the matrix p E G^txn. For each vector v E L_p, the prover can use the witness x E TL^ to derive a one-time homomorphic signature {z, r, u) on v. I n order to obtain the sought-after relative simulation-soundness property, the difficulty is that it is necessary to combine two seemingly conflicting requirements: first, the prover should be able to publicly derive a homomorphic signature {z, r, u) on v from signatures that are available in the CRS; second, one should prevent unwanted manipulations in the derived signature. In particular, for a given honestly generated proof of some statement v = g^{x A}, no one should be able to derive a proof for a related statement (ρ', ν') or a new proof for the same statement.

To achieve this, properties of a 2-universal SPHF should be used : each proof of membership (z, r, u, n_Q) E G⁴ consists of a derived linearly homomorphic signature {z, r, u) on some vector that depends on v and a non-malleable part π₀ consisting of a SPHF public evaluation which is calculated as a function of the language p and the statement !?. More precisely, the SPHF evaluation π₀ calculated as a function of a hash value = H(p, v) E Έ_ρ of the pair (p, v) where H: {0,1}*→ Έ_ρ is an ordinary collision-resistant hash function. The relative soundness property is guaranteed by the properties of the underlying SPHF as it implies that, even if the adversary is allowed to see exactly one simulated proof for a false statement, it will be unable to prove a false statement by itself. Indeed, the 2-universal property of the underlying SPHF guarantees that, for any two distinct vectors v, v' E Gⁿ outside the linear span of g^A E G^txn , the private evaluation algorithm A_sk (. ) yields pairwise independent private evaluations: given pk = ^λ:), the joint distribution {A_sk (v), A_sk (v')} is statistically indistinguishable from random. Hence, even if the adversary is given A_sk(v) as part of a simulated proof of membership for i;, it is unable to predict the proof π₀' = A_sk (v') that would make the private verifier accept π₀' in a proof of membership for i?'. Since the private verifier and the public verifier almost always agree if the DLIN assumption holds, the proof system is guaranteed to be as sound to the public verifier as it is to the private one. Finally, in order to prevent anyone from turning a proof for some statement (p, v) into a different proof of the same statement, the following property also described, in the section "d) Linearly Homomorphic Structure-Preserving Signatures" in the present document, that two distinct signatures on the same vector immediately give a solution to the SDP problem, is used.

By having the prover carefully embed a = H(p, v) E Έ_ρ in the vector for which it computes a derived signature, it can be made sure that:

(i) The correctness of the public SPHF evaluation π₀ becomes publicly verifiable;

(ii) The adversary cannot falsely prove the membership of a vector outside the row space of g^A E G^txn even after having seen one such simulated proof; (iii) The adversary will be unable to maul an observed proof in order to obtain a proof for some related statement.

Figures l(a)-(d) present a relatively sound QA-NIZK proof system according to one embodiment of the invention.

In the following, vectors are always considered as row vectors unless stated otherwise. If .4 £ Zp^Xnis a matrix, ^ E G^txndenotes the matrix obtained by exponentiating g using the entries of A. We consider public parameters Γ = (G, G_T, g) consisting of bilinear groups (G, G_T) with a generator g E G. Like in the article "Shorter Quasi-Adaptive NIZK Proofs for Linear Subspaces" , we consider languages

L_p = {g*^A E I x £ ¾ } that are parameterized by p = g^A E G^txn, where A E Zp^xnis a t x n matrix such that t < n.

As in the article "Shorter Quasi-Adaptive NIZK Proofs for Linear Subspaces" , it is assumed that the distribution T>_r is efficiently samplable: namely, there exists a PPT algorithm which outputs a pair (p, A) describing a relation ^ and its associated language L_p according to the

R

distribution T)_v. One such distribution is obtained by picking a uniform matrix .4 <- Zp and computing = g^A E G^txn.

Under the DLIN assumption, it can be constructed a relatively sound Q.A-NIZK proof system where each proof only requires 4 group elements. Under the k -linear assumption, the proof length amounts to 0 (/c) elements for a CRS of size 0(/cn).

