Keywords: cryptography, provable security, computational assumptions, zero-knowledge proofs, secure computation

Dans cette thèse, nous étudions les preuves à divulgation nulle de connaissance, une primitive cryptographique permettant de prouver une assertion en ne révélant rien de plus que sa véracité, et leurs applications au calcul sécurisé. Nous introduisons tout d'abord un nouveau type de preuves à divulgation nulle, appelées arguments implicites à divulgation nulle, intermédiaire entre deux notions existantes, les preuves interactives et les preuves noninteractives à divulgation nulle. Cette nouvelle notion permet d'obtenir les mêmes bénéfices en terme d'efficacité que les preuves non-interactives dans le contexte de la construction de protocoles de calcul sécurisé faiblement interactifs, mais peut être instanciée à partir des mêmes hypothèses cryptographiques que les preuves interactives, permettant d'obtenir de meilleures garanties d'efficacité et de sécurité. Dans un second temps, nous revisitons un système de preuves à divulgation nulle de connaissance qui est particulièrement utile dans le cadre de protocoles de calcul sécurisé manipulant des nombres entiers, et nous démontrons que son analyse de sécurité classique peut être améliorée pour faire reposer ce système de preuve sur une hypothèse plus standard et mieux connue. Enfin, nous introduisons une nouvelle méthode de construction de systèmes de preuves à divulgation nulle sur les entiers, qui représente une amélioration par rapport aux méthodes existantes, tout particulièrement dans un modèle de type client-serveur, où un client à faible puissance de calcul participe à un protocole de calcul sécurisé avec un serveur à forte puissance de calcul.

I have been struggling with this acknowledgment section for quite a time now. Writing a thesis takes some time, but it is made easier by the comfortable feeling that almost no one will ever read it, that all my inaccuracies, stylistically inappropriate sentences, and mistakes, are safely locked behind a wall of seemingly obscure mathematics. This is unfortunately not the case with the acknowledgment section, where I can expect to have a bunch of readers wondering why it has been already almost an entire paragraph, and yet they have still not seen their name. A noticeable proportion of those same readers should probably be listening to my presentation right now, if only to find out whether I'm almost done and they'll soon be able to drink champagne.

Anyway, it's now time to say thank you. There are many people I want to thank, and many more that I should thank, but will forget to. I have been staring at my screen for about five minutes already, trying to find an appropriate way to formulate it without success, so let's just put it simply: I apologize to all people that should have been mentioned there, but that I forgot. I cannot be completely sure because I cannot remember you right now, but I probably like you very much and would definitely include you in the acknowledgments, if it weren't for my bad memory. Also, a little bit of cash does usually a good job at refreshing my memory, just saying.

First of all, I want to thank David Pointcheval. I cannot express how grateful I am to you. Your guidance, from my master internship to my PhD thesis, has been invaluable, and you've always done a perfect job at encouraging me when I had ideas, helping me when I didn't, teaching me when I had questions, being friendly when I didn't, and pushing me to concentrate on the important things when I was trying to pursue all directions at once (and especially the useless ones). Working and interacting with you has always been a pleasure, and I'm constantly impressed at how you somehow manage to dedicate time to all students while dealing with a thousand other things in parallel, without ever looking overwhelmed by work -I've tried to sum the amount of time taken by all tasks you handle daily, but it always ends up way above 24 hours. I feel extremely lucky that I was supervised by you.

I am also very grateful to Hoeteck Wee. I always admire your intelligence and the sharpness of your remarks, and I enjoyed our discussions. Your advices have been precious to me, and you have an impressive high level view of things -probably because you're often looking at them from the window of a plane.

I want to thank the researchers with whom I had many wonderful discussions about crypto, complexity theory, or science in general. These discussions shaped my taste for theoretical computer science, and gave me a clear view of what I love about research and which goals I want to pursue. I am particularly thankful for that to Yuval Ishai, Pooya Farshim, and Chris Brzuska. I am looking forward to get more occasions to discuss or debate with you. I also had thrilling discussions with Alain Passelègue, even though I'm not sure that I entirely agree with his point that "no one ever prove non-trivial results in crypto, we cryptographers are just not good enough to do hard stuff".

I am grateful to Ivan Damgård and Jens Groth, who agreed to perform the tedious task of viireviewing my thesis, in spite of their busy schedules. I also want to thank Céline Chevalier, Jens Groth, Benoît Libert, and Yuval Ishai, who accepted to be part of my thesis jury. I want to thank the researchers who gave me the opportunity to visit them and their team: Jens Groth, for inviting me for one week at UCL in November 2015, Ivan Damgård, for inviting me in Aarhus to give a talk at the TPMPC 2016 workshop, Melissa Chase, for inviting me for one day at Microsoft Research when I was in Seattle in August 2016 (I also want to thank Josh Benaloh, with whom I had insightful discussions on e-voting there), Yuval Ishai and Amit Sahai, for inviting me for two weeks at UCLA in May 2017, and Dennis Hofheinz, who invited me twice at KIT so that I could get to meet my future colleagues. I also want to thank Dennis for offering me a postdoctoral position at KIT, I am already convinced that I will have a wonderful time there.

I would also like to thank my coauthors, without whom my research attempts would have been far less productive: Fabrice Benhamouda, Elette Boyle, Pyrros Chaidos, Niv Gilboa, Yuval Ishai, Michele Orrù, Thomas Peters, David Pointcheval, and Hoeteck Wee. I already expressed the depth of my gratitude to David and Hoeteck; among my coauthors, I also want to insist on the invaluable help and encouragements that I received from Fabrice Benhamouda (who is simultaneously a patient teacher, and an impressive problem solver), Thomas Peters (whose way of thinking and approach to research I really enjoyed), and Yuval Ishai (Hoeteck once told me "it's highly recommanded to talk to Yuval when you get occasions to, his view on things is extremely insightful". I could not agree more with this advice, and I'd like to add that it's impressive that Yuval seems to find time to share his fantastic way of thinking with many people around while at the same time writing eight papers at once). Getting to meet the three of you has been the core milestones toward becoming a researcher, during each of my three years of phd.

Having fun, hanging around, talking, and drinking coffee with colleagues is an important part of a phd. For that, I want to thank my colleagues at ENS: Michel Abdalla, Balthazar Bauer, Sonia Belaïd, Fabrice Benhamouda, Raphaël Bost, Florian Bourse, Céline Chevalier, Jérémy Chotard, Simon Cogliani, Mario Cornejo, Edouard Dufour Sans, Angelo De Caro, Rafaël Del Pino, Itai Dinur, Aurélien Dupin, Pierre-Alain Dupont, Pooya Farshim, Houda Ferradi, Georg Fuchsbauer, Romain Gay, Rémi Géraud, Dahmun Goudarzi, Giuseppe Guagliardo, Chloé Hébant, Julia Hesse, Duong Hieu Phan, Louiza Khati, Tancrède Lepoint, Baptiste Louf, Vadim Lyubashevsky, Pierrick Méaux, Thierry Mefenza, Michele Minelli, David Naccache, Anca Nitulescu, Michele Orrù, Alain Passelègue, Thomas Peters, David Pointcheval, Thomas Prest, Răzvan Roşie, Mélissa Rossi, Sylvain Ruhault, Olivier Sanders, Antonia Schmidt-Lademann, Adrian Thillard, Bogdan Ursu, Damien Vergnaud, and Hoeteck Wee. A special thanks goes to Florian, Rafaël, Pierrick, Romain, and Rémi, with whom I spent most of my time during conferences (for purely work-related reasons, obviously). I had also a lot of fun hanging around with Alain, Dahmun, Aurélien, the true Michele, the other Michele, Adrian, and Anca.

I would like to thank the administrative staff of the DI, and the members of the SPI: Jacques Beigbeder, Lise-Marie Bivard, Isabelle Delais, Nathalie Gaudechoux, Joëlle Isnard, Valérie Mongiat, Ludovic Ricardou, and Sophie Jaudon.

Looking further away in the past, I want to express my deepest gratitude to two wonderful people, who paved my way to mathematics and to research. The first of them is my grandfather, a crazy astronomer who enjoyed calculating integrals for fun, or playing the game "try to compute this square root on a calculator before I find the result by head". He would have loved to see the grandson he spent hours explaining trigonometry and logarithms ix to during holiday evenings doing a phd in science. He is the one who taught me the beauty of mathematics. The second is Pierre-François Berger, my math teacher from preparatory class for entrance to Grandes Ecoles, another crazy person with a wonderful sense for the beauty of mathematics who, in spite of all my laziness, never stopped to believe that I could succeed in math. Without his passion and his tireless support, I would never have believed it myself.

Looking even further away in the past, I have been blessed from the start with a wonderful family, without which none of this would have been possible. I owe so much to my parents that I could never express it with words. They always maintained a perfect balance between giving me the freedom of building my own experiences, and pushing me toward doing what was right, to ensure that I would not miss opportunities nor have regrets. They also managed to accept my strange tastes, especially for music, which was not an obvious task. I also want to thank my brothers and sisters for their love and support. And the dog. I'm from a family where it's important to mention the dog, too. Thank you, dog. 1 I cannot name all friends who made these last three years so fun and enjoyable, if only because I would forget to mention people that counted a lot for me. I still want to thank two people in particular, Patrick Lambein and Geoffrey Poncelet, for too many reasons to list them.

Last and above all, I want to thank Camille Jandot. Being by your side for the last four years has been the best thing that ever happened to me, and I could not imagine life without you. I am also grateful to all the efforts you made to bear my tendencies to constantly talk about crypto.

Introduction

Historically, cryptography has been concerned with the design of ciphers, or encryption schemes, with the goal of permitting secure communication between distant parties in the presence of an eavesdropper. In the last half-century, however, its purpose evolved considerably. Nowadays, cryptography is concerned with the broad task of designing methods that allow to realize some specified functionality, while preventing malicious abuse of the functionality. This imprecise definition calls for a better understanding of what we can know, or assume, about the behavior of a malicious user. We could think at first sight that we could design perfectly secure cryptographic schemes, for which malicious abuse would be provably impossible. However, the seminal work of Shannon on the theory of information has made this hopeless. Indeed, Shannon proved the following:

For any cipher that perfectly hides all information about the message, the secret key used to encrypt the message must be at least as long as the message itself.

Therefore, if one aims at constructing cipher that will provably withstand all malicious behaviors, this theorem considerably limits the efficiency of the cryptographic systems that one could design: for each message that must be transmitted securely, a key of the same length must have been securely exchanged first.

So, is security impossible to achieve? It is, if we do not want to assume anything about the adversary. However, if we are willing to make assumptions, we could hope to prove that even though no efficient cipher can hide all informations about a message, it would still be infeasible for an adversary with limited abilities to extract this information from the ciphertext. This raises the following question: which kind of limitation can we assume regarding an adversary?

It can be tempting to estimate that an attacker against a scheme will have to follow some natural strategy, and to design the scheme so as to make such natural strategies inefficient. However, this has long been known to be an unrealistic estimation, and is commonly illustrated by a famous quote of Bruce Schneier, which is known as Schneier's law: only he himself cannot break, but that will withstand even malicious strategies that he had not anticipated at the time of their design -even strategies imagined after the scheme was made public. And for this task, we need more realistic assumptions regarding the limitations of a malicious user. This is best put through the words of Oded Goldreich, in the preface of his book Foundations of Cryptography [START_REF] Goldreich | Foundations of Cryptography[END_REF]:

'We believe that it makes little sense to make assumptions regarding the specific strategy that an adversary may use. The only assumptions that can be justified refer to the computational abilities of the adversary.'

Without assuming anything about the strategies that a party will come up with, we are left with using the fact that this adversary necessarily has limited resources. Typically, it is very reasonable to assume that no user will be able to perform an immensely long computation. This guides the design and defines the goals of the security analysis of any cryptographic scheme: any malicious behavior that deviates from the specified purpose of the scheme should provably require too much resources to be mounted in practice.

Provable Security

The best scientists can do is fail to disprove things while pointing to how hard they tried.

-Richard Dawkins

For any cryptographic scheme to provide meaningful security guarantees, abusing the scheme should be a computationally difficult task. This requires, at the very least, that there exist computationally difficult tasks. In the theoretical study of algorithms, tasks that can be performed efficiently (in a computational sense) are formally defined as algorithms whose running time grows at most polynomially with the size of their inputs, which is known as the complexity class P. Therefore, to prove that a cryptographic scheme satisfies some security property, the cryptographer must show that no algorithm running in polynomial time can be able to perform the task of breaking this security property.

Unfortunately, we do not know how to do this. Broadly, tasks of interest for the design of functionalities are those that attempt to find a solution to a given problem, so that when a solution is found, anyone can efficiently verify that a valid solution has been found. The complexity class of all such problems is known as the class NP. The question of whether this class contains any problem that cannot be solved efficiently is the deepest and most intriguing open question of the theory of computation. In lack of a breakthrough providing insights regarding this incredibly hard question, we are left with assuming that such problems exist, and that specific problems that we know are of this kind. The choice of these problems can only be based on our trust in the fact that a long-standing resistance to all attempts of experts to design efficient algorithms solving these problems is an indication of security.

When proposing a new construction, a cryptographer could hope that it will attract attention from the cryptographic community, and will undergo a careful scrutiny, so that after some time, the scheme can be deemed secure. This is, however, hopeless in regard of the growing number of new cryptographic constructions that appear each year. The goal of provable security is to cope with this issue: rather than hoping that the security of a new scheme will eventually become a well-established assumption, we seek to show that the security of the scheme is, in fact, already captured by the strengths of an already well-established assumption. This is done by the mean of cryptographic reduction: a proof of security under a well-established assumption A is a proof that, if there is any adversary A that can abuse the scheme in polynomial time, then there must exist a polynomial adversary that will contradict the assumption A. Typically, such reductions are constructive, providing an explicit adversary A that runs A internally to break the assumption A. Therefore, provable security creates a network of seemingly unrelated primitives achieving very different goals, interconnected by their security reduction to a set of well-established assumptions. The foundations of this vast program have been laid in [START_REF] Goldwasser | Probabilistic encryption & how to play mental poker keeping secret all partial information[END_REF], and the network of new constructions has been constantly evolving ever since.

Proofs in Cryptography

We mentioned above that the complexity class NP refers to the problems for which solutions can be verified efficiently. Another way of stating it is as follows: NP is the class of all statements for the truth of which a short proof exists, and can be verified in reasonable time. Here, short and reasonable mean of size and with a verification running time which are bounded by a polynomial in the size of the statement. Hence, NP can be seen as the set of all assertions that can be proven efficiently (without considering how hard it might be to actually find the proof). This makes NP an object of deep philosophical interest, as the question of whether P is contained in NP fundamentally asks the following: if we can efficiently verify a mathematical proof for a theorem, can we just as easily find this proof? Or, as put by Scott Aaronson in his book [START_REF] Aaronson | Quantum computing since Democritus[END_REF], could mathematical creativity be automated?

Proofs are at the heart of cryptography. While it is fairly easy to come up with advanced algorithms realizing tasks of interest as long as the parties running the algorithm can be trusted, cryptography asks for the design of solutions where one does not have to trust his adversaries. The necessity for proofs in this setting emerges quite obviously: if we do not plan to trust a statement made by an adversary, it is natural to ask him for a proof of the truth of this statement. The class NP, however, captures only a limited 'static' type of proofs: those that consist in a deterministic demonstration written once for all, that can be efficiently verified. To get more expressiveness or better efficiency, it is useful to relax this definition, by allowing proofs to be probabilistic (i.e., to let them depend on coins flipped by the parties) and interactive (i.e., to give the verifier of the proof the opportunity to ask questions). This leads to the study of interactive proofs, which has been extremely fruitful and produced some of the most successful results in complexity.

Fundamentally, a proof reveals whether a statement is true. In 1989, Goldwasser, Micali, and Rackoff [START_REF] Goldwasser | The Knowledge Complexity of Interactive Proof Systems[END_REF] raised a question that turned out to be of great interest for cryptography: what else is revealed by the proof of a statement? Suppose for example that you have solved a very hard mathematical problem -say, one of the millenium problems whose solutions are rewarded a million dollar by the Clay Mathematics Institute. You can easily prove to a friend that you have solved it: simply show him your solution. However, revealing the actual solution gives him way more information than the fact that you know a solutionin particular, it gives him the opportunity to claim the prize himself. Could you avoid this pitfall, showing him that you solved this problem without revealing your solution? This boils down to the following general question: Is it possible to produce a proof of the truth of a statement, that yields nothing but the 1 Introduction validity of this statement? Goldwasser, Micali, and Rackoff's positive answer to this question in their seminal work [START_REF] Goldwasser | The Knowledge Complexity of Interactive Proof Systems[END_REF] has laid the foundations of cryptographic primitives known as zero-knowledge proofs, which have attracted considerable attention in the past decades, and enjoyed a tremendous number of applications. Zero-knowledge proofs, and their many natural variants, are the main focus of this thesis.

Zero-Knowledge Proofs

A zero-knowledge proof system is an interactive protocol between a prover and a verifier, which aims at demonstrating that some statement is true. Typical statements are membership statements to an NP-language: the prover should demonstrate that a public word x belongs to a given language L from the class NP. Informally, the proof must satisfy three properties:

1. correctness: if the statement is true, and the prover knows a proof of this, he will succeed in convincing the verifier;

2. soundness: if the statement is false, no prover can convince the verifier of the truth of the statement;

3. zero-knowledge: the interaction yields nothing beyond the fact that the statement is true. This is captured by requiring the existence of a simulator that can produce an honest-looking transcript for the protocol, without knowing anything about the statement.

Round-Efficient Zero-Knowledge Proofs. Zero-knowledge proof systems are usually interactive: they involve exchanging several messages between the prover and the verifier. In some scenarios, interactions are undesirable. In these situations, the standard approach is to use a specific type of zero-knowledge proofs, called non-interactive zero-knowledge proofs, which consist of a single flow from the prover to the verifier (after some one-time trusted setup has been performed). Generic methods have been designed to convert classical zero-knowledge proofs into non-interactive one, but they either provide only heuristic security guarantees [START_REF] Bellare | Random Oracles are Practical: A Paradigm for Designing Efficient Protocols[END_REF] (relying on an ideal abstraction called the random oracle model), or lead to proofs which cannot be publicly verified, which limits their applicability [START_REF] Damgård | Non-interactive Zero-Knowledge from Homomorphic Encryption[END_REF].

Provably secure publicly verifiable non-interactive zero-knowledge proofs have been introduced in [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF], under a specific type of assumptions known as pairing-based assumptions; it is currently a major open problem whether proof systems with comparable efficiency could be constructed without such assumptions. In this thesis, we will describe an alternative type of round-efficient zero-knowledge proofs, which do not require such assumptions (but which are not non-interactive zero-knowledge proofs). Zero-Knowledge Proofs over the Integers. Classically, efficient zero-knowledge proof systems deal with algebraic structures, such as finite groups. This makes existing proof systems well-suited for proving algebraic relations (for example, proving that some encrypted values satisfy some polynomial relation). On the other hand, several statements of interest are not efficiently captured by algebraic relations -the most standard example is that of range proofs, where the prover would like to show that some hidden value belongs to a given range.

Zero-knowledge proofs over the integers [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] allow to efficiently prove algebraic relations between values, while treating these values as integers, instead of elements of finite groups. Intuitively, this is done by letting the parties perform a zero-knowledge proof over a finite group whose order is unknown to the prover: if the algebraic relation holds over this group, then unless the prover knows the order of the group, it must also hold over the integers. Dealing with groups of unknown order makes such proofs typically harder to analysis (for examples, the security reduction cannot rely on computing inversions, which require knowing the order of the group).

Secure Two-Party Computation

Secure two-party and multiparty computation (respectively abbreviated 2PC and MPC) has been introduced in the seminal works of Yao [START_REF] Andrew | How to Generate and Exchange Secrets (Extended Abstract)[END_REF], and Goldwasser, Micali, and Wigderson [START_REF] Goldreich | How to Prove all NP-Statements in Zero-Knowledge, and a Methodology of Cryptographic Protocol Design[END_REF][START_REF] Goldreich | How to Play any Mental Game or A Completeness Theorem for Protocols with Honest Majority[END_REF]. While cryptography had been traditionally concerned with securing communication, MPC asks whether it is possible to make computation secure. Slightly more formally, the problem of secure multiparty computation can be stated as follows: consider n parties (P 1 , . . . , P n ), each holding respective inputs (x 1 , . . . , x n ), knowing the description of a function f : ({0, 1} * ) n → {0, 1} * . The MPC problem asks whether it is possible for all parties to obtain f (x 1 , . . . , x n ), with the following security guarantee: all informations that can be deduced by any subset S ⊂ [n] of the parties from the transcript of the protocol can already be deduced from (x i ) i∈S and f (x 1 , . . . , x n ) (in other words, the transcript of the protocol can be efficiently simulated given only (x i ) i∈S and f (x 1 , . . . , x n )).

The potential applications of MPC are manifold. It can be seen as providing a solution to the apparent opposition between privacy and usability: it allows any company (or any individual) owning data to ensure their privacy while at the same time letting them combine their data with other people's data, and evaluating any function of their choice to extract useful informations from it, getting potential benefits comparable to what they would get if every party was making his data publicly available. Therefore, secure computation has been a very active research field. While initial solutions were regarded as being mainly of theoretical interest, three decades of new ideas and clever optimizations have taken secure computation from being an intriguing theoretical object to becoming a practical and implementable tool, susceptible to provide an elegant solution to numerous problems. In fact, the first real-world uses of secure computation have already emerged [BLW08; BCD+09; BTW12; BKK+15], and the field is growing rapidly.

Active Security and Passive Security

Secure computation aims at protecting the privacy of data even when a subset of the parties has been corrupted by an adversary. Different security models emerge from the type of corruption that is considered. Passive corruption refer to adversaries that will only get access to the view of the corrupted parties. This corresponds to a situation where the computation has been performed by honest parties, and the transcript of the computation (which has been recorded and stored by the parties) is later leaked through an adversarial breakthrough (say, a hack of a party's computer). Security with respect to passive corruption (also known as security against honest-but-curious adversaries, or semi-honest security) tells that this transcript should not reveal any information about the inputs (apart from what can already be deduced given the output).

Introduction

Security against active corruption, on the other hand, is a much stronger model. In this situation, the adversary is given full control on the parties it corrupts, and can arbitrarily modify their behavior. This corresponds to a situation where some of the parties are actively cheating during the protocol, in an attempt to gain information, or to alter the outcome of the protocol. This model is also known as security against malicious adversaries, or malicious security. It is obviously the most desirable security that can be achieved, and is also harder to realize than the semi-honest model.

The possibility of securely computing any two-party functionality in the semi-honest model has been first observed by Yao [START_REF] Andrew | How to Generate and Exchange Secrets (Extended Abstract)[END_REF]. Goldwasser, Micali, and Wigderson later extended this result to an arbitrary number of parties [START_REF] Goldreich | How to Prove all NP-Statements in Zero-Knowledge, and a Methodology of Cryptographic Protocol Design[END_REF], still in the semi-honest setting. One year later, in [START_REF] Goldreich | How to Play any Mental Game or A Completeness Theorem for Protocols with Honest Majority[END_REF], the same authors gave the first solution to general multiparty computation in the malicious model. Their solution gave an elegant blueprint that has been followed by most subsequent works on multiparty computation: start from a protocol secure against semi-honest adversaries, who follow the specifications of the protocol, and ask every party to prove, after sending each flow, that this flow was indeed computed honestly. As a flow can depend on private inputs held by the parties, this proof must carefully avoid to leak any private information; this is ensured by relying on zero-knowledge proofs, that are guaranteed to leak nothing beyond the validity of the statement.

The possibility of compiling any semi-honest protocol into a malicious protocol using zero-knowledge proofs is one of their most compelling applications to cryptography. In this thesis, we will be specifically interested in zero-knowledge proofs as a tool to ensure honest behavior in secure computation protocols.

Our Results

In this thesis, we introduce new types of zero-knowledge proofs, and revisit the security analysis of existing zero-knowledge proofs. Our results have implications for various types of secure computation protocols that rely on discrete-logarithm-based assumptions, or factorizationbased assumptions. We expand below on the three contributions that are developed in this thesis, and outline some of their implications. The results discussed below have been mainly taken from two papers, [START_REF] Benhamouda | Implicit Zero-Knowledge Arguments and Applications to the Malicious Setting[END_REF] (co-authored with Fabrice Benhamouda, David Pointcheval, and Hoeteck Wee) and [START_REF] Couteau | Removing the Strong RSA Assumption from Arguments over the Integers[END_REF] (co-authored with Thomas Peters and David Pointcheval), which have been presented respectively at CRYPTO 2015 and EUROCRYPT 2017.

Implicit Zero-Knowledge Arguments

In Chapter 4, we introduce a new type of zero-knowledge proofs, called implicit zero-knowledge arguments (iZK). While standard zero-knowledge arguments aim at producing a convincing proof that a statement is true, implicit zero-knowledge arguments are an encapsulation mechanism, that allows to mask a message, so that the message can be recovered if and only if the statement is true. iZK retains the same zero-knowledge properties as standard zero-knowledge arguments, in that the ability to unmask a message only leaks whether the statement was true, and nothing more.

Motivation. The main motivation for implicit zero-knowledge arguments is secure computation -more specifically, for compiling semi-honest two-party protocols into protocols secure against malicious adversaries. It is indeed fairly easy to see that iZK can play a role comparable to standard zero-knowledge in secure computation: to guarantee the privacy of the inputs of the parties, it is not necessary to explicitly check that the opponent behaved honestly. Rather, it suffices to make sure that if it is not the case, it will be impossible for the other party to recover any subsequent messages of the protocol.

Comparison with Standard Zero-Knowledge. As explained above, iZK plays a role comparable to standard zero-knowledge in secure two-party computation. We now explain their benefits over classical approaches. An issue with the standard approach for compiling semi-honest protocols into malicious ones is the round-efficiency of the compiled protocol. Standard zero-knowledge proofs are interactive, hence their use for each flow of the protocol results in a blowup for the number of rounds. For secure computation in a WAN setting, this can be a major efficiency drawback.

