## Cryptology ePrint Archive: Report 2021/1693

Verifiable Decryption for BGV

Tjerand Silde

Abstract: In this work we present a direct construction for verifiable decryption for the BGV encryption scheme by combining existing zero-knowledge proofs for linear relations and bounded values. This is one of the first constructions of verifiable decryption protocols for lattice-based cryptography, and we give a protocol that is simpler and at least as efficient as the state of the art when amortizing over many ciphertexts.

To prove its practicality we provide concrete parameters, resulting in proof size of less than $47 \tau$ KB for $\tau$ ciphertexts with message space $2048$ bits. Furthermore, we provide an open source implementation showing that the amortized cost of the verifiable decryption protocol is only $90$ ms per message when batching over $\tau = 2048$ ciphertexts.

Category / Keywords: cryptographic protocols / lattice cryptography, verifiable decryption, zero-knowledge

Original Publication (in the same form): Workshop on Advances in Secure Electronic Voting 2022

Date: received 23 Dec 2021, last revised 4 Jan 2022

Contact author: tjerand silde at ntnu no

Available format(s): PDF | BibTeX Citation

Note: This was accepted as a short paper at the workshop.

Short URL: ia.cr/2021/1693

[ Cryptology ePrint archive ]