As in the article "Relatively-Sound NIZKs and Password-Based Key-Exchange" , relative soundness (using smooth projective hash functions) is achieved. To this end, it is needed to encode the matrix p = g^A E G^txn as a It x (2n + 1).

The initialization method (see Figure 1(a)) aims at obtaining from a security parameter l, some parameters that are used in the other methods described in Figures 1(b) -

(e).

More precisely, in a step, referenced 101, an electronic device obtain a symmetric bilinear groups (G, G_T) of prime order p > 2^λ with g a randomly chosen element in the group G. Then, it is outputted the set of parameters Γ = (G, G_T, g).

Again, the dimensions A E Ζ_ρ ^χη can be either fixed or part of £_p so that t, n can be given as input to the CRS generation method described in Figure 1(b).

The CRS generation method (see Figure 1(b)), executed or implemented by an electronic device, takes as input the set of parameters Γ as well as a parameter = (G_i;)_{1≤i≤t 1≤;≤n} E G^txn.

In a step referenced 102, the electronic device obtains/chooses randomly two n-vectors d and e defined as follows: d = (d_lt ... , d_n) E ¾, and e = (e_lt ... , e_n) E ¾, in order to define the elements W = (W_lt...,W_t) = g^AAT £ G^f and Ϋ = (Y_lt...,Y_t) = g^A§T £ G^f . These elements are used later to define a projective hash function.

Then, in a step referenced 103, the electronic device generates a key pair (pk_ots,sk_ots) for the one-time linearly homomophic signature, depicted in the section "d) Linearly Homomorphic Structure-Preserving Signatures" in the present document, in order to sign vectors in G²ⁿ⁺¹. Let pk_ots = (G,G_T),g_z,g_r,h_z,h_u,{g_i,h_i} ^¹) be the public key and let sk_ots = (_{Xi,Yi,

be the corresponding private key. For simplicity, the generation of (pk_ots,sk_ots) can re-use the generator g produced in output of step 101.

Then, in a step referenced 104, the electronic device uses the secret key sk_ots in order to generate one-time linearly homomorphic signatures {(z^r^ ιΐ;)}²^ on the following independent vectors, which are obtained from the rows of the matrix p = (G_i;)_{1≤i≤t 1≤;≤n}:

Hi = (G , ... , G _n, Y_i} 1, ... ,1) £ G²ⁿ⁺¹ with i £ {1, ... , t}

Ft = (1, ... X W G_i , ... , G _n) £ G²ⁿ⁺¹ with i £ {1, ... , t}.

Then, in a step referenced 105, the electronic device obtains a collision-resistant hash function H: {0,1}*→ Έ_ρ to be used.

Then, in a step referenced 106, the electronic device determines the CRS i/> which comprises a first part CRSi that is only used by the prover and a second part CRS₂whch is only used by the verifier. These are defined as

CRS₁ = (p,pk_ots,W,Y, {^, ,η^^,Η),

CRS₂ = (pk_ots,W,Y,H).

The simulation trapdoor T_sim is sk_ots = {{χι,Υί, ^J²^¹) and the private verification trapdoor is τ_ν = [d, e .

The proof generator method (see Figure 1(c)), executed or implemented by an electronic device, takes as input a candidate vector v being equal to ( _lt ... , v_n) £ Gⁿ, a witness x being equal to (x_lt ...,x_t) £ Έρ such that v = g^xA , a label Ibl and elements Γ and ψ previously defined.

In a step referenced 107, the electronic device determines the value of a = H(p,v,lbl) £ Z_p. Then, in a step referenced 108, the electronic device, using the linearly homomorphic signatures {(z_i; r^ ii;)}²^ comprised in the CRS, derives a one-time linearly homomorphic signature {z, r, u) on the vector v = ( _lt ... , v_n, n_Q, v ^a, ... , v_n ^a) E G²ⁿ⁺¹ , where π₀ =

Then, the electronic device outputs the proof π which is equal to (z, r, u, π₀) E G⁴.

Hence, the generator method system delivers a relatively sound QA-NIZK proof that only requires 0(1) group elements. The size of the proof does not depend on the dimension of the considered subspace.

