@inproceedings {43113,
	title = {Counting Vampires: From Univariate Sumcheck to~Updatable ZK-SNARK},
	journal = {Asiacrypt 2022},
	volume = {13792},
	year = {2023},
	pages = {249 - 278},
	publisher = {Springer Nature Switzerland},
	address = {Cham},
	abstract = {We propose a univariate sumcheck argument\&nbsp;Count\&nbsp;of essentially optimal communication efficiency of one group element. While the previously most efficient univariate sumcheck argument of Aurora is based on polynomial commitments,\&nbsp;Count\&nbsp;is based on inner-product commitments. We use\&nbsp;Count to construct a new pairing-based updatable and universal zk-SNARK\&nbsp;Vampire\&nbsp;with the shortest known argument length (four group and two finite field elements) for\&nbsp;NP. In addition,\&nbsp;Vampire\&nbsp;uses the aggregated polynomial commitment scheme of Boneh et al.},
	isbn = {978-3-031-22965-7},
	issn = {0302-9743},
	doi = {10.1007/978-3-031-22966-410.1007/978-3-031-22966-4_9},
	url = {https://link.springer.com/10.1007/978-3-031-22966-4},
	author = {Lipmaa, Helger and Siim, Janno and Zaj{\k a}c, Micha{\l}},
	editor = {Agrawal, Shweta and Lin, Dongdai}
}
@inproceedings {43117,
	title = {Another Look at Extraction and~Randomization of Groth{\textquoteright}s zk-SNARK},
	journal = {FC 2021},
	volume = {12674},
	year = {2021},
	pages = {457 - 475},
	publisher = {Springer Berlin Heidelberg},
	address = {Berlin, Heidelberg},
	abstract = {Due to the simplicity and performance of zk-SNARKs they are widely used in real-world cryptographic protocols, including blockchain and smart contract systems. Simulation Extractability (SE) is a necessary security property for a NIZK argument to achieve Universal Composability (UC), a common requirement for such protocols. Most of the works that investigate SE focus on its strong variant which implies proof non-malleability. In this work we investigate a relaxed weaker notion, that\&nbsp;allows proof randomization, while guaranteeing statement non-malleability, which we argue to be a more natural security property. First, we show that it is already achievable by\&nbsp;Groth16, arguably the most efficient and widely deployed SNARK nowadays. Second, we show that because of this,\&nbsp;Groth16\&nbsp;can be\&nbsp;efficiently\&nbsp;transformed into a black-box weakly SE NIZK, which is sufficient for UC protocols.To support the second claim, we present and compare two practical constructions, both of which strike different performance tradeoffs:Int-Groth16\&nbsp;makes use of a known transformation that encrypts the witness inside the SNARK circuit. We instantiate this transformation with an efficient SNARK-friendly encryption scheme.Ext-Groth16\&nbsp;is based on the SAVER encryption scheme (Lee et al.) that plugs the encrypted witness directly into the verification equation, externally to the circuit. We prove that\&nbsp;Ext-Groth16\&nbsp;is black-box weakly SE and, contrary to\&nbsp;Int-Groth16, that its proofs are fully randomizable.},
	isbn = {978-3-662-64321-1},
	issn = {0302-9743},
	doi = {10.1007/978-3-662-64322-810.1007/978-3-662-64322-8_22},
	url = {https://link.springer.com/content/pdf/10.1007/978-3-662-64322-8_22},
	author = {Baghery, Karim and Kohlweiss, Markulf and Siim, Janno and Volkhov, Mikhail},
	editor = {Borisov, Nikita and Diaz, Claudia}
}
@inproceedings {43118,
	title = {Snarky Ceremonies},
	journal = {Asiacrypt 2021},
	volume = {13092},
	year = {2021},
	pages = {98 - 127},
	publisher = {Springer International Publishing},
	address = {Cham},
	abstract = {Succinct non-interactive arguments of knowledge (SNARKs) have found numerous applications in the blockchain setting and elsewhere. The most efficient SNARKs require a distributed ceremony protocol to generate public parameters, also known as a structured reference string (SRS). Our contributions are two-fold:- We give a security framework for non-interactive zero-knowledge arguments with a ceremony protocol.- We revisit the ceremony protocol of Groth{\textquoteright}s SNARK [Bowe et al., 2017]. We show that the original construction can be simplified and optimized, and then prove its security in our new framework. Importantly, our construction avoids the random beacon model used in the original work.},
	isbn = {978-3-030-92077-7},
	issn = {0302-9743},
	doi = {10.1007/978-3-030-92078-410.1007/978-3-030-92078-4_4},
	url = {https://link.springer.com/chapter/10.1007/978-3-030-92078-4_4},
	author = {Kohlweiss, Markulf and Maller, Mary and Siim, Janno and Volkhov, Mikhail},
	editor = {Tibouchi, Mehdi and Wang, Huaxiong}
}
@inproceedings {27574,
	title = {Somewhere Statistically Binding Commitment Schemes with Applications},
	journal = {FC 2021},
	volume = {LNCS, volume 12674},
	year = {2021},
	pages = {436-456},
	publisher = {Springer},
	abstract = {We define a new primitive that we call a somewhere statistically binding (SSB) commitment scheme, which is a generalization of dual-mode commitments but has similarities with SSB hash functions (Hubacek and Wichs, ITCS 2015) without local opening. In (existing) SSB hash functions, one can compute a hash of a vector v that is statistically binding in one coordinate of v. Meanwhile, in SSB commitment schemes, a commitment of a vector v is statistically binding in some coordinates of v and is statistically hiding in the other coordinates. The set of indices where binding holds is predetermined but known only to the commitment key generator. We show that the primitive can be instantiated by generalizing the succinct Extended Multi-Pedersen commitment scheme (Gonz{\'a}lez et al., Asiacrypt 2015). We further introduce the notion of functional SSB commitment schemes and, importantly, use it to get an efficient quasi-adaptive NIZK for arithmetic circuits and efficient oblivious database queries.},
	keywords = {Commitment scheme, oblivious transfer, QA-NIZK, SSB},
	author = {Fauzi, Prastudy and Lipmaa, Helger and Pindado, Zaira and Siim, Janno}
}
@inproceedings {28260,
	title = {Verifiably-Extractable OWFs and~Their Applications to~Subversion Zero-Knowledge},
	journal = {Asiacrypt 2021},
	volume = {LNCS, volume 13093},
	year = {2021},
	pages = {618 - 649},
	publisher = {Springer International Publishing},
	address = {Cham},
	isbn = {978-3-030-92067-8},
	issn = {0302-9743},
	doi = {10.1007/978-3-030-92068-5_21},
	url = {https://link.springer.com/content/pdf/10.1007/978-3-030-92068-5_21},
	author = {Fauzi, Prastudy and Lipmaa, Helger and Siim, Janno and Zajac, Michal and Arne Tobias {{\O}degaard}},
	editor = {Tibouchi, Mehdi and Wang, Huaxiong}
}
@inproceedings {27144,
	title = {A Non-Interactive Shuffle Argument With Low Trust Assumptions},
	journal = {Cryptographers{\textquoteright} Track at the RSA Conference (CT-RSA 2020)},
	year = {2020},
	month = {02/2020},
	pages = {667-692},
	publisher = {Springer, Cham},
	abstract = {A shuffle argument is a cryptographic primitive for proving correct behaviour of mix-networks without leaking any private information. Several recent constructions of non-interactive shuffle arguments avoid the random oracle model but require the public key to be trusted.We augment the most efficient argument by Fauzi et al. [Asiacrypt 2017] with a distributed key generation protocol that assures soundness of the argument if at least one party in the protocol is honest and additionally provide a key verification algorithm which guarantees zero-knowledge even if all the parties are malicious. Furthermore, we simplify their construction and improve security by using weaker assumptions while retaining roughly the same level of efficiency. We also provide an implementation to the distributed key generation protocol and the shuffle argument.},
	keywords = {Non-interactive zero-knowledge, Secure multi-party computation, Shuffle, Subversion security},
	doi = {https://doi.org/10.1007/978-3-030-40186-3_28},
	url = {https://eprint.iacr.org/2019/1420},
	author = {Aggelakis, Antonis and Fauzi, Prastudy and Korfiatis, Georgios and Louridas, Panos and Mergoupis-Anagnou, Foteinos and Siim, Janno and Zaj{\k a}c, Micha{\l}},
	editor = {Jarecki, Stanislaw}
}
@inproceedings {26618,
	title = {An Efficient Pairing-Based Shuffle Argument},
	journal = {ASIACRYPT 2017},
	volume = {10626},
	year = {2017},
	pages = {97 - 127},
	publisher = {Springer International Publishing},
	address = {Cham},
	abstract = {We construct the most efficient known pairing-based NIZK shuffle argument. It consists of three subarguments that were carefully chosen to obtain optimal efficiency of the shuffle argument:1. A same-message argument based on the linear subspace QANIZK argument of Kiltz and Wee,\&nbsp;2. A (simplified) permutation matrix argument of Fauzi, Lipmaa, and Zaj{\k a}c,\&nbsp;3. A (simplified) consistency argument of Groth and Lu.We prove the knowledge-soundness of the first two subarguments in the generic bilinear group model, and the culpable soundness of the third subargument under a KerMDH assumption. This proves the soundness of the shuffle argument. We also discuss our partially optimized implementation that allows one to prove a shuffle of\&nbsp;100000100000\&nbsp;ciphertexts in less than a minute and verify it in less than 1.5\&nbsp;min.},
	keywords = {Common Reference String, Generic group model, Mix-net, Shuffle argument, Zero knowledge},
	isbn = {978-3-319-70696-2},
	issn = {0302-9743},
	doi = {10.1007/978-3-319-70697-910.1007/978-3-319-70697-9_4},
	url = {http://link.springer.com/10.1007/978-3-319-70697-9_4},
	author = {Fauzi, Prastudy and Lipmaa, Helger and Zaj{\k a}c, Micha{\l} and Siim, Janno},
	editor = {Takagi, Tsuyoshi and Peyrin, Thomas}
}