To avoid the issue of blowing up the number of rounds in such settings, the traditional solution is to rely on non-interactive zero-knowledge proofs, in which the proof consists of a single flow from the prover to the receiver. However, unless one is willing to assume the random oracle model [START_REF] Bellare | Random Oracles are Practical: A Paradigm for Designing Efficient Protocols[END_REF] (this is an idealized model that allows to give heuristic arguments of security, which cannot be turned into real proofs of security as this model cannot be instantiated in the real world, and leads to insecure constructions for some contrived examples [START_REF] Canetti | The Random Oracle Methodology, Revisited (Preliminary Version)[END_REF]), the only known (publicly verifiable) non-interactive zero-knowledge proofs are based on elliptic curves equipped with bilinear maps (also called pairings) [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF]. 1This raises two issues. The first one is that it forces to base the security of the compiled protocol on a narrower range of assumptions: while classical zero-knowledge proofs can be based on a wide variety of well-studied assumption, pairing-based non-interactive zeroknowledge proofs rely on more specific assumptions about elliptic curves with bilinear maps. The second one is that it comes at a computational cost by requiring to work over structure equipped with a pairing, as group operations on elliptic curves with pairings are typically slower than on the best elliptic curves without pairings. Furthermore, computing the proofs requires evaluating pairing operations, which are particularly slow.

Implicit zero-knowledge arguments aim at providing almost the same benefits as noninteractive zero-knowledge proofs regarding the round-efficiency of compiled protocols, under a wider range of assumptions. More precisely, while an n-round protocol is compiled to a 3n-round protocol with standard zero-knowledge in general, and to an n-round protocol with non-interactive zero-knowledge, iZKs allow to compile it to an (n + 2)-round protocol in general, while being constructible from a wide variety of assumptions. They can be based on essentially the same assumptions as classical zero-knowledge protocols, and do not require pairings. In particular, this implies that they require less computation and communication that existing non-interactive zero-knowledge proofs, hence can act as a good alternative to them for round-efficient compiling of secure computation protocols. Our constructions are based on a primitive called hash proof system, or smooth projective hash function [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF].

Applications. The most obvious application is the description of a new round-efficient general compiler from semi-honest to malicious security for two-party computation protocols. To illustrate the fact that iZK can often be applied more efficiently than with the general compiler for structured problems, we describe two more specific applications:

• We show how iZK can be used to prove correctness of a computation represented by a given computational structure at a cost proportional to the representation size of the computation. We illustrate this on computations represented by boolean circuits, which are very generic, but also on computations represented by arithmetic branching programs, which often allow for more compact representation of arithmetic computations.

• We describe an optimized conversion for a specific two-party protocol (which, in particular, takes one round less than what the generic compiler would give, and is exactly as round-efficient as solutions based on non-interactive zero-knowledge) which computes the inner-product between private inputs of the parties. This illustrates the fact that iZK can be used more efficiently in specific settings. It also outlines some additional advantages of iZK: their structure make them easily amenable to batch techniques, which can be used to reduce communication and computation.

Improved Security Analysis of Integer Zero-Knowledge Arguments

Numerous secure computation protocols involve manipulating integers, seen as elements of Z and not as elements of a finite group. Examples include some electronic voting schemes, or some electronic cash systems. More generally, this situation is common for protocols manipulating values that should be in a specific range.

Standard zero-knowledge proofs can of course be used to convert such protocols into protocols secure against malicious adversaries, but this will in general involve treating the integer values as a bit-string and interpreting the statement as some polynomial relation between the bits of the strings, which can be quite inefficient in many scenarios. Zeroknowledge proofs over the integers are specific types of zero-knowledge proofs which aim at overcoming this issue, by providing tools to prove statements directly on integers, seen as atomic objects. These proofs often result in more efficient protocols, by avoiding blowups proportional to the bit-length of the integer values manipulated in the protocol. This comes, however, at a cost regarding the assumptions on which such constructions can be based: all known zero-knowledge proofs over the integers require to assume a strong variant of the classical RSA assumption. While the RSA assumption is a very well studied assumption (related to the hardness of factoring integers), this variant gives a lot of freedom to the adversary, has been less studied, and can be argued to be less desirable.

In Chapter 5, we revisit the security analysis of the standard construction of zero-knowledge proofs over the integers. Our improved analysis shows that this construction can in fact be proven secure directly under the standard RSA assumption, without any modification. It was previously unknown whether even a modified version of this construction could be proven secure from the standard RSA assumption, and this question was a quite old open problem. Furthermore, our analysis involves interesting new ideas that could potentially be of independent interest and allow to create new types of constructions whose security can be reduced to the RSA assumption.

New Integer Zero-Knowledge Arguments

Eventually, in Chapter 6, we introduce a new method to construct zero-knowledge arguments over the integers. Our new method allows to reduce the work of the verifier in such proofs, as well as to reduce communication in many settings, still under the RSA assumption. This makes it suited for use in secure computation protocols in a client-server setting, where the bulk of the computation should be performed by the (computationally more powerful) server, but the client should still be able to verify that the server behaved honestly. The method relies on the observation that existing integer commitment schemes (which bind the prover to some integer values while keeping those values hidden to the verifier) can be converted into another type of commitment scheme where the committed values are reduced modulo a small prime number, making these values less costly to manipulate and to communicate. Letting the prover perform this conversion during the proof allows the verifier to save a significant amount of computation for the verification of the proof.

Our Other Contributions

In addition to the contributions outlined above and developed in this manuscript, we have worked during our thesis on various other problems related to secure computation. These contributions are not described in this thesis because, even though they also target problems related to secure computation, they do not achieve their results through the analysis and design of zero-knowledge proofs, which we wanted to be the main focus of this thesis.

Encryption Switching Protocols [CPP16; CPP15b]

In this work, we introduced and studied a new cryptographic primitive, called encryption switching protocol (ESP). An ESP allows two players to convert an encryption of a message m with some cryptographic scheme into an encryption of the same message m, under a different cryptographic scheme. The crucial security requirement of an ESP is that this conversion should not reveal anything about the message m. This primitive can be used to efficiently reconcile the malleability properties of different encryption scheme, to be able to benefit from the properties of both schemes in secure computation protocols. More specifically, we build an ESP to swich between two encryption schemes, one which allows homomorphic evaluation of arbitrary linear functions, and one which allows homomorphic evaluation of arbitrary monomials (i.e., products and exponentiations). Together, these malleability properties allow to evaluate any function; for functions that can be represented efficiently by (sparse) multivariate polynomials, this allows to save communication, as the communication can be made independent of the degree of the function. In [START_REF] Couteau | Encryption Switching Protocols[END_REF], we introduce the primitive, instantiate it under standard assumptions, study its security, develop new types of zero-knowledge proofs to make it secure against malicious adversaries, and describe some applications to secure computation. In a workshop paper [START_REF] Couteau | Secure Distributed Computation on Private Inputs[END_REF], we also describe an additional application of ESPs to the setting of delegation of computation.

These results appear in the proceedings of CRYPTO 2016, and of the workshop FPS 2015 (co-authored with Thomas Peters and David Pointcheval).

Homomorphic Secret Sharing [BCG+17]

In this work, we study a primitive called homomorphic secret sharing, which was introduced by Boyle et al. in [START_REF] Boyle | Breaking the circuit size barrier for secure computation under DDH[END_REF], and studied further in [START_REF] Boyle | Group-Based Secure Computation: Optimizing Rounds, Communication, and Computation[END_REF]. This primitive allows to share an input between two parties, with the following guarantees: each share hides the input, yet each party can locally perform an evaluation procedure for some function f (from a class of functions specified by the scheme), so that for a share input x, the outputs of the players form 1 Introduction shares of f (x). The core contribution of the work of Boyle et al. is a homomorphic secret sharing scheme for the class of all functions that can be computed by a branching program, under the decisional Diffie-Hellman assumption. This implies in particular the existence of secure computation protocols with communication sublinear in the circuit size of the function, still under the decisional Diffie-Hellman assumption; previously, such protocols were only known from lattice-based assumptions. In [START_REF] Boyle | Homomorphic Secret Sharing: Optimizations and Applications[END_REF], we make four types of contributions: we optimize the scheme on all aspects (communication, computation, security analysis, usability, range of applications) using a combination of standard techniques and new methods, we describe applications for which our improved schemes provide practically efficient solutions that outperform alternative methods, we give a detailed report on implementation results (with non-trivial machine-level optimizations), and we introduce and study a new primitive that can be built from homomorphic secret sharing. The latter, called cryptocapsule, allows to greatly reduce the communication overload of the preprocessing phase of secure protocols. This primitive is still mainly of theoretical interest, but we describe new algorithmic techniques to make strong asymptotic improvements over a natural constructions of cryptocapsules from a method of [START_REF] Boyle | Group-Based Secure Computation: Optimizing Rounds, Communication, and Computation[END_REF].

These results appear in the proceedings of CCS 2017 (co-authored with Elette Boyle, Niv Gilboa, Yuval Ishai, and Michele Orrù).

Secure Equality Tests and Comparisons [Cou16a]

In this work, we study a specific type of two-party secure computation protocol, where the goal of the two players is to learn which of their private inputs is greater. This protocol is commonly used as a subroutine in many protocols for secure computation, (examples include, but are not limited to, protocols for secure machine learning, or protocols for face recognition). We design a new protocol for comparing private inputs, in the semi-honest model, that relies only on a primitive known as oblivious transfer. Our protocol has an extremely efficient, information-theoretic online phase, and improves regarding communication and computation over the best existing solutions, at the cost of a higher number of rounds.

Toward constructing this protocol, we also introduce another protocol, which has independent applications: a protocol for securely testing whether two private strings are equal, so that the parties obtain bit-shares of the result of the test. This protocol also enjoys an extremely efficient, information-theoretic online phase, and a small communication and computation.

These results are described in a yet unpublished manuscript.

Covert Multiparty Computation [Cou16b]

In this work, we study a very strong form of secure computation, which was introduced in [AHL05; CGOS07]. A covert multiparty computation protocol allows parties to securely evaluate a function while hiding not only their input, but also the very fact that they are taking part to the protocol. Only when the final result is obtained are the players made aware of the fact that a computation indeed took place (and this happens only if the result was deemed favorable by all the parties). While previous work had established feasibility results for covert MPC, these results were essentially of theoretical interest. In this work, we show that this very strong notion can be achieved at a surprisingly small cost, by modifying a state-of-the-art MPC protocol to make it covert (at an additive cost independent of the size of the circuit), under standard assumptions. We develop a framework to argue the security of covert protocols that enhance them with non-trivial composability properties. As for our iZKs of Chapter 4, this protocol is built out of smooth projective hash functions.

These results are described in a yet unpublished manuscript.

Organization of this Thesis

The rest of this manuscript is organized as follows: in Chapter 2, we introduce the necessary preliminaries for this thesis, by recalling mathematical, algorithmic and computational notions, and by describing standard computational assumptions and cryptographic primitives.

We devote an entire chapter to zero-knowledge proofs in Chapter 3, as they are the main subject of this thesis. This chapter aims at being somewhat hybrid between a survey and a preliminary chapter for our work: we formally introduce zero-knowledge proofs and some of their many variants, but also recall classical methods used for their design and their analysis, as well as historical results on their study. We try to provide a (non-comprehensive) overview of this subject to the reader, while at the same time introducing the necessary background for our contributions. Chapters 4, 5, 6 focus on our personal contributions, which we outlined above.

We attempted to gather all technical preliminaries that are not our contributions in the chapters 2 and 3, to clearly separate existing results that we use from our new contributions. Chapters 4, 5, 6, which focus only on our contributions, do refer the reader to the appropriate section of the preliminaries when necessary. However, it should be fairly easy for the reader to identify the sections of the preliminaries that are necessary to understand the details of each contribution.

Personal Publications

Preliminaries

In this chapter, we introduce the notations and the basic notions that will be used throughout this thesis. We recall standard mathematical and algorithmic concepts, and introduce the main notions related to provable security. Afterward, we recall and discuss standard computational assumptions (discrete-logarithm-based assumptions and factorization-based assumptions) and cryptographic primitives that will be involved in this work. Most of the material presented in this section is rather standard and can be easily skimmed through.

Notation and Preliminaries

Mathematical Notations

Sets, Integers. We denote by Z the set of integers, and by N the set of non-negative integers. The integer range a ; b stands for {x ∈ Z | a ≤ x ≤ b}, and a ; b c stands for

{x ∈ Z | a ≤ x ≤ b ∧ gcd(x, c) = 1}.
For a positive integer k ∈ N, we denote by {0, 1} k the set of bitstrings of length k. We denote by {0, 1} * the set of all bitstrings. When an element s is represented by an integer, |s| is the bit-length of the integer, and ||s|| denotes its absolute value (or norm).

Modular Arithmetic. For an integer x ∈ Z, the reduction of x modulo k, denoted x mod k, is the remainder of the Euclidean division of x by k. We denote (Z k , +) the additive group of integers modulo k, i.e., the set {0, . . . , k -1} of non-negative integers smaller than k, equipped with the addition operation modulo k. We write a = b mod k to specify that a = b in Z k and we write a ← [b mod k] to affect the smallest positive integer to a so that a = b mod k. We denote by (Z k , +, •) the ring of integers modulo k. Furthermore, we denote by (Z * k , •) the multiplicative subgroup of (Z k , +, •) of invertible integers modulo k. We will often abuse these notations and write Z k for (Z k , +), and Z * k for (Z * k , •). Note that when k is a prime, which will often be the case in this thesis, Z k is also a field, and

Z * k = Z k \ {0}.
For arbitrary integers, the size of Z * k (the number of invertible elements modulo k) is given by Euler's totient function, which we denote ϕ(k). It corresponds to the number of integers n between 1 and k such that gcd(k, n) = 1, where gcd denotes the greatest common divisor. Cyclic Groups. A cyclic group is a finite group generated by a single element. In particular, a cyclic group is Abelian (commutative). A generator g of a cyclic group G of order p is an element of G that generates the entire group, i.e., G = {1, g, g2 , . . . , g p-1 } (1 = g 0 denotes the identity element). We denote this G = g . Given a group g, we denote by ord(G) its order.

Legendre Symbol and Jacobi Symbol. For an odd prime p, the Legendre symbol of a determines whether a is a quadratic residue modulo p. More specifically, it is 1 if a is a non-zero quadratic residue modulo p, -1 if it is a quadratic non-residue, and 0 if a = 0 mod p. It can be computed as a (p-1)/2 mod p. The Jacobi symbol generalizes the Legendre symbol with respect to every odd number: the Jacobi symbol of a modulo n is the product of its Legendre symbol with respect to every prime factor of n.

Vectors and Matrices.

Vectors are denoted with an arrow. For a vector #"

x = (x 1 , • • • , x ), g #" x denotes (g x 1 , • • • , g x ).
Matrices are denoted with capital greek letters (e.g., Γ).

Assignation. Given a finite set S, the notation x $ ← S means a uniformly random assignment of an element of S to the variable x: for any s ∈ S we have Pr S [x = s] = 1/|S| where |S| denotes the cardinality of S.

Probabilities. We denote by Pr[X = x] the probability of a random variable X taking value x, and Pr x∈D [f (x) = y] to denote the probability that f (x) is equal to some fixed value y, when x is sampled from the distribution D. We denote by U n the uniform distribution over {0, 1} n .

Miscellaneous.

For a function f , we write 'f (x) = poly(x) for all x' to indicate that there exists a polynomial p such that for every x in the domain of f , ||f (x)|| ≤ p(x).

Algorithms

Turing Machines. A Turing machine is an abstract model of computations in which a tape head reads symbols on the tape and perform operations (writing, moving left, moving right) that depend on the symbol that is read. More formally, a Turing machine is a 7-tuple M = (Q, Γ, b, Σ, δ, q 0 , F ) where Q is a finite set of states, Γ is an alphabet (a set of symbols that can be on the machine tape), b ∈ Γ is the blank symbol (to indicate that a cell of the tape is empty), Σ ⊆ Γ \ {b} is the set of symbols initially written on the tape, δ is the transition function (it takes as input a state and a symbol, and outputs a new state, a new symbol, and a move indication, either left or right), q 0 ∈ Q is the initial state, and F ⊆ Q is the set of final states. An accepting initial state corresponds to a state for which the machine M eventually halts in a state from F . This mathematical model provides a convenient abstraction to describe the computations that an algorithm can perform.

Interactive Probabilistic Turing Machines. All algorithms discussed in this work will be probabilistic Turing machines. A probabilistic Turing machine is a multi-tape Turing machines that can use an additional tape containing random bits (usually called random coins). When discussing interactive protocols, that involve interactive parties, the parties will be modeled as interactive probabilistic Turing machines, i.e., multi-tape Turing machines equipped with a read-only input tape, a read-only random tape, a read-and-write work tape, a write-only output tape, and a pair of communication tapes, one read-only and one write-only. Interaction between Turing machine is captured by letting pairs of machines share their communication tape: the read-only communication tape of one machine is the write-only communication tape of another machine, and vice versa.

Polynomial-Time Algorithms. We will call a PPT algorithm, or equivalently an efficient algorithm, a probabilistic algorithm running in time polynomial in its input size, on all inputs and all random coins. An expected PPT algorithm is a probabilistic algorithm whose expected running time is bounded by a polynomial in his input size, where the expectation is taken over the random coins of the algorithm.

Algorithm Execution. We write y ← A(x) for 'y is the output of the algorithm A on the input x', while y $ ← A(x) means that A will additionally use random coins. We sometimes write st the state of the adversary.

Classes P, BPP, and NP. Decisions problems ar problems whose solutions are of the form 'yes' or 'no'. A decision problem defines a language, which is the set of all instances for which the answer to the decision problem is 'yes'. Solving an instance x of a decision problem d can be therefore formulated as finding out whether the word x belongs to the language L d associated to d. We denote by P the class of languages that can be decided by a Turing machines running in time polynomial in its input size. BPP corresponds of the class of languages that can be decided by a polynomial-time probabilistic Turing machine with less than 1/3 errors (both for positive answers and negative answers). Eventually, the class NP contains all languages L R of the form L R = {x | ∃w, (|w| = poly(|x|)) ∧ (R(x, w) = 1)}, where R is a polynomial-time computable relation.

Provable Security

Negligibility. We say that a function µ is negligible, and write µ(x) = negl(x), if for any constant c ∈ N there exists x ∈ N such that for all y ≥ x, ||µ(y)|| ≤ 1/y c . We say that a function µ is overwhelming if 1µ is negligible.

Security Parameter.

As is common in cryptography, the security properties of most primitives discussed in this thesis break down if the attacker has a sufficiently powerful computer, or is allowed a sufficiently long running time. Moreover, the computational power of an adversary can greatly evolve over time. This is captured by introducing a security parameter, which will be denoted κ throughout this thesis, and feeding all PPT algorithms with the unary representation 1 κ of the security parameter (this will sometimes be done implicitely). That way, all efficient algorithms are guaranteed to run in time polynomial in κ. The parameters of the system will be chosen so that the system is estimated to provide κ bits of security -i.e., such that the best known attack on the system requires 2 κ steps to be mounted. A common widely accepted value of the security parameter is 128: if 2 128 computational steps are necessary to break a system, attacking the system can be considered infeasible within a reasonable amount of time, with the current computing power of computers.

Adversaries, which will be denoted with calligraphic letters (e.g., A ) will be usually modeled as efficient algorithms taking 1 κ as input. We will sometimes also consider security against unbounded adversaries, which can run in arbitrary time.

Oracle Access. In addition to inputs and random coins, algorithms will sometimes be given access to oracles. An oracle is an ideal black-box that receives some inputs and returns some output, and are used to capture the fact that an algorithm might get access to the answers to some queries, without specifying how these queries are asked, or how these answers are computed. Given an oracle O, we write A O (x) to indicate that the algorithm A run on input x is given oracle access to O. Success, Advantage, Experiments. We define, for a distinguisher A and two distributions D 0 , D 1 , the advantage of A (i.e., its ability to distinguish those distributions) by

Adv D 0 ,D 1 (A) = Pr x∈D 0 [A(x) = 1] -Pr x∈D 1 [A(x) = 1]
. The qualities of adversaries will also be measured by their successes and advantages in certain experiments. An experiment is a game played between an adversary and a challenger; Figure 2.1 illustrates the way we represent an experiment Exp sec A for a property sec with an adversary A . Successes refer to experiment where the adversary attempts to win with non-negligible probability: the experiment is denoted Exp sec A , and the success is defined as

Succ sec (A , κ) = Pr[Exp sec A (1 κ ) = 1]
. Advantages refer to experiment where the adversary attempts to win with non-negligible advantage over the random guess: the experiment is denoted Exp sec-b A , where a bit b distinguishes between two variants of the experiment that the adversary should distinguish between, and the advantage is defined as

Adv sec (A , κ) = Pr[Exp sec -1 A (1 κ ) = 1] -Pr[Exp sec -0 A (1 κ ) = 1].
For both types of qualities, probabilities are over the random coins of the challenger and of the adversary.

Statistical Indistinguishability. The statistical distance between two distributions D 0

Exp sec

A (1 κ ) : challenger interacts with adversary A , by generating some material and running A on this material.

If the experiment proceeds in several rounds, A may pass a state st from one round to the next.

An experiment typically ends by checking for a condition: if condition then return 1 else return 0

[x = i] -Pr x $ ←D 1 [x = i] .
For any integers a ≤ b, the statistical distance between two uniform distributions, over U a = 1 ; a and

U b = 1 ; b respectively, is given by b i=1 | Pr Ua [x = i] -Pr U b [x = i]| = a i=1 (1/a - 1/b) + b i=a+1 1/b = 2(b -a)/b.
Two distributions are said statistically indistinguishable if their statistical distance is negligible. Note that this is equivalent to saying that any algorithm (not necessarily polynomial time) has negligible advantage over distinguishing the two distributions.

Computational Assumptions

In this section, we recall the classical computational assumptions on which we will rely throughout this work. As most cryptographic assumptions (and unlike standard assumptions in complexity theory, which are worst-case hardness assumptions), they are concerned with the average-case hardness of certain mathematical problems. The assumptions we will discuss can be divided in two main categories, discrete-logarithm-based assumptions and factorizationbased assumptions, which are sometimes referred to as the "20 th century assumptions". Indeed, they were for a long time the assumptions underlying most constructions of publickey cryptography (with some noticeable exceptions [START_REF] Robert | A public-key cryptosystem based on algebraic[END_REF]), starting with the famous RSA [START_REF] Ronald L Rivest | A method for obtaining digital signatures and public-key cryptosystems[END_REF] and ElGamal [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF] cryptosystems. Even though the last decade has witnessed the emergence of new types of cryptographic assumptions (the most prominent being lattice-based assumptions [Ajt96; Reg05; HPS98; LPR10]), they remain widely used to date and as such, a large body of work has been dedicated to their study; we will recall the main cryptanalytic results and cryptographic reductions when introducing the assumptions. A general issue with 20 th century assumptions, which was one of the main motivations for the study of alternative assumptions, is that they are only conjectured to hold against classical PPT adversaries: it was shown in the seminal work of Shor [Sho99] that they do not hold against quantum polynomial-time adversaries, hence the advent of general-purpose quantum computers would render insecure the constructions based on these assumptions. However,

Exp dlog A (G, g, 1 κ ) : x $ ← Z p X ← g x x ← A (X) if x = x then return 1 else return 0 Figure 2.2: Experiment Exp dlog A (G, g, 1 κ
) for the discrete logarithm problem over a group G of order p with generator g their security against classical computers is quite well understood, and they enjoy a number of algebraic properties which make them well suited for a wide number of applications and amenable to practical instantiations.

Discrete-Logarithm-Based Assumptions

Given a cyclic group G with a generator g, the discrete logarithm assumption over G states, informally, that it is computationally infeasible given a random group element h ∈ G to find an integer x such that h = g x . Generic algorithms, which are independent of the particular structure of the underlying group G, have a running time proportional to the square root of the group order. In spite of more than four decades of intense cryptanalytic effort, there exist certain groups in which we do currently not know of algorithm with better efficiency than the generic algorithms. For all assumptions discussed in this section, no attack significantly better than solving the discrete logarithm assumption is known, although in most cases, no formal reduction showing that a PPT algorithm breaking the assumption would imply a PPT algorithm breaking the discrete logarithm assumption are known. As previously mentioned, the discrete logarithm assumption (hence all assumptions discussed in this section) does not hold against quantum polynomial-time adversaries [START_REF] Peter | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF].

The Discrete Logarithm Assumption

Let G be a cyclic group, with a generator g. The discrete logarithm assumption states that: Assumption 2.2.1. (Discrete Logarithm Assumption) For any efficient algorithm A , it holds that Succ dlog (A , κ) = negl(κ).

The experiment Exp dlog

A (G, g, 1 κ ) is represented Figure 2.2. Below, we briefly discuss standard property of the dlog assumption, generic attacks against the assumption, and standard groups over which the assumption is commonly instantiated.

Random Self-Reducibility. An important property of the discrete logarithm assumption is its random self-reducibility, a property introduced in [AFK87]: if the discrete logarithm problem is hard for some specific instances over a group G, then it remains hard for random instanced over G. Indeed, suppose that an oracle solves random instances of dlog over G, and let h = g x be some fixed dlog instance. Then it is easy to see that h ← hg r for a uniformly random r follows a uniformly random distribution in G, and from the discrete logarithm y ∈ Z ord(G) of h returned by the oracle, one can compute the logarithm x of h as x = yr mod ord(G).

Generic Attacks. Let t ← ord(G).

A generic deterministic algorithm for computing discrete logarithms in arbitrary groups was designed by Shanks [START_REF] Shanks | Class number, a theory of factorization, and genera[END_REF]; it involves O( √ t) group operations (and comparable space complexity). This algorithm was improved by Pollard in [START_REF] John | Monte Carlo methods for index computation (mod p)[END_REF] to use only constant space (at the cost of being probabilistic rather than deterministic), and still O( √ t) group operations. It is also more amenable to distributed computation than Shank's baby-step-giant-step algorithm. Pollard's rho algorithm, for which practical improvements were suggested in [Tes01; BLS11], is the state-of-the-art algorithm for computing arbitrary discrete logarithm in generic groups. However, more efficient algorithms can exist for specific group, which might have additional structure. Shoup's proof of optimality of Pollard's algorithm in a model known as the generic group model [START_REF] Shoup | Lower Bounds for Discrete Logarithms and Related Problems[END_REF] suggests that it might be asymptotically optimal in arbitrary groups. This has led to two research directions: designing improved algorithms for specific groups commonly used in crypto, or designing specific groups in which no attack better than Pollard's rho algorithm is known. Both directions are closely interleaved, as new cryptanalytic insights from the former influence the design strategies of the latter.

