Homomorphic Trapdoor Commitments to Group Elements

Download PDF
Comment
Report 1 Downloads 14 Views
Homomorphic Trapdoor Commitments to Group Elements Jens Groth University College London [email protected]

Abstract We present homomorphic trapdoor commitments to group elements. In contrast, previous homomorphic trapdoor commitment schemes only allow the messages to be exponents. Our commitment schemes are length-reducing, we can make a short commitment to many group elements at once, and they are perfectly hiding and computationally binding. The commitment schemes are based on groups with a bilinear map. We can commit to elements from a base group, whereas the commitments belong to the target group. We present two constructions based on simple computational intractability assumptions, which we call respectively the double pairing assumption and the simultaneous triple pairing assumption. While the assumptions are new, we demonstrate that they are implied by well-known assumptions; respectively the decision Diffie-Hellman assumption and the decision linear assumption. Our constructions also have applications in the context of committing to exponents. Variants of the Pedersen commitment scheme make it possible to commit to many exponents at once; however, this comes at the cost of a public key that grows linearly in the number of committed exponents. We propose homomorphic trapdoor commitment schemes for multiple exponents with constant size commitments and sub-linear size public keys. Keywords: Homomorphic trapdoor commitment, bilinear groups, double pairing assumption, simultaneous triple pairing assumption.

1

Introduction

A non-interactive commitment scheme makes it possible to create a commitment 𝑐 to a secret message π‘š. The commitment hides the message, but we may later disclose π‘š and demonstrate that 𝑐 was a commitment to π‘š by revealing the randomness π‘Ÿ used when creating it. Revealing the message and the randomness is called opening the commitment. It is essential that once a commitment is made, it is binding. Binding means that it is infeasible to find two openings of the same commitment to two different messages. In this paper, we are interested in public-key commitments with some useful features. First, we want the commitment scheme to have a trapdoor property. In normal operation the commitment scheme is binding, however, if we know a secret trapdoor π‘‘π‘˜ associated with the public commitment key π‘π‘˜, then it is possible to create commitments that can be opened to any message. We note that the trapdoor property implies that the commitment hides the message. Second, we want the commitment scheme to be homomorphic. Homomorphic means that messages and commitments belong to abelian groups and if we multiply two commitments, we get a new commitment that contains the product of the two messages. Third, we want the commitment scheme to be length reducing, i.e., the commitment is shorter than the message. Related work. There are many examples of homomorphic commitments. Homomorphic cryptosystems such as ElGamal [ElG85], Okamoto-Uchiyama [OU98], Paillier [Pai99], BGN [BGN05] or Linear 1

Encryption [BBS04] can be seen as homomorphic commitment schemes that are perfectly binding and computationally hiding. Commitments based on homomorphic encryption can be converted into computationally binding and perfectly hiding homomorphic commitments, see for instance the mixed commitments of Damg˚ ard and Nielsen [DN02] and the commitment schemes used by Groth, Ostrovsky and Sahai [GOS06], Boyen and Waters [BW06], Groth [Gro06] and Groth and Sahai [GS08]. Even in the perfectly hiding versions of these commitment schemes the size of a commitment is larger than the size of a message though. This length-increase follows from the fact that the underlying building block is a cryptosystem and a ciphertext must be large enough to include the message. There are also direct constructions of homomorphic trapdoor commitment schemes such as Guillou and Quisquater commitments [GQ88] and Pedersen commitments [Ped91]. Pedersen commitments are one of the most used commitment schemes in the field of cryptography. The public key consists of two group elements 𝑔, β„Ž belonging to a group of prime order 𝑝 and we commit to a message π‘š ∈ ℀𝑝 by computing 𝑐 = 𝑔 π‘š β„Žπ‘‘ , where 𝑑 ∈ ℀𝑝 is a randomly chosen randomizer. Pedersen commitments are perfectly hiding with a trapdoor and if the discrete logarithm problem is hard they are computationally binding. There are many variants of the Pedersen commitment scheme. Fujisaki and Okamoto [FO97] and Damg˚ ard and Fujisaki [DF02] for instance suggest a variant where the messages can be arbitrary integers. There is an important generalization of the Pedersen commitment scheme that makes it possible to commit to many messages at once. The public key consists + 1 group elements 𝛾1 , . . . , π›Ύπ‘š , β„Ž and ∏ ofπ‘šπ‘š 𝑖 we compute a commitment to (π‘š1 , . . . , π‘šπ‘š ) as 𝑐 = β„Žπ‘‘ π‘š 𝛾 . This commitment scheme is length𝑖=1 𝑖 reducing since we only use one group element to commit to π‘š messages, a feature that has been found useful in contexts such as mix-nets/voting, digital credentials, blind signatures and zero-knowledge proofs [FS01, Nef01, Bra00, KZ06, Lip03]. Common for all the homomorphic trapdoor commitment schemes1 we mentioned above is that they are homomorphic with respect to addition in a ring or a field. However, in public-key cryptography it is common to work over groups that are not rings or fields and often it is useful to commit to group elements from such groups. Of course, if we know the discrete logarithms of the group elements we want to commit to, we can use the Pedersen commitment scheme to commit to the discrete logarithms. In general, we cannot expect to know the discrete logarithms of the group elements that we want to commit to though, leaving us with the open problem of constructing homomorphic trapdoor commitments to group elements. Our contribution. The contribution of this paper is the construction of homomorphic trapdoor commitment schemes for group elements. The commitment schemes are perfectly hiding, perfectly trapdoor and computationally binding. We stress that we can commit to arbitrary group elements and trapdoor-open to arbitrary group elements, even if we do not know the discrete logarithms of these group elements. Moreover, the commitment schemes have the additional advantage of being length-reducing; we can commit to multiple group elements with one short commitment. Our constructions are based on bilinear groups. These are groups 𝐺1 , 𝐺2 , 𝐺𝑇 with a bilinear map 𝑒 : 𝐺1 Γ— 𝐺2 β†’ 𝐺𝑇 . Messages and randomizers are elements from 𝐺2 , whereas the commitments will consist of a few group elements in 𝐺𝑇 . An advantage of our commitment schemes is that the constructions are very simple. In one construction, the public key consists of 𝑛 + 1 group elements (π‘”π‘Ÿ , 𝑔1 , . . . , 𝑔𝑛 ) from 𝐺1 and we commit to π‘š1 , . . . , π‘šπ‘› ∈ 𝐺2 by choosing π‘Ÿ ∈ 𝐺2 at random and computing the commitment 𝑛 ∏ 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ) 𝑒(𝑔𝑖 , π‘šπ‘– ). 𝑖=1 1

Boyen and Waters [BW06], Groth [Gro06] and Groth and Sahai [GS08] use homomorphic commitments to group elements, but they do not have a trapdoor property that makes it possible to open them to arbitrary group elements. Moreover, those commitments suffer from being length-increasing.

2

In the other construction, the public key consists of 2𝑛 + 4 group elements (π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔1 , β„Ž1 , . . . , 𝑔𝑛 , β„Žπ‘› ) from 𝐺1 and the commitment consists of picking π‘Ÿ, 𝑠 at random from 𝐺2 and computing the commitment (𝑐, 𝑑) as 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)

𝑛 ∏

𝑒(𝑔𝑖 , π‘šπ‘– )

and

𝑖=1

𝑑 = 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)

𝑛 ∏

𝑒(β„Žπ‘– , π‘šπ‘– ).

𝑖=1

The commitment schemes are computationally binding assuming the double pairing assumption respectively the simultaneous triple pairing assumption hold. The double pairing assumption says that given a random couple (π‘”π‘Ÿ , 𝑔𝑑 ) from 𝐺1 it is computationally infeasible to find non-trivial group elements π‘Ÿ, 𝑑 ∈ 𝐺2 so 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑑 , 𝑑) = 1. The simultaneous triple pairing assumption says that given two random triples (π‘”π‘Ÿ , 𝑔𝑠 , 𝑔𝑑 ) and (β„Žπ‘Ÿ , β„Žπ‘  , β„Žπ‘‘ ) from 𝐺1 it is computationally infeasible to find non-trivial group elements π‘Ÿ, 𝑠, 𝑑 ∈ 𝐺2 so 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)𝑒(𝑔𝑑 , 𝑑) = 1

and

𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)𝑒(β„Žπ‘‘ , 𝑑) = 1.

We will show that the decision Diffie-Hellman assumption in 𝐺1 implies the double pairing assumption and perhaps surprisingly that the decision linear assumption [BBS04] in 𝐺1 implies the simultaneous triple pairing assumption. We remark that the roles of 𝐺1 and 𝐺2 can be reversed giving us commitments to group elements in 𝐺1 . Since the constructions and the assumptions would be identical after reversing the roles of 𝐺1 and 𝐺2 , we will without loss of generality only consider the case of committing to group elements in 𝐺2 . Applications. As an example of the usage of our commitment schemes, we consider in Section 5 the case of committing to Pedersen commitments. Pedersen commitments, allow the commitment to βˆπ‘š π‘š 𝑖 𝑑 multiple values π‘š1 , . . . , π‘šπ‘š ∈ ℀𝑝 as β„Ž 𝑖=1 𝛾𝑖 . A Pedersen commitment is itself just a group element, and we can therefore use our commitment schemes to commit to multiple Pedersen commitments. Since our commitment schemes are homomorphic and the Pedersen commitment scheme is homomorphic, their combination is also homomorphic. We get a homomorphic trapdoor commitment scheme to π‘šπ‘› elements from ℀𝑝 . In contrast with the Pedersen commitment scheme, however, the public key of our scheme is only 𝑂(π‘š + 𝑛) group elements. Moreover, we propose an honest verifier zero-knowledge argument of knowledge of the committed values with a communication complexity 𝑂(π‘š + 𝑛) group and field elements, which improves on the communication complexity of π‘šπ‘› field elements for the most practical honest verifier zero-knowledge arguments of knowledge for the Pedersen commitment scheme to π‘šπ‘› field elements. Such an efficient homomorphic trapdoor commitment scheme may in turn be a useful component in constructing more advanced zero-knowledge arguments. One can for instance reduce the communication complexity of Groth’s [Gro09] sub-linear size zero-knowledge argument for circuit satisfiability from 1 1 𝑂(∣𝐢∣ 2 ) group elements to 𝑂(∣𝐢∣ 3 ) group elements, although the details of the construction are beyond the scope of this paper.

2

Definitions

Notation. Algorithms in our commitment schemes take a security parameter π‘˜ as input written in unary. For simplicity we will sometimes omit writing the security parameter explicitly, assuming π‘˜ can be deduced from the other inputs. All our algorithms will be probabilistic polynomial time algorithms. We write 𝑦 = 𝐴(π‘₯; π‘Ÿ), when 𝐴 on input π‘₯ and randomness π‘Ÿ outputs 𝑦. We write 𝑦 ← 𝐴(π‘₯), for the process of picking randomness π‘Ÿ at random and setting 𝑦 = 𝐴(π‘₯; π‘Ÿ). We also write 𝑦 ← 𝑆 for 3

sampling 𝑦 uniformly at random from the set 𝑆. When defining security, we assume that there is an adversary attacking our schemes. The adversary is modeled as a non-uniform polynomial time stateful algorithm. By stateful, we mean that we do not need to give it the same input twice, it remembers from the last invocation what its state was. This makes the notation a little simpler, since we do not need to explicitly write out the transfer of state from one invocation to the next. Given two functions 𝑓, 𝑔 : β„• β†’ [0; 1] we write 𝑓 (π‘˜) β‰ˆ 𝑔(π‘˜) when there is negligible difference, i.e., βˆ£π‘“ (π‘˜) βˆ’ 𝑔(π‘˜)∣ = π‘˜ βˆ’πœ”(1) .

