Zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) is a kind of proof system that enables a prover to convince a verifier that an NP statement is true efficiently. Our research focuses on designated-verifier zk-SNARKs, where only the indicated verifier knowing some secret verification state can be convinced by the proof. A natural idea of getting a designated-verifier zk-SNARK is applying public-key encryption to proofs. This is also the core idea behind the well-known transformation proposed by Bitansky et al. in TCC 2013. However, the applicable zk-SNARKs are limited and the loss of the secret verification state also makes the proof immediately lose the designated-verifier property. To address these issues, we first define “strong designated-verifier” considering the case where the adversary has access to the secret verification state, then propose a construction of strong designated-verifier zk-SNARKs inspired by designated verifier signatures based on two-party ring signatures under the circuit satisfiability problem, which do not use encryption and can be applied on any public-verifiable zk-SNARKs to yield a designated-verifiable variant. The construction can be implemented in constraint-based languages like Circom for building arithmetic circuits and to be deployed in action.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Strong Designated-Verifier zk-SNARKs

  • Chen Li,
  • Fangguo Zhang

摘要

Zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) is a kind of proof system that enables a prover to convince a verifier that an NP statement is true efficiently. Our research focuses on designated-verifier zk-SNARKs, where only the indicated verifier knowing some secret verification state can be convinced by the proof. A natural idea of getting a designated-verifier zk-SNARK is applying public-key encryption to proofs. This is also the core idea behind the well-known transformation proposed by Bitansky et al. in TCC 2013. However, the applicable zk-SNARKs are limited and the loss of the secret verification state also makes the proof immediately lose the designated-verifier property. To address these issues, we first define “strong designated-verifier” considering the case where the adversary has access to the secret verification state, then propose a construction of strong designated-verifier zk-SNARKs inspired by designated verifier signatures based on two-party ring signatures under the circuit satisfiability problem, which do not use encryption and can be applied on any public-verifiable zk-SNARKs to yield a designated-verifiable variant. The construction can be implemented in constraint-based languages like Circom for building arithmetic circuits and to be deployed in action.