The public verification method (see Figure 1(d)) executed or implemented by an electronic device, takes as input a vector v being equal to ( _lt ... , v_n) E Gⁿ, a proof π , the CRS ψ previously defined, the witness x being equal to (x_1; ... , x_t) E Έ_ρ such that v = g^{x A} , a label Ibl and element Γ = (G, <&_T, g).

In a step, referenced 109, the electronic device verifies that the format of the received/obtained parameters is compliant with the expected one (i.e. each coordinate of the vector v must belong to the group G, the proof should have the following format (z, r, u, π₀) E G⁴, etc.).

Then, in a step, referenced 110, the electronic device determines the following value: a = H(p, v, lbl) E Έ_ρ, and, it determines the vector v = ( _lt ... , v_n, n_Q, v ^a , ... , v_n ^a) E G²ⁿ⁺¹.

Then, in a step, referenced 111, the electronic device determines if the elements

{z, r, u) comprised in said received/obtained proof π corresponds to a valid one time linearly homomorphic signature on the vector v = ( _lt ... , v_n, π₀, v ^a, ... , v_n ^a) E G²ⁿ⁺¹ .

The electronic device outputs an information (such as a value equal to 1) if the one time linearly homomorphic signature is valid. In the step 111, the electronic device verifies if the following equations stand (where

^are obtained from the public key pk_ots generated in step 103 and comprised in the CRS ψ)

1<G_T = e{g_z, z). e{g_r, r) e{g_t. gf_+n+1, Vi ). e(g_n+1, n₀); 1<G_T = e{h_z, z). e{h_u, u) .Π?=ι ^β(¾_ΐ. /ι"_+η+1, ν_ΐ ). e(/i_n+1, 7r₀).

If the verification fails, the electronic device outputs a value equal to 0.

The private verification method (see Figure 1(e)) executed or implemented by an electronic device, takes as a vector v being equal to ( _lt ... , v_n) E Gⁿ, a proof π , a label Ibl and elements Γ and ψ previously defined, and the element τ_ν which corresponds to the verification trapdoor comprising the vectors d and e : d = (d_lt ... , d_n) E Έρ, and e = (e_lt ... , e_n) E Έρ .

In a step, referenced 112, the electronic device determines that the format of the parameters provided as input fulfill the expected rule.

Then, in a step, referenced 113, the electronic device determines the value of a = H(p, v, lbl) E TL_V.

In a step referenced 114, the electronic device checks if the following equations stand (where

^are obtained from the public key pk_ots generated in step 103):

1<G_T = e(g_z, z). e(g_r,

e(g_i. gi_+n+1, v_i ). e(g_n+1, n₀); l_Gr = e(h_z, z). e(h_u, u) W^ e ii. h +^ Vt ). e(h_n+1, n₀).

If the check fails (i.e. at least one of the equation is not verified), the electronic device delivers an output value equals to zero.

Then, in a step referenced 115, the electronic device determines if π₀ =

Π;=ι v. ¹ .The electronic device delivers an output value equals to zero if the equation is not verified. Otherwise, it delivers an output value equals to one.

The proposed relatively sound QA-NIZK proof system readily extends to rest on the k - SDP assumption with /c > 2 . The only required modification is to replace the linearly homomorphic signature based on the SDP assumption by the second linearly homomorphic signature described in the section "d) Linearly Homomorphic Structure-Preserving Signatures" in the present document. In each proof, the {z, r, u) part is thus replaced by a signature of the form (z, r_lt ... , r_k) while the smooth projective hash value remains unchanged. In this case, the proof requires k + 2 group elements whereas combining the techniques of the articles "Relatively-Sound NIZKs and Password-Based Key-Exchange" and "Shorter Quasi-Adaptive NIZK Proofs for Linear Subspaces" requires k(n + 1— t) elements per proof. From a security standpoint, the following result can be proven: the proposed proof system is a relatively sound Q.A-NIZK proof system if the SDP assumption holds in (G, G_T) and if H is a collision-resistant hash function.