2.1

Commitments

A commitment scheme is a protocol between Alice and Bob that allows Alice to commit to a secret message π‘š. Later Alice may open the commitment and reveal to Bob that she committed to π‘š. Commitment schemes must be binding and hiding. Binding means that Alice cannot change her mind; a commitment can only be opened to one message π‘š. Hiding means that Bob does not learn which message Alice committed to. In this paper, we will focus on non-interactive commitment schemes. In a non-interactive commitment scheme, Alice computes the commitment herself and sends it to Bob. The opening process is also non-interactive, it simply consists of Alice sending the message and the randomness she used when creating the commitment to Bob. Bob can now run the commitment protocol himself to check that indeed this was the message Alice had committed to. A non-interactive commitment scheme consists of three polynomial time algorithms (𝒒, 𝐾, com). 𝒒 is a probabilistic setup algorithm that takes as input the security parameter π‘˜ and outputs some setup information π‘”π‘˜. The setup information π‘”π‘˜ can for instance describe a finite group over which we are working, but it could also just be the security parameter written in unary so there is no loss of generality in including a setup algorithm. We include an explicit algorithm for the setup because when designing cryptographic protocols we often need the commitment scheme to work with an existing finite group. 𝐾 is a probabilistic algorithm that takes as input the setup π‘”π‘˜ and generates a public commitment key π‘π‘˜ and a trapdoor key π‘‘π‘˜. The commitment key π‘π‘˜ specifies a message space β„³π‘π‘˜ , a randomizer space β„›π‘π‘˜ and a commitment space π’žπ‘π‘˜ . We assume it is easy to verify membership of the message space, randomizer space and the commitment space and it is possible to sample randomizers uniformly at random from β„›π‘π‘˜ . The algorithm com takes as input the commitment key π‘π‘˜, a message π‘š from the message space, a randomizer π‘Ÿ from the randomizer space and outputs a commitment 𝑐 in the commitment space. We are interested in constructing homomorphic trapdoor commitments. By homomorphic, we mean that β„³π‘π‘˜ , β„›π‘π‘˜ , π’žπ‘π‘˜ are groups with the property that if we multiply two commitments, then we get a commitment to the product of the messages. By trapdoor we mean that given the secret trapdoor key generated by the key generator, it is possible to open a commitment to any message. For this purpose, we have two additional probabilistic polynomial time algorithms Tcom and Topen. Tcom takes the trapdoor π‘‘π‘˜ as input and outputs an equivocal commitment 𝑐 and an equivocation key π‘’π‘˜. Topen on input π‘’π‘˜, 𝑐 and a message π‘š ∈ β„³π‘π‘˜ creates an opening π‘Ÿ ∈ β„›π‘π‘˜ of the commitment, so 𝑐 = comπ‘π‘˜ (π‘š; π‘Ÿ). Definition 1 (Homomorphic trapdoor commitment scheme) A homomorphic trapdoor commitment scheme consists of a quintuple of algorithms (𝒒, 𝐾, com, Tcom, Topen) as described above, such that (𝒒, 𝐾, com) is hiding and binding and homomorphic and (𝒒, 𝐾, com, Tcom, Topen) has a perfect trapdoor property as defined below. Definition 2 (Perfect hiding) The triple (𝒒, 𝐾, com) is perfectly hiding if for all stateful adversaries π’œ we have [ ] Pr π‘”π‘˜ ← 𝒒(1π‘˜ ); (π‘π‘˜, π‘‘π‘˜) ← 𝐾(π‘”π‘˜); (π‘š0 , π‘š1 ) ← π’œ(π‘”π‘˜, π‘π‘˜); 𝑐 ← comπ‘π‘˜ (π‘š0 ) : π’œ(𝑐) = 1 [ ] = Pr π‘”π‘˜ ← 𝒒(1π‘˜ ); (π‘π‘˜, π‘‘π‘˜) ← 𝐾(π‘”π‘˜); (π‘š0 , π‘š1 ) ← π’œ(π‘”π‘˜, π‘π‘˜); 𝑐 ← comπ‘π‘˜ (π‘š1 ) : π’œ(𝑐) = 1 , 4

where we require that π’œ outputs π‘š0 , π‘š1 that belong to β„³π‘π‘˜ . Definition 3 (Computational binding) The triple (𝒒, 𝐾, com) is computationally binding if for all non-uniform polynomial time stateful adversaries π’œ we have [ Pr π‘”π‘˜ ← 𝒒(1π‘˜ ); (π‘π‘˜, π‘‘π‘˜) ← 𝐾(π‘”π‘˜); (π‘š0 , π‘š1 , π‘Ÿ0 , π‘Ÿ1 ) ← π’œ(π‘”π‘˜, π‘π‘˜) : ] π‘š0 βˆ•= π‘š1 ∧ comπ‘π‘˜ (π‘š0 ; π‘Ÿ0 ) = comπ‘π‘˜ (π‘š1 ; π‘Ÿ1 ) β‰ˆ 0, where we require that π’œ outputs π‘š0 , π‘š1 ∈ β„³π‘π‘˜ and π‘Ÿ0 , π‘Ÿ1 ∈ β„›π‘π‘˜ . Definition 4 (Perfect trapdoor) The quintuple (𝒒, 𝐾, com, Tcom, Topen) is perfectly trapdoor if for all stateful adversaries π’œ we have [ ] Pr π‘”π‘˜ ← 𝒒(1π‘˜ ); (π‘π‘˜, π‘‘π‘˜) ← 𝐾(π‘”π‘˜); π‘š ← π’œ(π‘”π‘˜, π‘π‘˜); π‘Ÿ ← β„›π‘π‘˜ ; 𝑐 = comπ‘π‘˜ (π‘š; π‘Ÿ) : π’œ(𝑐, π‘Ÿ) = 1 [ = Pr π‘”π‘˜ ← 𝒒(1π‘˜ ); (π‘π‘˜, π‘‘π‘˜) ← 𝐾(π‘”π‘˜); π‘š ← π’œ(π‘”π‘˜, π‘π‘˜); (𝑐, π‘’π‘˜) ← Tcomπ‘π‘˜ (π‘‘π‘˜); ] π‘Ÿ ← Topenπ‘’π‘˜ (𝑐, π‘š) : π’œ(𝑐, π‘Ÿ) = 1 , where π’œ outputs π‘š ∈ β„³π‘π‘˜ . We note that the perfect trapdoor property implies that the commitment scheme is perfectly hiding, since a commitment is perfectly indistinguishable from an equivocal commitment that can be opened to any message. Definition 5 (Homomorphic) The commitment scheme (𝒒, 𝐾, com) is homomorphic if 𝐾 always outputs π‘π‘˜ describing groups β„³π‘π‘˜ , β„›π‘π‘˜ , π’žπ‘π‘˜ , which we will write multiplicatively, such that for all π‘š, π‘šβ€² ∈ β„³π‘π‘˜ , π‘Ÿ, π‘Ÿβ€² ∈ π’žπ‘π‘˜ we have comπ‘π‘˜ (π‘š; π‘Ÿ)comπ‘π‘˜ (π‘š; π‘Ÿβ€² ) = comπ‘π‘˜ (π‘šπ‘šβ€² ; π‘Ÿπ‘Ÿβ€² ).

3

Foundations

Bilinear groups. Let 𝒒 be a probabilistic polynomial time algorithm that generates (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ) such that βˆ™ 𝑝 is a π‘˜-bit prime βˆ™ 𝐺1 , 𝐺2 , 𝐺𝑇 are cyclic groups of order 𝑝 βˆ™ 𝑒 : 𝐺1 Γ— 𝐺2 β†’ 𝐺𝑇 is a non-degenerate bilinear map so – 𝑒(𝛾1 , 𝛾2 ) generates 𝐺𝑇 if 𝛾1 , 𝛾2 generate 𝐺1 and 𝐺2 – βˆ€π›Ύ1 ∈ 𝐺1 , 𝛾2 ∈ 𝐺2 , π‘Ž, 𝑏 ∈ ℀𝑝 we have 𝑒(𝛾1π‘Ž , 𝛾2𝑏 ) = 𝑒(𝛾1 , 𝛾2 )π‘Žπ‘ βˆ™ Group operations, evaluation of the bilinear map, sampling of generators and membership of 𝐺1 , 𝐺2 , 𝐺𝑇 are all efficiently computable. Double pairing assumption. The security of our first commitment scheme will be based on the double pairing assumption.2 The double pairing problem is given random elements π‘”π‘Ÿ , 𝑔𝑑 ∈ 𝐺1 to find a non-trivial couple (π‘Ÿ, 𝑑) ∈ 𝐺22 such that 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑑 , 𝑑) = 1. 2

The double pairing assumption was also proposed independently by Abe, Haralambiev and Ohkubo [AHO10].

5

Definition 6 We say the double pairing assumption holds for the bilinear group generator 𝒒 if for all non-uniform polynomial time adversaries π’œ we have [ Pr π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ); π‘”π‘Ÿ , 𝑔𝑑 ← 𝐺1 ; (π‘Ÿ, 𝑑) ← π’œ(π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 ) : ] (π‘Ÿ, 𝑑) ∈ 𝐺22 βˆ– {(1, 1)} ∧ 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑑 , 𝑑) = 1 β‰ˆ 0. One could also consider the reverse double pairing assumption, where π‘”π‘Ÿ , 𝑔𝑑 ∈ 𝐺2 . The double pairing assumption is used for commitments to elements in 𝐺2 , whereas the reverse double pairing assumption would be used for commitments to elements in 𝐺1 . We will without loss of generality only describe commitments to group elements in 𝐺2 in the paper. Simultaneous triple pairing assumption. The security of our second commitment scheme will be based on the simultaneous triple pairing assumption. The simultaneous triple pairing problem is given random elements π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔𝑑 , β„Žπ‘‘ ∈ 𝐺1 to find a non-trivial triple (π‘Ÿ, 𝑠, 𝑑) ∈ 𝐺32 such that 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)𝑒(𝑔𝑑 , 𝑑) = 1 and 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)𝑒(β„Žπ‘‘ , 𝑑) = 1. Definition 7 (Simultaneous triple pairing assumption) We say the simultaneous triple pairing assumption holds for the bilinear group generator 𝒒 if for all non-uniform polynomial time adversaries π’œ we have [ Pr π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ); π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔𝑑 , β„Žπ‘‘ ← 𝐺1 ; (π‘Ÿ, 𝑠, 𝑑) ← π’œ(π‘”π‘˜, π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔𝑑 , β„Žπ‘‘ ) : (π‘Ÿ, 𝑠, 𝑑) ∈ 𝐺32 βˆ– {(1, 1, 1)} ∧

𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)𝑒(𝑔𝑑 , 𝑑) = 1

∧

] 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)𝑒(β„Žπ‘‘ , 𝑑) = 1 β‰ˆ 0.

