R. Ostrovsky, R. Venkatesan, M. Yung, Interactive Hashing Simplifies Zero-Knowledge Protocol Design, Eurocrypt 1993 proceedings, May 24-27 1993, Norway.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....are also black box transformations. Examples include the Collapse Theorem of Babai and Moran [BM88] the transformation of [FGM 89] from interactive proofs to ones with perfect completeness, and transformations of honest verifier zero knowledge proofs to general zero knowledge proofs [BMO90, OVY93, DGOW95, GSV98] The only exceptions we know of are those that exploit complete problems, such as [GMW91, BGKW88, LFKN92, Sha92] and typically this approach increases complexity to the maximum. For example, another way to prove that every problem possessing an interactive proof also has a ....

Rafail Ostrovsky, Ramarathnam Venkatesan, and Moti Yung. Interactive hashing simplifies zero-knowledge protocol design. In Proceedings of Eurocrypt `93, Lecture Notes in Computer Science. Springer-Verlag, 1993.

.... zero knowledge interactive proofs (SZKIPs) ffl (Honest verifier SZKIP vs Any (dishonest honest) verifier SZKIP) Bellare, Micali and Ostrovsky [BMO90] have proven that it is true under a number theoretic assumption (i.e. the difficulty of the discrete logarithm) Ostrovsky, Venkatesan and Yung [OVY93] have proven that it is also true under a more general assumption, the existence of one way permutations. However, if we require no computational assumption, only one restricted result by Damgard [Dam93] has been known previously: he has shown that it is true for a constant round and public ....

Ostrovsky, R., Venkatesan, R. and Yung, M.: Interactive Hashing Simplifies Zero-Knowledge Protocol Design. Proc. of Eurocrypt'93, LNCS, Springer--Verlag (1994)

....resolve the problem in this case Theorem 2 Every language having an Honest Verifier Statistical Zero Knowledge proof system, also has a general (public coin) Statistical Zero Knowledge proof. Results of similar nature were previously achieved under intractability assumptions (cf. BMO90, OVY93, Oka96] A weaker unconditional result was claimed in [DOY97] All these are discussed in detail below. But first we need to be somewhat more precise about the notions and issues discussed above. 1.1 Formal Setting The basic notions of interactive proofs [GMR89] are recalled in Appendix A. ....

Rafail Ostrovsky, Ramarathnam Venkatesan, and Moti Yung. Interactive hashing simplifies zero-knowledge protocol design. In Proceedings of Eurocrypt `93, Lecture Notes in Computer Science. Springer-Verlag, 1993.

....a better sampling protocol, which is optimal up to a constant factor. Our basic two party sampling protocol is very similar to a protocol, called interactive hashing, which was discovered independently by Ostrovsky et al. 20] Interactive hashing has found many applications in cryptography (cf. [20, 18, 21, 10]) For details see Remark 2. 2 Preliminaries 2.1 Bivariate Functions Throughout the paper we represent the bivariate function f : f0; 1g n Theta f0; 1g n 7 f0; 1g as an N by N matrix, where N def = 2 n . An entry, x; y) in the matrix which has value v (i.e. f(x; y) v) is called ....

.... Gamma 1 (rather than l) rounds. Interactive hashing was invented for completely different purposes and consequently its analysis as in [20] and subsequent studies) is very different from what appears above. Interactive hashing was used in implementing various types of commitment protocols (cf. [20, 18, 21, 10]) Main Result Combining Propositions 20 and 21 with Theorem 15, we get Theorem 22 (efficient protocol meeting the lower bound) There exists a (generic) two party protocol, for evaluating an arbitrary bivariate function f . This protocol is performed by a pair of uniform probabilistic ....