Instantiating G with Multiplicative Subgroups of Finite Fields. One of the most common instantiations of G is as follows: let p be a random large strong prime (which means that p = 2p + 1, where p is itself a prime). Then F p is a field, and the subgroup of squares of F * p (i.e., group elements of the form u 2 for u ∈ F * p ) is a cyclic group of order p where the discrete logarithm assumption is conjectured to hold. Note that to construct a generator of G, it suffices to pick any u ∈ F * p \ {1} and set g ← u 2 . Note that the assumption is also conjectured to hold directly over F * p ; however, considering the subgroup of squares is common because some assumptions related to dlog, such as the decisional Diffie-Hellman assumption (which we will discuss in this section), are insecure over F * p . Over such groups, the best known attacks are known as index calculus methods, whose fundational ideas were developed in [START_REF] Kraitchik | Théorie des nombres[END_REF]. It gives rise to algorithms with subexponential complexity (O(exp(a log b t log log 1-b t)), for some constants a and b ≤ 1/3). The latest development in this family of attacks was provided by Joux in [START_REF] Joux | A New Index Calculus Algorithm with Complexity L(1/4 + o(1)) in Small Characteristic[END_REF] for fields of small characteristic. The existence of subexponential algorithms implies that parameters must be chosen quite large: current recommandations suggest using 2048-bit primes. A survey of state-of-the-art index calculus-based methods for discrete logarithms in finite fields is given in [START_REF] Joux | The past, evolving present, and future of the discrete logarithm[END_REF].

Instantiating G with Elliptic Curves. Alternatively, it is common to instantiate the discrete logarithm assumptions over elliptic curves, which are algebraic curves defined by an equation of the form y 2 = x 3 + ax + b on which a group operation can be defined. Elliptic curves have been the subject of a very rich study. In spite of an important cryptanalytic effort that showed how to use various methods (such as index calculus-based methods and bilinear maps-based methods) to speed up discrete logarithm computation over elliptic curves, Pollard's rho algorithm is still the only known attack over some well-chosen curves, which nonetheless admit efficient algorithms for computing group operations (e.g., [START_REF] Victor | Use of Elliptic Curves in Cryptography[END_REF][START_REF] Koblitz | Elliptic curve cryptosystems[END_REF][START_REF] Daniel | Curve25519: New Diffie-Hellman Speed Records[END_REF]). For such curves, choosing the order of a group as a 256-bit prime suffices to give 128 bits of security with respect to all known attacks. Group elements are therefore up to ten times smaller over elliptic curves than over finite fields for comparable security requirements.

Other Common Instantiations of G. In addition to finite fields and elliptic curves, the discrete logarithm problems has been considered in various other groups in the literature. One of them is the subgroup of squares of Z * n , where n is a product of two primes. It is

Exp cdh A (G, g, 1 κ ) : (x, y) $ ← Z 2 p (X, Y ) ← (g x , g y ) Z ← A (X, Y ) if Z = X y then return 1 else return 0 Figure 2.3: Experiment Exp cdh A (G, g, 1 κ
) for the computational Diffie-Hellman problem over a group G with generator g worth noting that the discrete logarithm in this group reduces to the discrete logarithm over the subgroup of squares of both Z * p and Z * q when the factorization n = pq of the modulus is known, using CRT decomposition; when the factorization is unknown, the hardness of the dlog assumption over this group is implied by the hardness of the factorization assumption (which will be discussed later on in this section).

The Computational Diffie-Hellman Assumption

The computational Diffie-Hellman assumption was introduced by Diffie and Hellman in their seminal work on public-key cryptography [START_REF] Diffie | New directions in cryptography[END_REF], and has been used as a basis for a tremendous number of cryptographic applications. As above, let G be a cyclic group, with a generator g. The computational Diffie-Hellman assumption states that: Assumption 2.2.2. (Computational Diffie-Hellman Assumption (CDH)) For any efficient algorithm A , it holds that Succ cdh (A , κ) = negl(κ).

The experiment Exp

cdh A (G, g, 1 κ ) is represented Figure 2.3.
It is easy to see that CDH is implied by the dlog assumption. In the reverse direction, no attack significantly better than solving a discrete logarithm problem is known against CDH. However, no formal reduction is known in general. It was proven by Boer [den90] that CDH is as hard as the discrete logarithm problem over F * p if ϕ(p -1) is smooth (i.e., its prime factors are small). A general algorithm for solving dlog given access to a CDH oracle in arbitrary group is due to Maurer [START_REF] Ueli | Towards the Equivalence of Breaking the Diffie-Hellman Protocol and Computing Discrete Algorithms[END_REF], but it assumes (informally) that some additional information is known about the order of the group. We also note that as for the DLOG assumption, the CDH assumption satisfies random self-reducibility.

The Decisional Diffie-Hellman Assumption

While the discrete logarithm assumption and the computational Diffie-Hellman assumptions are based on search problem (they assume that finding a solution to some problem is infeasible in polynomial time), the decisional variant of the Diffie-Hellman assumption is based on a decision problem. ; as for dlog and CDH, it is random self-reducible. Like the

Exp ddh-0 A (G, g, 1 κ ) : (x, y, z) $ ← Z 3 p (X, Y, Z) ← (g x , g y , g z ) return A (X, Y, Z) Exp ddh-1 A (G, g, 1 κ ) : (x, y) $ ← Z 2 p (X, Y, Z) ← (g x , g y , g xy ) return A (X, Y, Z) Figure 2.4: Experiments Exp ddh-0 A (G, g, 1 κ ) and Exp ddh-1 A (G, g, 1 κ
) for the decisional Diffie-Hellman problem over a group G with generator g

Exp dlin-0 A (G, g, h, 1 κ ) : (x, y, z) $ ← Z 3 p F $ ← G (X, Y, Z) ← (g x , h y , F z ) return A (X, Y, F, Z) Exp dlin-1 A (G, g, h, 1 κ ) : (x, y) $ ← Z 2 p F $ ← G (X, Y, Z) ← (g x , h y , F x+y ) return A (X, Y, F, Z) Figure 2.5: Experiments Exp dlin-0 A (G, g, h, 1 κ ) and Exp dlin-1 A (G, g, h, 1 κ
) for the decision linear assumption over a group G with generators (g, h)

CDH assumption, no attack significantly better than solving a discrete logarithm problem is known against DDH. It is easy to solve DDH given oracle access to a CDH solver; however, DDH is not believed to be equivalent to dlog in general, or even to CDH, as there exists groups in which CDH is believed to hold, while DDH does not hold (examples include F * p , where computing the Legendre symbol gives non-negligible advantage in distinguishing DDH tuples from random tuples, or elliptic curves equipped with a symmetric pairing).

Generalizations of the DDH Assumption

In this section, we consider several variants of the DDH assumption that generalize it: the decision linear assumptions, and the matrix Diffie-Hellman assumptions. In our work, we will describe several DDH-based primitives. All of our constructions that can be reduced to the DDH assumption are described with respect to this assumption for the sake of concreteness; they can be generalized in a natural way to hold under the k-Lin assumption for any k, or under any of the MDDH assumptions.

The Decision Linear Assumption. The decision linear assumption (DLIN) is a variant of the DDH assumption introduced in [BBS04] as a way to construct analogeous of DDH-based cryptographic primitives in groups where the DDH assumption does not hold.

Assumption 2.2.4. (Decision Linear Assumption (DLIN)) For any efficient algorithm

A , it holds that Adv dlin (A , κ) = negl(κ).
The experiments Exp dlin-b A (G, g, 1 κ ), indexed by a bit b, are represented Figure 2.5. The properties of the DLIN assumption are comparable to those of the DDH assumption. The DLIN assumption can be generalized in a natural way to the k-Lin assumption, where the goal is to distinguish (F, F i≤k x i ) from (F, F z ). This leads to a hierarchy of increasingly weaker assumptions.

The Matrix Diffie-Hellman Assumption. The MDDH family of assumptions further generalizes the DDH assumption and the k-Lin assumptions, allowing for more variants of DDH under which most constructions can be naturally extended to work. It was introduced in [START_REF] Escala | An Algebraic Framework for Diffie-Hellman Assumptions[END_REF]. Relations between the assumptions of this family were recently studied in [START_REF] Villar | Equivalences and Black-Box Separations of Matrix Diffie-Hellman Problems[END_REF]. As we will not explicitly use it in our work (although our DDH-based constructions can be extended to work under MDDH assumptions), we skip the details.

Assumptions on Bilinear Groups

A bilinear map (or pairing) is an application e : G 1 × G 2 → G T , where G 1 , G 2 , G T are cyclic groups of the same order, that satisfies e(g a 1 , g b 2 ) = e(g 1 , g 2 ) ab for all exponents a, b and generators g 1 of G 1 and g 2 of G 2 . Elliptic curves equipped with bilinear maps are commonly used in cryptography, either in the symmetric pairing setting (e : G × G → G T ) or in the asymmetric pairing setting (G 1 = G 2 ). Note that the DDH assumption cannot hold in a group with a symmetric pairing, although it can hold in one of the groups (or both) of a pair of groups equipped with an asymmetric pairing. Curves with bilinear maps have been observed to allow for the construction of advanced cryptographic primitives [Jou00; BF01]. Cryptographic constructions relying on such curves are usually proven under variants of the Diffie-Hellman assumptions over pairing groups. We do not introduce specific instances of such assumptions here, as we will not use them in this work. We note, however, that they are believed to be stronger than the above assumptions (DDH, CDH, and their variants), and can be only instantiated over specific groups, while the previously discussed assumptions can be stated for a large variety of cyclic groups.

Factorization-Based Assumptions

The factorization assumption states, informally, that given a product n with large prime factors, it is computationally infeasible to factor n. With the discrete logarithm assumption, the factorization assumption is one of the most common assumptions in public-key cryptography.

While the assumptions can in theory be instantiated with any product of sufficiently large prime numbers, we will focus in this work on the most standard version, where the modulus is computed as the product of two large primes (p, q). In addition, it is common to restrict the primes (p, q) to be strong primes. That means that p = 2p + 1 and q = 2q + 1 for two other primes so that p, p , q, q are all distinct, and ϕ(n) = 4p q . One can note that in such groups, p and q are Blum primes: p = q = 3 mod 4. Assuming that (p, q) have been chosen this way, we can consider the following subgroups of Z * n :

• We let J n denote the subgroup of Z * n with Jacobi symbol 1. It has order ϕ(n)/2 = 2p q . It is the largest cyclic group contained in Z * n .

• We let QR n denote the subgroup of the squares, i.e.,

QR n = {a ∈ Z * n | ∃b ∈ Z * n , a = b 2 mod n}. This is a cyclic subgroup of Z *
n of order ϕ(n)/4 = p q , and a subgroup of J n .

Properties of QR n . Below, we outline some classical properties of the group QR n which will be useful for our work.

Proposition 2.2.5. The following facts hold: Let us briefly explain why these facts hold, using the Jacobi symbol function J n (x) = J p (x) × J q (x) in Z * n , as the extension of the Legendre symbol on Z * p for prime p, where J p (x) = (x) (p-1)/2 determines whether x is a square or not in Z * p . Since p and q are Blum primes, J p (-1) = J q (-1) = -1, and so J n (-1) = 1, but -1 is not in QR n , hence the Fact 1. The four square roots of 1, in Z * n are 1 and -1, both with Jacobi symbol +1, but respectively (+1, +1) and (-1, -1) for the Legendre symbols in Z * p and Z * q , and α, and -α, both with Jacobi symbol -1, but respectively (+1, -1) and (-1, +1) for the Legendre symbols in Z * p and Z * q . As a consequence, given a square h ∈ QR n , and a square root u, the four square roots are u, -u, and αu, -αu, one of which being in QR n , since the four kinds of Legendre symbols are represented. This leads to the Fact 2.

1. -1 ∈ J n \ QR n ; Exp fact A (1 κ ) : (n, (p, q)) $ ← GenMod(1 κ ) (a, b) ← A (n) if (p, q) = (a,

Modulus Generation Algorithm.

In the following, we denote by GenMod(1 κ ) a PPT algorithm that, given the security parameter κ, generates a strong RSA modulus n and secret parameters (p, q) of at least κ bits each with the specification that n = pq. In the following, we write (n, (p, q)) $ ← GenMod(1 κ ). We will sometimes abuse the notation n $ ← GenMod(1 κ ) to say that the modulus n has been generated according to this distribution.

The Factorization Assumption

We state the factorization assumption below. The experiment Exp fact A is represented Figure 2.6. Assumption 2.2.6. (Factorization Assumption) For any efficient algorithm A , it holds that Succ fact (A , κ) = negl(κ).

The best known attacks against the factorization assumption are based on an algorithm known as the general number field sieve, and run in subexponential time, with the current record being the factorization of a 768-bit modulus [START_REF] Kleinjung | Factorization of a 768-Bit RSA Modulus[END_REF]. Current recommandations for the size of p and q suggest to use 2048-bit random strong primes. As for assumptions related to the discrete logarithm, Shor's algorithm [START_REF] Peter | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] can be used to break this assumption in polynomial time with a quantum computer.

Additional Properties. We outline some useful observations regarding the factorization assumption.

Proposition 2.2.7. The following facts hold:

1. for a random element h ∈ QR n , finding a square root of h is equivalent to factoring the modulus n;

2. for random elements g, h ∈ QR n , finding non-zero integers a, b such that g a = h b mod n is equivalent to factoring the modulus n; Proof. For Fact 1, if one chooses a random u ∈ Z * n and sets h = u 2 mod n, J n (u) is completely hidden. Another square root v has probability one-half to have J n (v) = -J n (u). This means that u 2 = v 2 mod n, but u = ±v mod n. Then, gcd(uv, n) gives a non-trivial factor of n.

Exp rsa A (1 κ ) : (n, (p, q)) $ ← GenMod(1 κ ) e $ ← Dist n x $ ← Z n y ← A (n,
For Fact 2, if one chooses a random u ∈ Z * n and a large random scalar α and sets h = u 2 mod n and g = h α mod n, h is likely a generator of QR n , and then g a = h b mod n means that m = baα is a multiple of p q , the order of the subgroup of the squares. Let us write m = 2 v • t, for an odd t, then p q divides t: let us choose a random element u ∈ Z * n , with probability close to one-half, J n (u) = -1, and so J n (u t ) = -1 while u t is a square root of 1. As in the proof of the previous Fact 1, we can obtain a non-trivial factor of n.

We also note that by Fact 1, the hardness of the factorization assumption implies the hardness of the CDH assumption over the group QR n . Indeed, let g be a target element of QR n . Given access to a CDH oracle over QR n , one can compute a square root of g as follows: pick (a, b) $ ← Z 2 n/4 (observe that a, b follow a distribution statistically close from the uniform distribution over Z ϕ(n)/4 ), set h ← g 2 , compute (g 0 , g 1 ) ← (g • h a , g • h b ), and send (h, g 0 , g 1 ) to the CDH oracle. It is easy to observe that, given the CDH output g 2 = h (a+1/2)•(a+1/2) = h ab g a+b+1/2 , one can recover a square root of g by computing

g 2 • h ab • g -a-b .

The RSA Family of Assumptions

The RSA assumption is probably one of the most famous assumptions in cryptography. It was introduced in the seminal work of Rivest, Shamir, and Adleman [START_REF] Rivest | A Method for Obtaining Digital Signature and Public-Key Cryptosystems[END_REF]. It states, informally, that given an exponent e prime to ϕ(n), it is hard for any probabilistic polynomialtime algorithm to find the e-th root modulo n of a random y $ ← Z * n . More formally, let P n be the subset of 1 ; n of elements prime to ϕ(n). The RSA assumption does in fact refer to a class of assumptions, depending of the distribution Dist n over P n from which the exponent e is drawn. The experiment Exp rsa A is represented Figure 2.7. Assumption 2.2.8. (Dist n -RSA Family of Assumptions) For any efficient algorithm A , it holds that Succ rsa (A , κ, Dist n ) = negl(κ).

Various flavours of the RSA assumption are standard in the literature. In particular, the RSA assumption with a fixed small exponent (the most common being 65537) is widely used in practical implementations. In theoretical papers, it is common to consider the RSA assumption for exponents picked from the uniform distribution over P n (see [START_REF] Hohenberger | Short and Stateless Signatures from the RSA Assumption[END_REF] for example). In this work, we will use several flavours of the RSA assumption which are somewhat intermediate between these two standard variants: we will consider the RSA assumption for exponents picked from the uniform distribution over 3 ; a ∩ P n for a value a polynomial in κ (hence, we consider random small exponents), which we will denote a-RSA, and the RSA assumption for random κ-bit prime exponents.

Exp rsa A (1 κ ) : (n, (p, q)) $ ← GenMod(1 κ ) x $ ← Z n (y, e) ← A (n, x) if y e = x
Relation to the Factorization. It is clear that the hardness of RSA implies the hardness of the factorization, but the converse is not known. In fact, there are some evidences that we are unlikely to find a black-box reduction from factoring to RSA [BV98], although such a reduction is known if the adversary is restricted to be a straight-line program [START_REF] Daniel | Breaking RSA May Be As Difficult As Factoring[END_REF].

Additional Properties. We outline some useful observations regarding the RSA family of assumptions.

Proposition 2.2.9. For an RSA instance (n, e, y), finding x ∈ Z * n and e prime to e such that x e = y e mod n is equivalent to finding an e-th root of y modulus n.

Proof. Using Bézout relation ue + ve = 1, then x ve = y ve = y 1-ue mod n. So y = (x v y u ) e mod n.

The Strong-RSA Assumption

The Strong-RSA assumption [BP97; FO97] is a variant of the RSA assumption that gives more freedom to the adversary: rather than drawing the exponent e from some specified distribution, it lets the choice of e to the adversary. The experimentExp srsa A is represented Figure 2.8. Assumption 2.2.10. (Strong-RSA Assumption) For any efficient algorithm A , it holds that Succ srsa (A , κ) = negl(κ).

Relation to RSA and Factoring. It is clear that if Strong-RSA is hard, then both factoring and RSA are hard (for any distribution over the exponent). No reduction is known in the other direction. In fact, Strong-RSA appears clearly stronger than the RSA family of assumptions: while in any RSA assumption, the adversary A wins if he finds the only valid solution to the challenge, there are exponentially many valid solutions to a Strong-RSA challenge. Using the terminology of [START_REF] Goldwasser | Cryptographic Assumptions: A Position Paper[END_REF], both factoring and RSA are 1-search complexity assumption, while Strong-RSA is a t-search complexity assumption, for an exponentially large t. Although it remains a falsifiable assumption (i.e., the falseness of the assumption can be proven by exhibiting an algorithm that breaks it), t-search assumptions with large t are less desirable cryptographic assumptions. This is best said by quoting Goldwasser and Kalai [GK16]: 'Whereas the strong RSA assumption is considered quite reasonable in our community, the existence of exponentially many witnesses allows for assumptions that are overly tailored to cryptographic primitives.' Such assumptions do not allow standard win-win results: either the assumption is true and some cryptographic construction is secure, or it is not, and we obtain a useful algorithm for solving some hard problem. Therefore, it is typical to try to avoid such assumptions in cryptography.

Cryptographic Primitives

In this section, we discuss cryptographic primitives that are relevant to our work.

One-Way Functions

Cryptography is based on the existence of tasks that can be efficiently executed, but that cannot be efficiently abused. One-way functions represent the most fundamental object of this kind, and as such constitute the basis of a variety of other primitives: a one-way function is a function that can be efficiently computed, but that cannot be efficiently inverted (where inverting means finding any valid preimage of a random image). More formally, Definition 2.3.1. (One-Way Function) A function f : {0, 1} * → {0, 1} * is one-way if it satisfies the following two conditions:

1. there exists a deterministic polynomial-time algorithm F so that for all input x in the domain of f , F (x) = f (x) (in other words, f is efficiently computable);

2. for every PPT algorithm A , every (positive) polynomial p(•), and all large enough n's,

Pr[A (f (U n ), 1 n ) ∈ f -1 (f (U n ))] < 1 p(n)
Note that this definition enlightens the importance of the parameter 1 n : without it, a function could appear one-way merely because it shrinks its input by a very large (say, exponentially large) factor, hence inverting the output cannot be done in time polynomial in the output size. We also remark that this definition corresponds to a flavor of one-way function usually known as strong one-way function, and is the most standard one. A strong one-way function guarantees that any PPT adversary has only a negligible probability of inverting the function; a weak one-way function, on the other hand, only guarantees that any PPT adversary has a non-negligible probability of failing to invert the function. In fact, weak one-way functions can be shown to imply strong one-way function (and the reverse direction is obvious), hence both definitions are equivalent.

Commitment Schemes

The notion of commitment is one of the most fundamental and widely used in cryptography. A commitment scheme allows a committer C holding a secret value s to send a commitment • Π.Setup(1 κ ), generates the public parameters pp, which also specifies the message space M, the commitment space C, the opening space D, and the random source R;

Exp hiding-0 A (1 κ ) : pp $ ← Π.Setup(1 κ ) (m 0 , m 1 , st) $ ← A (pp) r $ ← R (c, d) ← Π.Commit(pp, m 0 ; r) b ← A (pp, c, st) Exp hiding-0 A (1 κ ) : pp $ ← Π.Setup(1 κ ) (m 0 , m 1 , st) $ ← A (pp) r $ ← R (c, d) ← Π.Commit(pp, m 1 ; r) b ← A (pp, c, st)
• Π.Commit(pp, m; r), given the message m ∈ M and some random coins r ∈ R, outputs a commitment-opening pair (c, d),

• Π.Verify(pp, c, d, m), outputs a bit b whose value depends on the validity of the opening (m, d) with respect to the commitment c, which satisfies the correctness, hiding, and binding properties defined below.

We now introduce the security properties of a commitment scheme, starting with the correctness property. We define the binding property of a commitment scheme. The experiment Exp binding A (1 κ ) for the binding property of a commitment scheme Π is represented Figure 2.10. Definition 2.3.5. (Binding Property of a Commitment Scheme) A commitment scheme Π is binding if for any PPT adversary A , it holds that Succ binding (A , κ) = negl(κ). An Example: the Pedersen Commitment Scheme. A famous example of commitment scheme is the Pedersen commitment scheme [START_REF] Torben | Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing[END_REF], which is perfectly hiding and whose binding property relies on the discrete logarithm assumption:

Exp binding A (1 κ ) : pp $ ← Π.Setup(1 κ ) (c, d, m 0 , m 1 ) $ ← A (pp) if Π.Verify(pp, c, d, m 0 ) =
Example 2.3.6. (Pedersen) The Pedersen commitment scheme is defined as follows:

• Setup(1 κ ), generates the description of a group G of prime order p together with two generators (g, h). We let pp denote (G, p, g, h);

• Commit(pp, m; r), given the message m ∈ Z p and some random coins r ∈ Z p , outputs a commitment-opening pair (c, d) ← (g m h r , r),

• Verify(pp, c, d, m), returns 1 iff g m h r = c.

This commitment scheme is perfectly hiding, binding under the discrete logarithm assumption in G, and additively homomorphic.

Proof. For the hiding property, notice that upon random choice of r ∈ Z p , for any m ∈ Z p , g m h r is uniformly distributed over G. For the binding property, given openings (r 0 , r 1 ) for a commitment c to distinct messages (m 0 , m 1 ), the relation

g m 0 h r 0 = g m 1 h r 1 leads to h = g (m 0 -m 1 )(r 1 -r 0 ) -1
, which gives the discrete logarithm of h in base g. Finally, it is clear that from c 0 = g m 0 h r 0 and c 1 = g m 1 h r 1 , r 0 + r 1 is a valid opening of c 0 c 1 to m 0 + m 1 , hence the homomorphic property.

On the Relation Between Commitments and

Exp ind-cpa-0 A (1 κ ) : (pk, sk) $ ← Π.KeyGen(1 κ ) (m 0 , m 1 , st) $ ← A (pk) r $ ← R c ← Π.Encrypt(pk, m 0 ; r) b ← A (pk, c, st) Exp ind-cpa-1 A (1 κ ) : (pk, sk) $ ← Π.KeyGen(1 κ ) (m 0 , m 1 , st) $ ← A (pk) r $ ← R c ← Π.Encrypt(pk, m 1 ; r) b ← A (pk, c, st) Figure 2.11: Experiments Exp ind-cpa-0 A (1 κ ) and Exp ind-cpa-1 A
(1 κ ) for the IND-CPA security property of a public-key encryption scheme Π

Public-Key Encryption Schemes

A public-key encryption scheme allows to encode a message using an encryption key, so that it is unfeasible to find out the message from its encoding (even given the encryption key), yet a decryption key allows to recover the message from the encoding. More formally, Definition 2.3.8. (Public-Key Encryption Scheme) A public-key encryption scheme Π is a triple of PPT algorithms (Π.KeyGen, Π.Encrypt, Π.Decrypt), such that • Π.KeyGen(1 κ ), generates a pair (pk, sk), where pk is the public key and sk is the private key. We assume that pk specifies the ciphertext space C, the message space M, and the random source R;

• Π.Encrypt(pk, m; r), given the message m ∈ M and some random coins r ∈ R, outputs a ciphertext c;

Definition 2.3.10. (IND-CPA Security Property of a Public-Key Encryption Scheme) A public-key encryption scheme

Π is IND-CPA secure if for any PPT adversary A , it holds that Adv ind-cpa (A , κ) = negl(κ).
Public-key encryption schemes can also be additively homomorphic, which is defined similarly as for commitment schemes.

An Example: the ElGamal Encryption Scheme. The ElGamal encryption scheme is a famous public-key encryption scheme introducted in [START_REF] Elgamal | A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF] whose IND-CPA security property reduces to the DDH assumption. In its original formulation, the plaintext m is a group element. We describe below a standard variant, where the message is encrypted in the exponent. This variant is additively homomorphic and decryption requires brute-forcing over the message space; the latter must therefore be sufficiently small.