The simultaneous triple pairing assumption is used to build commitments to group elements in 𝐺2 . We could also define a reverse simultaneous triple pairing assumption, which would give us commitments to group elements in 𝐺1 . We will without loss of generality only describe commitments to group elements in 𝐺2 in the paper. Comparison. The double pairing assumption is the simplest of the two assumptions and leads to the most efficient commitment scheme. It is a stronger assumption than the simultaneous triple pairing assumption though as the following theorem shows. Theorem 8 If the double pairing assumption holds for 𝒒, then the simultaneous triple pairing assumption holds for 𝒒. Proof. We will show that if π’œ has probability πœ–(π‘˜) of breaking the simultaneous triple pairing assumption for 𝒒, then there is an algorithm ℬ that breaks the double pairing assumption for 𝒒 with at least πœ–(π‘˜) βˆ’ 1/𝑝 chance. Let (π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 ) be a random double pairing challenge given to ℬ. If π‘”π‘Ÿ = 1 or 𝑔𝑑 = 1, it is trivial to find a solution to the double pairing problem. If π‘”π‘Ÿ βˆ•= 1 and 𝑔𝑑 βˆ•= 1, the double pairing adversary ℬ selects πœŒπ‘Ÿ , πœπ‘Ÿ , πœŒπ‘  , πœπ‘  , πœŒπ‘‘ , πœπ‘‘ ← ℀𝑝 and computes β„Žπ‘Ÿ = π‘”π‘ŸπœŒπ‘Ÿ π‘”π‘‘πœπ‘Ÿ , β„Žπ‘  = π‘”π‘ŸπœŒπ‘  π‘”π‘‘πœπ‘  , β„Žπ‘‘ = π‘”π‘ŸπœŒπ‘‘ π‘”π‘‘πœπ‘‘ . It also selects π‘”Λ†π‘Ÿ , 𝑔ˆ𝑠 , 𝑔ˆ𝑑 ← 𝐺1 at random. The double pairing adversary ℬ runs π’œ on (π‘”π‘˜, π‘”Λ†π‘Ÿ , 𝑔ˆ𝑠 , 𝑔ˆ𝑑 , β„Žπ‘Ÿ , β„Žπ‘  , β„Žπ‘‘ ) and with at least πœ–(π‘˜) probability it gets a non-trivial solution (Λ† π‘Ÿ, 𝑠ˆ, 𝑑ˆ) to the simultaneous triple pairing problem. The solution satisfies 𝑒(β„Žπ‘Ÿ , π‘ŸΛ†)𝑒(β„Žπ‘  , 𝑠ˆ)𝑒(β„Žπ‘‘ , 𝑑ˆ) = 1 (it will not be needed in the proof that the solution also satisfies 𝑒(π‘”Λ†π‘Ÿ , π‘ŸΛ†)𝑒(𝑔ˆ𝑠 , 𝑠ˆ)𝑒(𝑔ˆ𝑑 , 𝑑ˆ) = 1). We deduce 𝑒(π‘”π‘Ÿ , π‘ŸΛ†πœŒπ‘Ÿ π‘ Λ†πœŒπ‘  π‘‘Λ†πœŒπ‘‘ )𝑒(𝑔𝑑 , π‘ŸΛ†πœπ‘Ÿ π‘ Λ†πœπ‘  π‘‘Λ†πœπ‘‘ ) = 1. No matter what the πœŒπ‘Ÿ , πœŒπ‘  , πœŒπ‘‘ values are, the random choice of πœπ‘Ÿ , πœπ‘  , πœπ‘‘ makes β„Žπ‘Ÿ , β„Žπ‘  , β„Žπ‘‘ be random group elements. This means π’œ has no information whatsoever about πœŒπ‘Ÿ , πœŒπ‘  , πœŒπ‘‘ and hence there is probability 1/𝑝 for π‘ŸΛ†πœŒπ‘Ÿ π‘ Λ†πœŒπ‘  π‘‘Λ†πœŒπ‘‘ = 1. With at least πœ–(π‘˜) βˆ’ 1/𝑝 probability (Λ† π‘ŸπœŒπ‘Ÿ π‘ Λ†πœŒπ‘  π‘‘Λ†πœŒπ‘‘ , π‘ŸΛ†πœπ‘Ÿ π‘ Λ†πœπ‘  π‘‘Λ†πœπ‘‘ ) is a solution to the double pairing problem. β–‘ There are some types of bilinear groups the double pairing assumption cannot be true. Galbraith, Paterson and Smart [GPS08] classify bilinear groups into three types: 6

Type 1: 𝐺1 = 𝐺2 . Type 2: There is no efficiently computable homomorphism πœ“ : 𝐺1 β†’ 𝐺2 . Type 3: There are no efficiently computable homomorphisms in either direction between 𝐺1 and 𝐺2 . The double pairing assumption can only hold when there is no efficiently computable non-trivial homomorphism πœ“ : 𝐺1 β†’ 𝐺2 , since otherwise π‘Ÿ = πœ“(𝑔𝑑 ) and 𝑑 = πœ“(π‘”π‘Ÿ ) would be a solution to the double pairing problem. This means the double pairing assumption does not hold in bilinear groups of Type 1 and the reverse double pairing assumption does not hold in bilinear groups of Type 1 or Type 2. In contrast, the simultaneous triple pairing assumption and the reverse simultaneous triple pairing assumption are plausible in all types of bilinear groups.

3.1

Security Analysis of the Double Pairing Assumption

The double pairing assumption is a new assumption. To gain confidence in the double pairing assumption, we will now show that it is implied by the decision Diffie-Hellman assumption in 𝐺1 . Definition 9 (Decision Diffie-Hellman assumption) The decision Diffie-Hellman assumption holds in 𝐺1 for 𝒒 if for all non-uniform polynomial time adversaries π’œ we have [ ] Pr π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ) ; π‘”π‘Ÿ , 𝑔𝑑 ← 𝐺1 ; 𝜌 ← ℀𝑝 : π’œ(π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 , π‘”π‘ŸπœŒ , π‘”π‘‘πœŒ ) = 1 [ ] β‰ˆ Pr π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ) ; π‘”π‘Ÿ , 𝑔𝑑 ← 𝐺1 ; 𝜌, 𝜏 ← ℀𝑝 : π’œ(π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 , π‘”π‘ŸπœŒ , π‘”π‘‘πœ ) = 1 . Theorem 10 If the decision Diffie-Hellman assumption holds in 𝐺1 for 𝒒, then the double pairing assumption holds for 𝒒. Proof. We will show that an adversary π’œ that breaks the double pairing assumption with probability πœ–(π‘˜) can be used to build a decision Diffie-Hellman adversary ℬ that has advantage πœ–(π‘˜) βˆ’ 3/𝑝 in breaking the decision Diffie-Hellman problem. Given a Diffie-Hellman challenge (π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 , π‘”π‘ŸπœŒ , π‘”π‘‘πœ ), where 𝜏 may be random or may be equal to 𝜌, ℬ gives the challenge (π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 ) to π’œ. π’œ outputs a pair (π‘Ÿ, 𝑑) in response. ℬ outputs 1 if (π‘Ÿ, 𝑑) is a non-trivial pair so 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑑 , 𝑑) = 1 and 𝑒(π‘”π‘ŸπœŒ , π‘Ÿ)𝑒(π‘”π‘‘πœ , 𝑑) = 1, otherwise ℬ outputs 0. Let us look at the first distribution (π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 , π‘”π‘ŸπœŒ , π‘”π‘‘πœŒ ). There is πœ–(π‘˜) chance for π’œ outputting a non-trivial pair so 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑑 , 𝑑) = 1, in which case we will also have 𝑒(π‘”π‘ŸπœŒ , π‘Ÿ)𝑒(π‘”π‘‘πœŒ , 𝑑) = 1. So here ℬ has probability πœ–(π‘˜) of outputting 1. Let us now look at the second distribution (π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 , π‘”π‘ŸπœŒ , π‘”π‘‘πœ ). There is less than 3/𝑝 chance of π‘”π‘Ÿ = 1, 𝑔𝑑 = 1 or 𝜌 = 𝜏 . In case π‘”π‘Ÿ βˆ•= 1, 𝑔𝑑 βˆ•= 1 and 𝜌 βˆ•= 𝜏 , there is no non-trivial couple π‘Ÿ, 𝑑 such that 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑑 , 𝑑) = 1 and 𝑒(π‘”π‘ŸπœŒ , π‘Ÿ)𝑒(π‘”π‘‘πœ , 𝑑) = 1. β–‘

3.2

Security Analysis of the Simultaneous Triple Pairing Assumption

To gain confidence in the simultaneous triple pairing assumption, we will show that it follows from the decision linear assumption [BBS04]. The decision linear problem is to decide whether a tuple (𝑔1 , 𝑔2 , 𝑔3 , 𝑔1𝜌 , 𝑔2𝜎 , 𝑔3𝜏 ) has 𝜏 = 𝜌 + 𝜎 or 𝜏 is random. Definition 11 (Decision linear assumption) The decision linear assumption holds in 𝐺1 for 𝒒 if

7

for all non-uniform polynomial time adversaries π’œ we have: [ Pr π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ) ; 𝑔1 , 𝑔2 , 𝑔3 ← 𝐺1 ; 𝜌, 𝜎 ← ℀𝑝 : ] π’œ(π‘”π‘˜, 𝑔1 , 𝑔2 , 𝑔3 , 𝑔1𝜌 , 𝑔2𝜎 , 𝑔3𝜌+𝜎 ) = 1 [ β‰ˆ Pr π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ) ; 𝑔1 , 𝑔2 , 𝑔3 ← 𝐺1 ; 𝜌, 𝜎, 𝜏 ← ℀𝑝 : ] π’œ(π‘”π‘˜, 𝑔1 , 𝑔2 , 𝑔3 , 𝑔1𝜌 , 𝑔2𝜎 , 𝑔3𝜏 ) = 1 . Theorem 12 If the decision linear assumption holds in 𝐺1 for 𝒒, then the simultaneous triple pairing assumption holds for 𝒒. Proof. We will show how to convert an adversary π’œ that breaks the simultaneous triple pairing assumption with probability πœ–(π‘˜) into an adversary ℬ that has advantage πœ–(π‘˜) βˆ’ 11/𝑝 against the decision linear assumption. On a decision linear challenge (π‘”π‘˜, 𝑔1 , 𝑔2 , 𝑔3 , β„Ž1 , β„Ž2 , β„Ž3 ), ℬ picks 𝛼, 𝛽 ← ℀𝑝 at random, sets π‘”π‘Ÿ = 𝑔1 , β„Žπ‘Ÿ = β„Ž1 , 𝑔𝑠 = 𝑔2 , β„Žπ‘  = β„Ž2 , 𝑔𝑑 = 𝑔32 𝑔1𝛼 𝑔2𝛽 , β„Žπ‘‘ = β„Ž3 β„Žπ›Ό1 β„Žπ›½2 and runs (π‘Ÿ, 𝑠, 𝑑) ← π’œ(π‘”π‘˜, π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔𝑑 , β„Žπ‘‘ ). ℬ returns 1 if (π‘Ÿ, 𝑠, 𝑑) is a non-trivial solution to 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)𝑒(𝑔𝑑 , 𝑑) = 1

