@inproceedings {43117,
	title = {Another Look at Extraction and~Randomization of Groth{\textquoteright}s zk-SNARK},
	journal = {FC 2021},
	volume = {12674},
	year = {2021},
	pages = {457 - 475},
	publisher = {Springer Berlin Heidelberg},
	address = {Berlin, Heidelberg},
	abstract = {Due to the simplicity and performance of zk-SNARKs they are widely used in real-world cryptographic protocols, including blockchain and smart contract systems. Simulation Extractability (SE) is a necessary security property for a NIZK argument to achieve Universal Composability (UC), a common requirement for such protocols. Most of the works that investigate SE focus on its strong variant which implies proof non-malleability. In this work we investigate a relaxed weaker notion, that\&nbsp;allows proof randomization, while guaranteeing statement non-malleability, which we argue to be a more natural security property. First, we show that it is already achievable by\&nbsp;Groth16, arguably the most efficient and widely deployed SNARK nowadays. Second, we show that because of this,\&nbsp;Groth16\&nbsp;can be\&nbsp;efficiently\&nbsp;transformed into a black-box weakly SE NIZK, which is sufficient for UC protocols.To support the second claim, we present and compare two practical constructions, both of which strike different performance tradeoffs:Int-Groth16\&nbsp;makes use of a known transformation that encrypts the witness inside the SNARK circuit. We instantiate this transformation with an efficient SNARK-friendly encryption scheme.Ext-Groth16\&nbsp;is based on the SAVER encryption scheme (Lee et al.) that plugs the encrypted witness directly into the verification equation, externally to the circuit. We prove that\&nbsp;Ext-Groth16\&nbsp;is black-box weakly SE and, contrary to\&nbsp;Int-Groth16, that its proofs are fully randomizable.},
	isbn = {978-3-662-64321-1},
	issn = {0302-9743},
	doi = {10.1007/978-3-662-64322-810.1007/978-3-662-64322-8_22},
	url = {https://link.springer.com/content/pdf/10.1007/978-3-662-64322-8_22},
	author = {Baghery, Karim and Kohlweiss, Markulf and Siim, Janno and Volkhov, Mikhail},
	editor = {Borisov, Nikita and Diaz, Claudia}
}
@inproceedings {43118,
	title = {Snarky Ceremonies},
	journal = {Asiacrypt 2021},
	volume = {13092},
	year = {2021},
	pages = {98 - 127},
	publisher = {Springer International Publishing},
	address = {Cham},
	abstract = {Succinct non-interactive arguments of knowledge (SNARKs) have found numerous applications in the blockchain setting and elsewhere. The most efficient SNARKs require a distributed ceremony protocol to generate public parameters, also known as a structured reference string (SRS). Our contributions are two-fold:- We give a security framework for non-interactive zero-knowledge arguments with a ceremony protocol.- We revisit the ceremony protocol of Groth{\textquoteright}s SNARK [Bowe et al., 2017]. We show that the original construction can be simplified and optimized, and then prove its security in our new framework. Importantly, our construction avoids the random beacon model used in the original work.},
	isbn = {978-3-030-92077-7},
	issn = {0302-9743},
	doi = {10.1007/978-3-030-92078-410.1007/978-3-030-92078-4_4},
	url = {https://link.springer.com/chapter/10.1007/978-3-030-92078-4_4},
	author = {Kohlweiss, Markulf and Maller, Mary and Siim, Janno and Volkhov, Mikhail},
	editor = {Tibouchi, Mehdi and Wang, Huaxiong}
}