Figures 2(a)-(f) present a non-interactive threshold cryptosystem according to one embodiment of the invention.

Indeed, as detailed in the present section, it can be constructed an adaptively secure CCA2-secure non-interactive threshold cryptosystem based on the DLIN assumption. Adaptively secure threshold cryptosystems with chosen-ciphertext security (in the sense of article "Non-

C. Rackoff, D. Simon, and published in the conference proceedings of Crypto'91, LNCS 576, pp. 433-444, 1991) were previously proposed in the article "Adgptively Secure Threshold Cryptogrgphy: Introducing Concurrency, Removing Erasures" by S. Jarecki, A. Lysyanskaya, in the conference proceedings of Eurocrypt'OO, LNCS 1807, pp. 221-242, 2000, and in the article "Adgptively Secure Feldmgn VSS gnd Applicgtions to Universglly-Composgble Threshold Cryptogrgphy" by M. Abe, S. Fehr, published in the conference proceedings of Crypto'04, LNCS 3152, pp. 317- 334, 2004, but they require some interaction during the decryption process. Non-interactive solutions were put forth in the three following articles: "Threshold Public-Key Encryption with

B. Qjn et al., published in the conference proceedings of ICICS'10, LNCS 6476, pp. 62-76, 2010, "Adgptively Secure Non-Interactive Threshold Cryptosystems" by B. Libert and M. Yung, published in the conference proceedings of ICALP 2011, LNCS 6756, pp. 588-600, 2011, and "Non-Interactive CCA2-Secure Threshold Cryptosystems with Adaptive Security: New Framework and Constructions" \i by B. Libert and M. Yung, published in the conference proceedings TCC 2012, LNCS 7194, pp. 75-93, Springer, 2012.

But, as detailed in the following, they are less efficient than the proposed technique. Under the /c-linear assumption, if compared to previous constructions based on the same assumption, the proposed technique (related to Figures 2(a)-(f)) shortens ciphertexts by O (/c) group elements. This result is important as non-interactive threshold schemes can potentially serve as building blocks for protocols in the multi-linear setting (see the article "Candidate Multilinear Maps from Ideal Lattices" b S. Garg et al., published in the conference proceedings of Eurocrypt 2013, LNCS series, pp. 1-17, 2013, and the article "Practical Multilinear Maps over the Integers" by J.-S. Coron et al., published in the conference proceedings of Crypto 2013). Indeed, the (/c— l)-linear problem is easy in groups equipped with a k -linear map (as shown in the article "An Algebraic Framework for Diffie-Hellman Assumptions" \i A. Escala et al., published in the conference proceedings of Crypto 2013, LNCS 8043, pp. 129-147, 2013) but instantiations where the k -linear assumption holds (as seems to be the case in the previous mentioned article "Pmcticgl Multilinegr Mgps over the Integers") can be used.

The proposed threshold scheme is fully non-interactive: namely, decryption servers never have to talk to each other during the decryption process and they only send one message to a dedicated entity, called combiner, that gather the decryption shares in order to recover the plaintext.

The key generation method (see Figure 2(a)) executed or implemented by an electronic device, takes a security parameter λ, a number t, and a number N enabling to define a (t, N)- threshold encryption scheme (where t parties (or electronic devices) are required to perform the deciphering).

In a step referenced 201, the electronic device obtains a bilinear group (G, G_r) of prime order p > 2^λ.

In a step referenced 202, the electronic device obtains three elements (randomly

R

generated) that belong to the group G: g, f, h <- G.

In a step referenced 203, the electronic device obtains nine random elements in Έ_ρ :

R R R

Q, \, X₂ <- TL_V , Ύθ' Ύΐ' Ύ2 *~ ¾ ^{a r,}d ^wo_> w_lt w₂ <- Έ_ρ . Then, it determines the six following elements: X_i =

_{# Wi =} fw_{l gWo a nd} W₂ = h^W2g^w° .