∧

𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)𝑒(β„Žπ‘‘ , 𝑑) = 1

𝛼

∧

𝑒(𝑔2 , 𝑠𝑑𝛽 )𝑒(𝑔3 , 𝑑) = 1,

∧

𝑒(𝑔1 , π‘Ÿπ‘‘ )𝑒(𝑔3 , 𝑑) = 1

and else it returns 0. Let us now analyze the success probability of ℬ. It is given a challenge (π‘”π‘˜, 𝑔1 , 𝑔2 , 𝑔3 , 𝑔1𝜌 , 𝑔2𝜎 , 𝑔3𝜏 ), where 𝜏 = 𝜌 + 𝜎 or 𝜏 is random. By the choice of (π‘”π‘Ÿ , 𝑔𝑠 , 𝑔𝑑 , β„Žπ‘Ÿ , β„Žπ‘  , β„Žπ‘‘ ) a solution (π‘Ÿ, 𝑠, 𝑑) to the simultaneous triple pairing problem 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)𝑒(𝑔𝑑 , 𝑑) = 1 ∧ 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)𝑒(β„Žπ‘‘ , 𝑑) = 1 also satisfies ( )( ) 𝑒(𝑔1 , π‘Ÿπ‘‘π›Ό )𝑒(𝑔3 , 𝑑) 𝑒(𝑔2 , 𝑠𝑑𝛽 )𝑒(𝑔3 , 𝑑) = 1 ( )𝜌 ( )𝜎 ∧ 𝑒(𝑔1 , π‘Ÿπ‘‘π›Ό )𝑒(𝑔3 , 𝑑) 𝑒(𝑔2 , 𝑠𝑑𝛽 )𝑒(𝑔3 , 𝑑) = 𝑒(𝑔3 , π‘‘πœŒ+πœŽβˆ’πœ ). Let us first analyze the case of 𝜏 being random. If 𝑔3 βˆ•= 1, 𝜏 βˆ•= 𝜌 + 𝜎, then a simultaneous triple pairing solution (π‘Ÿ, 𝑠, 𝑑) that also satisfies 𝑒(𝑔1 , π‘Ÿπ‘‘π›Ό )𝑒(𝑔3 , 𝑑) = 1 ∧ 𝑒(𝑔2 , 𝑠𝑑𝛽 )𝑒(𝑔3 , 𝑑) = 1 would by the latter equation given above have 𝑑 = 1. If 𝑔1 βˆ•= 1, 𝑔2 βˆ•= 1, 𝜌 βˆ•= 𝜎 the two equations above then imply π‘Ÿ = 1 and 𝑠 = 1, leading us to conclude that (π‘Ÿ, 𝑠, 𝑑) is trivial. Since the chance of 𝑔1 = 1 ∨ 𝑔2 = 1 ∨ 𝑔3 ∨ 𝜌 = 𝜎 ∨ 𝜏 = 𝜌 + 𝜎 is less than 5/𝑝, there is less than 5/𝑝 chance of outputting 1 when 𝜏 is chosen at random. Let us now analyze the case 𝜏 = 𝜌 + 𝜎. The simultaneous triple pairing problem given to π’œ is of the form (π‘”π‘˜, 𝑔1 , 𝑔2 , 𝑔32 𝑔1𝛼 𝑔2𝛽 , 𝑔1𝜌 , 𝑔2𝜎 , 𝑔3𝜏 𝑔1πœŒπ›Ό , 𝑔2πœŽπ›½ ). Assuming 𝑔1 βˆ•= 1, 𝑔2 βˆ•= 1, 𝜌 βˆ•= 𝜎 this corresponds to a standard triple pairing challenge conditioned on 𝑔1 βˆ•= 1, 𝑔2 βˆ•= 1, β„Ž1 βˆ•= β„Ž2 . So there is at least probability πœ–(π‘˜) βˆ’ 3/𝑝 chance that π’œ outputs a non-trivial solution (π‘Ÿ, 𝑠, 𝑑) so 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)𝑒(𝑔𝑑 , 𝑑) = 1 and 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)𝑒(β„Žπ‘‘ , 𝑑) = 1. Since 𝜏 = 𝜌 + 𝜎 and 𝜌 βˆ•= 𝜎, the two equations above tell us that such a solution (π‘Ÿ, 𝑠, 𝑑) also satisfies 𝑒(𝑔1 , π‘Ÿπ‘‘π›Ό )𝑒(𝑔3 , 𝑑) = 1 and 𝑒(𝑔2 , 𝑠𝑑𝛽 )𝑒(𝑔3 , 𝑑) = 1. Since there is probability at most 3/𝑝 for 𝑔1 = 1 ∨ 𝑔2 = 1 ∨ 𝜌 = 𝜎, we conclude that ℬ has probability at least πœ–(π‘˜) βˆ’ 6/𝑝 for outputting 1 when 𝜏 = 𝜌 + 𝜎. β–‘

4

Homomorphic Trapdoor Commitments to Group Elements

We will now present the homomorphic trapdoor commitment schemes. The setup algorithm generates a bilinear group (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) and the commitment schemes can commit to 𝑛 group elements from 𝐺2 . 8

4.1

Commitments based on the Double Pairing Assumption

We have message space β„³π‘π‘˜ = 𝐺𝑛2 , randomizer space β„›π‘π‘˜ = 𝐺2 and commitment space π’žπ‘π‘˜ = 𝐺𝑇 , where each of them are interpreted as a group using entry-wise multiplication. Setup: On input 1π‘˜ return π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ). Key generator: On input π‘”π‘˜ pick at random π‘”π‘Ÿ ← 𝐺1 βˆ– {1} and π‘₯1 , . . . , π‘₯𝑛 ← ℀𝑝 and define 𝑔1 = π‘”π‘Ÿπ‘₯1 , β‹… β‹… β‹… , 𝑔𝑛 = π‘”π‘Ÿπ‘₯𝑛 . The commitment key is π‘π‘˜ = (π‘”π‘˜, π‘”π‘Ÿ , 𝑔1 , . . . , 𝑔𝑛 ) and the trapdoor key is π‘‘π‘˜ = (π‘”π‘˜, π‘”π‘Ÿ , π‘₯1 , . . . , π‘₯𝑛 ). Commitment: Using commitment key π‘π‘˜ on input message (π‘š1 , . . . , π‘šπ‘› ) ∈ 𝐺𝑛2 pick randomizer π‘Ÿ ← 𝐺2 . The commitment is given by 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ)

𝑛 ∏

𝑒(𝑔𝑖 , π‘šπ‘– ).

𝑖=1

Trapdoor commitment: Using commitment key π‘π‘˜ and trapdoor key π‘‘π‘˜ generate an equivocal commitment 𝑐 ∈ 𝐺𝑇 by picking π‘Ÿ ← 𝐺2 and computing 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ) The corresponding equivocation key is π‘’π‘˜ = (π‘‘π‘˜, π‘Ÿ). 𝑛 Trapdoor opening: On an equivocal commitment 𝑐 ∈ 𝐺𝑇 to a message (π‘šβˆ 1 , . . . , π‘šπ‘› ) ∈ 𝐺2 using the 𝑛 βˆ’π‘₯𝑖 β€² equivocation key π‘’π‘˜, compute and return the trapdoor opening π‘Ÿ = π‘Ÿ 𝑖=1 π‘šπ‘– .

Theorem 13 (𝒒, 𝐾, com, Tcom, Topen) described above is homomorphic, perfectly trapdoor, and assuming the double pairing assumption holds for 𝒒 the commitment scheme is computationally binding. Proof. Given a commitment key π‘π‘˜ = (π‘”π‘˜, π‘”π‘Ÿ , 𝑔1 , . . . , 𝑔𝑛 ) it is straightforward to check the homomorphic property. For all (π‘š1 , . . . , π‘šπ‘› ), (π‘šβ€²1 , . . . , π‘šβ€²π‘› ) ∈ 𝐺𝑛2 and all π‘Ÿ, π‘Ÿβ€² ∈ 𝐺2 we have 𝑒(π‘”π‘Ÿ , π‘Ÿ)

𝑛 ∏

β€²

𝑒(𝑔𝑖 , π‘šπ‘– ) β‹… 𝑒(π‘”π‘Ÿ , π‘Ÿ )

𝑖=1

𝑛 ∏

𝑒(𝑔𝑖 , π‘šβ€²π‘– )

β€²

= 𝑒(π‘”π‘Ÿ , π‘Ÿπ‘Ÿ )

𝑖=1

𝑛 ∏

𝑒(𝑔𝑖 , π‘šπ‘– π‘šβ€²π‘– ).

𝑖=1

Next, we will prove that the commitment scheme has the perfect trapdoor property. By construction, π‘”π‘Ÿ βˆ•= 1 so both real commitments and trapdoor commitments are distributed uniformly at random in 𝐺𝑇 , because of their 𝑒(π‘”π‘Ÿ , π‘Ÿ) factor where π‘Ÿ is chosen randomly from 𝐺2 . The fact that π‘”π‘Ÿ βˆ•= 1 also implies that for any commitment 𝑐 and set of messages (π‘š1 , . . . , π‘šπ‘› ) ∈ 𝐺𝑛2 there is a unique randomβˆπ‘› izer π‘Ÿ ∈ 𝐺2 so 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ) 𝑖=1 𝑒(𝑔𝑖 , π‘šπ‘– ). To conclude the proof for the perfect trapdoor property, we therefore just need to show that the trapdoor opening algorithm gives the correct opening π‘Ÿβ€² of the commitment. This follows from β€²

𝑒(π‘”π‘Ÿ , π‘Ÿ )

𝑛 ∏ 𝑖=1

𝑒(𝑔𝑖 , π‘šπ‘– ) = 𝑒(π‘”π‘Ÿ , π‘Ÿ

𝑛 ∏

𝑖 π‘šβˆ’π‘₯ ) 𝑖

𝑖=1

𝑛 ∏

𝑒(π‘”π‘Ÿπ‘₯𝑖 , π‘šπ‘– ) = 𝑒(π‘”π‘Ÿ , π‘Ÿ) = 𝑐.