R. Ostrovsky, R. Venkatesan and M. Yung, "Interactive Hashing Simplifies ZeroKnowledge Protocol Design", Eurocrypt93.

....proof systems against an honest verifier, which we denote SZK. Usually one wants the zero knowledge condition to hold for all (even dishonest) polynomial time verifiers. Our results translate to this more general setting under cryptographic assumptions such as the existence of one way functions [8, 27, 12, 14, 26]. SZK contains a number of important problems, including GRAPH NONISOMORPHISM [19] a problem which is not known to be in NP. It also contains problems with cryptographic application and significance that are believed to be hard on average [22, 18] At the same time, the statistical ....

R. Ostrovsky, R. Venkatesan, andM. Yung. Interactive hashing simplifies zero-knowledge protocol design. In Proceedings of Eurocrypt `93, Lecture Notes in Computer Science. Springer-Verlag, 1993.

....fully resolve the problem in this case Theorem 2 Every language having an Honest Verifier Statistical Zero Knowledgeproof system, also has a general (public coin) Statistical Zero Knowledge proof. Results of similar nature were previously achievedunder intractability assumptions (cf. BMO90, OVY93, Oka96] A weaker unconditional result was claimed in [DOY97] All these are discussed in detail below. But first we need to be somewhat more precise about the notions and issues discussed above. 1.1 Formal Setting The basic notions of interactive proofs [GMR89] are recalled in Appendix A. ....

Rafail Ostrovsky, Ramarathnam Venkatesan, and Moti Yung. Interactive hashing simplifies zero-knowledge protocol design. In Proceedings of Eurocrypt `93, Lecture Notes in Computer Science. Springer-Verlag, 1993.

No context found.

R. Ostrovsky, R. Venkatesan, M. Yung, Interactive Hashing Simplifies Zero-Knowledge Protocol Design, Eurocrypt 1993 proceedings, May 24-27 1993, Norway.

No context found.

R. Ostrovsky, R. Venkatesan, and M. Yung. Interactive hashing simplifies zeroknowledge protocol design. In Advances in Cryptology - EUROCRYPT '93, Lecture Notes in Computer Science. Springer-Verlag, 1993.

No context found.

R. Ostrovsky, R. Venkatesan, and M. Yung. Interactive hashing simplifies zero-knowledge protocol design. In Advances in Cryptology - EUROCRYPT '93, Lecture Notes in Computer Science. Springer-Verlag, 1993.

.... unbounded) Other applications of interactive hashing: The technique of interactive hashing presented here were useful in constructing fail stop signatures [11] by replacing a collision free one way hash functions, and in designing zero knowledge proofs from honest verifier zero knowledge proofs [34, 10]. It would be interesting to know if further applications of the techniques to reduction of computational complexity assumptions are possible. One plausible scenario is replacing collision intractable hash functions used in the work of Kilian [25] and Micali [29] in order to reduce the ....

R. Ostrovsky, R. Venkatesan, M. Yung, Interactive Hashing Simplifies Zero-Knowledge Protocol Design, Advance in Cryptology - Eurocrypt '93, Lecture Notes in Computer Science 765, Springer-Verlag, 1994.

....g . ffl Each function g 2 GK is a permutation over f0; 1g K and is computable in polynomial time (that is, there exists an algorithm that given g 2 G, and x 2 f0; 1g computes the value of g(x) in time polynomial in jxj) 5 Interactive hashing has found many applications in cryptography (cf. [33, 29, 14, 34, 35, 18, 10, 6]) since, in some settings, it can replace collision resistant hash functions but it can be implemented from general cryptographic assumptions. The drawback of this primitive is its high round complexity (our protocol for a malicious server inherits this drawback; the question of how to reduce the ....

....that property 3 does not guarantee that specific bits of x are hard to find. Instead we will make use of hard core bits. We shall use in an essential way an interactive hashing protocol of Ostrovsky, Venkatesan and Yung [33] Interactive hashing found many applications in cryptography (cf. [33, 14, 29, 34, 35, 18, 10, 6]) This is a protocol between two players Alice and Bob, where both Alice and Bob are probabilistic polynomial time machines. Alice is given as an input 1 K , a function g 2 GK and an input x 2 f0; 1g K ; Bob is given 1 K . The interactive hashing protocol proceeds as follows: ffl Bob ....