In a step referenced 204, the electronic device obtains Groth-Sahai CRS (f_lt f₂ , f₃), to be used for providing the validity of decryption shares. More precisely, the electronic device R

obtains two elements chosen randomly in the group G:f_x,f <- G, as well as two elements chosen randomly in Έ_ρ: φ₁, φ₂ <- Z_p. Then the Groth-Sahai CRS ( j, /₂ , f₃) are determined as follows:

In a step referenced 205, the electronic device obtains three random polynomials

P₀[Z],P₁[Z],P₂[Z] E Z_p[Z]of degree t - 1, such that P„(0) = x₀, ^ι(Ο) = *i and P₂(0) = x₂- Then, the following elements are determined: X_tl =

fori = ltoN.

In a step referenced 206, the electronic device obtains a collision-resistant hash function H: {0,1}^*→ Έ_ρ.

In a step referenced 207, the electronic device generates/obtains a key pair for the one time linearly homomorphic signature depicted in the section "d) Linearly Homomorphic Structure-Preserving Signatures" in the present document, with n = 7. The public key is equal to (g_z, g_r,h_z,h_u,{g_i,h_i}⁷ _i=1) and the corresponding private key is {χι,Ύι, 5J⁷ ₌₁.

In a step referenced 208, the electronic device generates/determines/obtains one-time linearly homomorphic signatures [Zj, Rj, Uj ^ on the following linearly independent vectors: hi = (f, 1, g, Y_1} 1, 1, 1) E G⁷X₂ = (1, h, g, Y₂, 1, 1, 1) £ G⁷,

hi= (1,1,1, Wi,/, l,g E G⁷ = (1,1, 1, W₂,l, h, g) E G⁷.

In a step referenced 209, the electronic device determines the vector of private key shares as being SK = SK_lt ...,SK_N) with SK_t = {P₀{i),P₁{i),P₂{i)) e 1_p ³ for each i E {1, ...,N}.The corresponding vector VK = VK_lt ...,VK_N) of verification keys is defined in such way that VKi = (Χι^,Χι^) E G², for each i E {1, ...,N}. The public key is defined to be:

PK = {g> 7i> T2, h, Xi, X₂, Yi, Y₂, W_lt W₂, g_z, g_r, h_z, h_u, {g /j⁷ ₌₁, {Z_jt R_jt Uj _j=i> H) .

The encryption method (see Figure 2(b)) executed or implemented by an electronic device, takes as input a message M E Gand a public key being defined as follows: PK =

{g> 7i> T2, h> Xi> X₂> ^Yi> ^Y2, Wi, W₂, g_z, g_r, h_z, h_u, {g_b /ij⁷ ₌₁, {Zj, Rj, Uj† , H). Then, in a step referenced 210, the electronic device obtains two random elements in

R

Έ_ρ: θ_χ, θ₂ <- Zp. It determines the following elements:

C₀ = M.X^.X^, C = f⁹ C₂ = h^e C₃ = g⁹^ and

C₄ = (W^Y^ (W₂ ^aY₂)⁹^, where a = H(C₀, C_lt C₂, C₃) £ Z_p.

Then, in a step referenced 211, the electronic device determine a linearly homomorphic signature (Z,R,U) on the vector C₁,C₂,C₃,C₄,C₁ ^a,C₂ ^a,C₃ ^a) E G⁷. More precisely, it determines such signature as follows:

z— Δ₁ .z₂ z₃ z₄ ;

p _ η^θι η^θ2 η^θι-^α η^θ2-α. υ = υ υ₂ ²υ ^ιαυ ^2α.

Then, the electronic device delivers the ciphertext C = (C₀, C_lt C₂, C₃, C , Z, R, U) E G⁸.

The ciphertext verify method (see Figure 2(c)) executed or implemented by an electronic device, takes in input a public key PK and a ciphertext C.

The electronic device checks, in a step referenced 212, if the ciphertext comprises eight elements of G (i.e. the ciphertext C can be represented by (C₀, C_lt C₂, C₃, C ,Z,R, U) EG⁸).

The electronic device determines the value of a = H(C_Q, C_lt C₂, C₃) E Έ_ρ.