𝑖=1

Finally, we will prove that the commitment scheme is computationally binding if the double pairing assumption holds for 𝒒. We will show that if π’œ has probability πœ–(π‘˜) of breaking the binding property, then there is an algorithm ℬ that breaks the double pairing assumption with at least πœ–(π‘˜) βˆ’ 3/𝑝 chance. Let (π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑑 ) be a random double pairing challenge given to ℬ. If π‘”π‘Ÿ = 1 or 𝑔𝑑 = 1, it is trivial to break the double pairing assumption. If π‘”π‘Ÿ βˆ•= 1, 𝑔𝑑 βˆ•= 1 the double pairing adversary ℬ selects 𝜌1 , 𝜏1 , . . . , πœŒπ‘› , πœπ‘› ← ℀𝑝 and computes 𝑔1 = π‘”π‘ŸπœŒ1 π‘”π‘‘πœ1 , . . . , 𝑔𝑛 = π‘”π‘ŸπœŒπ‘› π‘”π‘‘πœπ‘› . It runs π’œ on (π‘”π‘˜, π‘”π‘Ÿ , 𝑔1 , . . . , 𝑔𝑛 ) and with πœ–(π‘˜) probability it gets two different openings to the same commitment. If the openings are π‘š1 , . . . , π‘šπ‘› , π‘Ÿ and π‘šβ€²1 , . . . , π‘šβ€²π‘› , π‘Ÿβ€² , we have by the homomorphic property of the commitment scheme 9

∏ βˆ’1 β€² β€² βˆ’1 β€² that 𝑒(π‘”π‘Ÿ , π‘Ÿβˆ’1 π‘Ÿβ€² ) 𝑛𝑖=1 𝑒(𝑔𝑖 , π‘šβˆ’1 𝑖 π‘šπ‘– ) = 1. Defining πœ‡1 = π‘š1 π‘š1 , . . . , πœ‡π‘› = π‘šπ‘› π‘šπ‘› this means we have ∏ 𝑛 βˆ’1 β€² 𝑒(π‘”π‘Ÿ , π‘Ÿ π‘Ÿ ) 𝑖=1 𝑒(𝑔𝑖 , πœ‡π‘– ) = 1 where at least one πœ‡π‘– βˆ•= 1. This implies 𝑒(π‘”π‘Ÿ , π‘Ÿβˆ’1 π‘Ÿβ€² )

𝑛 ∏

𝑒(π‘”π‘ŸπœŒπ‘– π‘”π‘‘πœπ‘– , πœ‡π‘– ) = 𝑒(π‘”π‘Ÿ , π‘Ÿβˆ’1 π‘Ÿβ€²

𝑖=1

𝑛 ∏

πœ‡πœŒπ‘– 𝑖 )𝑒(𝑔𝑑 ,

𝑖=1

𝑛 ∏

πœ‡πœπ‘– 𝑖 ) = 1.

𝑖=1

∏ This breaks the double pairing assumption unless π‘Ÿβˆ’1 π‘Ÿ 𝑖=1 πœ‡πœŒπ‘– 𝑖 = 1 and 𝑛𝑖=1 πœ‡πœπ‘– 𝑖 = 1 at the same time. However, since the πœŒπ‘– ’s are perfectly hidden by the πœπ‘– ’s, we have no more than 1/𝑝 chance of the latter equality holding when there is some πœ‡π‘– βˆ•= 1. β–‘ βˆπ‘› β€²

4.2

Commitments based on the Simultaneous Triple Pairing Assumption

We have message space β„³π‘π‘˜ = 𝐺𝑛2 , randomizer space β„›π‘π‘˜ = 𝐺22 and commitment space π’žπ‘π‘˜ = 𝐺2𝑇 , where each of them are interpreted as a group using entry-wise multiplication. Setup: On input 1π‘˜ return π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ). Key generator: On input π‘”π‘˜ pick at random 𝑔 ← 𝐺1 βˆ– {1} and π‘₯π‘Ÿ , π‘¦π‘Ÿ , π‘₯𝑠 , 𝑦𝑠 , π‘₯1 , 𝑦1 , . . . , π‘₯𝑛 , 𝑦𝑛 ← ℀𝑝 such that π‘₯π‘Ÿ 𝑦𝑠 βˆ•= π‘₯𝑠 π‘¦π‘Ÿ and define π‘”π‘Ÿ = 𝑔 π‘₯π‘Ÿ

β„Žπ‘Ÿ = 𝑔 π‘¦π‘Ÿ

𝑔𝑠 = 𝑔 π‘₯𝑠

β„Ž 𝑠 = 𝑔 𝑦𝑠

𝑔1 = 𝑔 π‘₯1

β„Ž1 = 𝑔 𝑦1 β‹… β‹… β‹… 𝑔𝑛 = 𝑔 π‘₯𝑛

β„Žπ‘› = 𝑔 𝑦𝑛 .

The commitment key is π‘π‘˜ = (π‘”π‘˜, π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔1 , β„Ž1 , . . . , 𝑔𝑛 , β„Žπ‘› ) and the trapdoor key is π‘‘π‘˜ = (π‘”π‘˜, 𝑔, π‘₯π‘Ÿ , π‘₯𝑠 , π‘¦π‘Ÿ , 𝑦𝑠 , π‘₯1 , 𝑦1 , . . . , π‘₯𝑛 , 𝑦𝑛 ). Commitment: Using commitment key π‘π‘˜ on input message (π‘š1 , . . . , π‘šπ‘› ) ∈ 𝐺𝑛2 pick randomizer (π‘Ÿ, 𝑠) ← 𝐺22 . The commitment is (𝑐, 𝑑) ∈ 𝐺2𝑇 given by 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)

𝑛 ∏

𝑒(𝑔𝑖 , π‘šπ‘– )

and

𝑑 = 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)

𝑖=1

𝑛 ∏

𝑒(β„Žπ‘– , π‘šπ‘– ).

𝑖=1

Trapdoor commitment: Using commitment key π‘π‘˜ and trapdoor key π‘‘π‘˜, generate an equivocal commitment (𝑐, 𝑑) ∈ 𝐺2𝑇 by picking (π‘Ÿ, 𝑠) ← 𝐺22 and computing 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)

and 𝑑 = 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠).

The corresponding equivocation key is π‘’π‘˜ = (π‘‘π‘˜, π‘Ÿ, 𝑠). Trapdoor opening: To trapdoor open an equivocal commitment (𝑐, 𝑑) ∈ 𝐺2𝑇 to a message (π‘š1 , . . . , π‘šπ‘› ) ∈ 𝐺𝑛2 using the equivocation key π‘’π‘˜, compute π‘Ž = π‘Ÿ π‘₯π‘Ÿ 𝑠 π‘₯𝑠

𝑛 ∏

𝑖 π‘šβˆ’π‘₯ 𝑖

and 𝑏 = π‘Ÿπ‘¦π‘Ÿ 𝑠𝑦𝑠

𝑖=1

Since π‘₯π‘Ÿ 𝑦𝑠 βˆ•= π‘₯𝑠 π‘¦π‘Ÿ we can compute (

𝛼 𝛽 𝛾 𝛿

𝑛 ∏ 𝑖=1

)

( =

π‘₯π‘Ÿ π‘₯𝑠 π‘¦π‘Ÿ 𝑦𝑠

)βˆ’1

Compute π‘Ÿβ€² = π‘Žπ›Ό 𝑏𝛽

and 𝑠′ = π‘Žπ›Ύ 𝑏𝛿 .

Return the opening (π‘Ÿβ€² , 𝑠′ ) of (𝑐, 𝑑) to message (π‘š1 , . . . , π‘šπ‘› ). 10

.

𝑖 π‘šβˆ’π‘¦ 𝑖 .

Theorem 14 (𝒒, 𝐾, com, Tcom, Topen) described above is a homomorphic trapdoor commitment scheme to 𝑛 group elements. It has the perfect trapdoor property and assuming the simultaneous triple pairing assumption holds for 𝒒 the commitment scheme is computationally binding. Proof. Given a commitment key π‘π‘˜ = (π‘”π‘˜, π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔1 , β„Ž1 , . . . , 𝑔𝑛 , β„Žπ‘› ) it is straightforward to check the homomorphic property. For all (π‘š1 , . . . , π‘šπ‘› ), (π‘šβ€²1 , . . . , π‘šβ€²π‘› ) ∈ 𝐺𝑛2 and all (π‘Ÿ, 𝑠), (π‘Ÿβ€² , 𝑠′ ) ∈ 𝐺22 we have 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠) 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)

𝑛 ∏

𝑒(𝑔𝑖 , π‘šπ‘– ) β‹… 𝑒(π‘”π‘Ÿ , π‘Ÿβ€² )𝑒(𝑔𝑠 , 𝑠′ )

𝑛 ∏

𝑖=1 𝑛 ∏

𝑖=1 𝑛 ∏

𝑖=1

𝑖=1

𝑒(β„Žπ‘– , π‘šπ‘– ) β‹… 𝑒(β„Žπ‘Ÿ , π‘Ÿβ€² )𝑒(β„Žπ‘  , 𝑠′ )

𝑒(𝑔𝑖 , π‘šβ€²π‘– ) = 𝑒(π‘”π‘Ÿ , π‘Ÿπ‘Ÿβ€² )𝑒(𝑔𝑠 , 𝑠𝑠′ )

𝑛 ∏

𝑒(𝑔𝑖 , π‘šπ‘– π‘šβ€²π‘– )

𝑖=1 𝑛 ∏

𝑒(β„Žπ‘– , π‘šβ€²π‘– ) = 𝑒(β„Žπ‘Ÿ , π‘Ÿπ‘Ÿβ€² )𝑒(β„Žπ‘  , 𝑠𝑠′ )

𝑒(β„Žπ‘– , π‘šπ‘– π‘šβ€²π‘– )

𝑖=1

Next, we will prove that the commitment scheme has the perfect trapdoor property. By construction, π‘₯π‘Ÿ 𝑦𝑠 βˆ•= π‘₯𝑠 π‘¦π‘Ÿ so (π‘₯π‘Ÿ , π‘¦π‘Ÿ ) and (π‘₯𝑠 , 𝑦𝑠 ) are linearly independent in β„€2𝑝 . We can deduce from this that both real commitments and trapdoor commitments are distributed uniformly at random in 𝐺2𝑇 , because of their 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠) and 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠) factors where π‘Ÿ, 𝑠 are chosen randomly from 𝐺2 . The linear independence of (π‘₯π‘Ÿ , π‘¦π‘Ÿ ) and (π‘₯𝑠 , 𝑦𝑠 ) also implies that for any pair (𝑐, 𝑑) ∈ 𝐺2𝑇 and a set of messages (π‘š1 , . . . , π‘šπ‘› ) ∈ 𝐺𝑛2 there is a unique randomizer (π‘Ÿ, 𝑠) ∈ 𝐺22 so 𝑐 = 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠)

𝑛 ∏

𝑒(𝑔𝑖 , π‘šπ‘– )

∧

𝑑 = 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠)

𝑖=1

𝑛 ∏

𝑒(β„Žπ‘– , π‘šπ‘– ).

