@inproceedings {43117,
	title = {Another Look at Extraction and~Randomization of Groth{\textquoteright}s zk-SNARK},
	journal = {FC 2021},
	volume = {12674},
	year = {2021},
	pages = {457 - 475},
	publisher = {Springer Berlin Heidelberg},
	address = {Berlin, Heidelberg},
	abstract = {Due to the simplicity and performance of zk-SNARKs they are widely used in real-world cryptographic protocols, including blockchain and smart contract systems. Simulation Extractability (SE) is a necessary security property for a NIZK argument to achieve Universal Composability (UC), a common requirement for such protocols. Most of the works that investigate SE focus on its strong variant which implies proof non-malleability. In this work we investigate a relaxed weaker notion, that\&nbsp;allows proof randomization, while guaranteeing statement non-malleability, which we argue to be a more natural security property. First, we show that it is already achievable by\&nbsp;Groth16, arguably the most efficient and widely deployed SNARK nowadays. Second, we show that because of this,\&nbsp;Groth16\&nbsp;can be\&nbsp;efficiently\&nbsp;transformed into a black-box weakly SE NIZK, which is sufficient for UC protocols.To support the second claim, we present and compare two practical constructions, both of which strike different performance tradeoffs:Int-Groth16\&nbsp;makes use of a known transformation that encrypts the witness inside the SNARK circuit. We instantiate this transformation with an efficient SNARK-friendly encryption scheme.Ext-Groth16\&nbsp;is based on the SAVER encryption scheme (Lee et al.) that plugs the encrypted witness directly into the verification equation, externally to the circuit. We prove that\&nbsp;Ext-Groth16\&nbsp;is black-box weakly SE and, contrary to\&nbsp;Int-Groth16, that its proofs are fully randomizable.},
	isbn = {978-3-662-64321-1},
	issn = {0302-9743},
	doi = {10.1007/978-3-662-64322-810.1007/978-3-662-64322-8_22},
	url = {https://link.springer.com/content/pdf/10.1007/978-3-662-64322-8_22},
	author = {Baghery, Karim and Kohlweiss, Markulf and Siim, Janno and Volkhov, Mikhail},
	editor = {Borisov, Nikita and Diaz, Claudia}
}