The electronic device outputs a value equal to 1 if and only if the following equations are verified:

1<G_T = e(g_z,Z).e(g_r,R) .i\₌₁ e(g_t.gf₊ , C_t ). e(g₄, C₄); l_Gr = e(h_z,Z).e(h_u,U) .nLi

Q).

Hence, (Z, R, U) must be a valid linearly homomorphic signature on the vector

(C_lt C₂, C₃, C , C^, C₂ ^a , C₃ ^a) E G⁷. Otherwise, the electronic device outputs a value equal to zero.

The share decrypt method (see Figure 2(d)) executed or implemented by an electronic device, takes as input a public key PK, a value i, a secret key S/Q and a ciphertext C. The secret key must be represented as follows: S/Q =

^e ¾³· In a step, referenced 214, the electronic device executes the method described in Figure 2(c). In the case that the result is equal to zero, then, the electronic device outputs the value i and an information, noted 1, indicating that the ciphertext is malformed. Otherwise, the electronic device executes the step referenced 215 which comprises the step of determining fit = ( _i,Cp_i,Cp₂,Cp₀, _v.), which consists of a partial decryption v_t =

commitments C_PQ, C_PI, C_?2 respectively to Ρ₀(ί),Ρ₁(ί),Ρ₂(0' ^anc' ^a proof π_ν. that the following equations are satisfied:

_Vi = Cf^l(0. C₂ ^¾( . °^ω, X ₁ = fWlgW) and X_i>2 = h^p \g^p^\

The commitments C_PI,C_P2, C_PQ and the proof π_ν. are generated using the CRS

The share verify method (see Figure 2(e)) executed or implemented by an electronic device, takes as input a public key PK, a verification key VK_it a ciphertext C and the following value (i, fli) (corresponding to the output of the share decrypt method).

In a step referenced 216, the electronic device parses the ciphertext C as (C₀, C_lt C₂, C₃, C ,Z, R, U) E G⁸, and VKi as (Χι^,Χι^) ε <£>²· If the _έ is equal to 1, or if _έ can not be parsed properly as ( _i,C_Pi,Cp₂,C_Po,n_Vi), then it outputs a value equal to 0. Otherwise it outputs a value equal to 1 if π_ν. is a valid proof. In other situation, it outputs a value equal to 0.

The combine method (see Figure 2(f)) executed or implemented by an electronic device takes as input PK, VK, C, { i, fii )}_{έ eS}.

In a step referenced 217, for each i E S, the electronic device parses the corresponding decryption share _έ as (y_i,C_Pl,Cp₂,Cp₀,n_v ^'), and return 1, if the share verify method described in Figure 2(e) outputs a value equal to zero. Otherwise, the electronic device determines ^{v =} Π_ί ES ^Ν£^ΔΊ,5(·⁰'⁾) which equalsv = C^.C^.C^⁰ = X^.X^and in turn reveals the plaintext M = C₀/v.

The threshold encryption scheme of Figures 2(a)-(f) can be proved chosen-ciphertext secure under adaptive corruptions if the DLIN assumption holds. Moreover, the security reduction is tight as, up to negligible terms, the adversary's advantage is bounded by a constant multiplied by the maximal probability of breaking the underlying assumptions. The following theorem can be set up: the above threshold cryptosystem is IND-CCA secure against adaptive corruptions assuming that: (i) H is collision-resistant; (ii) The DLIN assumption holds in G. More precisely, the advantage of any PPT adversary /Zis at most

Αάν{Λ)≤ Adv^CR-^hash{X) + 3. Adv^DLIN (X) +

where the first term of the right-hand-side member accounts for the maximal advantage of any PPT collision-finding algorithm for H.