Example 2.3.11. (ElGamal) The ElGamal encryption scheme is defined as follows:

• KeyGen(1 κ ), generates the description of a group G of prime order p together with a generators g, picks s $ ← Z p , sets h ← g s , pk ← (G, p, g, h), and sk ← (G, p, g, s).

• Encrypt(pk, m; r), given the message m ∈ Z p (from a message space of size bounded by a polynomial) and some random coins r ∈ Z p , parses pk as (G, p, g, h) and outputs a ciphertext c ← (g r , g m h r ),

• Decrypt(sk, c), parses c as (c 0 , c 1 ), sk as (G, p, g, s), and outputs m ← dlog g (c 1 /c s 0 ).

This encryption scheme is perfectly correct, additively homomorphic, and its IND-CPA security reduces to the decisional Diffie-Hellman assumption (see Section 2.2.1.3).

Proof. Correctness and additive homomorphism are clear from the description. For IND-CPA security, given a bit b and a tuple (g, h, u, v), the challenger in the experiment Exp ind-cpa-b A

(1 κ ) sets (g, h) to be the public key of the scheme. Upon receiving (m 0 , m 1 ) from A , he computes

c as (u, vg m b ). If (g, h, u, v) is a random tuple, this perfectly hides m b ; otherwise, if (g, h, u, v) is a DDH tuple,
this is a valid encryption of m b . Therefore, from the answer of an adversary that wins the experiment with non-negligible probability, the challenger can guess whether (g, h, u, v) is a DDH tuple with non-negligible probability.

Smooth Projective Hash Functions

Hash proof systems, also called smooth projective hash functions (SPHFs), have been introduced by Cramer and Shoup in [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF] as a tool to build IND-CCA secure cryptosystems (i.e., cryptosystems which should remain secure even when the adversary is given access to a decryption oracle). Since then, SPHFs have found many more applications.

We recall that an NP-language L ⊂ X associated to a relation R is a set of the form

L = {x ∈ X | ∃w, R(x, w) = 1}
, where R is a polynomial-time computable function.

Informally speaking, an SPHF for a language L ⊂ X provides two ways to hash a word x ∈ X, either using a hashing key hk, or using a projection key hp together with a witness w for the statement x ∈ L . The correctness requirement states that the two ways of hashing should return the same hash value for any x ∈ L . The smoothness property, on the other hand, says that if x / ∈ L , then the hash value computed with hk is statistically indistinguishable from a random value from the view point of any adversary, even given hp. More formally, Definition 2.3.12. (SPHF) A smooth projective hash function S for a NP-language L ⊂ X with hash space H is a 4-tuple of PPT algoritms (S.HashKG, S.ProjKG, S.Hash, S.ProjHash) such that:

• S.HashKG(1 κ ) : outputs a hashing key hk;

• S.ProjKG(hk, x) : on input hk and a word x ∈ X, output a projection key hp;

• S.Hash(hk, x) : on input hk and a word x ∈ X, outputs a hash value H ∈ H;

• S.ProjHash(hp, x, w) : on input hp, a word x ∈ L , and a witness w for the statement x ∈ L , outputs a projective hash value projH ∈ H;

which satisfies the correctness and smoothness properties defined below.

Smooth projective hash functions are often used in conjunction with hard-subset-membership languages, which are NP languages L ⊂ X satisfying two properties: it is possible to efficiently sample pairs (x, w) where x is uniform over L and w is a valid witness for x ∈ L (with a PPT algorithm Sample), and no efficient algorithm can distinguish the distribution {x $ ← X} from the distribution {x ∈ X | (x, w) $ ← Sample(L )}. As an example, the language of DDH tuples is a hard-subset-membership language over G 4 , provided that the decisional Diffie-Hellman assumption holds over G.

Note that the above definition allows the projection key hp to depend on the word x. This is a relaxation of the original definition of [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF], where hp had to be independent of the word x, that was suggested in [GL06; KOY09]. The variant considered here is usually called GL-SPHF (for Gennaro-Lindell SPHF). We now define the correctness property of SPHFs. Definition 2.3.13. (Correctness of SPHFs) A smooth projective hash function S for a NPlanguage L ⊂ X is correct if for any hk $ ← S.HashKG(1 κ ), any x ∈ L with witness w, and hp ← S.ProjKG(hk, x), it holds that S.Hash(hk, x) = S.ProjHash(hp, x, w)

We now define the smoothness property of SPHFs.

Definition 2.3.14. (Smoothness of SPHFs) A smooth projective hash function S for a

NP-language L ⊂ X is smooth if for any hk $ ← S.HashKG(1 κ ), any x ∈ X \ L , and hp ← S.ProjKG(hk, x), the distributions {(x, hp, H) | H ← S.Hash(hk, x)} and {(x, hp, H) | H $ ← H} are statistically indistinguishable.
Note that this definition assumes that the word x is chosen before hp is generated (as, in particular, the latter can depend of it). We already mentioned the alternative definition of [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF], in which hp is independent of x. With this alternative definition, two variants can be considered: the strongest, denoted KV-SPHF (for Katz-Vaikuntanathan SPHF) requires the smoothness to hold even if the word x is chosen adaptively by the adversary after seing hp, while the weakest, usually denoted CS-SPHF (for Cramer-Shoup SPHF) is the original definition of [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF] and requires x to be generated before seing hp.

Generic Framework of SPHFs over Cyclic Groups

In this section, we briefly introduce an algebraic framework for constructing SPHFs on languages defined over cyclic groups. This framework was initially introduced in [START_REF] Benhamouda | New Techniques for SPHFs and Efficient One-Round PAKE Protocols[END_REF].

Languages. Let G be a cyclic group of prime order p and Z p the field of integers modulo p. If we look at G and Z p as the same ring (G, +, •), where internal operations are on the scalars, many interesting languages can be represented as subspaces of the vector space G n , for some n. Here are some examples.

Example 2.3.15 (DDH or ElGamal ciphertexts of 0). Let g and h be two generators of G.

The language of DDH tuples in basis (g, h) is

L = {(u, e) ∈ G 2 | ∃r ∈ Z p , u = g r and e = h r } ⊆ G 2 ,
where r is the witness. It can be seen as the subspace of G 2 generated by (g, h). We remark that this language can also be seen as the language of (additive) ElGamal ciphertexts of 0 for the public key pk = (g, h).

Example 2.3.16 (DLin). Let g 1 , g 2 and h be three generators of G. The language of DLin tuples in basis (g 1 , g 2 , h) is

L = {(u 1 , u 2 , e) ∈ G 2 | ∃(r, s) ∈ Z 2 p , u 1 = g r 1 , u 2 = g s 2 and e = h r+s } ⊆ G 3 ,
where r is the witness. It can be seen as the subspace of G 3 generated by the rows of the following matrix:

Γ = g 1 1 h 1 g 2 h .
Example 2.3.17 (ElGamal ciphertexts of a bit). Let us consider the language of ElGamal ciphertexts of 0 or 1, under the public key pk = (g, h):

L := {(u, e) ∈ G 2 | ∃r ∈ Z p , ∃b ∈ {0, 1}, u = g r and e = h r g b }.
Here C = (u, e) cannot directly be seen as an element of some vector space. However, a word C = (u, e) ∈ G 2 is in L if and only there exists

#" λ = (λ 1 , λ 2 , λ 3 ) ∈ Z 3 p such that: u = g λ 1 (= λ 1 • g) e = h λ 1 g λ 2 (= λ 1 • h + λ 2 • g) 1 = u λ 2 g λ 3 (= λ 2 • u + λ 3 • g) 1 = (e/g) λ 2 h λ 3 (= λ 2 • (e -g) + λ 3 • h), because, if we write C = (u, e) = (g r , h r g b ) (with r, b ∈ Z p , which is always possible), then the first three equations ensure that λ 1 = r, λ 2 = b and λ 3 = -rb, while the last equation (right bottom) ensures that b(b -1) = 0, i.e., b ∈ {0, 1}, as it holds that (h r g b /g) b h -rb = g b(b-1) = 1.
Therefore, if we introduce the notation

#" Ĉ = θ(C) := u e 1 1 ∈ G 4 ,

then the language

L can be defined as the set of C = (u, e) such that #" Ĉ is in the subspace of G 4 generated by the rows of the following matrix

Γ :=    g h 1 1 1 g u e/g 1 1 g h    .
Example 2.3.18 (Conjunction of Languages). Let g i and h i (for i = 1, 2) be four generators of G, and L i be (as in Example 2.3.15) the languages of DDH tuples in bases (g i , h i ) respectively. We are now interested in the language L = L 1 × L 2 ⊆ G 4 , which is thus the conjunction of L 1 × G 2 and G 2 × L 2 : it can be seen as the subspace of G 4 generated by the rows of the following matrix

Γ := g 1 h 1 1 1 1 1 g 2 h 2 .
This can also be seen as the matrix, diagonal by blocks, with Γ 1 and Γ 2 the matrices for L 1 and L 2 respectively.

More formally, the generic framework for SPHFs in [START_REF] Benhamouda | New Techniques for SPHFs and Efficient One-Round PAKE Protocols[END_REF] considers the languages L ⊆ X defined as follows: There exist two functions θ and Γ from the set of words X to the vector space G n of dimension n, and to set G k×n of k × n matrices over G, such that

C ∈ L if and only if #" Ĉ := θ(C) is a

linear combination of the rows of Γ(C). From a witness

w for a word C, it should be possible to compute such a linear combination as a row vector

#" λ = (λ i ) i=1,...,k ∈ Z 1×k p : #" Ĉ = θ(C) = #" λ • Γ(C). (2.1)
For the sake of simplicity, because of the equivalence between w and #" λ , we will use them indifferently for the witness.

SPHFs.

Let us now build an SPHF on such a language. A hashing key hk is just a random column vector hk ∈ Z n p , and the associated projection key is hp := Γ(C) • hk. The hash value of a word C is then H := #" Ĉ • hk, and if #" λ is a witness for C ∈ L , this hash value can also be computed as:

H = #" Ĉ • hk = #" λ • Γ(C) • hk = #" λ • hp = projH, which

only depends on the witness

#" λ and the projection key hp. On the other hand, if

C / ∈ L , then #"
Ĉ is linearly independent from the rows of Γ(C). Hence, H := #" Ĉ • hk looks random even given hp := Γ(C) • hk, which is exactly the smoothness property.

Example 2.3.19. The SPHF corresponding to the language in Example 2.3.17, is then defined by:

hk = (hk 1 , hk 2 , hk 3 , hk 4 ) $ ← Z 4 p hp = Γ(C) • hk = (g hk 1 h hk 2 , g hk 2 u hk 3 (e/g) hk 4 , g hk 3 h hk 4 ) H = #" Ĉ • hk = u hk 1 e hk 2 projH = #" λ • hp = hp r 1 • hp b 2 • hp -rb 3 .
For the sake of clarity, we will omit the C argument, and write Γ, instead of Γ(C).

Zero-Knowledge Proofs and Arguments

The main focus of our work is the study of interactive proofs, that allow a prover to convince a computationally bounded verifier of the truth of a statement. More specifically, we will consider zero-knowledge arguments, in which the prover is also computationally bounded, and the proof is guaranteed (informally) to leak nothing except the truth of the statement.

In this chapter, we recall the classical definitions of zero-knowledge proofs and argument. To provide the reader with an overview of the context of our work, we organize this chapter as a (non-comprehensive) introduction to zero-knowledge, and recall a variety of important results, together with chronological insights and concrete examples.

Interactive Proofs

As discussed in the introduction, interactive proofs capture a natural generalization of the class NP; in this section, we discuss further this relation and formally define these notions.

Definitions

We recall that the class NP corresponds to the class of languages for which a computationally unbounded teacher can generate a proof of membership π which can be verified by a polynomial-time student -this captures proofs that can be efficiently verified. More formally, Definition 3.1.1. (The Class NP) A language L is in the class NP if there exists a polynomial time algorithm R L such that

L = {x | ∃π, |π| = poly(|x|) ∧ R L (x, π) = 1}
The proof π is usually called a witness for the statement x ∈ L . By the above definition, NP contains all languages for which an unbounded prover can compute deterministic proofs, where a proof is viewed as a string of size polynomial in the word x.

An interactive proof relaxes these requirements in two directions: first, the parties are allowed to use random coins, and the output of a proof verification should only match the actual truth of the statement with some reasonable enough probability. Second, rather than seing the proof as a fixed string π checked by the student, the student is allowed to interact with his teacher, asking questions and receiving answers in an adaptive way.

Definition 3.1.2. (Interactive Proof System) An n-round interactive proof system (P, V)

between a prover P and a verifier V for a language L is any pair of randomized algorithms (modeled as interactive Turing Machines) such that V runs in probabilistic polynomial-time and the following conditions hold:

• Completeness. (P, V) is complete, if for any x ∈ L : Pr [ (P, V)(x) = 1 ] ≥ 2/3; • Soundness. (P, V) is sound, if for any x /
∈ L , for any prover P :

Pr (P , V)(x) = 1 ≤ 1/3;
We denote by (P, V)(x) the random variables (where randomness is taken over the coin tosses of the parties) representing the output of V after interacting with P on a common input x.

The choice of the constants 1/3 and 2/3 in Definition 3.1.2 is arbitrary: the constant 1/3 (resp. 2/3) can be amplified by sequential repetitions to be as close to 0 (resp. to 1) as desired. 1 Typically, the error probability will be made superpolynomially small in the security parameter. It is clear that every language L in NP has an interactive proof system, where the interaction consists in a single flow from P to V: the prover simply sends the membership witness w to the verifier, who outputs one if and only if R L (x, w) = 1.

Having defined interactive proof systems, it is natural to consider the class IP of all languages that have an interactive proof system.

Definition 3.1.3. (Class IP)

A language L is in the class IP if it has an interactive proof system with a polynomial number of rounds (in its input length).

Historical Notes

Seminal Works. Interactive proofs systems were studied in two seminal papers by Babai [START_REF] Babai | Trading Group Theory for Randomness[END_REF], and Goldwasser, Micali, and Rackoff [START_REF] Goldwasser | The Knowledge Complexity of Interactive Proof-Systems (Extended Abstract)[END_REF]. Both papers introduced and studied complexity classes where a computationally unbounded prover must convince a polynomially bounded receiver of the truth of a statement using rounds of interactions. The main difference between the notions studied in both works is with respect to the random coins of the verifier: in the work of Babai, the verifier was required to reveal to the prover all coins that he used during the computation. Such interactive proofs are referred to as public coin interactive proofs, as opposed to private coin interactive proofs, in which the verifier might keep its internal state hidden. The complexity classes corresponding to public coin interactive proofs were denoted AM[f (n)] by Babai, where AM stands for Arthur-Merlin, n is the input length, and f (n) is the allowed number of rounds of interaction. The complexity classes corresponding to private coin interactive proofs were denoted IP[f (n)] by Goldwasser, Micali, and Rackoff.

Major Results. One year after their introduction, these complexity classes were proven to be essentially equivalent: any language recognized by a private coin interactive protocol with f (n) rounds can be recognized by a public coin interactive protocol with at most f (n) + 2 rounds. In other words, the ability to hide its internal random coins does little to help the verifier. This result was proven by Goldwasser and Sipser [START_REF] Goldwasser | Private Coins versus Public Coins in Interactive Proof Systems[END_REF].

One of the most natural questions to ask about interactive proofs is whether these relaxations of the standard model of proofs, which is captured by the class NP, really helps recognizing more languages -namely, whether IP is strictly more powerful than NP. The most celebrated result in the field of interactive proofs is the proof that IP = PSPACE. The class PSPACE contains all languages that can be recognized by an algorithm that uses polynomial space, but which is allowed unbounded running time. PSPACE is believed to be strictly more powerful than NP; in particular, it contains the entire polynomial hierarchy. The proof that IP = PSPACE arose from a sequence of works, culminating with the work of Lund, Fortnow, Karloff, and Nisan [LFKN92] and of Shamir [START_REF] Shamir | Ip= pspace[END_REF], who introduced a new proof technique, called arithmetization, that proved extremely fruitful.

Additional Observations. The class IP relaxes NP in two directions, by introducing randomness (and allowing errors), and adding interactions. One might wonder to what extent both relaxations are necessary.

Regarding randomness, it is known that if no randomness is allowed, the class of interactive proof systems collapses back to NP. In fact, it suffices to restrict soundness to be perfect (i.e., for any x / ∈ L , for any prover P , Pr [ (P , V)(x) = 1 ] = 0) for this collapse to happen; on the other hand, restricting completeness to be perfect does not reduce the expressivity of interactive proof systems (any language having an interactive proof system has one with perfect completeness) [START_REF] Furer | On completeness and soundness in interactive proof systems[END_REF]. Conversely, relaxing further the requirements by allowing unbounded error (completeness must hold with any probability strictly greater than 1/2, and soundness with any probability strictly lower) does also not change the expressivity of interactive proofs; the resulting class is still equal to PSPACE.

Regarding interaction, the non-interactive version of IP (where verification is still randomized) is the class MA defined in [START_REF] Babai | Trading Group Theory for Randomness[END_REF]; it contains NP, but the converse is not known.

Interactive Zero-Knowledge Proofs

Zero-knowledge proofs were introduced in the seminal work of Goldwasser, Micali, and Rackoff [START_REF] Goldwasser | The Knowledge Complexity of Interactive Proof Systems[END_REF]. They play a central role in cryptography; their study and their applications to secure computation are the main motivations of this thesis. Informally, a zero-knowledge proof is an interactive proof systems in which it is additionally required that the verifier should not learn anything from his interaction with the prover, beyond the truth of the statement. A typical usecase of zero-knowledge proofs is to ask all participants of some interactive protocol to prove that they behaved honestly, without revealing their private values.

Definitions

The main issue with defining zero-knowledge is that it apparently requires to first define what knowledge is, and what it does mean to gain no additional information. The elegant solution introduced in [GMR89] is to consider that a (potentially malicious) verifier V * gains no new information from interacting with a prover P on a common input x if everything this verifier can compute after interacting with P can be computed directly from the common input x by an efficient algorithm. Proving zero-knowledge is therefore done by exhibiting such an efficient algorithm; it is called a simulator for the zero-knowledge proof. A natural efficiency requirement would be to assume that the simulator runs in probabilistic polynomial-time; it turns out that this is too restrictive and the definition of [START_REF] Goldwasser | The Knowledge Complexity of Interactive Proof Systems[END_REF] relaxes this requirement by letting the simulator run in expected polynomial time.

Perfect Zero-Knowledge

We start by defining perfect zero-knowledge proof systems, and discuss useful relaxations of this notion afterward. Definition 3.2.1. (Perfect Zero-Knowledge Proof System) An n-round perfect zero-knowledge proof system (P, V) for a language L is an n-round interactive proof system for L such that for every probabilistic polynomial time V * there exists a probabilistic simulator Sim running in expected polynomial time such that for every x ∈ L ,

(P, V * )(x) ≡ Sim(x)
Alternatively, the simulator can run in strict polynomial time if it is allowed to output a special symbol ⊥ on input x with probability at most 1/2. The above definition only asks the simulator to compute the same output than V * ; a seemingly stronger definition would be to let the simulator output the entire view of V * during its interaction with P. In facts, this does not change the definition, as a simulator must exist for every adversarial verifier V * , and in particular for all verifiers that output their entire view; however, this alternative definition is convenient to work with. Let us denote View P V * (x) the view of V * when interacting with P on common input x, i.e., the sequence of all its local configurations. Without loss of generality, we can assume that View P V * (x) consists of the internal random tape of V * , together with the sequence of all messages he received from P (as all its local configurations can be deterministically computed from this). Having defined perfect zero-knowledge proofs, we can introduce the class of languages they capture: Definition 3.2.2. (The Class PZK) A language L is in the class PZK if it has a perfect zero-knowledge proof system with a polynomial number of rounds (in its input length).

Statistical Zero-Knowledge

A natural relaxation of the above definition is to require instead that for all x, the statistical distance between View P V * (x) and Sim(x) should be negligible in |x|. To simplify notations, we write X stat ≡ Y to say that X is statistically indistinguishable from Y , and X comp ≡ Y to say that X is computationally indistinguishable from Y (i.e., any PPT adversary has negligible advantage in distinguishing X from Y ).

Definition 3.2.3. (Statistical Zero-Knowledge Proof System)

An n-round statistical zeroknowledge proof system (P, V) for a language L is an n-round interactive proof system for L such that for every probabilistic polynomial time V * there exists a probabilistic simulator Sim running in expected polynomial time such that for every x ∈ L ,

View P V * (x) stat ≡ Sim(x) Definition 3.2.4. (The Class SZK) A language L is in the class SZK if it has a statistical
zero-knowledge proof system with a polynomial number of rounds (in its input length).

Computational Zero-Knowledge

One can relax further the definition of zero-knowledge proof systems by requiring only that the view of V * and the output of the simulator must be computationally indistinguishable.

The core feature of computational zero-knowledge proof systems is that, while providing meaningful zero-knowledge guarantees, they are very expressive: assuming the existence of one-way function, all languages in NP have a computational zero-knowledge proof systems.

No such inclusion is known for PZK or SZK.

Definition 3.2.5. (Computational Zero-Knowledge Proof System) An n-round computational zero-knowledge proof system (P, V) for a language L is an n-round interactive proof system for L such that for every probabilistic polynomial time V * there exists a probabilistic simulator Sim running in expected polynomial time such that for every x ∈ L ,

View P V * (x) comp ≡ Sim(x)
Definition 3.2.6. (The Class CZK) A language L is in the class CZK if it has a computational zero-knowledge proof system with a polynomial number of rounds (in its input length).

The following theorem was proven in [START_REF] Goldreich | Proofs that Yield Nothing But their Validity and a Methodology of Cryptographic Protocol Design (Extended Abstract)[END_REF], it is the cornerstone of a large number of results in cryptography (and in particular in secure computation): Theorem 3.2.7. Assuming the existence of one-way functions, NP ⊆ CZK.

Proof. (Sketch) Assume that the parties have performed the setup of a computationally hiding, statistically binding commitment scheme (Setup, Commit, Verify). By Proposition 2.3.7, such a scheme exists under the assumption that one-way functions exist.

Observe that to build a computational zero-knowledge proof system for all of NP, it suffices to build such a system for any NP-complete language, as all languages of NP can be reduced to it, using e.g., Karp reductions. We therefore focus on the following NP-complete problem: E), determines whether there exists an assignment Color : [n] → {red, green, blue}, which associates a color to each vertex of the graph, such that no pair of adjacent vertices has the same color.

Problem 3.2.8. (Graph 3-Coloring) Given a graph G = ([n],
We now describe a computational zero-knowledge proof system for graph 3-coloring (3COL). Let G = ([n], E) be the common input to (P, V). We assume that P is given a 3-coloring col of G.

1. P picks a uniformly random permutation π of the color set {red, green, blue}, and

computes col = π • col. For each vertex v ∈ [n], P computes a commitment-opening pair (c v , d v ) $ ← Commit(col (v)) and sends c v to V.
2. V picks a uniformly random edge e = (u, v) ∈ E and sends it to P. Color v , and

Verify(c u , d u , Color u ) = Verify(c v , d v , Color v ) = 1.
Completeness follows easily by observing that when col is a valid 3-coloring of G, then so is col . For soundness, if G is not 3-colorable, then it must necessarily hold that there exists an edge (u, v) ∈ E such that Color u = Color v ; by the binding property of the commitment scheme, if the verifier asked this edge, P cannot open (c u , c v ) to different colors, hence V will reject with probability at least 1/|E|. While this gives a very large soundness error, the soundness can always be amplified by sequential repetitions of the protocol; typically, sequentially repeating the protocol λ • (|E| + 1) times, for some security parameter lambda, ensures that the soundness error is bounded by

(1 -1/|E|) λ•(|E|+1) < 3 -λ .
For zero-knowledge, we must exhibit a simulator Sim which, given the code of some verifier V * , produces a transcript indistinguishable from View P V * (G) without knowing a 3-coloring of G. We sketch a description of such a simulator: for every

v ∈ [n], Sim will pick Color v $ ← {red, green, blue} and compute (c v , d v ) $ ← Commit(Color v ).
Then, Sim writes c v on the inputmessage tape of V * for every v ∈ [n], and runs it until it outputs a query e ∈ E (treating any invalid query as some predetermined fixed edge). If e corresponds to an edge (u, v) such that

Color u = Color v , Sim terminates with transcript (c 1 , • • • , c n , e = (u, v), Color u , d u , Color v , d v );
otherwise, it restarts the protocol, selecting a new uniformly random tape for V * . Observe that if V * was picking e = (u, v) independently of (c 1 , • • • , c n ), it would hold that Color u = Color v with probability 2/3; it can be shown that this remains essentially true when V * is given

(c 1 , • • • , c n )
by the hiding property of the commitment scheme. Similarly, when Sim terminates, its output (c

1 , • • • , c n , e = (u, v), Color u , d u , Color v , d v ) is computationally indistinguishable from View P V * (G)
. For a fully detailed proof of Theorem 3.2.7, see Goldreich's book [START_REF] Goldreich | Foundations of Cryptography[END_REF]. Note that this result was later extended to the stronger result IP = CZK (see [IY88; BGG+90]).

Honest-Verifier Zero-Knowledge.

The definition of zero-knowledge proof systems asks for the existence of an algorithm that can simulate the view of any verifier V * . Honest-verifier zero-knowledge proof systems are interactive proof systems with a weaker notion of zero-knowledge, called honest-verifier zero-knowledge (HVZK), which only asks for the existence of a simulator for a single verifier, which is the honest verifier prescribed by the specification of the protocol. Definition 3.2.9. (Honest-Verifier Zero-Knowledge Proof System) An n-round (perfect, statistical, computational) honest-verifier zero-knowledge proof system (P, V) for a language L is an n-round interactive proof system for L such that there exists a probabilistic simulator Sim running in expected polynomial time such that for every x ∈ L ,

View P V (x) ≡ Sim(x)
where ≡ denotes equality, statistical indistinguishability, or computational indistinguishability.

From HVZK to ZK. At first sight, the honest-verifier zero-knowledge notion might seem too weak to provide meaningfull security guarantees in cryptographic protocols. However, perhaps surprisingly, HVZK proofs can be shown to capture the essence of the challenge of building zero-knowledge proofs. Indeed, as shown by Goldreich, Sahai, and Vadhan in [START_REF] Goldreich | Honest-Verifier Statistical Zero-Knowledge Equals General Statistical Zero-Knowledge[END_REF], a language L has a statistical honest-verifier zero-knowledge proof system if and only if it belongs to SZK. A similar statement was established for public-coin computational zero-knowledge proof systems. Thus, in essence, honest-verifier zero-knowledge proof systems and zero-knowledge proof systems capture the same languages. This equivalence is not a purely theoretical observation: it turns out that, when considering practical zero-knowledge proofs in a classical model known as the common reference string model (which will be discussed later on), the conversion from a HVZK proof to a ZK proof can be done very efficiently, at a small, constant additive cost in communication and computation (see e.g. [Gro04; GMY06]).

Brief Survey of Known Results

We have seen above that NP ⊆ CZK assuming one-way functions. In this section, we briefly discuss other aspect of the complexity-theoretic study of zero-knowledge proof systems.

Regarding the classes PZK and SZK, it is known [For87; AH91] that PZK ⊆ SZK ⊆ AM ∩ coAM, where coAM is the class of languages whose complementary is in AM. This inclusion implies that it is unlikely that NP ⊆ SZK: this would imply that AM∩coAM contains NP-complete problems, hence that AM = coAM, which would have surprising consequences, such as the collapse of the polynomial hierarchy. Other complexity-theoretic results on SZK were established by Okamoto [START_REF] Okamoto | On Relationships between Statistical Zero-Knowledge Proofs[END_REF] who established that SZK = coSZK (SZK is closed by complement), and that every language in SZK also has a public coin statistical zero-knowledge proof system (where all coins of the verifier are revealed to the prover during the computation).

Regarding the class CZK, a natural question is to ask whether one-way functions are necessary to prove NP ⊆ CZK. The first steps toward answering this question were made in [START_REF] Ostrovsky | One-way functions are essential for nontrivial zero-knowledge[END_REF], and were extended in [START_REF] Salil | An Unconditional Study of Computational Zero Knowledge[END_REF][START_REF] Shien | Zero Knowledge and Soundness Are Symmetric[END_REF] to give a full characterization of languages in CZK as having a "part" in SZK, and a part from which one-way functions can be constructed.

Interactive Zero-Knowledge Arguments

We have seen that it is unlikely that NP ⊆ SZK. The class CZK can be seen as a relaxation of zero-knowledge proof systems, in which we allow the zero-knowledge property to hold only computationally, while maintaining a statistical soundness property. As we observed, this relaxation suffices to capture every language in NP.

In this section, we explore an alternative notion, called interactive zero-knowledge arguments, which can be seen as a relaxation of zero-knowledge proofs dual to CZK: the zero-knowledge property of a zero-knowledge argument is required to hold statistically, while the knowledge-extraction property must only hold computationally. This relaxation is of a different nature than the previous one, as for it to make sense, we must restrict our attention to computationally bounded provers, while zero-knowledge proof systems can be described with respect to bounded or unbounded provers. Therefore, the natural setting for zero-knowledge arguments is to focus on languages in NP, and on efficient prover which are assumed to hold a membership witness for the statement as auxiliary input.

Definitions

Definition 3.3.1. (Statistical Zero-Knowledge Argument System) An n-round interactive zero-knowledge argument system (P, V) between a prover P and a verifier V for a language L is any pair of probabilistic polynomial-time algorithms such that the following conditions hold:

• Completeness. (P, V) is complete, if for any x ∈ L with a membership witness w:

Pr [ (P(w), V)(x) = 1 ] ≥ 2/3; • Computational Soundness. (P, V) is sound, if for any x /
∈ L , for any probabilistic polynomial-time prover P :

Pr (P , V)(x) = 1 ≤ 1/3;
• Statistical Zero-Knowledge. (P, V) is zero-knowledge, if for every probabilistic polynomial time V * there exists a probabilistic simulator Sim running in expected polynomial time such that for every x ∈ L ,

View P V * (x) stat ≡ Sim(x)
Note that perfect zero-knowledge argument systems and computational zero-knowledge argument systems can be defined in a similar fashion. Definition 3.3.2. (The Classes PZKA,SZKA,CZKA) A language L is in the class SZKA (resp. PZKA, CZKA) if it has a statistical (resp. perfect, computational) zero-knowledge argument system with a polynomial number of rounds (in its input length).

Using the same methodology than in the proof of Theorem 3.2.7, one can prove that every language in NP has a statistical zero-knowledge argument system. The proof goes on by replacing the statistically binding, computationally hiding commitment scheme with a statistically hiding, computationally binding commitment scheme. As the latter can also be built from any one-way function [HR07; NOV06], we have:

Theorem 3.3.3.
Assuming the existence of one-way functions, NP ⊆ SZKA.

Historical Notes

Zero-knowledge argument were introduced in [START_REF] Brassard | Minimum Disclosure Proofs of Knowledge[END_REF]. They proved to be a very powerful relaxation of zero-knowledge proof systems. In particular, it is possible to construct zero-knowledge argument systems with very strong succinctness requirements, where the communication complexity (and sometimes the work of the verifier) can be made sublinear in (or even independent of) the witness size [Kil92; IKO07; BCC+16]. In comparison, zero-knowledge proofs (or even standard interactive proofs) with sublinear communication would have surprising consequences [GH98; GVW02].

Proofs and Arguments of Knowledge

Zero-knowledge proofs, and their relaxed version, zero-knowledge arguments, allow to prove statements of the form x ∈ L (i.e., membership statements). Restricting our attention to NP-languages, such statements can be phrased as existential statements, of the form ∃w, R L (x, w) = 1. Proofs of knowledge strengthen the security guarantee given by classical zero-knowledge proofs. While a zero-knowledge proof suffices to convince the verifier of the existence of a witness w for the statement, a proof of knowledge additionally proves that the prover knows such a witness.

Several remarks are in order here. First, observe that when considering unbounded prover, this distinction does not make sense, as an unbounded prover can always compute a witness if there exists one. However, when restricting our attention to computationally bounded provers, the distinction makes sense, as a witness can potentially exist for a statement, even though the limited prover might not be able to compute it.

Second, we have to define what it means for a prover to know such a witness. Informally, this is done as follows: we say that a party, modeled as a Turing machine, knows a value is the machine can be easily modified so as to output it. More specifically, we will say that an (efficient) algorithm A knows a value w if we can build another efficient algorithm which, given access to A (e.g. by getting the code of A), can output w. Such an algorithm is called an extractor for A. Intuitively, this allows to define proofs of knowledge for a statement x ∈ L as follows: the soundness property is replaced by a knowledge-extraction property, which states that for every efficient algorithm P * such that (P * , V)(x) = 1, there exists an efficient extractor Ext which, given access to P * , can compute a witness w such that R L (x, w) = 1. By efficient, we mean that the running time of the extractor should be inversely related to the success probability of P * .

Third, an important property of proofs of knowledge is that they can make sense even for statements that are trivial from an existential point of view, i.e., for trivial languages for which a membership witness always exists, but can be hard to compute. We illustrate this with a classical example: Example 3.4.1. Let L dlog (G, g) denote, for a cyclic group (G, •) with a generator g, the following language:

L dlog (G, g) = {h ∈ G | ∃x ∈ Z, g x = h}
As g is a generator of G, this is a trivial language: all elements of G belong to L dlog (in other words, G = L dlog ). However, although it holds that for all h ∈ G, there is an integer x such that h = g x , computing such an integer x can be computationally infeasible (see the discussion on the discrete logarithm assumption, Section 2.2.1). Therefore, while asking a prover to show the existence of the discrete logarithm of some word h is meaningless, convincing a verifier that a prover knows the discrete logarithm of h in base g gives him a non-trivial information.

As an example of a typical use case of zero-knowledge arguments of knowledge, consider the issue of authenticating a server: to allow for secure communication with the clients, a server releases his public key pk, and stores the corresponding secret key sk (in Example 3.4.1, pk could be a group element h, and sk an integer x such that g x = h). Before interacting with the server, a client might want to be sure that he is talking to the right server, and not with some potentially malicious individual. To do so, the client typically asks his opponent to perform a zero-knowledge proof that he knows the secret key sk corresponding to pk; a successful proof authenticates the server.

Definitions

Before defining zero-knowledge proofs of knowledge, let us introduce some notations. Recall that A B indicates that A is given oracle access to B.

Definition 3.4.2. (Next-Message Function) For any algorithm A, we denote by nm x,w;r [A]

the next-message function of A, i.e., the algorithm that on input a list m of messages, outputs the next message sent by A after receiving these messages for a common input x, an auxiliary input w, and a random tape r.

The next-message function allows to formalize the fact that the extractor will be given a fine-grained oracle access to the prover algorithm in the knowledge-extraction procedure. Definition 3.4.3. (Zero-Knowledge Proof of Knowledge) An n-round interactive (perfect, statistical, computational) zero-knowledge proof of knowledge (P, V) between a prover P and a verifier V, for a language L with relation R L , is any pair of algorithms such that V runs in probabilistic polynomial time and the following conditions hold:

• Completeness. (P, V) is complete, if for any x ∈ L with a membership witness w:

Pr [ (P(w), V)(x) = 1 ] ≥ 2/3;
(x, w ) = 1] ≥ ε -κ p(|x|)
where ε denotes the probability that V accepts when interacting with P * on common input x.

• Zero-Knowledge. (P, V) is (perfectly, statistically, computationally) zero-knowledge, if for every probabilistic polynomial time V * there exists a probabilistic simulator Sim running in expected polynomial time such that for every x ∈ L ,

View P V * (x) ≡ Sim(x)
where ≡ denotes equality, statistical indistinguishability, or computational indistinguishability.

The parameter κ specifies the error made by Ext when extracting a witness. The knowledge error can be made exponentially small by sequential repetitions of the proof system, see [START_REF] Goldreich | Foundations of Cryptography: Volume 2, Basic Applications[END_REF]. Definition 3.4.4. (The Classes PZKPoK, SZKPoK, CZKPoK) A language L is in the class SZKPoK (resp. PZKPoK, CZKPoK) if it has a statistical (resp. perfect, computational) zero-knowledge proof of knowledge system with a negligible knowledge error and a polynomial number of rounds (in its input length).

The zero-knowledge proof system defined in the proof of Theorem 3.2.7, on common input G = ([n], E), can be proven to be a zero-knowledge proof of knowledge of a 3-coloring of G with knowledge error 1 -1/|E|. Therefore, we get: Theorem 3.4.5. Assuming the existence of one-way functions, NP ⊆ CZKPoK.

Σ-Protocols

The previous sections focused on discussions and abstract descriptions of the security properties of zero-knowledge proof systems. The aim of this section is to provide more concrete examples, by considering a specific class of zero-knowledge proof systems to which most efficient zero-knowledge protocols from the literature belong: Σ-protocols.

Definition

A Σ-protocol is an honest-verifier zero-knowledge proof of knowledge, with a particular threemove structure. While they are only honest-verifier zero-knowledge, standard techniques (e.g. [Gro04; GMY06]) can be used to turn any Σ-protocol into full-fledged zero-knowledge proofs of knowledge, at the cost of an additional round of interaction (plus a small additive cost in communication). Definition 3.5.1. (Σ-Protocol) A Σ-protocol for a language L is a public-coin three-move honest-verifier zero-knowledge proof of knowledge, that has the following structure:

1. P sends to V some commitments values r, Protocol Π dlog Common Input: the description of a prime-order group G of (exponentially large) order p with a generator g, and a group element h.

Prover Witness: A value x ∈ Z p such that g x = h.

Protocol: The attentive reader might have already noticed that the zero-knowledge proof system described in the proof of Theorem 3.2.7 satisfies this three move structure, and indeed, this protocol is a Σ-protocol (although we have only sketched a proof of soundness, it can be proven to be knowledge-extractable as well). Below, we will provide further examples of Σ-protocols.

1. P: pick r $ ← Z p , send ρ ← g r . 2. V: pick e $ ← Z p , send e. 3. P: send d ← e • x + r mod p Verification: V accepts iff g d = h e ρ.

First Example: the Schnorr Protocol

In Section 3.4, we illustrated proofs of knowledge with Example 3.4.1, mentioning the possibility to prove knowledge of the discrete logarithm of some group element h in some base g, where g is the generator of some group G. We now elaborate on this example by describing a Σ-protocol for proving knowledge of a discrete logarithm. The protocol is given Figure 3.1. It was first described in [START_REF] Schnorr | Efficient Identification and Signatures for Smart Cards[END_REF]. It is commonly used as an authentication protocol: given a public value h, the prover authentifies himself by proving his knowledge of the secret value x associated to this public value (i.e., x is such that g x = h for a fixed generator g).

Rewinding. The standard solution to prove security of Σ-protocols is to use a technique called rewinding. The simulator will run the code of the prover, feeding it with the verifier inputs it requires, and then rewind it to some previous state so as to feed it with different inputs. Doing so, he will be able to get several outputs of the prover with respect to different verifier inputs, starting from some common state of the prover. Intuitively, this allows the simulator to cancel out some randomness that had been introduced by the prover to mask his witness and ensures that the proof will remain zero-knowledge.

Rewinding is also widely used to prove the zero-knowledge property against a potentially malicious verifier V * . Here, the simulator will rewind the verifier many times, until he is able to generate an accepting transcript with respect to a run of this verifier.

Security Analysis (Sketch). We show that the protocol Π dlog given Figure 3.1 is perfectly complete, knowledge-extractable, and honest-verifier zero-knowledge. Perfect completeness follows immediately by inspection: if d = ex + r mod p, g = h x and ρ = h r , then g d = h e ρ.

For honest-verifier zero-knowledge, let Sim be a simulator which is given the common input (G, g, h) and the code of V. Sim selects a uniformly random tape for V and runs it with this random tape on a random input message ρ $ ← G. Once V outputs a challenge e, Sim restarts the protocol, feeding V with the same random tape and setting the input message ρ to g r h -e for a uniformly random r. Note that ρ is distributed exactly as in an honest execution of the protocol. After V outputs the challenge e (as V is honest, it always draw e honestly, using only the coins of his random tape, hence this challenge is the same than the one extracted by Sim in the previous run of V), Sim answers with d ← r; observe that the equation g d = h e ρ is always satisfied when d = r and ρ = g r h -e , and that the answer is distributed exactly as in an honest run of Π dlog , hence the honest-verifier zero-knowledge property.

For knowledge-extraction, let P * be a prover that produces an accepting answer with non-negligible probability ε, and let Sim be a simulator which is given the code of P * as input. Once P * outputs the first flow ρ, Sim writes a random e $ ← Z p on its message input tape, and get an answer d. Then, Sim rewinds P * to step 2 of Π dlog , feeding it with a new random challenge e $ ← Z p , and getting a new answer d . Observe that if both (d, d ) are accepting answers, it holds that g d = h e ρ and g d = h e ρ, which gives g d-d = h e-e = g x•(e-e ) . In this case, Sim can obtain x by computing (dd )(ee ) -1 mod p (as e = e with overwhelming probability).

Second Example: Disjunction of Languages

We further elaborate on the example of Section 3.5.1.1 by showing that the techniques it involves do extend to more complex statements, such as proof of knowledge of a discrete logarithm in two bases, or disjunction of statements. Let us fix a prime-order group G with a generator g, and consider the following statement for words (h, u, v, u , v ) ∈ G 5 : "I know x such that g x = h, or I know y such that u y = u and v y = v ."

Let us call statement 1 the left part of the above statement, and statement 2 its right part. Statement 1 is exactly the statement in the Schnorr protocol. Statement 2 corresponds to a proof of knowledge of a witness for the language of DDH tuples over G (i.e., tuples of the form (u, v, u y , v y )). Note that the latter is also a meaningful membership statement, as the language of DDH tuples is a non-trivial language (assuming the hardness of the DDH assumption, it is a hard-subset-membership language), unlike statement 1. Section 3.5.1.1 gives a Σ-protocol for statement 1; we describe a Σ-protocol for statement 2 in Figure 3.2. Note that this protocol is a very natural generalization of the Schnorr protocol; it is straightforward to extend the security proof of the Schnorr protocol into a security proof for the protocol of Figure 3.2.

Disjunction of Statements.

Observe that the zero-knowledge property of the protocols Π dlog and Π DDH essentially stems from the following observation: if the prover knows the challenge e in advance, he can make the verification succeed even if he does not know a witness for the statement (see the security analysis in 3.5.1.1). This exact observation is the key to the standard method for proving disjunctions of statements, which was introduced in [START_REF] Cramer | Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols[END_REF]. We outline the method on Figure 3.3.

Protocol Π S

Given a statement S = S 0 ∨ S 1 , which is a disjunction of two statements S 0 , S 1 , let (Π 0 , Π 1 ) denote Σ-protocols for (S 0 , S 1 ). The protocol Π S for S proceeds as follows:

Common Input: the common input of Π 0 and Π 1 Prover Witness: P know a witness w b to the statement S b for some b ∈ {0, 1}; w b is also a witness for the disjunction statement S. Verification: V sets e 1 ← ee 0 mod p, and perform the verification procedure of Π 0 with transcript (m 0 , e 0 , m 0 ), and Π 1 with transcript (m 1 , e 1 , m 1 ).

The Common Reference String Model

All the results of the previous sections relied on interactive protocols with strong security guarantees without making any trust assumption whatsoever. This is known as the plain model, and it provides the highest real-world security guarantees in an adversarial context. However, the absence of any form of trust strongly narrows the range of feasibility results: several desirable properties, either related to the security or to the efficiency of interactive proof systems, are provably unachievable in the plain model. Consider for example the important question of building zero-knowledge proofs with a small number of rounds of interaction. We know that there is no hope of building a zero-knowledge proof system in the plain model with a single round of interaction for non-trivial languages [START_REF] Goldreich | Definitions and Properties of Zero-Knowledge Proof Systems[END_REF], and strong limitations are also known for two rounds of interaction [GO94; BLV03]. Regarding security, a highly desirable property is that of composability: a secure proof system should remain secure even if arbitrarily many instances of the system are run concurrently as parts of a larger protocol. However, by the seminal work of Canetti [START_REF] Canetti | Universally Composable Security: A New Paradigm for Cryptographic Protocols[END_REF], we know that universally composable zero-knowledge proof systems exist only for trivial languages. Numerous other limitations are known for zero-knowledge proof systems in which the simulator makes only a black-box use of the verifier; for example, constant-round zeroknowledge proof systems secure under concurrent composition are impossible to achieve in the plain model with black-box simulators [START_REF] Canetti | Black-box concurrent zero-knowledge requires Omega (log n) rounds[END_REF]. Consequently, any zero-knowledge proof system overcoming these limitations in the plain model must make use of non-black-box techniques, which are often inefficient in practice.

Functionality F crs

Trusted Setup Assumptions

In light of these strong limitations, a natural question to ask is whether there exists minimal trust assumptions one could make that lead to a model in which practically efficient zeroknowledge proof systems with strong security guarantees can be built. In this work, we will consider zero-knowledge proof systems in a model known as the common reference string (crs) model, which was introduced by Damgård in [START_REF] Damgård | Efficient Concurrent Zero-Knowledge in the Auxiliary String Model[END_REF]. In this model, the parties are given access to a common string that has been honestly drawn from some prescribed distribution in a setup phase by a trusted dealer. More formally, the crs model enhances the plain model by giving both players access (via perfectly secure authenticated channels) to an ideal functionality F crs , represented Figure 3.4. While weaker models have been proposed (such as the common random string model, in which crs comes from the uniform distribution, or the registered public-key model), the common reference string model has proven very convenient to use for constructing a large variety of efficient primitives with strong security requirements.

Proving Security of Zero-Knowledge Proof Systems

At an intuitive level, most impossibility results in the plain model stem from the fact that soundness and zero-knowledge appear somewhat contradictory. Consider for simplicity the case of zero-knowledge proofs of knowledge. The zero-knowledge property ensures that nothing leaks from the transcript of the protocol, while soundness ensures that a simulator can extract a valid witness from the prover. If the verifier could simply run the simulator algorithm and extract the witness of the prover, the proof could not possibly be zero-knowledge. What makes such proofs possible is that the simulator is given some additional power that the verifier does not have. Therefore, it is crucial to analyze exactly what kind of extra power can be given to the simulator. A natural solution is to give the simulator the code of the prover, as this code is not available to the verifier. However, this raises the issue of how to extract the relevant information from this code, which could possibly be non-trivial (think for example of an obfuscated code). Below, we outline two standard method for proving security of zero-knowledge proof systems. The first one, the rewinding technique, will be extensively used in Chapter 5 and Chapter 6. The second one is specific to the common reference string model but is convenient to prove the security of the system in a composable setting; we will use it in Chapter 4.

Rewinding

The rewinding strategy, which was informally introduced and illustrated in Section 3.5.1.1, is the most standard method to prove security of zero-knowledge protocols in the plain model. It is conceptually simple, and only requires to give the simulator black-box access to the next-message function of his opponent. However, this method fails in various setting -most notably, rewinding often fails in multiparty settings where several instances of the protocols can be composed together, as the number of necessary rewinding can grow exponentially in these situations, preventing the simulator from running in (expected) polynomial time. In such situations, one must rely on alternative proof strategies.

Disjunction With a Hard Subset-Membership Problem

Rewinding has the advantage of not requiring any setup assumption. However, if one is willing to assume such setup assumption, as we will do in this work, alternative proof methods are available. Recall that the crs model assumes that all players have access to some reference string drawn from a known distribution D. This suggests another way of giving the simulator the extra power he needs over the honest prover to simulate the protocol: the simulator will simulate not only the prover, but also the crs functionality, which will allow him to generate an alternative crs from a different distribution D . This alternative crs should allow him to generate valid proofs on arbitrary statements. Of course, the distribution D should be indistinguishable from D, otherwise the verifier could distinguish the simulation from a real execution.

Intuition. More specifically, we outline below a standard method that we will use in this work. Let the common reference string contain the description of an hard-subset-membership language L : for random x, it should be computationally infeasible to find out whether

x ∈ L holds. The distribution D outputs a description of L together with a random x / ∈ L . Now, to prove a statement S, the prover will instead prove the statement S = S ∨ (x ∈ L ). For honestly generated reference strings, S gives exactly the same guarantees than S does. On the other hand, the simulator will modify the crs distribution and generate instead a random x ∈ L , keeping the associated witness w. The modified crs is computationally indistinguishable from an honestly generated crs, by the hard-subset-membership property of L . However, all statements of the form S = S ∨ (x ∈ L ) now become trivially true, and the witness w is a valid witness for these statements, giving the simulator a way to prove them. For this method to work, the underlying proof system must only guarantee witness indistinguishability, meaning that the protocol should not leak information on which witness was used by the prover, when several witnesses are available. This notion is weaker than zero-knowledge, and witness-indistinguishable proof systems are typically easier to build than zero-knowledge proof systems.

Example. Consider the statement "I know the discrete logarithm of h in base g" for some elements (g, h) of a prime-order group G, as considered in Section 3.5.1.1. Let us build a zero-knowledge proof system in the common reference string model for this statement as follows: the common reference string contains the description of G, a generator g, and a four-tuple (u, v, u , v ) ∈ G of uniformly random group elements. The protocol is constructed as the disjunction of the two Σ-protocols Π dlog (on the word (g, h)) and Π DDH (on the word (u, v, u , v )), as described in Section 3.5.1.2. The resulting protocol is therefore a Σ-protocol for the statement "I know x such that g x = h, or I know a witness proving that (u, v, u , v ) is a DDH tuple".

For an honestly generated crs, (u, v, u , v ) is not a DDH tuple with overwhelming probability, hence the above protocol ensures that the prover knows the discrete logarithm of h. However, to simulate the prover for the zero-knowledge property, the simulator can modify the crs distribution so that it outputs a tuple (u, v, u y , v y ) instead, for some random (u, v) and a random exponent y of his choice. Under the DDH assumption, this is indistinguishable from an honestly generated crs, but the trapdoor y is also a witness for the statement "(u, v, u , v ) is a DDH tuple", hence the simulator can play the role of the prover with this witness. Observe that he does not need to rewind the verifier to do so, which is a desirable property to analyze the behavior of the protocol in a concurrent setting.

Simulation Soundness

We have seen above that the common reference string model allows to design zero-knowledge proofs that remain secure when composed with other cryptographic protocols. However, in most scenarios that involve the composition of zero-knowledge proofs, their soundness property does not suffice anymore to ensure the security of the entire protocol: indeed, when proving the security of the protocol, the simulator might produce simulated proofs (possibly on false statements). The soundness property does not guarantee that an adversary could not break the security of the protocol given access to such simulated proofs. Informally, simulation soundness requires that soundness still holds when the adversary is given access to a simulation oracle. Formally defining simulation soundness requires defining a zero-knowledge proof system with an explicit simulator algorithm, and thus can depend on the exact type of proof system that is considered. We do not attempt to give a formal definition here, but we will later formally define simulation soundness for the new type of zero-knowledge proof system that we introduce in Chapter 4.

Zero-Knowledge Arguments over the Integers

The protocols Π dlog of Section 3.5.1.1 and Π DDH of Section 3.5.1.2 can be naturally extended to prove a large variety of statements, such as arbitrary algebraic relations between values, committed (e.g., with a Pedersen commitment, see Section 2.3.2) or encrypted (e.g., with the ElGamal encryption scheme, see Section 2.3.3). Such algebraic statements arise naturally in many scenarios.

Zero-Knowledge Proofs of Non-Algebraic Statements

The above method also allows for proving arbitrary non-algebraic statements x ∈ L : the prover commits to every bit of the witness w, proves with a disjunction proof that each commitment commits to either 0 or 1, and proves that the polynomial relation R L (x, w) between the public x and the committed bits of w evaluates to 1. However, this method is quite inefficient in general; in particular, it requires to exchange at least a number of group elements proportional to the length of the witness. To address this issue, a number of solutions have been suggested, such as garbled-circuit-based zero-knowledge proofs for statements expressed by boolean circuits [JKO13; FNO15], which only use symmetric-key operations for each gate of the circuit, or zero-knowledge arguments with sublinear communication based on generalized Pedersen commitments [START_REF] Groth | Linear Algebra with Sub-linear Zero-Knowledge Arguments[END_REF][START_REF] Groth | Efficient Zero-Knowledge Arguments from Two-Tiered Homomorphic Commitments[END_REF].

An alternative approach to the above have been suggested by Lipmaa in [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF], and stems from ideas that can be traced to the work of Boudot [START_REF] Boudot | Efficient Proofs that a Committed Number Lies in an Interval[END_REF]. The observation is that several non-algebraic statements that naturally arise in applications can be efficiently expressed as Diophantine relations. Therefore, such statements can be efficiently proven if we can commit and prove relations between integer values.

Range Proofs

Consider a user who has committed some private values, and is asked to prove that they satisfy a certain relation. In many scenarios, this relation cannot be efficiently expressed algebraically. A common example is the case of range proofs: the prover is asked to show that a committed value belongs to some public range. This situation occurs e.g., in protocols for e-voting, or in anonymous cryptocurrencies. Standard zero-knowledge proof systems for such statements require to see the committed input as a bitstring, and to prove that its bits satisfy some polynomial relation, resulting in a blowup in communication and computation.

The work of Boudot [START_REF] Boudot | Efficient Proofs that a Committed Number Lies in an Interval[END_REF] and Lipmaa [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] suggest the following alternative approach: suppose that we have at our disposal an integer commitment scheme, that allows to commit to an arbitrary m ∈ Z, together with a zero-knowledge proof system that allows to prove integer algebraic relations between committed integers. Then, membership to a large variety of languages (looking ahead, languages of words that satisfy a Diophantine relations) can be expressed by proving such integer algebraic relations. For example, by a famous result of Lagrange, an integer m belongs to a range a ; b if and only if there exists four integers

(m 1 , m 2 , m 3 , m 4 ) such that (m -a)(b -m) = i m 2 i .
Therefore, to prove that a committed value m belongs to a ; b , the prover simply computes the appropriate values (m 1 , m 2 , m 3 , m 4 ) (using the Rabin-Shallit algorithm [START_REF] Michael | Randomized algorithms in number theory[END_REF]) and proves that the above relation holds. Below, we generalize this observation to statements that can be expressed by Diophantine relations.

Zero-Knowledge Arguments from Diophantine Relations

A Diophantine set S ⊆ Z k is a set of vectors over Z k defined by a (multivariate) representing

polynomial P S (X, W ) with X = (X 1 , • • • , X k ) and W = (Y 1 , • • • , Y ), i.e., a set of the form S = { #" x ∈ Z k | ∃ #"
w ∈ Z , P S ( #" x , #" w) = 0} for some polynomial P S . It was shown in [DPR61] that any recursively enumerable set is Diophantine. An interesting class for cryptographic applications is the class D of Diophantine sets S such that each #" x ∈ S has at least one witness #" w satisfying || #" 1) . It is widely conjectured that D = NP, as D contains several NP-complete problems, and it was shown in [START_REF] Pollett | On the bounded version of Hilbert's tenth problem[END_REF] that if co-NLOGTIME ⊆ D, then D = NP. The class D was introduced in [AM76] and its cryptographic relevance was pointed out in [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF]. For example, the set Z + of positive integers is in D, as by a well-known result of Lagrange, it can be defined as

w|| 1 ≤ (|| #" x || 1 ) O(
Z + = {x ∈ Z | ∃(w 1 , w 2 , w 3 , w 4 ) ∈ Z 4 , x-(w 2 1 +w 2 2 +w 2 3 +w 2 4 ) = 0}. In addition, each w i is of bounded size ||w i || ≤ ||x||.
Lipmaa [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] has shown that zero-knowledge arguments of membership to a set S ∈ D, with representing polynomial P over k-vector inputs and -vector witnesses, can be constructed using an integer commitment scheme, such as [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF]. The size of the argument (the communication between P and V) depends on k, , and deg(P ), the degree of P . As noted in [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF], intervals, unions of intervals, exponential relations (i.e., set of tuples (x, y, z) such that z = x y ) and gcd relation (i.e., set of tuples (x, y, z) such that z = gcd(x, y)) are all in D, with parameters (k, and deg(P )) small enough for cryptographic applications.

Non-Interactive Zero-Knowledge Arguments

As we have seen previously, interactive proofs can be understood as a relaxation of the standard non-interactive proofs (captured by the class NP), where we allow interaction (as well as random coins) between the verifier and the prover. Zero-knowledge proofs are a randomized interactive proof systems satisfying a specific zero-knowledge property. A natural question is to ask whether this zero-knowledge property can also be satisfied by non-interactive randomized proofs. Such systems are called non-interactive zero-knowledge proof systems (NIZK).

This question is also very interesting from a practical point of view: in the real world, interactivity means exchanging information over some network, which raises some latency issues. A highly interactive protocol can be inefficient in a setting where the interacting parties are far away -for example, if two parties are performing a protocol between San Fransisco and London, there is a 100ms roundtrip. Furthermore, while computation will always improve with more computational power, and communication with additional bandwidth, interactivity is inherently limited by the speed of light (e.g., we cannot hope to exchange messages in less that 37ms between San Fransisco and London). Therefore, the more computers improve, the more interactivity becomes a major concern for efficiency.

Eventually, we mention that another motivations for NIZK proofs are their applications to numerous cryptographic primitives. As this works mainly targets applications related to secure computation, we do not discusses this in detail.

Definition and Security Properties

Definition 3.8.1. (Publicly Verifiable Non-Interactive Zero-Knowledge Proof System) A non-interactive zero-knowledge (NIZK) proof system between a prover P and a verifier V for a family of languages {L crs } crs is a triple of probabilistic polynomial-time algorithms (Setup, P, V) such that

• crs $ ← Setup(1 κ
), outputs a common reference string crs,

• π ← P(crs, x, w), on input the crs crs, a word x, and a witness w, outputs a proof π,

• b ← V(crs, x, π), on input the crs crs, a word x, and a proof π, outputs b ∈ {0, 1}, which satisfies the completeness, zero-knowledge, and soundness properties defined below.

A few remarks are in order. In the above definition of NIZK proof systems, the verifier algorithm takes only public informations as input in addition to the proof. This gives rise to the notion of publicly verifiable NIZK proof system. Alternatively, the Setup can generate a secret verification key vk, which is used by the verification algorithm; this variant is known as designated-verifier NIZK proof system. We only consider publicly verifiable NIZKs here. Definition 3.8.2. (Perfect Completeness) A NIZK proof system (Setup, P, V) for a family of languages {L crs } crs with relations R Lcrs satisfies the perfect completeness property if for crs $ ← Setup(1 λ ), for every x ∈ L crs and every witness w such that R Lcrs (x, w) = 1,

Pr[π ← P(crs, x, w) : V(crs, x, π) = 1] = 1
We now define the zero-knowledge property. The definition we adopt is stronger than needed, but is satisfied by known constructions of efficient NIZK proof systems, and makes the NIZKs more amenable to composition. Definition 3.8.3. (Zero-Knowledge) A NIZK proof system (Setup, P, V) for a family of languages {L crs } crs with relations R Lcrs satisfies the (composable) zero-knowledge property if there exists a simulated setup algorithm Setup and a probabilistic polynomial-time simulator Sim such that • Setup (1 κ ) outputs a pair (crs , T ), where T is a trapdoor;

• Sim(crs , T , x), on input a pair (crs , T ) and a word x, outputs a simulated proof π ; which satisfy the following properties:

• the distributions {crs $ ← Setup(1 κ ) : crs} and {(crs, T ) $ ← Setup (1 κ ) : crs} are indistinguishable, and
• for any (crs , T ) $ ← Setup (1 κ ), any word x ∈ L crs with witness w, the distributions {π $ ← P(crs , x, w) : π} and {π $ ← Sim(crs , T , x) : π } are indistinguishable.

We will adopt a comparable formalism for defining our new variant of zero-knowledge proof systems in Chapter 4. In addition, we will require the following property: the distributions generated by Setup and Setup should be statistically indistinguishable. This is a useful property in settings where many proofs can be composed. In the above definition, the word x / ∈ L crs is chosen non-adaptively, before the public parameter are generated. A stronger security property is the adaptive soundness property, which allows x to be adversarially picked after the common reference string is fixed.

Brief Survey of Known Results

Non-interactive zero-knowledge proofs have been first introduced in [START_REF] Blum | Non-Interactive Zero-Knowledge and Its Applications (Extended Abstract)[END_REF]. NIZK proof systems from general assumptions (doubly enhanced trapdoor permutations, or certified trapdoor permutations) have been first introduced in [FLS90]. Our definitions above assume a setup algorithm that generates a common reference string. One can wonder whether NIZKs could be defined in the plain model, without having to assume a trusted setup. Unfortunately, it was shown in [START_REF] Oren | On the Cunning Power of Cheating Verifiers: Some Observations about Zero Knowledge Proofs (Extended Abstract)[END_REF] that NIZKs in the plain model can exist only for trivial languages, namely, those that are contained in BPP. The common reference string model is not the only one that was proposed for NIZKs; NIZK proof systems have also been defined in the stronger preprocessing model [START_REF] De Santis | Non-Interactive Zero-Knowledge with Preprocessing[END_REF], or in a different secret-key model [START_REF] Cramer | Secret-Key Zero-Knowlegde and Noninteractive Verifiable Exponentiation[END_REF].

The class NISZK of languages that admit a NIZK proof system with statistical zeroknowledge has been proven in [START_REF] Goldreich | Can Statistical Zero Knowledge Be Made Non-interactive? or On the Relationship of SZK and NISZK[END_REF] to be equal to SZK if NISZK is closed by complement. Proving the latter is a well-established open problem.

Fiat-Shamir Heuristic

The Fiat-Shamir heuristic [START_REF] Fiat | How to Prove Yourself: Practical Solutions to Identification and Signature Problems[END_REF] is a heuristic method to convert Σ-protocols (see Section 3.5) into non-interactive zero-knowledge proofs. It proceeds as follows: to prove the membership of a word x to a language L the prover P first compute the first flow (the commitments) of a Σ-protocol for this statement. Let c denote this first flow. Then, P sets e ← H(x, c), where H is some hash function, and computes the last flow of the Σ-protocol, using e as the challenge.

While this approach leads to very efficient NIZKs, it cannot be proven to work under any standard assumption related to hash functions. Instead, the above methodology can be proven to work if the hash function is modeled as a truly random function. This idealized model is known as the random oracle model. Unfortunately, truly random functions are objects of exponential size, and cannot be realized efficiently. In fact, some (contrived) protocols can be proven secure in the random oracle model, but are trivially insecure when instantiated with any concrete hash function [START_REF] Bellare | Random Oracles are Practical: A Paradigm for Designing Efficient Protocols[END_REF]. Therefore, this abstraction is best seen as a heuristic indication of security.

Groth-Sahai Proofs

For a long time, two types of NIZK proof systems were available: efficient but heuristically secure proof systems in the random oracle model, and inefficient proof systems in the hidden bit model [START_REF] Feige | Multiple Non-Interactive Zero Knowledge Proofs Based on a Single Random String (Extended Abstract)[END_REF], which can be instantiated in the standard model, under well-studied assumptions. This changed with the arrival of pairing-based cryptography, from which a fruitful line of work (starting with the work of Groth, Ostrovsky, and Sahai [GOS06b; GOS06a]) introduced increasingly more efficient NIZK proof systems in the standard model. This line of work culminated with the framework of Groth-Sahai proofs [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF], which identified a restricted yet very powerful class of languages for which efficient pairing-based NIZK could be designed, with security based on essentially any standard assumption on pairing-friendly groups. This framework (which was subsequently optimized in [GSW10; BFI+10; EG14]) paved the road to numerous practical applications. In the next chapter, we aim at providing an alternative solution to one of those applications, round-efficient two-party computation.

Implicit Zero-Knowledge Arguments

It is my experience that proofs involving matrices can be shortened by 50% if one throws the matrices out.

-Emil Artin, Geometric Algebra -59 -

Introduction

Zero-Knowledge Arguments have found numerous applications in cryptography, most notably to simplify protocol design as in the setting of secure two-party computation [Yao86; GMW87b; GMW87a], and as a tool for building cryptographic primitives with strong security guarantees such as encryption secure against chosen-ciphertext attacks [NY90; DDN91]. In this chapter, we focus on the use of zero-knowledge arguments as used in efficient two-party protocols for enforcing semi-honest behavior. We are particularly interested in round-efficient two-party protocols, as network latency and round-trip times can be a major efficiency bottleneck, for instance, when a user wants to securely compute on data that is outsourced to the cloud.

Enforcing Honest Behavior in Two-Party Computation

The study of zero-knowledge as a tool to enforce semi-honest behavior in secure two-party computation was initiated in [START_REF] Goldreich | How to Prove all NP-Statements in Zero-Knowledge, and a Methodology of Cryptographic Protocol Design[END_REF]. While this seminal work essentially established the theoretical feasability of the method, the developements of efficient zero-knowledge proof systems in the past two decades have led to natural and practically efficient compilers for a large variety of two-party computation protocols, where honest behavior can be captured by membership to algebraic languages. We briefly mention two of the most natural alternatives below.

• Σ-protocols lead to efficient protocols regarding both computation and communication, and can be based on virtually any group-based assumption, such as the discrete logarithm assumption. However, an n-round semi-honest protocol compiled into a actively secure protocol via Σ-protocols will in general have 3n rounds, causing a blowup in round efficiency. The Fiat-Shamir transform (see Section 3.8.3) overcomes this issues in the random oracle model, but as random oracles cannot be instantiated in the real world, this can only be seen as a heuristic indication of security [BR93; FS87].

• Alternatively, one can rely on pairing-based non-interactive zero-knowledge proof systems a la Groth-Sahai [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF], see Section 3.8.4. The use of elliptic curves with a pairing makes this alternative less efficient regarding computation (pairings are expensive operations, and exponentiations are up to three times slower on curves with pairings than on curves without pairings), but it remains fairly practical. It allows for provably secure compilation of n-round semi-honest protocols into n-rounds actively secure protocols, in the common reference string model, under pairing-based cryptographic assumptions.

In this chapter, we introduce a new primitive called implicit zero-knowledge argument (iZK) that stands philosophically as an intermediate notion between interactive zero-knowledge proofs (such as Σ-protocols) and (designated-verifier) non-interactive zero-knowledge proofs, when used as a tool to compile semi-honest two-party computation protocols into actively secure two-party computation protocols.

The intuition of iZKs is captured by the following observation: standard methods for compiling semi-honest protocols into actively secure protocols require the parties to verify, using zero-knowledge proofs, that their opponents behaved honestly before sending their next message. In contrast, iZK allow the parties to send their next flow masked, so that their opponents will be able to remove the mask if and only if they behaved honestly. This guarantees that private informations remain hidden to malicious parties, but does not explicitely inform the sending party on the honesty of his opponents -hence the implicit zero-knowledge flavor. It turns out that this approach gives rise to low-interactivity protocols, almost matching the round-efficiency offered by NIZK, while being realizable from a wider class of assumptions (essentially the same class of assumptions on which Σ-protocols can be based). As a byproduct, our construction does not require pairings, which results in important savings in both communication and computation when compared to pairing-based non-interactive zero-knowledge proofs.

Summing up, iZKs allow to compile semi-honest two-party protocols into actively secure protocols under a wide variety of standard assumptions, and lead to efficient protocols regarding both communication and computation. It is also almost as round-efficient as NIZKs: an n-round protocol is compiled into an (n + 2)-round protocol in general (or (n + 1)-round in many natural scenarios).

Application to Covert Two-Party Computation. Subsequent to our work, implicit zero-knowledge arguments have also proven valuable tools to construct two-party computation protocols enjoying a very strong security property, known as covertness, which states (informally) that no information should leak from the transcript of a protocol -not even the fact that the parties were taking part to the protocol, and not carrying normal conversations. A covert analogue of Yao's garbled circuit based on implicit zero-knowledge arguments has been proposed in [START_REF] Law | Efficient covert two-party computation[END_REF].

On Round-Efficiency

We point out that, contrary to some common belief, there is no straightforward way to reduce the number of rounds of zero-knowledge proofs "à la Schnorr" [START_REF] Schnorr | Efficient Identification and Signatures for Smart Cards[END_REF] by performing the first steps (commitment and challenges) in a preprocessing phase, so that each proof only takes one flow subsequently. Indeed, as noticed by Bernhard-Pereira-Warinschi in [START_REF] Bernhard | How Not to Prove Yourself: Pitfalls of the Fiat-Shamir Heuristic and Applications to Helios[END_REF], the statement of the proof has to be chosen before seeing the challenges, unless the proof becomes unsound.

In addition to being an interesting theoretical problem, improving the round efficiency is also very important in practice. If we consider a protocol between a client in Europe, and a cloud provider in the US, for example, we expect a latency of at least 100ms (and even worse if the client is connected with 3g or via satellite, which may induce a latency of up to 1s [START_REF] Brodkin | Satellite Internet faster than advertised, but latency still awful[END_REF]). Concretely, using Curve25519 elliptic curve of Bernstein [START_REF] Daniel | Curve25519: New Diffie-Hellman Speed Records[END_REF] (for 128 bits of security, and 256-bit group elements) with a 10Mbps Internet link and 100ms latency, 100ms corresponds to sending 1 flow, or 40,000 group elements, or computing 1,000 exponentiations at 2GHz on one core of current AMD64 microprocessor1 , hence 4,000 exponentiations on a 4-core microprocessor 2 . As a final remark on latency, while speed of networks keeps increasing as technology improves, latency between two (far away) places on earth is strongly limited by the speed of light: there is no hope to get a latency less than 28ms between London and San Francisco, for example.

Contributions of this Chapter

As already outlined, we introduce in this chapter the notion of implicit Zero-Knowledge Arguments or iZK and simulation-sound variants thereof or SSiZK, lightweight alternatives to (simulation-sound) zero-knowledge arguments for enforcing semi-honest behavior in two-party protocols. Then, we construct efficient two-flow iZK and SSiZK protocols for a large class of languages under the (plain) DDH assumption in cyclic groups without random oracles; this is the main technical contribution of our work. Our SSiZK construction from iZK is very efficient and incurs only a small additive overhead. Finally, we present several applications of iZK to the design of efficient secure two-party computation, where iZK can be used in place of interactive zero-knowledge arguments to obtain more round-efficient protocols.

While our iZK protocols require an additional flow compared to NIZK, we note that eliminating the use of pairings and random oracles offers both theoretical and practical benefits. From a theoretical stand-point, the DDH assumption in cyclic groups is a weaker assumption than the DDH-like assumptions used in Groth-Sahai pairing-based NIZK [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF], and we also avoid the theoretical pitfalls associated with instantiating the random oracle methodology [START_REF] Canetti | The Random Oracle Methodology, Revisited[END_REF][START_REF] Bellare | An Uninstantiable Random-Oracle-Model Scheme for a Hybrid-Encryption Problem[END_REF]. From a practical stand-point, we can instantiate our DDH-based protocols over a larger class of groups. Concrete examples include Bernstein's Curve25519 [START_REF] Daniel | Curve25519: New Diffie-Hellman Speed Records[END_REF] which admit very efficient group exponentiations, but do not support an efficient pairing and are less likely to be susceptible to recent breakthroughs in discrete log attacks [START_REF] Barbulescu | A Heuristic Quasi-Polynomial Algorithm for Discrete Logarithm in Finite Fields of Small Characteristic[END_REF][START_REF] Granger | Breaking '128-bit Secure' Supersingular Binary Curves -(Or How to Solve Discrete Logarithms in F 2 4•1223 and F 2 12•367[END_REF]. By using more efficient groups and avoiding the use of pairing operations, we also gain notable improvements in computational efficiency over Groth-Sahai proofs. Moreover, additional efficiency improvements come from the structure of iZK which makes them efficiently batchable. Conversely, Groth-Sahai NIZK cannot be efficiently batched and do not admit efficient SS-NIZK (for non-linear equations).

New Notion: Implicit Zero-Knowledge Arguments

iZK is a two-party protocol executed between a prover and a verifier, at the end of which both parties should output an ephemeral key. The idea is that the key will be used to encrypt subsequent messages and to protect the privacy of a verifier against a cheating prover. Completeness states that if both parties start with a statement in the language, then both parties output the same key K. Soundness states that if the statement is outside the language, then the verifier's ephemeral output key is hidden from the cheating prover. Note that the verifier may not learn whether his key is the same as the prover's and would not be able to detect whether the prover is cheating, hence the soundness guarantee is implicit. This is in contrast to a standard ZK argument, where the verifier would "explicitly" abort when interacting with a cheating prover. Finally, zero-knowledge stipulates that for statements in the language, we can efficiently simulate (without the witness) the joint distribution of the transcript between an honest prover and a malicious verifier, together with the honest prover's ephemeral output key K. Including K in the output of the simulator ensures that the malicious verifier does not gain additional knowledge about the witness when honest prover uses K in subsequent interaction, as will be the case when iZK is used as part of a bigger protocol.

More precisely, iZKs are key encapsulation mechanisms in which the public key ipk is associated with a word x and a language i L . In our case, x is the flow3 and i L the language

Interactive ZK A x, π 1 B π 2 . . . π 2n+1 x if argument valid NIZK A x, π B x if π valid iZK A x, ipk B x ⊕ K, c
• x: original flow from (honest) Alice (A) to Bob (B);

• x : the answer of B, which has to be sent after B is sure that x is valid;

• π1, . . . , π2n+1: flows of the interactive ZK argument;

• π: non-interactive ZK proof;

• ipk, K, c: public key (associated to x), ephemeral key computed by B, key encapsulation (which can be decapsulated by A if she generated honestly ipk, using a witness that x was valid), respectively. of valid flows. If x is in i L , knowing a witness proving so (namely, random coins used to generate the flow) enables anyone to generate ipk together with a secret key isk, using a key generation algorithm iKG. But, if x is not in i L , there is no polynomial-time way to generate a public key ipk for which it is possible to decrypt the associated ciphertexts (soundness).

To ensure semi-honest behavior, as depicted in Figure 4.1, each time a player sends a flow x, he also sends a public key ipk generated by iKG and keeps the associated secret key isk. To answer back, the other user generates a key encapsulation c for ipk and x, of a random ephemeral key K. He can then use K to encrypt (using symmetric encryption or pseudo-random generators and one-time pad) all the subsequent flows he sends to the first player. For this transformation to be secure, we also need to be sure that c (and the ability to decapsulate K for any ipk) leaks no information about random coins used to generate the flow (or, more generally, the witness of x). This is ensured by the zero-knowledge property, which states there must exist a trapdoor (for some common reference string) enabling to generate a public key ipk and a trapdoor key itk (using a trapdoor key algorithm iTKG), so that ipk looks like a classical public key and itk allows to decapsulate any ciphertext for ipk.

Overview of our iZK and SSiZK Constructions

We proceed to provide an overview of our two-flow iZK protocols; this is the main technical contribution of our work. Our main tool is Hash Proof Systems or Smooth Projective Hash Functions (SPHFs) [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF]. We observe that SPHFs are essentially "honest-verifier" iZK; our main technical challenge is to boost this weak honest-verifier into full-fledged zero knowledge, without using pairings or random oracles. Preliminaries on SPHFs can be found in Section 2.3.4, but to recall briefly, a smooth projective hash function on a language L is a hash function whose evaluation on a word C ∈ L can be computed in two ways, either by using a hashing key hk or by using the associated projection key hp. When C / ∈ L , however, the hash of C cannot be computed from hp; actually, when C / ∈ L , the hash of C computed simplify explanations.

with hk is statistically indistinguishable from a random value from the point of view of any individual knowing the projection key hp only. In this chapter, as in [START_REF] Gennaro | A Framework for Password-Based Authenticated Key Exchange[END_REF], we consider a weak form of SPHFs, where the projection key hp can depend on C.

On Building iZK from SPHF. Concretely, if we have an SPHF for some language L , we can set the public key ipk to be empty (⊥), the secret key isk to be the witness w, the ciphertext c to be the projection key hp, and the encapsulated ephemeral key K would be the hash value. (Similar connections between SPHF and zero knowledge were made in [GL03; GL06; BPV12; ABB+13].) The resulting iZK would be correct and sound, the soundness coming from the smoothness of the SPHF: if the word C is not in L , even given the ciphertext c = hp, the hash value K looks random. However, it would not necessarily be zero-knowledge for two reasons: a malicious verifier could generate a malformed projection key, for which the projected hash value of a word depends on the witness, and there seems to be no trapdoor enabling to compute the hash value K from only c = hp. These two issues could be solved using either Trapdoor SPHF [START_REF] Benhamouda | New Techniques for SPHFs and Efficient One-Round PAKE Protocols[END_REF] or NIZK of knowledge of hk. But both methods require pairings or random oracle, if instantiated on cyclic or bilinear groups. Instead we construct it as follows:

First, suppose that a projection key is well-formed (i.e., there exists a corresponding hashing key). Then, there exists an unbounded zero-knowledge simulator that "extracts" a corresponding hashing key and computes the hash value. To boost this into full-fledged zero knowledge with an efficient simulator, we rely on the "OR trick" from [START_REF] Feige | Multiple Non-Interactive Zero Knowledge Proofs Based on a Single Random String (Extended Abstract)[END_REF]. We add a random 4-tuple (g , h , u , e ) to the CRS, and build an SPHF for the augmented language C ∈ L or (g , h , u , e ) is a DDH tuple. In the normal setup, (g , h , u , e ) is not a DDH tuple with overwhelming probability, so the soundness property is preserved. In the trapdoor setup, (g , h , u , e ) := (g , h , g r , h r ) is a random DDH tuple, and the zero-knowledge simulator uses the witness r to compute the hash value.

Second, to ensure that the projection key is well-formed, we use a second SPHF. The idea for building the second SPHF is as follows: in most SPHF schemes, proving that a projected key hp is valid corresponds to proving that it lies in the column span of some matrix Γ (where all of the linear algebra is carried out in the exponent). Now pick a random vector tk: if hp lies in the span of Γ, then hp tk is completely determined given Γ tk; otherwise, it is completely random. The former yields the projective property and the latter yields smoothness, for the SPHF with hashing key hk and projection key tp = Γ tk. Since the second SPHF is built using the transpose Γ of the original matrix Γ (defining the language L ), we refer to it as a "transpose SPHF". As it turns out, the second fix could ruin soundness of the ensuing iZK protocol: a cheating prover could pick a malformed Γ tk, and then the hash value hp tk computed by the verifier could leak additional information about his witness hk for hp, thereby ruining smoothness. To protect against the leakage, we would inject additional randomness into hk so that smoothness holds even in the presence of leakage from the hash value hp tk. This idea is inspired by the 2-universality technique introduced in a very different context of chosen-ciphertext security [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF].

Finally, to get simulation-soundness (i.e., soundness even if the adversary can see fake or simulated proofs), we rely on an additional "OR trick" (mixed up with an idea of Malkin et al. [START_REF] Tal Malkin | Signatures Resilient to Continual Leakage on Memory and Computation[END_REF]): we build an SPHF for the augmented language C ∈ L , or (g , h , u , e ) is a DDH tuple (as before), or (g , h ,

W 1 (C), W 2 (C)) is not a DDH tuple (with W k a Waters function [Wat05], W k (m) = v k,0 |m| i=1 v m i k,i , when m = m 1 .
. . m |m| is a bitstring, the v k,0 , . . . , v k,|m| are random group elements, and C is seen as a bitstring, for k = 1, 2).

In the security proof, with non-negligible probability, (g , h , W 1 (C), W 2 (C)) is a non-DDH tuple for simulated proofs, and a DDH tuple for the soundness challenge, which proves simulation-soundness.

Organization. First, we formally introduce the notion of implicit zero-knowledge proofs (iZK) in Section 4.2. Second, in Section 4.3, we discuss some difficulties related to the construction of iZK from SPHF and provide an intuition of our method to overcome these difficulties. Next, we show how to construct iZK and SSiZK from SPHF over cyclic groups for any language handled by the generic framework [START_REF] Benhamouda | New Techniques for SPHFs and Efficient One-Round PAKE Protocols[END_REF], which encompasses most, if not all, known SPHFs over cyclic groups. Then in Section 4.3.8, we extend our construction of iZK from SPHF to handle larger classes of languages described by computational structures such as circuits or branching programs. Third, in Section 4.4, we indeed show a concrete application of our iZK constructions: the most efficient 3-round two-party protocol computing inner product in the UC framework with static corruption so far. We analyze our construction and provide a detailed comparison with the Groth-Sahai methodology [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF] and the approach based on zero-knowledge proofs "à la Schnorr" [START_REF] Schnorr | Efficient Identification and Signatures for Smart Cards[END_REF] in Section 4.4.3. In addition, as proof of concept, we show in Section 4.4.1 that iZK can be used instead of ZK arguments to generically convert any protocol secure in the semi-honest model into a protocol secure in the malicious model. This conversion follows the generic transformation of Goldreich, Micali and Wigderson (GMW) in their seminal papers [START_REF] Goldreich | How to Prove all NP-Statements in Zero-Knowledge, and a Methodology of Cryptographic Protocol Design[END_REF][START_REF] Goldreich | How to Play any Mental Game or A Completeness Theorem for Protocols with Honest Majority[END_REF]. While applying directly the original transformation with Schnorr-like ZK protocols blows up the number of rounds by a multiplicative factor of at least three (even in the common reference string model), our conversion only adds a small constant number of rounds.

Related Work

SPHFs were introduced by Cramer and Shoup in [START_REF] Cramer | Universal Hash Proofs and a Paradigm for Adaptive Chosen Ciphertext Secure Public-Key Encryption[END_REF] in order to achieve IND-CCA security from IND-CPA encryption schemes, which led to the first efficient IND-CCA encryption scheme provably secure in the standard model under the DDH assumption [START_REF] Cramer | A Practical Public Key Cryptosystem Provably Secure Against Adaptive Chosen Ciphertext Attack[END_REF]. They can intuitively be seen as a kind of implicit designated-verifier proofs of membership to some language [ACP09; BPV12]. The connection between zero-knowledge protocols and SPHF was uncovered in [GL03; GL06] with password-authenticated key exchange protocols, in [START_REF] Blazy | Round-Optimal Privacy-Preserving Protocols with Smooth Projective Hash Functions[END_REF] with blind signatures, and in [START_REF] Abdalla | SPHF-Friendly Non-interactive Commitments[END_REF] with oblivious transfer.

Using the "OR trick" with SPHF is reminiscent of [START_REF] Abdalla | Disjunctions for Hash Proof Systems: New Constructions and Applications[END_REF]. However, the methods used in this are very different from the one in [ABP15], as we do not use pairings, but consider weaker form of SPHF on the other hand.

A recent line of work has focused on the cut-and-choose approach for transforming security from semi-honest to malicious models [IKLP06; LP07; LP11; sS11; sS13; Lin13; HKE13] as an alternative to the use of zero-knowledge arguments. Indeed, substantial progress has been made towards practical protocols via this approach, as applied to Yao's garbled circuits. However, the state-of-the-art still incurs a large computation and communication multiplicative overhead that is equal to the security parameter. We note that Yao's garbled circuits do not efficiently generalize to arithmetic computations, and that our approach would yield better concrete efficiency for natural functions F that admit compact representations by arithmetic branching programs. In particular, Yao's garbled circuits cannot take advantage of the structure in languages handled by the Groth-Sahai methodology [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF], and namely the ones defined by multi-exponentiations: even in the latter case, Groth-Sahai technique requires pairings, while we will be able to avoid them.

The idea of using implicit proofs (without the zero-knowledge requirement) as a lightweight alternative to zero-knowledge proofs also appeared in an earlier work of Aiello, Ishai and Reingold [START_REF] Aiello | Priced Oblivious Transfer: How to Sell Digital Goods[END_REF], where it was already observed that they could be used to build round-efficient protocols. They realize implicit proofs using conditional disclosure of secrets [START_REF] Gertner | Protecting Data Privacy in Private Information Retrieval Schemes[END_REF]. The latter, together with witness encryption [START_REF] Garg | Witness encryption and its applications[END_REF] and SPHFs, only provide a weak "honest-verifier zero-knowledge" guarantee.

In a completely different context, a primitive called zero-knowledge to garbled circuits has been introduced in [START_REF] Chandran | Covert Multi-Party Computation[END_REF]. The latter is essentially an implicit zero-knowledge proof (in the plain model). However, it was built using very general tools (and relies on expensive Karp reductions to NP-complete problems), without computational efficiency in mind, to show the theoretical feasibility of a strong form of secure computation called covert multiparty computation. It was observed later in [START_REF] Jarecki | Efficient Covert Two-Party Computation[END_REF] that iZK can also be used to achieve this security notion efficiently. Very recently, zero-knowledge to garbled circuits have been used to obtain new results (in the plain model) regarding the round-efficiency of general multiparty computation [START_REF] Ananth | A New Approach to Round-Optimal Secure Multiparty Computation[END_REF].

Recently, Jarecki introduced the concept of conditional key encapsulation mechanism [START_REF] Jarecki | Practical Covert Authentication[END_REF], which is related to iZK as it adds a "zero-knowledge flavor" to SPHFs by allowing witness extraction. The construction is a combination of SPHF and zero-knowledge proofs "à la Schnorr". Contrary to iZK, it does not aim at reducing the interactivity of the resulting protocol, but ensures its covertness.

Witness encryption was introduced by Garg et al. in [START_REF] Garg | Witness encryption and its applications[END_REF]. It enables to encrypt a message M for a word C and a language L into a ciphertext c, so that any user knowing a witness w that C ∈ L can decrypt c. Similarly to SPHFs, witness encryption also only has this "honest-verifier zero-knowledge" flavor: it does not enable to decrypt ciphertext for words C / ∈ L , with a trapdoor. That is why, as SPHF, witness encryption cannot be used to construct directly iZK.

Definition of Implicit Zero-Knowledge Arguments

Definition

Let (i L crs ) crs be a family of NP languages, indexed by a common reference string crs, and defined by a (polynomial time) witness relation iR crs , namely i L = {x ∈ i X crs | ∃iw, iR crs (x, iw) = 1}, where (i X crs ) crs is a family of sets. The reference string crs is generated by some polynomialtime algorithm Setup crs taking as input the unary representation of the security parameter κ. For the sake of simplicity, crs is often implicit.

To achieve stronger properties (namely simulation-soundness in Section 4.3.5), we sometimes also assume that Setup crs can output some additional information or trapdoor T crs . This trapdoor should enable to check, in polynomial time, whether a given word x is in i L or not. It is only used in security proofs, and is never used by the iZK algorithms.

An iZK is defined by the following polynomial-time algorithms:

• icrs $ ← iSetup(crs) generates the (normal) common reference string (CRS) icrs (which implicitly contains crs). The resulting CRS provides statistical soundness;

• (icrs, i T ) $ ← iTSetup(crs) 4 generates the (trapdoor) common reference string icrs together with a trapdoor i T . The resulting CRS provides statistical zero-knowledge;

• (ipk, isk) $ ← iKG (icrs, x, iw) generates a public/secret key pair, associated to a word x ∈ i L and a label ∈ {0, 1} * , with witness iw;

• (ipk, itk) $ ← iTKG (icrs, i T , x) generates a public/trapdoor key pair, associated to a word x ∈ X and a label ∈ {0, 1} * ;

• (c, K) $
← iEnc (icrs, ipk, x) outputs a ciphertext c of a value K (an ephemeral key), for the public key ipk, the word x, and the label ∈ {0, 1} * ;

• K ← iDec (icrs, isk, c) decrypts the ciphertext c for the label ∈ {0, 1} * , and outputs the ephemeral key K;

• K ← iTDec (icrs, itk, c) decrypts the ciphertext c for the label ∈ {0, 1} * , and outputs the ephemeral key K.

The three last algorithms can be seen as key encapsulation and decapsulation algorithms. Labels are only used for SSiZK and are often omitted. The CRS icrs is often omitted, for the sake of simplicity. Normally, the algorithms iKG and iDec are used by the user who wants to (implicitly) prove that some word x is in i L (and we often call this user the prover), while the algorithm iEnc is used by the user who wants to (implicitly) verify this (and we often call this user the verifier), as shown in Figures 4.1 and 4.3. The algorithms iTKG and iTDec are usually only used in proofs, to generate simulated or fake implicit proofs (for the zero-knowledge property).

Security Requirements

An iZK satisfies the four following properties (for any (crs, T crs ) $ ← Setup crs (1 κ )):

• Correctness. The encryption is the reverse operation of the decryption, with or without a trapdoor: for any icrs $ ← iSetup(crs) or with a trapdoor, for any (icrs, i T ) $ ← iTSetup(crs), and for any x ∈ X and any ∈ {0, 1} * , if x ∈ i L with witness iw, (ipk, isk) $ ← iKG (icrs, x, iw), and (c, K) $ ← iEnc (ipk, x), then we have K = iDec (isk, c);

-if (ipk, itk) $ ← iTKG (i T , x) and (c, K) $ ← iEnc (ipk, x), then we have K = iTDec (itk, c).
• Setup Indistinguishability. A polynomial-time adversary cannot distinguish a normal CRS generated by iSetup from a trapdoor CRS generated by iTSetup. More formally, no PPT can distinguish, with non-negligible advantage, the two distributions:

{icrs | icrs $ ← iSetup(crs)} {icrs | (icrs, i T ) $ ← iTSetup(crs)}.
4 When the CRS is word-dependent, i.e., when the trapdoor i T does only work for one word x * previously chosen, there is a second argument: (icrs, i T ) $ ← iTSetup(crs, x * ). Security notions are then slightly different. See details in Section 4.3.7.2. • Soundness. When the CRS is generated as icrs $ ← iSetup(crs), and when x / ∈ L , the distribution of K is statistically indistinguishable from the uniform distribution, even given c. More formally, if Π is the set of all the possible values of K, for any bitstring ipk, for any word x / ∈ i L , for any label ∈ {0, 1} * , the two distributions:

Exp iZK-zk-b (A , crs, κ) (icrs, i T ) $ ← iTSetup(crs) ( , x * , iw, st) $ ← A (icrs, i T ) if iR(x * , iw) = 0 then return random bit if b = 0 then (ipk, isk) $ ← iKG (icrs, x * , iw * ) else (ipk, itk) $ ← iTKG (i T , x * ) (c, st) $ ← A (st, icrs, i T , ipk) if b = 0 then K ← iDec (isk, c) else K ← iTDec (itk, c) return A (st, K) Exp iZK-ss-b (A , crs, κ) (icrs, i T ) $ ← iTSetup(crs) ( * , x * , ipk * , st) $ ← A O (icrs) (c, K) $ ← iEnc (ipk * , x * ) if b = 0 then K ← K else K $ ← Π b $ ← A O (st, c, K ) if ∃itk, ( * , x * , ipk * , itk) ∈ L∪L then return random bit if x * ∈ i L then return random bit return b
{(c, K) | (c, K) $ ← iEnc (ipk, x)} {(c, K ) | (c, K) $ ← iEnc (ipk, x); K $ ← Π}
are statistically indistinguishable (iEnc may output (⊥, K) when the public key ipk is not well formed).

• Zero-Knowledge. For any label ∈ {0, 1} * , when the CRS is generated using (icrs, i T ) $ ← iTSetup (crs), for any message x * ∈ i L with the witness iw * , the public key ipk and the decapsulated key K corresponding to a ciphertext c chosen by the adversary, either using isk or the trapdoor itk, should be indistinguishable, even given the trapdoor i T . More formally, we consider the experiment Exp iZK-zk-b in Figure 4.2. The iZK is (statistically) zero-knowledge if the advantage of any adversary A (not necessarily polynomial-time) for this experiment is negligible.

We defined our security notion with a "composable" security flavor, as Groth and Sahai in [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF]: soundness and zero-knowledge are statistical properties, the only computational property is the setup indistinguishability property. This is slightly stronger than what is needed, but is satisfied by our constructions and often easier to use.

We also consider stronger iZK, called simulation-sound iZK or SSiZK, which satisfies the following additional property:

• Simulation Soundness. The soundness holds (computationally) even when the adversary can see simulated public keys and decryption with these keys. More formally, we consider the experiment Exp iZK-ss-b in Figure 4.2, where the oracle O, and the lists L and L are defined as follows:

on input ( , x), O generates (ipk, itk) $ ← iTKG(icrs, i T , x), stores ( , x, ipk, itk) in a list L, and outputs ipk;

Prover P Verifier V (ipk, isk) $ ← iKG(icrs, x, iw) x, ipk (c, K) $ ← iEnc(ipk, x) c K ← iDec(isk, c) accept if K = K K Figure 4
.3: Three-round zero-knowledge from iZK for a word x ∈ i L and a witness iw on input (ipk, c), O retrieves the record ( , x, ipk, itk) from L (and aborts if no such record exists), removes it from L, and adds it to L , computes K ← iTDec (icrs, itk, c), and outputs K. The iZK is (statistically) simulation-sound if the advantage of any adversary A (not necessarily polynomial-time) for this experiment is negligible. Remark 4.2.1. An iZK for some language i L directly leads to a 3-round zero-knowledge arguments for i L . The construction is depicted in Figure 4.3 and the proof is provided in Section 4.2.2. If the iZK is additionally simulation-sound, the resulting zero-knowledge argument is also simulation-sound.

Proof of Remark 4.2.1 (Sketch).

We prove that the construction of ZK from iZK given in Remark 4.2.1 is correct. The completeness and the soundness of the zero-knowledge protocol from iZK directly follows from the completeness and the soundness of the underlying iZK; the zero-knowledge is straightforward too: the existence of a simulator is ensured because a simulator is explicitly given by the underlying iZK. The simulator simply uses the trapdoor instead of the witness, and the proof of perfect simulation directly follows from the zero-knowledge property of the underlying iZK.

Construction of Implicit Zero-Knowledge Arguments

In this section, we construct implicit zero-knowledge arguments, building on the generic framework of SPHFs (introducted in [START_REF] Benhamouda | New Techniques for SPHFs and Efficient One-Round PAKE Protocols[END_REF] for the particular case of cyclic groups, and generalized in Benhamouda's thesis [START_REF] Benhamouda | Diverse modules and zero-knowledge[END_REF]), where the projection key hp can depend on the word, as it is at the core of our construction of iZK. The framework is recalled and illustrated in Section 2.3.4.1. First, we explain in more details the limitations of SPHFs and the fact they cannot directly be used to construct iZK (we actually exhibit a concrete attack). Second, we show how to overcome these limitations to build iZK and SSiZK.

Limitations of Smooth Projective Hash Functions

At a first glance, as explained in the introduction, it may look possible to construct an iZK from an SPHF for the same language L = i L as follows:

• iSetup(crs) and iTSetup(crs) outputs the empty CRS icrs :=⊥;

• iKG(icrs, x, iw) outputs an empty public key ipk :=⊥ together with the secret key isk := (x, iw);

• iEnc(ipk, x) generates a random hashing key hk $ ← HashKG(crs, x) and outputs the ciphertext c := hp ← ProjKG(hk, crs, x) together with the ephemeral key K := H ← Hash(hk, crs, x);

• iDec(isk, c) outputs the ephemeral key K := projH ← ProjHash(hp, crs, x, iw). This construction is sound: if x / ∈ L , given only c = hp, the smoothness ensures that K = H looks random. Unfortunately, there seems to be no way to compute K from only c, or in other words, there does not seem to exist algorithms iTKG and iTDec.

Example 2.3.19 is not Zero-Knowledge. Actually, with the SPHF from Example 2.3.19, no such algorithm iTKG or iTDec (verifying the zero-knowledge property) exists. It is even worse than that: a malicious verifier may get information about the witness, even if he just has a feedback whether the prover could use the correct hash value or not (and get the masked value or not), in a protocol such as the one in Figure 4.1. A malicious verifier can indeed generate a ciphertext c = hp, by generating hp 1 honestly but by picking hp 2 and hp 3 uniformly at random. Now, a honest prover will compute projH = hp r 1 hp b 2 hp -rb 3 , to get back the ephemeral key (using iDec). When C is an encryption of b = 1, this value is random and independent of H, as hp 2 and hp 3 have been chosen at random, while when b = 0, this value is the correct projH and is equal to H. Thus the projected hash value projH, which is the ephemeral output key by the honest prover, reveals some information about b, part of the witness.

If we want to avoid such an attack, the prover has to make sure that the hp he received was built correctly. Intuitively, this sounds exactly like the kind of verifications we could make with an SPHF: we could simply build an SPHF on the language of the "correctly built" hp. Then the prover could send a projection key for this new SPHF and ask the verifier to XOR the original hash value H with the hash value of this new SPHF. However, things are not that easy: first this does not solve the limitation due to the security proof (the impossibility of computing H for x / ∈ i L ) and second, in the SPHF in Example 2.3.19, all projection keys are valid (since Γ is full-rank, for any hp, there exists necessarily a hk such that hp = Γ • hk).

iZK Construction

Let us consider an SPHF defined as in Section 2.3.4.1 for a language i L = L . In this section, we show how to design, step by step, an iZK for i L from this SPHF, following the overview in Section 4.1.5. At the end, we provide a summary of the construction and a complete proof. We illustrate our construction on the language of ElGamal ciphertexts of bits (Examples 2.3.17 and 2.3.19), and refer to this language as "our example". We suppose a cyclic group G of prime order p is fixed, and that DDH is hard in G5 .

We have seen the limitations of directly using the original SPHF are actually twofold. First, SPHFs do not provide a way to compute the hash value of a word outside the language, with just a projection key for which the hashing key is not known. Second, nothing ensures that a projection key has really been derived from an actually known hashing key, and in such a bad case, the projected hash value may leak some information about the word C (and the witness).

To better explain our construction, we first show how to overcome the first limitation. Thereafter, we will show how our approach additionally allows to check the validity of the projection keys (with a non-trivial validity meaning). It will indeed be quite important to notice that the projection keys coming from our construction (according to one of the setups) will not necessarily be valid (with a corresponding hashing key), as the corresponding matrix Γ will not always be full rank, contrary to the projection keys of the SPHF in Example 2.3.19. Hence, the language of the valid projection keys will make sense in this setting.

Adding the Trapdoor. The CRS of our construction is a tuple icrs = (g , h , u = g r , e = h s ) ∈ G 4 , with g , h two random generators of G, and • r , s two random distinct scalars in Z p , for the normal CRS generated by iSetup, so that (g , h , u , e ) is not a DDH tuple;

• r = s a random scalar in Z p , for the trapdoor CRS generated by iTSetup, with i T = r the trapdoor, so that (g , h , u , e ) is a DDH tuple.

Then, we build an SPHF for the augmented language L t defined as follows: a word

C t = (C, u , e
) is in L t if and only if either C is in the original language L or (u , e ) is a DDH tuple. This new language L t can be seen as the disjunction of the original language L and of the DDH language in basis (g , h ). Construction of disjunctions of SPHFs were proposed in [START_REF] Abdalla | Disjunctions for Hash Proof Systems: New Constructions and Applications[END_REF] but require pairings. In this thesis, we use an alternative more efficient construction without pairing 6 . Let us show it on our example, with C t = (C, u , e ). We set #" • If λ t,6 = 0, looking at the second and the third columns of Γ t gives that: 6 , h λ t,5 /λ t,6 ), or in other words (u , e ) is a DDH tuple in basis (g , h );

Ĉt := (g -1 , 1, 1, 1, 1, 1, 1) and Γ t (C t ) ∈ G (k+3)×(n+3) as Γ t (C t ) :=        1 Γ(C) g 1 1 #" Ĉ = θ(C) 1 g h 1 . . . 1 g u e 1 . . . 1        =          1 1 1 g h 1 1 1 1 1 1 g u e/g 1 1 1 1 1 g h g 1 1 u e 1 1 1 g h 1 1 1 1 g u e 1 1 1 1          . ( 4
λ t,5 • (g , h ) + λ t,6 • (u , e ) = (1, 1) equivalent to (u , e ) = (g λ t,5 /λ t,
• if λ t,4 = 0, looking at the last four columns of Γ t gives that:

λ t,4 • #" Ĉ = λ t,4 • (u, e, 1, 1)
is a linear combination of rows of Γ, hence #" Ĉ too. As a consequence, by definition of

L , C ∈ L .
Now, whatever the way the CRS is generated (whether (u , e ) is a DDH tuple or not), it is always possible to compute projH as follows, for a word C ∈ L with witnesses r and b:

projH = #" λ t • hp #" λ t = ( #" λ , -1, 0, 0) = (r, b, -rb, -1, 0, 0)
When the CRS is generated with the normal setup, as shown above, this is actually the only way to compute projH, since (u , e ) is not a DDH tuple and so #" Ĉt is linearly dependent of the rows of Γ t if and only if C ∈ L . On the opposite, when the CRS is generated by the trapdoor setup with trapdoor r , we can also compute projH using the witness r : projH = #" λ t • hp with #" λ t = (0, 0, 0, 0, r , -1). However, the latter way to compute projH gives the same result as the former way, only if hp t,5 and hp t,6 involve the correct value for hk 1 . A malicious verifier could decide to choose random hp t,5 and hp t,6 , which would make #" λ t • hp look random and independent of the real hash value! Ensuring the Validity of Projection Keys. The above construction and trapdoor would provide zero-knowledge if we could ensure that the projection keys hp (generated by a potentially malicious verifier) is valid, so that, intuitively, hp t,5 and hp t,6 involve the correct value of hk 1 . Using a zero-knowledge proof (that hp derives from some hashing key hk) for that purpose would annihilate all our efforts to avoid adding rounds and to work under plain DDH (interactive ZK proofs introduce more rounds, and Groth-Sahai [GS08] NIZK would require assumptions on bilinear groups). So we are left with doing the validity check again with SPHFs.

Fortunately, the language of valid projection keys hp can be handled by the generic framework, since a valid projection key hp is such that: hp = Γ t • hk, or in other words, if we transpose everything hp = hk • Γ t . This is exactly the same as in Equation (2.1), with #" Ĉ ↔ hp , Γ ↔ Γ t and witness #" λ ↔ hk . So we can now define a smooth projective hash function on that language, where the projection key is called transposed projection key tp, the hashing key is called transposed hashing key tk, the hash value is called transposed hash value tH and the projected hash value is called transposed projected hash value tprojH.

Finally, we could define an iZK, similarly to the one in Section 4.3.1, except, ipk contains a transposed projection key tp (generated by the prover from a random transposed hashing key tk), and c contains the associated transposed projected hash value tprojH in addition to hp, so that the prover can check using tk that hp is valid by verifying whether tprojH = tH or not.

An Additional

Step. Unfortunately, we are not done yet, as the above modification breaks the soundness property! Indeed, in this last construction, the prover now learns an additional information about the hash value H: tprojH = hk tp, which does depend on the secret key hk. He could therefore choose tp = #" Ĉ t , so that tprojH = hk

#" Ĉ t =
#" Ĉt hk is the hash value

H = K of C under hk.
We can fix this by ensuring that the prover will not know the extended word #" Ĉt on which the SPHF will be based when he sends tp, by making #" Ĉt and K depend on a random scalar ζ ∈ Z p chosen by the verifier (and included in c). Detailed Construction. Let us now formally show how to build an iZK from any SPHF built from the generic framework of [START_REF] Benhamouda | New Techniques for SPHFs and Efficient One-Round PAKE Protocols[END_REF], following the previous ideas. We recall that we consider a language L = i L , such that a word x = C is in i L , if and only if #" Ĉ = θ(C) is a linear combination of the rows of some matrix Γ ∈ G k×n (which may depend on C). The coefficients of this linear combination are entries of a row vector #" λ ∈ Z 1×k p :

#" Ĉ = #" λ • Γ, where #" λ =
#" λ (iw) can be computed from the witness iw for x. The setup algorithms iSetup(crs) and iTSetup(crs) are defined as above (page 71). We define an extended language using the generic framework:

θ t (x, ζ) = #" Ĉt = (g -1 , 1, . . . , 1) ∈ G 1×(n+3) Γ t (x) ∈ G (k+3)×(n+3) ,
where Γ t (x) is the matrix of Equation (4.1), and ζ is a random scalar used to ensure the prover cannot guess the word #" Ĉt which will be used, and so cannot choose tp = #" Ĉt . We write:

#" λ t (iw) = ( #" λ (iw), -1, 0, 0) #" λ t (i T ) = (0, . . . , 0, r , -1, 0, . . . , 0)
with i T = r , so that:

#" Ĉt = #" λ t (iw) • Γ t (x) if (g , h , u , e ) is a DDH tuple, with witness iw #" λ t (i T ) • Γ t (x) if x ∈ i L with witness i T .
The resulting iZK construction is depicted in Figure 4.4. This is a slightly more efficient construction than the one we sketched previously, where the prover does not test anymore explicitly tprojH, but tprojH (or tH) is used to mask K. Thus, tprojH no more needs to be included in c.