𝑖=1

To conclude the proof for the perfect trapdoor property, we therefore just need to show that the trapdoor opening algorithm gives the correct opening (π‘Ÿβ€² , 𝑠′ ) of the commitment. Since ) ( ) ( )( π‘₯π‘Ÿ π‘₯𝑠 1 0 𝛼 𝛽 , = 0 1 π‘¦π‘Ÿ 𝑦𝑠 𝛾 𝛿 we have 𝑒(π‘”π‘Ÿ , π‘Ÿβ€² )𝑒(𝑔𝑠 , 𝑠′ ) = 𝑒(𝑔 π‘₯π‘Ÿ , π‘Žπ›Ό 𝑏𝛽 )𝑒(𝑔 π‘₯𝑠 , π‘Žπ›Ύ 𝑏𝛿 ) = 𝑒(𝑔, π‘Žπ‘₯π‘Ÿ 𝛼+π‘₯𝑠 𝛾 )𝑒(𝑔, 𝑏π‘₯π‘Ÿ 𝛽+π‘₯𝑠 𝛿 ) = 𝑒(𝑔, π‘Ž) 𝑒(β„Žπ‘Ÿ , π‘Ÿβ€² )𝑒(β„Žπ‘  , 𝑠′ ) = 𝑒(𝑔 π‘¦π‘Ÿ , π‘Žπ›Ό 𝑏𝛽 )𝑒(𝑔 𝑦𝑠 , π‘Žπ›Ύ 𝑏𝛿 ) = 𝑒(𝑔, π‘Žπ‘¦π‘Ÿ 𝛼+𝑦𝑠 𝛾 )𝑒(𝑔, π‘π‘¦π‘Ÿ 𝛽+𝑦𝑠 𝛿 ) = 𝑒(𝑔, 𝑏). ∏ ∏ 𝑖 we get By plugging in π‘Ž = π‘Ÿπ‘₯π‘Ÿ 𝑠π‘₯𝑠 𝑛𝑖=1 π‘šπ‘–βˆ’π‘₯𝑖 and 𝑏 = π‘Ÿπ‘¦π‘Ÿ 𝑠𝑦𝑠 𝑛𝑖=1 π‘šβˆ’π‘¦ 𝑖 β€²

β€²

𝑒(π‘”π‘Ÿ , π‘Ÿ )𝑒(𝑔𝑠 , 𝑠 ) 𝑒(β„Žπ‘Ÿ , π‘Ÿβ€² )𝑒(β„Žπ‘  , 𝑠′ )

𝑛 ∏

π‘₯π‘Ÿ π‘₯𝑠

𝑒(𝑔𝑖 , π‘šπ‘– ) = 𝑒(𝑔, π‘Ÿ 𝑠 )

𝑛 ∏

𝑖=1

𝑖=1

𝑛 ∏

𝑛 ∏

𝑒(β„Žπ‘– , π‘šπ‘– ) = 𝑒(𝑔, π‘Ÿπ‘¦π‘Ÿ 𝑠𝑦𝑠 )

𝑒(𝑔, π‘šπ‘₯𝑖 𝑖 βˆ’π‘₯𝑖 ) = 𝑒(π‘”π‘Ÿ , π‘Ÿ)𝑒(𝑔𝑠 , 𝑠) = 𝑐 𝑒(𝑔, π‘šπ‘–π‘¦π‘– βˆ’π‘¦π‘– ) = 𝑒(β„Žπ‘Ÿ , π‘Ÿ)𝑒(β„Žπ‘  , 𝑠) = 𝑑,

𝑖=1

𝑖=1

as we wanted. Finally, we will prove that the commitment scheme is computationally binding if the simultaneous triple pairing assumption holds for 𝒒. More precisely, we will show that if π’œ has probability πœ–(π‘˜) of breaking the binding property, then there is an algorithm ℬ that breaks the simultaneous triple pairing assumption with at least πœ–(π‘˜) βˆ’ 3/𝑝 chance. Let (π‘”π‘˜, π‘”π‘Ÿ , 𝑔𝑠 , 𝑔𝑑 , β„Žπ‘Ÿ , β„Žπ‘  , β„Žπ‘‘ ) be a random simultaneous triple pairing challenge for ℬ. Fix some 𝑔 βˆ•= 1 and let π‘₯π‘Ÿ = log𝑔 (π‘”π‘Ÿ ), π‘₯𝑠 = log𝑔 (𝑔𝑠 ), π‘¦π‘Ÿ = log𝑔 (β„Žπ‘Ÿ ), 𝑦𝑠 = log𝑔 (β„Žπ‘  ). We pick at random 𝜌1 , 𝜎1 , 𝜏1 , . . . , πœŒπ‘› , πœŽπ‘› , πœπ‘› ← ℀𝑝 and define 𝑔1 , β„Ž1 , . . . , 𝑔𝑛 , β„Žπ‘› by 𝑔𝑖 = π‘”π‘ŸπœŒπ‘– π‘”π‘ πœŽπ‘– π‘”π‘‘πœπ‘–

β„Žπ‘– = β„ŽπœŒπ‘Ÿ 𝑖 β„ŽπœŽπ‘  𝑖 β„Žπœπ‘‘ 𝑖 . 11

If (π‘₯π‘Ÿ , π‘¦π‘Ÿ ) and (π‘₯𝑠 , 𝑦𝑠 ) are linearly independent in β„€2𝑝 all these group elements are randomly distributed in 𝐺1 . This means π‘π‘˜ = (π‘”π‘˜, π‘”π‘Ÿ , β„Žπ‘Ÿ , 𝑔𝑠 , β„Žπ‘  , 𝑔1 , β„Ž1 , . . . , 𝑔𝑛 , β„Žπ‘› ) has the same distribution as commitment keys generated by 𝐾. ℬ gives this π‘π‘˜ to π’œ and in case π‘₯π‘Ÿ 𝑦𝑠 βˆ•= π‘₯𝑠 π‘¦π‘Ÿ it has πœ–(π‘˜) probability of getting two different messages (π‘š1 , . . . , π‘šπ‘› ), (π‘šβ€²1 , . . . , π‘šβ€²π‘› ) and randomizers (π‘Ÿ, 𝑠), (π‘Ÿβ€² , 𝑠′ ) so comπ‘π‘˜ (π‘š1 , . . . , π‘šπ‘› ; π‘Ÿ, 𝑠) = comπ‘π‘˜ (π‘šβ€²1 , . . . , π‘šβ€²π‘› ; π‘Ÿβ€² , 𝑠′ ). β€² βˆ’1 β€²β€² β€² βˆ’1 β€²β€² β€² βˆ’1 Define πœ‡1 = π‘šβ€²1 π‘šβˆ’1 1 , . . . , πœ‡π‘› = π‘šπ‘› π‘šπ‘› and π‘Ÿ = π‘Ÿ π‘Ÿ , 𝑠 = 𝑠 𝑠 . By the homomorphic property of β€²β€² β€²β€² the commitment scheme we have comπ‘π‘˜ (πœ‡1 , . . . , πœ‡π‘› ; π‘Ÿ , 𝑠 ) = (1, 1). This gives us β€²β€²

β€²β€²

𝑒(π‘”π‘Ÿ , π‘Ÿ )𝑒(𝑔𝑠 , 𝑠 )

𝑛 ∏

𝑒(𝑔𝑖 , πœ‡π‘– ) = 𝑒(π‘”π‘Ÿ , π‘Ÿ

β€²β€²

𝑖=1

𝑒(β„Žπ‘Ÿ , π‘Ÿβ€²β€² )𝑒(β„Žπ‘  , 𝑠′′ )

𝑛 ∏

𝑒(β„Žπ‘– , πœ‡π‘– ) = 𝑒(β„Žπ‘Ÿ , π‘Ÿβ€²β€²

𝑖=1

𝑛 ∏

πœ‡πœŒπ‘– 𝑖 )𝑒(𝑔𝑠 , 𝑠′′

𝑛 ∏

πœ‡πœŽπ‘– 𝑖 )𝑒(𝑔𝑑 ,

𝑛 ∏

𝑖=1

𝑖=1

𝑖=1

𝑛 ∏

𝑛 ∏

𝑛 ∏

πœ‡πœŒπ‘– 𝑖 )𝑒(β„Žπ‘  , 𝑠′′

𝑖=1

𝑖=1

πœ‡πœŽπ‘– 𝑖 )𝑒(β„Žπ‘‘ ,

πœ‡πœπ‘– 𝑖 ) = 1 πœ‡πœπ‘– 𝑖 ) = 1.

𝑖=1

Since (π‘š1 , . . . , π‘šπ‘› ) and (π‘šβ€²1 , . . . , π‘šβ€²π‘› ) are different, there is at least one πœ‡π‘– βˆ•= 1. Recall 𝑔𝑖 = π‘”π‘ŸπœŒπ‘– π‘”π‘ πœŽπ‘– π‘”π‘‘πœπ‘– and β„Žπ‘– = β„ŽπœŒπ‘Ÿ 𝑖 β„ŽπœŽπ‘  𝑖 β„Žπœπ‘‘ 𝑖 for random πœŒπ‘– , πœŽπ‘– , πœπ‘– ← ℀𝑝 . With (π‘₯π‘Ÿ , π‘¦π‘Ÿ ) and (π‘₯𝑠 , 𝑦𝑠 ) linearly independent in β„€2𝑝 there is for any πœπ‘–β€² a unique pair (πœŒβ€²π‘– , πœŽπ‘–β€² ) ∈ β„€2𝑝 that would yield 𝑔𝑖 , β„Žπ‘– .∏ This means from π’œβ€™s perspective πœπ‘– is a perfectly hidden random value in ℀𝑝 . The probability that 𝑛𝑖=1 πœ‡πœπ‘– 𝑖 = 1 is therefore at most 1/𝑝. Conditioned on π‘₯π‘Ÿ 𝑦𝑠 βˆ•= π‘₯𝑠 π‘¦π‘Ÿ the adversary ℬ breaks the simultaneous triple pairing problem with probability πœ–(π‘˜) βˆ’ 1/𝑝. There is less than 2/𝑝 chance for the discrete satisfying π‘₯ π‘Ÿ 𝑦𝑠 = π‘₯ 𝑠 π‘¦π‘Ÿ . βˆπ‘› logarithms πœŒπ‘– β€²β€² βˆπ‘› πœπ‘– πœŽπ‘– βˆπ‘› β€²β€² We conclude that ℬ has more than πœ–(π‘˜) βˆ’ 3/𝑝 chance of (π‘Ÿ 𝑖=1 πœ‡π‘– ) being a 𝑖=1 πœ‡π‘– , 𝑖=1 πœ‡π‘– , 𝑠 non-trivial solution to the simultaneous triple pairing problem. β–‘

