Cryptology ePrint Archive: Report 2020/668

On Subversion-Resistant SNARKs

Behzad Abdolmaleki and Helger Lipmaa and Janno Siim and Michał Zając

Abstract: While NIZK arguments in the CRS model are widely studied, the question of what happens when the CRS was subverted has received little attention. In ASIACRYPT 2016, Bellare, Fuchsbauer, and Scafuro showed the first negative and positive results in the case of NIZK, proving also that it is impossible to achieve subversion soundness and (even non-subversion) zero-knowledge at the same time. On the positive side, they constructed an involved sound and subversion-zero-knowledge (Sub-ZK) non-succinct NIZK argument for NP. We consider the practically very relevant case of zk-SNARKs. We make Groth's zk-SNARK for \textsc{Circuit-SAT} from EUROCRYPT 2016 computationally knowledge-sound and perfectly composable Sub-ZK with minimal changes. We only require the CRS trapdoor to be extractable and the CRS to be publicly verifiable. To achieve the latter, we add some new elements to the CRS and construct an efficient CRS verification algorithm. We also provide a definitional framework for knowledge-sound and Sub-ZK SNARKs.

Category / Keywords: cryptographic protocols / Common reference string, generic group model, non-interactive zero knowledge, subversion zero knowledge, SNARK

Original Publication (with major differences): IACR-ASIACRYPT-2017

Date: received 4 Jun 2020

Contact author: abdolmaleki behzad ir at gmail com,jannosiim@gmail com,helger lipmaa@gmail com,m p zajac@gmail com

Available format(s): PDF | BibTeX Citation

Note: This is a (belated) full version of the Asiacrypt 2017 paper of a slightly different subset of co-authors. There have been many smaller and bigger changes; we provided a short overview of them in Appendix A

Version: 20200605:195240 (All versions of this report)

Short URL: ia.cr/2020/668


[ Cryptology ePrint archive ]