Paper 2017/587

Subversion-zero-knowledge SNARKs

Georg Fuchsbauer

Abstract

Subversion zero knowledge for non-interactive proof systems demands that zero knowledge (ZK) be maintained even when the common reference string (CRS) is chosen maliciously. SNARKs are proof systems with succinct proofs, which are at the core of the cryptocurrency Zcash, whose anonymity relies on ZK-SNARKs; they are also used for ZK contingent payments in Bitcoin. We show that under a plausible hardness assumption, the most efficient SNARK schemes proposed in the literature, including the one underlying Zcash and contingent payments, satisfy subversion ZK or can be made to at very little cost. In particular, we prove subversion ZK of the original SNARKs by Gennaro et al. and the almost optimal construction by Groth; for the Pinocchio scheme implemented in libsnark we show that it suffices to add 4 group elements to the CRS. We also argue informally that Zcash is anonymous even if its parameters were set up maliciously.

Note: This version incorporates the corrections of the BCTV14 scheme (ia.cr/2013/879, version 20190205) and some small fixes on p. 26.

Metadata
Available format(s)
PDF
Category
Cryptographic protocols
Publication info
A major revision of an IACR publication in PKC 2018
Keywords
SNARKssubversion-resistancezero knowledgeZcash
Contact author(s)
fuchsbau @ di ens fr
History
2020-05-16: last of 4 revisions
2017-06-20: received
See all versions
Short URL
https://ia.cr/2017/587
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2017/587,
      author = {Georg Fuchsbauer},
      title = {Subversion-zero-knowledge SNARKs},
      howpublished = {Cryptology ePrint Archive, Paper 2017/587},
      year = {2017},
      note = {\url{https://eprint.iacr.org/2017/587}},
      url = {https://eprint.iacr.org/2017/587}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.