R. Ostrovsky, R. Venkatesan, and M. Yung. Interactive hashing simplifies zeroknowledge protocol design. In Advances in Cryptology - EUROCRYPT '93, Lecture Notes in Computer Science. Springer-Verlag, 1993.

.... in implementing bit commitment protocols with players of unequal power [OVY2] It can also have applications to zero knowledge proofs, showing that any zero knowledge proof protocol designed for a honest verifier can be compiled into a zero knowledge proof protocol for any (even cheating) verifier [OVY3] based on general complexity assumptions (this was originally based on algebraic assumptions, e.g. for statistical zero knowledge proofs the discrete logarithm was used in [BMO] Another important implication is implementing perfectly secure zero knowledge arguments (defined in [BCC] based on ....

R. Ostrovsky, R. Venkatesan, M. Yung, Interactive Hashing Simplifies Zero-Knowledge Protocol Design, Eurocrypt 1993 proceedings, May 24-27 1993, Norway.

.... Is the highly interactive nature of our protocol (n Gamma 1 rounds) essential The techniques presented here were useful in constructing fail stop signatures [8] by replacing a collision free one way hash functions, and in designing zero knowledge proofs from honest verifier zero knowledge proofs [27, 7]. It would be interesting to know if further applications of the techniques to reduction of computational complexity assumptions are possible. One plausible scenario is replacing collision intractable hash functions used in the work of Kilian [19] and Micali [22] in order to reduce the ....

R. Ostrovsky, R. Venkatesan, M. Yung, Interactive Hashing Simplifies Zero-Knowledge Protocol Design, Advance in Cryptology - EUROCRYPT '93, Lecture Notes in Computer Science 765, Springer-Verlag, 1994.

....OE = OE 1 OE 2 then execute GenBCL(OE1 ; XZ1 ; a) and GenBCL(OE2 ; XZ2 ; a) Return. We can thus state the main result of this section: Theorem 7 If the language L has a noninteractive SZK proof system, then the language Phi(L) has a honest verifier SZK proof system. From the result of [39] (following the model of [6] it follows that: Corollary 1 Let L be a language with a noninteractive SZK proof system. If one way permutations exist, Phi(L) has a SZK proof system. Let L and L 0 be two languages and define OR(L;L 0 ) as the language of pairs (x 1 ; x 2 ) such FOCS 94 ....

R. Ostrovsky, R. Venkatesan, and M. Yung, Interactive Hashing Simplifies Zero-Knowledge Protocol Design, in Proc. of EUROCRYPT '93.

.... that are hiding can be fooled to answer queries unrelated to the actual input (by definition, it cannot make the connection of a query to an input) As long as the verifier is honest, it asks queries as needed and we can be sure that our protocol is honest verifier minimum knowledge (see e.g. [13], where assuming one way permutations exist, such protocols can be transformed into a minimum knowledge protocols) All of our protocols that are hiding are honest verifier minimum knowledge . The protocols in fact, involve multi queries (which we may allow the verifier to ask) we call these ....

....leaks no other information. Thus, a cheating verifier can only obtain more bits of knowledge than one by verifying several signatures in the same protocol, which seems harmless. In application where we need to control knowledge tightly, we can transform the protocol to be minimum knowledge [13]. Remark 2: The knowledge complexity of the above protocol can easily be reduced from k bits to merely one bit, without increasing the probability of success of a cheating prover. This can be done by having the verifier release the blinding factor ae just before the end of the protocol, so that ....

R. Ostrovsky, R. Venkatesan, and M. Yung, "Interactive Hashing Simplifies Zero Knowledge Protocol Design", Eurocrypt '90.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC