On the Composition of 2-Prover Commitments and Multi-Round Relativistic Commitments. CWI Amsterdam

Size: px

Start display at page:

Download "On the Composition of 2-Prover Commitments and Multi-Round Relativistic Commitments. CWI Amsterdam"

Eugenia Kennedy
5 years ago
Views:

1 O the Compositio of 2-Prover Commitmets ad Multi-Roud Relativistic Commitmets Serge Fehr Max Filliger CWI Amsterdam

hold i quatum settig iterestig ope questios i quatum

2 Warig My talk: maily classical Still iterestig for you: topic (relativistic commitmets) some of our results hold i quatum settig iterestig ope questios i quatum settig Will use: ad to distiguish betwee classical ad quatum

Commitmet Schemes Commitmet scheme = digital aalogue of: puttig somethig i a vault ad revealig it later Security properties: hidig: verifier caot see

3 Commitmet Schemes Commitmet scheme = digital aalogue of: puttig somethig i a vault ad revealig it later Security properties: hidig: verifier caot see value iside commitmet bidig: prover caot chage his mid Importat cryptographic primitive, used for coi tossig zero-kowledge proofs multiparty computatio etc.

4 (Im)possibility Well kow / easy to see: scheme caot be ucoditioally hidig ad bidig Eve quatum commuicatio/computatio does ot help Need to restrict oe of the parties: computatioally-bouded prover (or verifier) prover (or verifier) with bouded (quatum) memory two-prover settig with o-commuicatig provers [BeOr,Goldreich,Kilia,Wigderso 1988]

5 Example Two-Prover Bit Commitmet Scheme PROVER P b! F 2, y! F 2 [Crépeau, Salvail, Simard, Tapp 2011] PROVER Q a! F 2 x := y + ab VERIFIER V commit? x " y = ab y ope

6 Example Two-Prover Bit Commitmet Scheme PROVER P [Crépeau, Salvail, Simard, Tapp 2011] b! F 2, y! Security: F 2 Hidig: obvious PROVER Q a! F 2 x := y + ab? x " y = ab VERIFIER V Bidig: opeig b = 0 # y = x both # Q kows a y commit opeig b = 1 # y = x "a Bidig: does still hold proof is more ivolved square-root loss ope

7 Relativistic Commitmet Schemes I essece: [Ket 1999, 2005 etc.] relativistic commitmet scheme = 2-prover commitmet scheme + assumptio eforced by special relativity

8 Example Relativistic Bit Commitmet Scheme PROVER P b! F 2, y! F 2 PROVER Q a! F 2 x := y " ab VERIFIER V commit? x " y = ab y ope Outside of the light coe!

9 Example Relativistic Bit Commitmet Scheme Disadvatage: PROVER P b! F 2, y! F 2 PROVER Q ope must take place veeeeeery shortly after commit a! F 2 x := y " ab VERIFIER V commit? x " y = ab y ope Outside of the light coe!

10 Multi-Roud Schemes Security requiremets: Hidig: util ope commit Bidig: from right after commit... ope hidig bidig sustai

11 A Multi-Roud Scheme [Lughi, Kaiewski, Bussières, Houlma, Tomamichel, Weher, Zbide 2014] b! F 2, y 0,y 1,...,y m! F 2 a 0! F 2 x 0 := y 0 " a 0 b a 1! F 2 F 2 $ F 2 commit a 2! F 2 x 2 := y 2 " a 2 y 1 x 1 := y 1 " a 1 y 0 sustai... compute y m-1,...,y 0 check x 0 " y 0 = ab y m ope

12 Previous Aalysis, ad Our Results Lughi et al. show: Theoretical aalysis: m-roud scheme is!-bidig with ". 2 Practical implemetatio: 2 m ca keep commitmet alive for 2 ms. doubly expoetial We show: New aalysis: m-roud scheme is!-bidig with ". m 2 2 # Usig data from their implemetatio: could keep commitmet alive for years!!!!

Previous Aalysis, ad Our Results Lughi et al. show: Actually, Theoretical aalysis: m-roud scheme is!-bidig with mai result: geeral compositio theorem ( ) based o: better uderstadig ".

13 Previous Aalysis, ad Our Results Lughi et al. show: Actually, Theoretical aalysis: m-roud scheme is!-bidig with mai result: geeral compositio theorem ( ) based o: better uderstadig ". 2 2 m of bidig property ( ) doubly expoetial Practical improved implemetatio: security aalysis follows as corollary ( ) ca keep commitmet alive for 2 ms. We show: Idepedet work (Chailloux, Chakraborty & Leverrier): New aalysis: m-roud scheme is!-bidig with Same improved boud o Lughi et al. scheme Tailored to the specific ". scheme m 2 2 # Much Usig less data geeral from their / less implemetatio: isightful could keep commitmet alive for years!!!!

14 Road Map 1. Itro 2. The Ituitio 3. Defiig the Bidig Property 4. The Compositio Theorem 5. Puttig Thigs together 6. Wrappig Up

15 The Lughi et al 2-Roud Scheme commitmet to b a 0! F 2 x 0 := y 0 " a 0 b sytactically: commitmet to ya 11! F 2 sytactically: commitmet to y 0 commit a 2! F 2 x 2 := y 2 " a 2 y 1 x 1 := y 1 " a 1 y 0 sustai y 2 ope opes commitmet to y 1

16 The Lughi et al Scheme - Schematically msg commit sustai 3147 ope

17 The Lughi et al Scheme - Schematically msg msg commit sustai 3147 Q: Is this compositio of commitmets still bidig? ope Subtle issue: i ope, provers could cheat origial commitmet. Ituitio: too late ow, they re ow committed to the opeig

18 Compositio of Commitmets msg 7305 =: CS 1 %CS 2.com 5922 CS 1 CS }=: CS 1 %CS 2.ope Compositio Theorem: If CS 1 & CS 2 are!- & "-bidig, the CS 1 %CS 2 is (!+")-bidig.

Security of the Lughi et al Scheme msg 5922 CS 0 CS 1 %CS 2 CS 2 = CS 0 %CS 1 %CS 2.com CS 1 3147 } 7305 = CS 0 %CS 1 %CS 2.

19 Security of the Lughi et al Scheme msg 5922 CS 0 CS 1 %CS 2 CS 2 = CS 0 %CS 1 %CS 2.com CS } 7305 = CS 0 %CS 1 %CS 2.ope CS 0 %(CS 1 %CS 2 ) By repeated applicatio of the compositio theorem: security of Lughi et al scheme with liear blow-up

20 Hurdles 1. Stadard defiitio: ufriedly for provig compositio Our solutio: itroduce ew yet equivalet defiitio show composability by meas of this ew defiitio (may be of idepedet iterest) 2. TBA

21 Road Map 1. Itro 2. The Ituitio 3. Defiig the Bidig Property 4. The Compositio Theorem 5. Puttig Thigs together 6. Wrappig Up

Defiig the (Ifo-Theoretic) Bidig Property Notatio: s! {0,1} & {'} = strig accepted by verifier p(s) = its distributio i case of a bit commitmet: b! {0,1,'} ad p(b) Ituitio: After committig,! ŝ!

22 Defiig the (Ifo-Theoretic) Bidig Property Notatio: s! {0,1} & {'} = strig accepted by verifier p(s) = its distributio i case of a bit commitmet: b! {0,1,'} ad p(b) Ituitio: After committig,! ŝ!{0,1} so that for ay ope s = ŝ s = ' except with small probability. Defiitio. A (2-prover) strig commitmet is!-bidig iff " commit! p(ŝ) " ope! p(ŝ,s) : p(ŝ ( s ( ') )! Remark: Is ot the strogest possible defiitio.

Equivalece to Stadard Defiitio Theorem. A (2-prover) bit commitmet is!-bidig iff " commit " ope0, ope1 : p(b0 = 0) + p(b1 = 1) ) 1+2! = commo defiitio, as used by [Crépeau et al.

23 Equivalece to Stadard Defiitio Theorem. A (2-prover) bit commitmet is!-bidig iff " commit " ope0, ope1 : p(b0 = 0) + p(b1 = 1) ) 1+2! = commo defiitio, as used by [Crépeau et al.], [Ket], [Lughi et al.], etc. Cor. The Crépeau et al. bit commitmet is 2 - -bidig. Cor. The Crépeau et al. bit commitmet is 2 -/2 -bidig. Recall: also eed security as strig commitmet...

24 Road Map 1. Itro 2. The Ituitio 3. Defiig the Bidig Property 4. The Compositio Theorem 5. Puttig Thigs together 6. Wrappig Up

25 Composig 2-Prover Commitmets s com PV com P com V ope Q C y CS com V com Q ope PQV CS ope P ope V C y ope Q CS = CS % CS ope V s Compositio Theorem: If CS & CS are!- & "-bidig, the CS%CS is (!+")-bidig.

ŷ : y $" ŷ (or =') Formal proof is more subtle: requires to glue together certai

26 Proof Sketch com PV ope PV com P com V ope P C com V com Q ope V C y ope V s ope Q To show: C! ŝ : s $!+" ŝ (or s =') ope V Proof: s *! ŝ : s * $! ŝ (or =')! ŷ : y $" ŷ (or =') Formal proof is more subtle: requires to glue together certai distributios, ad the argumet fails i the quatum settig # s = ope V (C, y ) $" ope V (C, ŷ ) = s * $! ŝ ŷ ope Q

27 Road Map 1. Itro 2. The Ituitio 3. Defiig the Bidig Property 4. The Compositio Theorem 5. Puttig Thigs together 6. Wrappig Up

28 (Almost) Doe? commitmet to b a 0! F 2 x 0 := y 0 " a 0 b sytactically: commitmet to ya 11! F 2 sytactically: commitmet to y 0 commit x 1 := y 1 " a 1 y 0 a 2! F 2 However: it is ot bidig!!! x 2 := y 2 " a 2 y 1 sustai Oly thig left to be show: y 2 ope opes commitmet to y 1 Crépeau et al. strig commitmet scheme is bidig

29 How to Deal with This Itroduce relaxed bidig property: fairly bidig ( ): allow ŝ ( s (', but the provers have o cotrol over s Show Crépeau et al. scheme 2 -/2 -fairly-bidig ( ) Exted compositio theorem to this relaxed versio ( ) Coclude security of Lughi et al. m -roud scheme as a fairly bidig strig commitmet scheme ( ) Show: fairly bidig # bidig whe s!{0,1} ( ) Corollary. Lughi et al. m -roud scheme is! -bidig with ". m 2 2

30 Summary Improved aalysis of Lughi et al. scheme: liear istead of doubly expoetial blow-up years istead of 2 ms O the way: better uderstadig of bidig property geeral compositio theorem(s) Ope problems: compositio for a larger class of schemes security for a stroger otio of bidig security agaist quatum attacks THANK YOU

Solutions to Problem Sheet 1

Solutions to Problem Sheet 1 Solutios to Problem Sheet ) Use Theorem.4 to prove that p log for all real x 3. This is a versio of Theorem.4 with the iteger N replaced by the real x. Hit Give x 3 let N = [x], the largest iteger x. The,