Cryptology ePrint Archive: Report 2017/599

A Subversion-Resistant SNARK

Behzad Abdolmaleki and Karim Baghery and Helger Lipmaa and Michal Zajac

Abstract: While succinct non-interactive zero-knowledge arguments of knowledge (zk-SNARKs) are widely studied, the question of what happens when the CRS has been subverted has received little attention. In ASIACRYPT 2016, Bellare, Fuchsbauer and Scafuro showed the first negative and positive results in this direction, proving also that it is impossible to achieve subversion soundness and (even non-subversion) zero knowledge at the same time. On the positive side, they constructed an involved sound and subversion zero-knowledge argument system for NP. We show that Groth's zk-SNARK for \textsc{Circuit-SAT} from EUROCRYPT 2016 can be made computationally knowledge-sound and perfectly composable Sub-ZK with minimal changes. We just require the CRS trapdoor to be extractable and the CRS to be publicly verifiable. To achieve the latter, we add some new elements to the CRS and construct an efficient CRS verification algorithm. We also provide a definitional framework for sound and Sub-ZK SNARKs and describe implementation results of the new Sub-ZK SNARK.

Category / Keywords: cryptographic protocols / Common reference string, generic group model, non-interactive zero knowledge, SNARK, subversion zero knowledge

Date: received 21 Jun 2017

Contact author: helger lipmaa at gmail com

Available format(s): PDF | BibTeX Citation

Note: An earlier version of this paper was submitted to Crypto 2017. The current version includes implementation data and readability improvements

Version: 20170621:143220 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]