| Authors | M. Ciampi, R. Parisella and D. Venturi |
| Editors | C. Galdi and V. Kolesnikov |
| Title | On Adaptive Security of Delayed-Input Sigma Protocols and Fiat-Shamir NIZKs |
| Afilliation | Cryptography |
| Project(s) | Simula UiB |
| Status | Published |
| Publication Type | Proceedings, refereed |
| Year of Publication | 2020 |
| Conference Name | Security and Cryptography for Networks |
| Pagination | 670–690 |
| Publisher | Springer International Publishing |
| Place Published | Cham |
| ISBN Number | 978-3-030-57990-6 |
| Abstract | We study adaptive security of delayed-input Sigma protocols and non-interactive zero-knowledge (NIZK) proof systems in the common reference string (CRS) model. Our contributions are threefold:We exhibit a generic compiler taking any delayed-input Sigma protocol and returning a delayed-input Sigma protocol satisfying adaptive-input special honest-verifier zero knowledge (SHVZK). In case the initial Sigma protocol also satisfies adaptive-input special soundness, our compiler preserves this property.We revisit the recent paradigm by Canetti et al. (STOC 2019) for obtaining NIZK proof systems in the CRS model via the Fiat-Shamir transform applied to so-called trapdoor Sigma protocols, in the context of adaptive security. In particular, assuming correlation-intractable hash functions for all sparse relations, we prove that Fiat-Shamir NIZKs satisfy either: (i)Adaptive soundness (and non-adaptive zero knowledge), so long as the challenge is obtained by hashing both the prover's first round and the instance being proven;(ii)Adaptive zero knowledge (and non-adaptive soundness), so long as the challenge is obtained by hashing only the prover's first round, and further assuming that the initial trapdoor Sigma protocol satisfies adaptive-input SHVZK.We exhibit a generic compiler taking any Sigma protocol and returning a trapdoor Sigma protocol. Unfortunately, this transform does not preserve the delayed-input property of the initial Sigma protocol (if any). To complement this result, we also give yet another compiler taking any delayed-input trapdoor Sigma protocol and returning a delayed-input trapdoor Sigma protocol with adaptive-input SHVZK. |
| Citation Key | 10.1007/978-3-030-57990-6_33 |