If each element has a 256-bit representation on BN curves (as in the article "Pairing- Friendly Elliptic Curves of Prime Order" by P. Barreto, M. Naehrig, published in the conference proceedings of SAC'05, LNCS 3897, pp. 319-331, 2005) at the 128-bit security level, the ciphertext overhead amounts to 1792 bits. The DLIN-based scheme described in the previous mentioned article "Non-Interactive CCA2-Secure Threshold Cryptosystems with Adaptive Security: New Framework and Constructions" has a ciphertext overhead comprised of 14 group elements and a one-time signature with its verification key (or 4864 bits using Groth's one-time signature; see the article "Simulation-sound NIZK proofs for a practical language and constant size group signgtures" by J. Groth, published in the conference proceedings of Asiacrypt 2006, LNCS 4284, pp. 444-459, 2006). The recent results of Escala et al. (in the previous mentioned article "An Algebmic Fmmework for Diffie-Hellmgn Assumptions" allow reducing this overhead to 3328 bits. The very recent techniques of Jutla and Roy (in the previous mentioned article "Shorter Qugsi-Adgptive NIZK Proofs for Linegr Subspgces") - which also work in the threshold setting although it was not explicitly stated in the previous mentioned article "Shorter Qugsi- Adgptive NIZK Proofs for Linegr Subspgces"- lead to ciphertexts comprised of 9 group elements under the DLIN assumption and 3k + 3 under the /c-linear assumption. Under DLIN, ciphertexts are further compressed by 11% while relying on the same assumption and retaining tight security. Under the /c-linear assumption, the improvement provided by the present technique becomes more important as the ciphertext reduces to 2k + 4 group elements. Specifically, it is needed k + 1 elements for the second homomorophic signature described in the section "d) Linegrly Homomorphic Structure-Preserving Signgtures" in the present document, another (/c + 1) elements to contain the /c-linear instance, one element for the Cramer-Shoup-like proof π₀ and one element to carry the plaintext. This allows saving 0 (/c) group elements with respect to the techniques described in the previous mentioned article "Relatively-Sound NIZKs and Password-Based Key-Exchange" , which require 3k + 3 group elements per ciphertext. In addition to this, the present technique may find applications in other protocols where decryption capabilities should be shared among several parties. Examples include auction protocols and privacy-preserving targeted advertising protocols (see the article "Targeted Advertising . . . And Privacy Too" by A. Juels, published in the conference proceedings of CT- RSA'01, LNCS 2020, pp. 408-424, 2001, for example). Figure 3 presents an example of a device that can be used to perform one or several steps of methods disclosed in the present document.

Such device referenced 300 comprises a computing unit (for example a CPU, for "Central Processing Unit"), referenced 301, and one or more memory units (for example a RAM (for "Random Access Memory") block in which intermediate results can be stored temporarily during the execution of instructions a computer program, or a ROM block in which, among other things, computer programs are stored, or an EEPROM ("Electrically-Erasable Programmable Read-Only Memory") block, or a flash block) referenced 302. Computer programs comprise instructions that can be executed by the computing unit. Such device 300 can also comprise a dedicated unit, referenced 303, constituting an input-output interface to allow the device 300 to communicate with other devices. In particular, this dedicated unit 303 can be connected with an antenna (in order to perform communication without contacts), or with serial ports (to carry communications by the use of physical contacts). It should be noted that the arrows in Figure 3 signify that the linked unit can exchange data through buses for example together. In an alternative embodiment, some or all of the steps of the method previously described, can be implemented in hardware in a programmable FPGA ("Field Programmable Gate Array") component or ASIC ("Application-Specific Integrated Circuit") component. In another embodiment of the invention, the previously mentioned means correspond to a dedicated circuit (such as a FPGA component or an ASIC component).

In an alternative embodiment, some or all of the steps of the method previously described, can be executed on an electronic device comprising memory units and processing units as the one disclosed in the Figure 3.

Claims

Claims

1. Method for generating a quasi-adaptive non-interactive zero-knowledge proof, said proof assessing a membership of a first vector to a hard language, which is a subspace of Gⁿ, where G is a group and n is an integer, said method being executed by an electronic device, and being characterized in that it comprises:

generating a derived linearly homomorphic signature on a second vector, said second vector being defined as a function of said first vector, a linearly homomorphic signatures comprised in a common reference string and a witness associated with said first vector; and

generating a non-malleable element by using a public evaluation function of a smooth projective hash function, in combination with a hash function, said first vector, said witness and elements comprised in said common reference string, said proof being a combination of said derived linearly homomorphic signature and said non-malleable element.