5

Committing to Commitments

Recall the Pedersen commitment to multiple elements from public key consists of 𝛾1 , . . . , π›Ύπ‘š , β„Ž ∏ ℀𝑝 . The π‘šπ‘– for 𝑑 ← ℀𝑝 . Since Pedersen commit𝛾 and we commit to π‘š1 , . . . , π‘šπ‘š ∈ ℀𝑝 by computing 𝑐 = β„Žπ‘‘ π‘š 𝑖=1 𝑖 ments are group elements, we can use one of our commitment schemes to commit to multiple Pedersen commitments. Each Pedersen commitment can hold π‘š elements from ℀𝑝 so we get a commitment to π‘šπ‘› elements from ℀𝑝 . Since our commitment scheme is homomorphic with respect to multiplication in 𝐺2 and the Pedersen commitments are homomorphic with respect to addition in ℀𝑝 , the combined commitment scheme is homomorphic with respect to addition in ℀𝑝 . Moreover, since our commitment schemes is a perfectly hiding trapdoor commitment scheme, the combined commitment scheme is also a perfectly hiding trapdoor commitment scheme. The binding property relies on the discrete logarithm assumption in 𝐺2 and either the double pairing assumption or the simultaneous triple pairing assumption. We will now give the full protocol for the combined commitment scheme3 , where (𝒒, 𝐾, com, Tcom, Topen) is one of our commitment schemes for 𝑛 elements in 𝐺2 . Setup: On input 1π‘˜ return π‘”π‘˜ = (𝑝, 𝐺1 , 𝐺2 , 𝐺𝑇 , 𝑒) ← 𝒒(1π‘˜ ). Key generator: On input π‘”π‘˜ pick at random 𝛾1 , . . . , π›Ύπ‘š , β„Ž ← 𝐺2 βˆ– {1} and (π‘π‘˜, π‘‘π‘˜) ← 𝐾(π‘”π‘˜). The commitment key is (π‘π‘˜, 𝛾1 , . . . , π›Ύπ‘š , β„Ž) and the trapdoor key is π‘‘π‘˜. 3

The commitment scheme can be simplified by omitting the β„Ž component in the Pedersen commitment scheme, since we only need the binding property of the Pedersen commitment scheme. The trapdoor property will follow from the trapdoor property of our commitment scheme, even if the simplified Pedersen commitment scheme is not hiding. For conceptual simplicity we have opted for maintaining the unmodified Pedersen commitments in our description, which may also be useful in some cases as the full Pedersen commitment scheme provides an alternative trapdoor.

12

Commitment: On message (π‘š11 , . . . , π‘šπ‘šπ‘› ) ∈ β„€π‘šπ‘› pick π‘Ÿ ← β„›π‘π‘˜ and 𝑑1 , . . . , 𝑑𝑛 ← ℀𝑝 and compute 𝑝 𝑐 = comπ‘π‘˜ (𝑐1 , . . . , 𝑐𝑛 ; π‘Ÿ)

where

𝑐𝑗 = β„Žπ‘‘π‘—

π‘š ∏

π‘šπ‘–π‘—

𝛾𝑖

.

𝑖=1

Trapdoor commitment: Generate an equivocal commitment (𝑐, π‘’π‘˜) ← Tcomπ‘π‘˜ (π‘‘π‘˜). Trapdoor opening: To trapdoor open the equivocal commitment 𝑐 to a message (π‘š11 , . . . , π‘šπ‘šπ‘› ) ∈ β„€π‘šπ‘› pick 𝑑1 , . . . , 𝑑𝑛 ← ℀𝑝 and using the equivocation key π‘’π‘˜ generate π‘Ÿβ€² = Topenπ‘’π‘˜ (𝑐, 𝑐1 , . . . , 𝑐𝑛 ), 𝑝 ∏ π‘šπ‘–π‘— where 𝑐𝑗 = β„Žπ‘‘π‘— π‘š . 𝑖=1 𝛾𝑖 The public key consists of 𝑛 + 1 group elements in 𝐺1 and π‘š + 1 group elements in 𝐺2 if we base it on the double pairing assumption, and the public key consists of 2𝑛 + 4 group elements in 𝐺1 and π‘š + 1 group elements in 𝐺2 if we base it on the simultaneous triple pairing assumption. This means that unlike the Pedersen commitment scheme the combined commitment scheme enjoys having both a sub-linear size public key and constant size commitments. The following theorem shows that the combined commitment scheme is secure. Theorem 15 The combined commitment scheme is homomorphic, perfect trapdoor, and computationally binding assuming the discrete logarithm problem is hard in 𝐺2 and assuming (𝒒, 𝐾, com) is computationally binding. Proof. Let us first show that the combined commitment scheme is homomorphic, since both the underlying commitment schemes are homomorphic. We have for all choices of π‘Ÿ, 𝑑1 , . . . , 𝑑𝑛 , π‘š11 , . . . , π‘šπ‘šπ‘› and π‘Ÿβ€² , 𝑑′1 , . . . , 𝑑′𝑛 , π‘šβ€²11 , . . . , π‘šβ€²π‘šπ‘› that comπ‘π‘˜ (β„Žπ‘‘1

π‘š ∏

π›Ύπ‘–π‘šπ‘–1 , . . . , β„Žπ‘‘π‘›

𝑖=1

= comπ‘π‘˜ (β„Žπ‘‘1

β€²

π›Ύπ‘–π‘šπ‘–1 β‹… β„Žπ‘‘1

𝑖=1 β€²

β€²

π›Ύπ‘–π‘šπ‘–π‘› ; π‘Ÿ) β‹… comπ‘π‘˜ (β„Žπ‘‘1

𝑖=1

π‘š ∏

= comπ‘π‘˜ (β„Žπ‘‘1 +𝑑1

π‘š ∏

π‘š ∏

π‘šπ‘–1β€²

𝛾𝑖

𝑖=1

π‘šπ‘–1 +π‘šβ€²π‘–π‘—

𝛾𝑖

π‘šπ‘–1β€²

β€²

𝛾𝑖

, . . . , β„Žπ‘‘π‘›

π‘š ∏

π‘šβ€²π‘–π‘›

𝑖=1

, . . . , β„Žπ‘‘π‘›

𝑖=1

π‘š ∏

π‘š ∏

π‘š ∏ 𝑖=1

β€²

, . . . , β„Žπ‘‘π‘› +𝑑𝑛

π‘š ∏

π‘šπ‘–π‘› +π‘šβ€²π‘–π‘›

𝛾𝑖

β€²

π›Ύπ‘–π‘šπ‘–π‘› β‹… β„Žπ‘‘π‘›

π‘š ∏

π‘šβ€²π‘–π‘›

𝛾𝑖

; π‘Ÿβ€² )

𝑖=1

𝛾𝑖

; π‘Ÿ β‹… π‘Ÿβ€² )

𝑖=1

; π‘Ÿπ‘Ÿβ€² ),

𝑖=1

which is a commitment to π‘š11 + π‘šβ€²11 , . . . , π‘šπ‘šπ‘› + π‘šβ€²π‘šπ‘› using randomness π‘Ÿπ‘Ÿβ€² , 𝑑1 + 𝑑′1 , . . . , 𝑑𝑛 + 𝑑′𝑛 . To see that a trapdoor opening is perfectly indistinguishable from a real opening, observe first that both in ∏ real commitments and in trapdoor openings we have Pedersen commitments 𝑐1 , . . . , 𝑐𝑗 where π‘šπ‘–π‘— 𝑐𝑗 = β„Žπ‘‘π‘— π‘š for random 𝑑𝑗 . The perfect trapdoor property of our commitment schemes therefore 𝑖=1 𝛾𝑖 gives us that the combined commitment scheme has identical probability distributions of real openings and trapdoor openings. To see that the combined commitment scheme is binding, consider an adversary that produces two different openings of the same commitment. If the two openings lead to two different sets of Pedersen commitments 𝑐1 , . . . , 𝑐𝑛 then it is a breach of the binding property of (𝒒, 𝐾, com). If on the other hand both openings lead to the same Pedersen commitments 𝑐1 , . . . , 𝑐𝑛 , then there must be at least one of the Pedersen commitments that has been opened in two different ways leading to a breach of the binding property of the Pedersen commitment scheme. Since the Pedersen commitment scheme is binding if the discrete logarithm assumption holds in 𝐺2 , we conclude that the discrete logarithm assumption in 𝐺2 and the binding property of (𝒒, 𝐾, com) implies the binding property of the combined commitment scheme. β–‘

