**Removing the Strong RSA Assumption from Arguments over the Integers**

*Geoffroy Couteau and Thomas Peters and David Pointcheval*

**Abstract: **Committing integers and proving relations between them is an essential ingredient in many cryptographic protocols. Among them, range proofs have shown to be fundamental. They consist in proving that a committed integer lies in a public interval, which can be seen as a particular case of the more general Diophantine relations: for the committed vector of integers x, there exists a vector of integers w such that P (x,w) = 0, where P is a polynomial.
In this paper, we revisit the security strength of the statistically hiding commitment scheme over the integers due to Damgard-Fujisaki, and the zero-knowledge proofs of knowledge of openings. Our first main contribution shows how to remove the Strong RSA assumption and replace it by the standard RSA assumption in the security proofs. This improvement naturally extends to generalized commitments and more complex proofs without modifying the original protocols.
As a second contribution, we design an interactive technique turning commitment scheme over the integers into commitment scheme modulo a prime p. Still under the RSA assumption, this results in more efficient proofs of relations between committed values. Our methods thus improve upon existing proof systems for Diophantine relations both in terms of performance and security. We illustrate that with more efficient range proofs under the sole RSA assumption.

**Category / Keywords: **Public-key cryptography, Commitment schemes, Interactive arguments of knowledge, Zero- knowledge proofs, RSA assumption.

**Date: **received 12 Feb 2016, last revised 12 Oct 2016

**Contact author: **geoffroy couteau at ens fr

**Available format(s): **PDF | BibTeX Citation

**Version: **20161012:095609 (All versions of this report)

**Short URL: **ia.cr/2016/128

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]