2. Method for generating according to claim 1, characterized in that said hard language corresponds to a set which is equal to E Gⁿ \ x E Έ_ρ s. t. v^* = g^xA], where p is a prime number, t is an integer, g is a generator of said group G, and A is a t x n matrix of rank t whose elements are comprised in Έ_ρ .

3. Method for generating according to claim 2, characterized in that said witness x belongs to Έ_ρ, and is associated with said first vector ^~v by a relationship

4. Method for generating according to any claims 2 to 3, characterized in that said linearly homomorphic signatures comprised in a common reference string comprise 2t elements, each element being defined by a vector (z, r_lt ... , r_k) , where k is a integer greater or equal to two, corresponding to a linearly homomorphic signature on independent vectors, which are obtained from rows of a matrix g^A.

Method for generating according to any claims 1 to 4, characterized in that generating a derived linearly homomorphic signature, and generating a non- malleable element further use a label.

Method for ciphering in an non-interactive and adaptively secure threshold cryptosystems with chosen-ciphertext security, said method being executed by an electronic device, and being characterized in that it comprises executing a method for generating a quasi-adaptive non-interactive zero knowledge proof according to claims 1 to 5.

A computer-readable and non-transient storage medium storing a computer program comprising a set of computer-executable instructions to implement a method for cryptographic computations when the instructions are executed by a computer, wherein the instructions comprise instructions, which when executed, configure the computer to perform a method for generating a quasi-adaptive non- interactive zero-knowledge proof of claims 1 to 5, and/or to perform a method ciphering in an non-interactive and adaptively secure threshold cryptosystems with chosen-ciphertext security of claim 6.

Electronic device comprising a module configured to generate a quasi-adaptive non- interactive zero-knowledge proof, said proof assessing a membership of a first vector to a hard language, which is a subspace of Gⁿ, where G is a group and n is an integer, said electronic device being characterized in that it comprises:

a module configured to generate a derived linearly homomorphic signature on a second vector, said second vector being defined as a function of said first vector, a linearly homomorphic signatures comprised in a common reference string and a witness associated with said first vector; and a module configured to generate a non-malleable element by using a public evaluation function of a smooth projective hash function, in combination with a hash function, said first vector, said witness and elements comprised in said common reference string, said proof being a combination of said derived linearly homomorphic signature and said non-malleable element.

9. Electronic device according to claim 8, characterized in that said hard language corresponds to a set which is equal to E Gⁿ\ x Ε _ρ s. t. v^* = g^{x A}], where p is a prime number, t is an integer, g is a generator of said group G, and A is a t x n matrix of rank t whose elements are comprised in Έ_ρ.

10. Electronic device according to claim 9, characterized in that said witness x belongs to Έρ, and is associated with said first vector ^~v by a relationship ^~v = g^xA.

11. Electronic device according to any claims 8 to 9, characterized in that said linearly homomorphic signatures comprised in a common reference string comprise 2t elements, each element being defined by a vector (z, r_lt ... , r_k) , where k is a integer greater or equal to two, corresponding to a linearly homomorphic signature on independent vectors, which are obtained from rows of a matrix g^A.

12. Electronic device according to any claims 8 to 11, characterized in that the module configured to generate a derived linearly homomorphic signature, and the module configured to generate a non-malleable element further use a label.

13. Electronic device comprising a module configured to cipher in an non-interactive and adaptively secure threshold cryptosystems with chosen-ciphertext security, said electronic device being characterized in that it comprises a module configured to generate a quasi-adaptive non-interactive zero-knowledge proof, said proof assessing a membership of a first vector to a hard language, which is a subspace of Gⁿ, where G is a group and n is an integer, that comprises:

a module configured to generate a derived linearly homomorphic signature on a second vector, said second vector being defined as a function of said first vector, a linearly homomorphic signatures comprised in a common reference string and a witness associated with said first vector; and

a module configured to generate a non-malleable element by using a public evaluation function of a smooth projective hash function, in combination with a hash function, said first vector, said witness and elements comprised in said common reference string, said proof being a combination of said derived linearly homomorphic signature and said non-malleable element.