### WI Is Not Enough: Zero-Knowledge Contingent (Service) Payments Revisited

Georg Fuchsbauer

##### Abstract

While fair exchange of goods is known to be impossible without assuming a trusted party, smart contracts in cryptocurrencies forgo such parties by assuming trust in the currency system. They allow a seller to sell a digital good, which the buyer will obtain if and only if she pays. Zero-knowledge contingent payments (zkCP) show that, despite the limited expressiveness of its scripting language, this is even possible in Bitcoin by using zero-knowledge proofs. At CCS'17, Campanelli, Gennaro, Goldfeder and Nizzardo showed that the zkCP protocol was flawed, in that the buyer could obtain information about the good without paying. They proposed countermeasures to repair zkCP and moreover observed that zkCP cannot be used when a service is sold. They introduce the notion of ZK contingent payments for services and give an instantiation based on a witness-indistinguishable (WI) proof system. We show that the main countermeasures they proposed are not sufficient and present an attack against their fixed zkCP scheme. We also show that their realization of zkCP for services is insecure, as the buyer could learn the desired information (i.e., whether the service was provided) without paying; in particular, we show that WI of the used proof system is not enough.

Available format(s)
Category
Cryptographic protocols
Publication info
Published elsewhere. ACM CCS 2019
DOI
10.1145/3319535.3354234
Keywords
ZK contingent paymentsBitcoinzkSNARKssubversion zero knowledge
Contact author(s)
fuchsbau @ di ens fr
History
Short URL
https://ia.cr/2019/964

CC BY

BibTeX

@misc{cryptoeprint:2019/964,
author = {Georg Fuchsbauer},
title = {WI Is Not Enough: Zero-Knowledge Contingent (Service) Payments Revisited},
howpublished = {Cryptology ePrint Archive, Paper 2019/964},
year = {2019},
doi = {10.1145/3319535.3354234},
note = {\url{https://eprint.iacr.org/2019/964}},
url = {https://eprint.iacr.org/2019/964}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.