13

Honest Verifier Zero-Knowledge Argument of Knowledge. While reducing the key size for homomorphic commitments is interesting in its own right, another concern that comes up in practice is that they have large openings that grow linearly in the number of committed values. We will now show that the combined commitment scheme has an efficient 3-move honest verifier zero-knowledge argument of knowledge, which in some applications means that we do not have to reveal the entire opening. This stands in contrast to the standard Pedersen commitment to multiple messages, where all known practical zero-knowledge arguments of knowledge have a size that grows linearly in the number of field elements we have committed to. It is possible to give similar types of efficient honest verifier zero-knowledge arguments for statements such as all the committed values being 0 or the committed values having a particular sum. Let 𝛾1 , . . . , π›Ύπ‘š , β„Ž be the commitment key for a Pedersen commitment to π‘š exponents and let π‘π‘˜ be a commitment key for one of our commitments scheme. The statement is a commitment 𝑐 ∈ π’žπ‘π‘˜ and the prover wants to give an argument of knowledge of the contents of 𝑐. The prover’s private input βˆπ‘š π‘šπ‘–π‘— 𝑑 𝑗 consists of π‘Ÿ ∈ β„›π‘π‘˜ and π‘š11 , . . . , π‘šπ‘šπ‘› ∈ ℀𝑝 so 𝑐 = comπ‘π‘˜ (𝑐1 , . . . , 𝑐𝑛 ; π‘Ÿ), where 𝑐𝑗 = β„Ž . The 𝑖=1 𝛾𝑖 argument runs as follows. ∏ 𝑑𝑖 β€² 1. The prover sends 𝑐′ = comπ‘π‘˜ (𝑐′1 , . . . , 𝑐′𝑛 ; π‘Ÿβ€² ) and 𝑐𝑑 = β„Žπ‘‘ π‘š 𝑖=1 𝛾𝑖 to the verifier, where π‘Ÿ ← β„›π‘π‘˜ 𝑑 β€² β€² 𝑗 with 𝑐𝑗 = β„Ž for 𝑑1 , . . . , 𝑑𝑛 ← ℀𝑝 and 𝑑, 𝑑1 , . . . , π‘‘π‘š ← ℀𝑝 . 2. The verifier sends the prover random challenges 𝑒, 𝑒1 , . . . , 𝑒𝑛 ← ℀𝑝 . βˆ‘π‘› βˆ‘π‘› β€² β€²β€² 𝑒 β€² β€²β€² 𝑒 β€² , . . . , 𝑐′′ = 𝑐𝑒 𝑐′ and 𝑑′ = 𝑒 3. The prover answers 𝑛 𝑛 𝑛 𝑗=1 𝑒𝑗 𝑑𝑗 + 𝑗=1 𝑒𝑗 𝑑𝑗 + βˆ‘π‘› with π‘Ÿ = π‘Ÿ π‘Ÿ , 𝑐1 = 𝑐1 𝑐1βˆ‘ 𝑛 𝑑, π‘š1 = 𝑑1 + 𝑒 𝑗=1 𝑒𝑗 π‘š1𝑗 , . . . , π‘šπ‘š = π‘‘π‘š + 𝑒 𝑗=1 𝑒𝑗 π‘šπ‘šπ‘— . ∏ β€² ∏ π‘šπ‘– 4. The verifier accepts if 𝑐𝑒 𝑐′ = comπ‘π‘˜ (𝑐′′1 , . . . , 𝑐′′𝑛 ; π‘Ÿβ€²β€² ) and 𝑐𝑑 𝑛𝑗=1 (𝑐′′𝑗 )𝑒𝑗 = β„Žπ‘‘ π‘š 𝑖=1 𝛾𝑖 . The complexity of this argument is roughly 𝑛 or 2𝑛 pairings (depending on the commitment scheme), π‘š + 𝑛 exponentiations and π‘šπ‘› multiplications for the prover, and 𝑛 or 2𝑛 pairings (depending on the commitment scheme) and 𝑛 + π‘š exponentiations for the verifier. The communication is roughly 2𝑛 + π‘š group and field elements. In other words, it is in all aspects significantly shorter and faster than the process of committing, opening, and verifying the opening of the commitment. The following theorem shows that it is an honest verifier zero-knowledge argument of knowledge of the contents of the commitment 𝑐. Theorem 16 The protocol given above is a 3-move honest verifier zero-knowledge argument of knowledge of the contents of the commitment 𝑐. Proof. The protocol clearly has 3 moves and it can be verified directly that it has perfect completeness. We will now show that the protocol has perfect special honest verifier zero-knowledge. By this we mean that given a challenge 𝑒, 𝑒1 , . . . , 𝑒𝑛 it is possible to perfectly simulate the entire argument. The simulation works as follows, the simulator picks random commitments 𝑐′′1 , . . . , 𝑐′′𝑛 and randomizer π‘Ÿβ€²β€² and computes 𝑐′ = π‘βˆ’π‘’ comπ‘π‘˜ (𝑐′′1 , . . . , 𝑐′′𝑛 ; π‘Ÿβ€²β€² ). It also picks π‘š1 , . . . , π‘šπ‘› and 𝑑′ at random and computes 𝑐𝑑 = β€² βˆπ‘š π‘š 𝑖 βˆπ‘› 𝑑 β€²β€² βˆ’π‘’π‘— . The simulated argument is (𝑐 , 𝑐′ , 𝑒, 𝑒 , . . . , 𝑒 , π‘Ÿ β€²β€² , 𝑐′′ , . . . , 𝑐′′ , 𝑑′ , π‘š , . . . , π‘š ). β„Ž 1 𝑛 1 π‘š 𝑑 𝑛 1 𝑖=1 𝛾𝑖 𝑗=1 (𝑐𝑗 ) To see this is a perfect simulation when the challenge is 𝑒, 𝑒1 , . . . , 𝑒𝑛 , observe that both in a real argument and in a simulated argument the values π‘Ÿβ€²β€² , 𝑐′′1 , . . . , 𝑐′′𝑛 and 𝑑′ , π‘š1 , . . . , π‘šπ‘š are uniformly random. Conditioned on these values, both 𝑐′ and 𝑐𝑑 can be determined uniquely. Real arguments and simulated arguments are therefore identically distributed. Finally, we will show that the protocol is an argument of knowledge. Consider an adversary π’œ that has probability of πœ–(π‘˜) of making an acceptable argument, we will show that there is an expected polynomial time black-box witness-extended emulator ℬ that has success-probability πœ–(π‘˜)βˆ’negligible(π‘˜) of answering a random challenge 𝑒, 𝑒1 , . . . , 𝑒𝑛 and at the same time outputting an opening of the commitment. 14

ℬ runs π’œ using a random challenges 𝑒, 𝑒1 , . . . , 𝑒𝑛 . If π’œ fails to produce an acceptable argument, we are done. However, with probability πœ–(π‘˜) it does produce an accepting argument on the challenge, and ℬ needs to extract an opening of the commitment. ℬ rewinds π’œ to the point where it has sent the initial message and selects new random challenges 𝑒, 𝑒1 , . . . , 𝑒𝑛 (it is possible, although unlikely, that the same challenge will repeat) until it has 2𝑛 + 1 acceptable arguments with the same initial message 𝑐𝑑 , 𝑐′ . Since π’œ has probability πœ–(π‘˜) chance of making an accepting argument in the first place, and collecting 2𝑛 + 1 acceptable arguments will take an average of 2𝑛+1 πœ–(π‘˜) rewinds, we get that on average ℬ uses 2𝑛 + 1 runs of π’œ. Let us now look at accepting challenges collected by ℬ. Since ℬ runs an expected 2𝑛 + 1 runs of π’œ, which is expected polynomial time, there is an overwhelming probability that two of the accepting arguments use different challenges. With two different challenges 𝑒 βˆ•= 𝑒ˆ we get two equations 𝑐𝑒 𝑐′ = comπ‘π‘˜ (𝑐′′1 , . . . , 𝑐′′𝑛 ; π‘Ÿβ€²β€² ) and 𝑐𝑒ˆ𝑐′ = comπ‘π‘˜ (𝑐ˆ1 β€²β€² , . . . , 𝑐ˆ𝑛 β€²β€² ; π‘ŸΛ†β€²β€² ). From this we can compute an opening of 𝑐 and then compute an opening of 𝑐′ . By the binding property of the commitment scheme, these openings will be used by π’œ in all the accepting arguments when answering the challenges. Consider now the second part of the verification. All the accepting arguments satisfy 𝑛 ∏

𝑐𝑑 (𝑐′′𝑗 )𝑒𝑗 𝑗=1

=

𝑛 ∏

𝑐𝑑 (𝑐𝑒𝑗 𝑐′𝑗 )𝑒𝑗 𝑗=1

=

𝑐1𝑑

𝑛 ∏ 𝑗=1

𝑒𝑒 𝑐𝑗 𝑗

𝑛 ∏

(𝑐′𝑗 )𝑒𝑗 𝑗=1

𝑑′

=β„Ž

π‘š ∏

π›Ύπ‘–π‘šπ‘– .

𝑖=1

With overwhelming probability the 2𝑛 + 1 challenge vectors (1, 𝑒𝑒1 , . . . , 𝑒𝑒𝑛 , 𝑒1 , . . . , 𝑒𝑛 ) are linearly independent. The 2𝑛 + 1 equations given by the accepting arguments then make it possible to extract openings of all the commitments 𝑐1 , . . . , 𝑐𝑛 . We conclude that the probability is negligible for π’œ making a valid argument, yet ℬ not being able to extract an opening of 𝑐. β–‘

References [AHO10] Masayuki Abe, Kristiyan Haralambiev, and Miyako Ohkubo. Signing on elements in bilinear groups for modular protocol design. Cryptology ePrint Archive, Report 2010/133, 2010. [BBS04] Dan Boneh, Xavier Boyen, and Hovav Shacham. Short group signatures. In CRYPTO, volume 3152 of Lecture Notes in Computer Science, pages 41–55, 2004. [BGN05] Dan Boneh, Eu-Jin Goh, and Kobbi Nissim. Evaluating 2-DNF formulas on ciphertexts. In TCC, volume 3378 of Lecture Notes in Computer Science, pages 325–341, 2005. [Bra00]

Stefan Brands. Rethinking Public Key Infrastructures and Digital Certificates; Building in Privacy. MIT Press, 2000.

[BW06]

Xavier Boyen and Brent Waters. Compact group signatures without random oracles. In EUROCRYPT, volume 4004 of Lecture Notes in Computer Science, pages 427–444, 2006.

[DF02]

Ivan Damg˚ ard and Eiichiro Fujisaki. A statistically-hiding integer commitment scheme based on groups with hidden order. In ASIACRYPT, volume 2501 of Lecture Notes in Computer Science, pages 125–142, 2002.

[DN02]

Ivan Damg˚ ard and Jesper Buus Nielsen. Perfect hiding and perfect binding universally composable commitment schemes with constant expansion factor. In CRYPTO, volume 2442 of Lecture Notes in Computer Science, pages 581–596, 2002. Full paper available at http://www.brics.dk/RS/01/41/index.html.

[ElG85]

Taher ElGamal. A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Transactions on Information Theory, 31(4):469–472, 1985. 15

[FO97]

Eiichiro Fujisaki and Tatsuaki Okamoto. Statistical zero knowledge protocols to prove modular polynomial relations. In CRYPTO, volume 1294 of Lecture Notes in Computer Science, pages 16–30, 1997.

[FS01]

Jun Furukawa and Kazue Sako. An efficient scheme for proving a shuffle. In CRYPTO, volume 2139 of Lecture Notes in Computer Science, pages 368–387, 2001.

[GOS06] Jens Groth, Rafail Ostrovsky, and Amit Sahai. Non-interactive zaps and new techniques for NIZK. In CRYPTO, volume 4117 of Lecture Notes in Computer Science, pages 97–111, 2006. [GPS08] Steven D. Galbraith, Kenneth G. Paterson, and Nigel P. Smart. Pairings for cryptographers. Discrete Applied Mathematics, 156(16):3113–3121, 2008. [GQ88]

Louis C. Guillou and Jean-Jacques Quisquater. A practical zero-knowledge protocol fitted to security microprocessor minimizing both trasmission and memory. In EUROCRYPT, volume 330 of Lecture Notes in Computer Science, pages 123–128, 1988.

[Gro06]

Jens Groth. Simulation-sound NIZK proofs for a practical language and constant size group signatures. In ASIACRYPT, volume 4248 of Lecture Notes in Computer Science, pages 444– 459, 2006. Full paper available at http://www.brics.dk/∼jg/NIZKGroupSignFull.pdf.

[Gro09]

Jens Groth. Linear algebra with sub-linear zero-knowledge arguments. In CRYPTO, volume 5677 of Lecture Notes in Computer Science, pages 192–208, 2009.

[GS08]

Jens Groth and Amit Sahai. Efficient non-interactive proof systems for bilinear groups. In EUROCRYPT, volume 4965 of Lecture Notes in Computer Science, pages 415–432, 2008. Full paper available at http://eprint.iacr.org/2007/155.

[KZ06]

Aggelos Kiayias and Hong-Sheng Zhou. Concurrent blind signatures without random oracles. In SCN, volume 4116 of Lecture Notes in Computer Science, pages 49–62, 2006.

[Lip03]

Helger Lipmaa. On diophantine complexity and statistical zero-knowledge arguments. In ASIACRYPT, volume 2894 of Lecture Notes in Computer Science, pages 398–415, 2003.

[Nef01]

C. Andrew Neff. A verifiable secret shuffle and its application to e-voting. In ACM CCS, pages 116–125, 2001.

[OU98]

Tatsuaki Okamoto and Shigenori Uchiyama. A new public-key cryptosystem as secure as factoring. In EUROCRYPT, volume 1403 of Lecture Notes in Computer Science, pages 308– 318, 1998.

[Pai99]

Pascal Paillier. Public-key cryptosystems based on composite residuosity classes. In EUROCRYPT, volume 1592 of Lecture Notes in Computer Science, pages 223–239, 1999.

[Ped91]

Torben P. Pedersen. Non-interactive and information-theoretic secure verifiable secret sharing. In CRYPTO, volume 576 of Lecture Notes in Computer Science, pages 129–140, 1991.

16

Recommend Documents