Notes

This construction was originally presented in [START_REF] Benhamouda | Implicit Zero-Knowledge Arguments and Applications to the Malicious Setting[END_REF]. The construction described in this section improves over the original construction by a factor 2, by avoiding the 2-universality method and directly using ζ to randomize K. For the sake of concreteness, the extended matrix Γ t is explicitely defined. In fact, this extended matrix corresponds to the matrix for the disjunction of two languages, the original language and the language of DDH tuples. The construction can be generalized to handle disjunction with an arbitrary hard-subsetmembership language, which allows to base it on a large variety of other assumptions. This generalized construction (also taking the factor two improvement into account) is presented in section 6.3.3.2 of our co-author's thesis [START_REF] Benhamouda | Diverse modules and zero-knowledge[END_REF]. The security requirements are also slightly relaxed in [START_REF] Benhamouda | Diverse modules and zero-knowledge[END_REF] to allow for computational soundness and computational zero-knowledge; here, we kept the original definition (soundness and zero-knowledge are statistical, only setup indistinguishability is computational) which is more restricted, but has a "composable" flavor comparable to the non-interactive zero-knowledge proofs of Groth and Sahai [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF].

Proof of Security

Correctness. Straightforward.

Setup Indistinguishability. The only difference between iSetup and iTSetup is that in the former (g , h , u , e ) is a random tuple, while in the later (g , h , u , e ) is a DDH tuple. Hence the setup indistinguishability holds under plain DDH in G. As x / ∈ L and (g , h , u , e ) is not a DDH tuple, it holds that θ t (x) does not belong to the span of the columns of Γ t (x). We start by showing that there is at most a single value

iSetup(crs) (g , h ) $ ← G * 2 (r , s ) $ ← Z 2 p \ {(a, a) | a ∈ Z p } (u , e ) ← (g r , h s ) ∈ G 2 icrs ← (g , h , u , e ) return icrs iTSetup(crs) (g , h ) $ ← G * 2 r $ ← Z p (u , e ) ← (g r , h r ) ∈ G 2 icrs ← (g , h , u , e ); i T ← r return (icrs, i T ) iKG(icrs, x, iw) tk $ ← Z k+3 p ipk := tp ← Γ t (x) • tk ∈ G n+3 isk := (x, tk, iw) return (ipk, isk) iTKG(icrs, x, i T ) tk $ ← Z k+3 p ipk := tp ← Γ t (x) • tk ∈ G n+3 itk := (x, tk, i T ) return (ipk, itk) iEnc(icrs, ipk, x) tp ← ipk; hk $ ← Z n+3 p ; ζ $ ← Z p hp ← Γ t (x) • hk ∈ Z k+3 p tprojH ← hk • tp ∈ G H ← θ t (x) • hk ∈ Z p K ← H ζ • tprojH ∈ G c := (ζ, hp) return (K, c) iDec(icrs, isk, c) (x, tk, iw) ← isk (ζ, hp) ← c tH ← hp • tk ∈ Z p projH ← #" λ t (iw) • hp ∈ G return K := projH ζ • tH ∈ G iTDec(icrs, itk, c) (x, tk, i T ) ← itk (ζ, hp) ← c tH ← hp • tk ∈ Z p trapH := #" λ t (i T ) • hp ∈ G return K := trapH ζ • tH ∈ G
ζ such that (ζ • θ t (x)) • ipk ∈ ColSpan(Γ t (x)). Let (ζ 1 , ζ 2 ) be two values such that (ζ 1 • θ t (x)) • ipk ∈ ColSpan(Γ t (x)) (ζ 2 • θ t (x)) • ipk ∈ ColSpan(Γ t (x)) This implies (ζ 1 -ζ 2 ) • θ t (x) ∈ ColSpan(Γ t (x)). As θ t (x) / ∈ ColSpan(Γ t (x)), this equation necessarily implies ζ 1 = ζ 2 . Suppose now that ζ is chosen such that (ζ • θ t (x)) • ipk / ∈ ColSpan(Γ t (x)
), which happens with overwhelming probability 1 -1/p. Then, observe that

K = H ζ • tprojH = (θ t (x) • hk) ζ • (hk • tp) = hk • ((ζ • θ t (x)) • tp), as H = H = θ t (x) • hk = hk • θ t (x)
. Therefore, the value K can be seen as the hash value of (ζ • θ t (x)) • tp, hence it is uniformly random from the view of the adversary.

Perfect Zero-Knowledge. Let x * ∈ i L = L be a word with witness iw * . For the zeroknowledge property, we (the challenger playing the role of the prover) generates a public key ipk = tp, where tp is a projection key, associated to a random hashing key tk, for the language of valid hp's. Then, the adversary (playing the role of the verifier) sends a ciphertext c(ζ, hp). There are two cases:

• either there exists hk ∈ Z n+3 p such that hp = Γ t • hk. In this case, we have

projH := #" λ t (iw * ) • hp = #" λ t (iw * ) • Γ t • hk = #" Ĉt • hk = #" λ t (i T ) • Γ t • hk = #" λ t (i T ) • hp := trapH
(this property actually can be seen as coming from the correctness of the SPHF with projection key hp);

• or, there does not exist hk ∈ Z n+3 p such that hp = Γ t • hk. In this case, hp is not valid and tH = Γ t • tk (with tk ∈ Z k+3 p ) looks uniformly random for the adversary (before he sees projH ζ • tH or trapH ζ • tH in the game), since the only information he sees about tk is tp = Γ t • tk, but hp is linearly independent of rows of Γ t . This property on tH can actually be seen as the smoothness property of the SPHF with projection key tp. Then projH ζ • tH and trapH ζ • tH look both uniformly random to the adversary, and cannot be distinguished. Therefore, our construction is perfect zero-knowledge.

SSiZK Construction

Our SSiZK construction is similar to our iZK construction, except that, in addition both iSetup and iTSetup add to the CRS icrs a tuple (v k,i ) k=1,2 i=0,...,2κ of group elements constructed as follows: for i = 0 to 2κ (with κ the security parameter):

r i $ ← Z p , v 1,i ← g r i , v 2,i ← h r i . We also define the two Waters functions [Wat05] W k : {0, 1} 2κ → G, as W k (m) = v k,0 2κ i=1 v m i
k,i , for any bitstring m = m 1 . . . m 2κ ∈ {0, 1} 2κ . Finally, the CRS is also supposed to contain a hash function H : {0, 1} * → {0, 1} 2κ drawn from a collision-resistant hash function family

HF.

Next, the language L t is further extended by adding 3 rows and 2 columns (all equal to 1 except on the 3 new rows) to Γ t (x), where the 3 new rows are:

   1 1 1 1 . . . 1 g h 1 1 1 1 . . . 1 u e g 1 1 1 . . . 1 g 1    ∈ G 3×(n+5) , with u = W 1 (H( , x)
) and e = W 2 (H( , x)). The vector #" Ĉt becomes #" Ĉt = (g -1 , 1, . . . , 1) (it is the same except for the number of 1's). The security proof of the construction is given below. It requires that Setup crs also outputs some additional information or trapdoor T crs , which enables to check, in polynomial time, whether a given word x is in i L or not.

Proof of Security

We first provide an informal overview of the security proof. Correctness, setup indistinguishability, and zero-knowledge are straightforward. Soundness follows from the fact that (g , h , u , e ) is a DDH-tuple, when parameters are generated by iSetup (and also iTSetup actually), and so (g , 1) is never in the subspace generated by (g , h ) and (u , e ) (as h = 1), hence the corresponding language L t is the same as for our iZK construction. Finally, to prove simulation-soundness, we use the programmability of the Waters function [START_REF] Hofheinz | Programmable Hash Functions and Their Applications[END_REF] and change the generation of the group elements (v k,i ) so that for the challenge proof (generated by the adversary) (g , h , u , e ) is not a DDH-tuple, while for the simulated proofs it is a DDH-tuple. Then, we can change the setup to iSetup, while still being able to simulate proofs. But in this setting, the word #" Ĉt for the challenge proof is no more in L t , and smoothness implies simulation-soundness.

Details. Let us first write down the complete matrices

#" Ĉt and Γ t (x):

θ t (x, ζ) = #" Ĉt = (g -1 , 1, . . . , 1) ∈ G 1×(n+5) Γ t ( , x) =                1 Γ(x) 1 g 1 1 #" Ĉ 1 1 1 g h 1 . . . 1 1 1 g u e 1 . . . 1 1 1 1 1 1 1 . . . 1 g h 1 1 1 1 . . . 1 u e g 1 1 1 . . . 1 g 1                ∈ G (k+6)×(n+5) #" λ t (iw) = ( #" λ (iw), -1, 0, 0, 0, 0, 0) #" λ t (i T ) = (0, . . . , 0, r , -1, 0, 0, 0, 0, . . . , 0) with i T = r , with u = W 1 (H( , x)
) and e = W 2 (H( , x)).

Proof.

Correctness. Straightforward.

Setup Indistinguishability. The only elements added to the CRS (v 1,i , v 2,i ) i have exactly the same distribution when generated by iSetup and iTSetup. So it is equivalent to the setup indistinguishability of our iZK construction (see Section 4.3.4), and is implied by the DDH assumption.

Zero-Knowledge. The proof is exactly the same as for our iZK construction (see Section 4.3.4).

Soundness.

Both iSetup and iTSetup output a CRS icrs, such that (g , h , v 1,i , v 2,i ) is a DDH tuple, and so is (g , h , u , e ). From the definition of #" Ĉt and Γ t , a word ( x,g ,h ,u ,e ,u ,e ) is in the extended language corresponding to #" Ĉt and Γ t if and only if x ∈ i L , or (g , h , u , e ) is a DDH tuple, or (g , 1) is in the subspace generated by (g , h ) and (u , e ). But the latter subspace is exactly the subspace generated by (g , h ) (as (g , h , u , e ) is a DDH tuple). Hence, (g , 1) is never in that subspace (as g and h are supposed to be generators), and the last case of the disjunction is never satisfied.

Therefore, the extended language is actually the same as for our iZK construction, and the soundness can be proved in the same way as in Section 4.3.4.

Simulation-Soundness.

Let us now prove the simulation-soundness by exhibiting a sequence of indistinguishable games. An overview of the proof is given in Section 4.3.5.

We consider an adversary A against the simulation soundness. In each game G i , we start by picking a random bit b, run some experiment, and output some bit b . We denote by Adv i the advantage of the adversary in the game G i :

Adv i = 2 • Pr[b = b] -1.
Finally, we write negl any negligible quantity in κ.

We recall that we suppose that Setup crs also outputs some additional information or trapdoor T crs , which enables to check, in polynomial time, whether a given word x is in i L or not. This enables to perform the test x * ∈ i L * (at the end of the experiment Exp iZK-ss-b (A , crs, κ)) in polynomial time.

Game G 0 : In this first game, we pick a random bit b, run the experiment Exp iZK-ss-b (A , crs, κ), and outputs the bit b (output by the experiment). We use the trapdoor T crs to test whether x * ∈ i L or not (at the end of the experiment). The advantage Adv 0 is exactly the advantage of the adversary A in the simulation soundness experiments.

Game G 1 : In this game, instead of picking DDH tuples (g , h , v 1,i , v 2,i ) in iTSetup, we pick v 1,i and v 2,i uniformly at random in G. Under the DDH assumption, Adv 0 ≤ Adv 1 +negl.

Game G 2 : Similarly to the proof in [START_REF] Libert | Non-malleability from Malleability: Simulation-Sound Quasi-Adaptive NIZK Proofs and CCA2-Secure Encryption from Homomorphic Signatures[END_REF], in this game, we pick g , h $ ← G, and set, for i = 0, . . . , 2κ:

r i $ ← Z p r i $ ← Z p (4.2) v 1,i ← g r i • g r i • g ρ i v 2,i ← h r i • h r i , (4.3) with ρ 0 = µζ -ρ 0 , ρ i = -ρ i (for i = 1, . . . , 2κ), µ $ ← {0, . . . , 2κ}, r i , r i $ ← Z p , ρ i $ ← {0, .
. . , ζ }, for i = 0, . . . , 2κ, with ζ = 2(q + 1) and q the number of simulated proofs (i.e., queries ( , x) to oracle O). This game is perfectly indistinguishable from the previous one, as the distribution of the v k,i 's is exactly the same:

Adv 1 = Adv 2 .
Game G 3 : In this game, we abort if for some query ( ,

x) to O, ρ 0 + 2κ i=i m i ρ i = 0, with m = m 1 . . . m 2κ = H( , x) ∈ {0, 1} 2κ ; or if for m * = m * 1 . . . m * 2κ = H( * , x * ) ∈ {0, 1} 2κ , ρ 0 + 2κ i=1 m * i ρ i = 0.
Using the same analysis as in [Wat05; BR09; LPJY14]:

Adv 2 2 /(27(q + 1)(2κ + 1)) ≤ Adv 3 .
Game G 4 : In this game, we choose g , h so that (g , h , g , h ) is a random DDH tuple (instead of a random tuple as before). Under the DDH assumption, Adv 3 ≤ Adv 4 + negl.

Game G 5 : In this game, we set, for i = 0, . . . , 2κ:

r i $ ← Z p v 1,i ← g r i • g ρ i v 2,i ← h r i , (4.4)
with ρ i defined as in G 2 . This game is perfectly indistinguishable from the previous one, as the distribution of the v k,i 's is exactly the same: Adv 4 = Adv 5 .

Game G 6 : In this game, for any query ( , x) to O, we generate ipk = tp as usual, but for a subsequent query (ipk = tp, c = (ζ, hp)) to O, we compute trapH (in iTDec) as

trapH = #" λ • hp instead of trapH = #" λ t (i T ) • hp, where #" λ = 0, . . . , 0, - r 0 + 2κ i=1 r i α , 1 α , -1, 0, . . . , 0 ,
and

m = H( , x) α = ρ 0 + n i=1 m i ρ i .
This vector #" λ is well defined as α = 0 from the abort condition in G 3 . Furthermore:

r 0 + 2κ i=1 r i α 1 α • g h W 1 (m) = v 1,0 2κ i=1 v m i 1,i W 2 (m) = v 2,0 2κ 2=1 v m i 1,i =   g (-r 0 -2κ i=1 m i r i )/α g (r 0 + 2κ i=1 m i r i +ρ 0 + 2κ i=1 ρ i )/α h (-r 0 -2κ i=1 m i r i )/α h (r 0 + 2κ i=1 m i r i )/α   = g (ρ 0 + 2κ i=1 ρ i ))/α h 0 = g 1 so that #" λ • Γ t = #" Ĉt .
Finally, a proof similar as the one for the zero-knowledge property of our iZK construction (see Section 4.3.4) shows that Adv 5 ≤ Adv 6 + negl.

Game G 7 :

In this game, we generate the CRS using iSetup (i.e., (g , h , u , e ) is now a random tuple instead of a DDH tuple). This is possible as i T was not used in the previous game. Under the DDH assumption, Adv 6 ≤ Adv 7 + negl.

In this last game, we remark that #" Ĉ * t (corresponding to the challenge * , x * ) is linearly independent of rows of Γ t ( * , x * ), as x * / ∈ i L , (g , h , u , e ) is not a DDH tuple, and (g , h , W 1 ( * , x * ), W 2 ( * , x * )) is a DDH tuple. Then, similarly as in the soundness proof above, we get that Adv 7 = negl (statistically).

More Efficient iZK Constructions

In this section, we describe several ways to get slightly more efficient constructions of iZK at the cost of some (very reasonable) additional requirements.

Reducing the Size of the Ciphertext Using Entropy Extractors

In the generic framework constructed in Section 4.3, the ciphertext c of the iZK contains a random integer ζ. However, the actual requirement on ζ is quite simple: we want to ensure that the adversary will not be able to guess it before we send it. If the adversary was able to guess ζ, then he could have sent a tprojH corresponding to a linear combination of the lines of the matrix, and then tprojH would contain additional information about the secret key, breaking the zero-knowledge property of the iZK. To ensure that the adversary will not guess the ζ in advance, it is not necessary to send the ζ among with the other elements of Exp iZK-zk-b (A , crs, κ) (x * , w, st) $ ← A (crs) / / only for word-dependent CRS x * ← ⊥ / / only for re-usable CRS (icrs, i T ) $ ← iTSetup(crs, x * ) ( , st) $ ← A (crs) / / only for word-dependent CRS ( , x * , w, st) $ ← A (st, icrs, i T ) / / only for re-usable CRS if R(x * , w, st) = 0 then return 0 This saves one element in c.

if b = 0 then (ipk, isk) $ ← iKG (icrs, x * , w) else (ipk, itk) $ ← iTKG (i T , x * ) (c, st) $ ← A (st, icrs, i T , ipk) if b = 0 then K ← iDec (isk, c) else K ← iTDec (itk, c) return A (st, K)

More Efficient Construction with Word-Dependent CRS

In Section 4.3, we have seen how to add a trapdoor in a SPHF to ensure the validity of the projection key. In many cases, it is possible to add the trapdoor in a slightly more efficient way, if we accept to use word-dependent CRS. (the trapdoor CRS only works for one word

x * = (u * , e * ) chosen before the CRS is generated). Instead of adding three columns and three rows to the matrix Γ (to obtain the matrix Γ t ), it may be possible to only add one row. The second part of the construction ensuring the validity of the projection keys hp t remains the same.

For example, in Example 2.3.19, the CRS can contain a row R = (R 1 , R 2 , R 3 , R 4 ) which is (u * s , e * s , 1, 1) in the trapdoor mode for x * , or (g s , h s , 1, 1) in the normal mode (with s a random scalar in Z * p ). In the trapdoor mode, s is the trapdoor for x * . The DDH assumption (or the semantic security of ElGamal) ensures that the two setups are indistinguishable. We then have:

#" Ĉt = #" Ĉ = (u, e, 1, 1) Γ t = Γ R =      g h 1 1 1 g u e/g 1 1 g h R 1 R 2 R 3 R 4      .
In normal mode, the last row R is s times the first row of Γ t , and so the new element in the projection key, hp t,4 = R • hk gives no more information than the first element hp t,1 = hp 1 (from an information theoretic point of view). That is why the smoothness does still hold in normal mode.

In trapdoor mode, we remark that hp t,4 = R • hk = (u * hk1 e * hk2 ) s . This is exactly the hash value of x * raised to the power of s (if hp is valid). So knowing the trapdoor s and hp t,4 enables to compute the hash value of C * .

Formal Construction of iZK with Word-Dependent CRS. We suppose to have two setup algorithms:

• iSetup(crs) generates a row vector R ∈ G 1×n which is linearly depend of the rows of any matrix Γ for any C (we recall that Γ may depend on C). Then it returns icrs = (crs, R).

• iTSetup(crs, x * ) generates a row vector R ∈ G 1×n and a trapdoor a row vector # " λ * ∈ Z k+1 p so that: # "

λ * • Γ R = #" Ĉ.
In other word # " λ * is a witness for the language defined by Γ R and θ. Then it returns icrs = (crs, R) and i T = # " λ * .

Then we do the same construction as in Section 4.3.2, except we use the following matrices Γ t (x), #" Ĉt , #" λ t (iw), and #" λ t (i T ):

#" Ĉt = #" Ĉ Γ t = Γ R #" λ t (iw) = ( #" λ , 0) #" λ t (i T ) = # " λ * .
If the two setup iSetup and iTSetup are indeed indistinguishable, the proof of security is almost identical to the one for the generic construction in Section 4.3.4. When it is usable, this construction is slightly more efficient than the generic one with re-usable CRS, since the resulting matrix Γ t has 4 less columns and 4 less rows.

iZK for Languages Defined by a Computational Structure

We have shown that a SPHF for some language L yields an iZK for the same language i L = L . However, if the class of NP languages handled by SPHFs is sufficient for many applications, there is still a large variety of useful languages which are not captured by the framework we presented above. We thus now (informally) explain how to construct iZK for any languages just from their representation through a given computational structure.

Of course, every NP language can be represented by the most general computational structure, the circuit. However, more efficient, but more restricted computational structures are widely used in cryptography, such as Boolean branching programs, arithmetic formulas, etc. A computational structure of particular interest is the model of Arithmetic Branching Programs (ABP). They provide a very compact way to represent multivariate polynomials and capture, among others, the two structure previously given.

A language i L represented by a computational structure can be converted into a language L which can be handled by the generic framework for SPHFs, by essentially extending the words with commitments to particular elements of the computational structure itself. Thus, on a given language, we can construct an iZK whose size is essentially the size of the most efficient computational structure which can represent the language.

In the following, we present the main ideas of how to construct an iZK for any NP language defined by a circuit, and also for any language defined by an ABP. We stress that they represent the most commonly used, and the most interesting, computational structures, but iZK can be constructed for others computational structures, depending of our needother constructions exist for other representations of languages and these examples aim at illustrating the way such constructions can be made.

For any NP Language Defined by a Circuit. Let us build an iZK for an NP language L defined by a (polynomial-size) circuit C that evaluates a function F : a word x is in L if and only if there exists a witness iw verifying F (x, iw) = 1. We remark that any NP language can be defined by such a circuit.

The idea for the iZK construction is the following: the prover sends (as part of the public key ipk) ElGamal ciphertexts encrypting both all the bits of iw and all the values of the wires of the circuit C when evaluated on x and iw. Then he uses an SPHF to implicitly prove that:

• encryption of input bits of iw indeed contain bits (which is our Example 2.3.17);

• encryption of the output wire of the circuit really contains 1 (which is similar to our Example 2.3.15);

• each gate is evaluated correctly.

All these properties are guaranteed together by the conjunction of all the languages, as in our Example 2.3.18. It is thus indeed sufficient to show how to handle every individual language with the generic framework for SPHFs. The resulting scheme is an iZK for the NP language defined by C , secure under plain DDH. It is straightforward to extend it to be secure under weaker assumptions such as DLIN.

For Languages Defined by an ABP. Arithmetic branching programs (ABP) are efficient computational models that capture, among others, the computation of Boolean formulas, Boolean branching programs and arithmetic formulas. They also give a very compact representation of multivariate polynomials. A branching program is defined by a directed acyclic graph (V, E) with two special vertices µ, ν ∈ V and a labeling function Φ. An ABP computes a function F : F p → F p (p is a prime power) as follows: Φ assigns to each edge of E either a constant value or an affine function in any number of the input variables of F , and F (z) is the sum over all the path from µ to ν of the product of all the values along the path. The evaluation of F can be performed by assigning a value to each node, when nodes are sorted topologically (i.e., in such an ordering, a node appears always after its predecessors). The last node is ν and its value if the value F (z).

In our case, we use ABP to define an NP language in the following way: a word x is in the language L if there exists a witness iw such that F (x, iw) = 0. The prover sends (as part of the public key ipk), ElGamal ciphertexts encrypting both all the bits of iw and all the values of the nodes when Φ is instantiated with x and iw. Then, as above, he uses a SPHF to implicitly prove that:

• encryption of input bits of iw indeed contain bits;

• encryption of the last node ν really contains 0;

• each value for the nodes are computed correctly; the plaintext is just the sum of the values of the previous nodes multiplied by affine evaluations on the input (x, iw).

Every individual language can be efficiently represented by an SPHF, and then conjunctions help to conclude, under the DDH assumption.

iZK for any NP Language Defined by a Circuit

In every construction described below, we consider that the additively homomorphic ElGamal encryption scheme is used. We will denote E pk (a; r) the encryption of a under the public key pk and with randomness r. Notations. Let F : {0, 1} → {0, 1} be a function computed by a circuit C on a basis B of boolean gates (with two input wires, without loss of generality), given by its directed acyclic graph (V, E). F takes as input z = (x, iw) where x ∈ {0, 1} x and iw ∈ {0, 1} iw such that

x + iw = . Nodes or gates v in V are either an input gate corresponding to some bit x i of x, iw i of iw, or a constant bit, or a boolean gate in the basis B. Let s = |V | be the size of the circuit. We consider the partial order on the set of gates V defined by u v if there is a path from the gate u to the gate v (the graph is acyclic). Then, we index the gates V = (v i ) s i , in an order-preserving way, such that for i = 1, . . . , , v i corresponds to the input bit z i of z and, if v i v j , then i ≤ j. For each internal gate v i , with i > , we denote by {i 1 , i 2 } = P(i) the indexes of the two preceding gates whose outputs are the inputs of v i . The output bit of the gate v i when evaluated on z = (x, iw) is denoted A i (for input gates, the output bit is just the value of the input).

Extended Language for F . We want an iZK for the language

i L = {x ∈ {0, 1} x | ∃iw ∈ {0, 1} iw , F (x, iw) = 1}.
However, this language cannot be directly handled by the SPHF framework, and we have to extend it first: we consider the extended language L of words of i L along with the encryption of the output bits A i of the gates v i for i > x (hence including the input gates corresponding to the bits of iw but excluding those corresponding to the bits of x, which are anyway already known). Witness for the new language will be the random coins for all the ciphertexts, together with the values A i for i > x . We recall that A i = x i for i = 1, . . . , x .

Formally, for a gate v i , let (β i , β + i , β × i ) be three integers such that, on input (x, y), the output of the gate is (

β i + β + i (x + y) + β × i xy).
This models all the (symmetric) binary gates: XOR = (0, 1, -2), OR = (0, 1, -1), AND = (0, 0, 1), NAND = (1, 0, -1), while the unary gate NOT is just XOR 1. For i = x + 1, . . . , s, we consider a ciphertext c i = E(A i ; r i ) of A i with random coins r i . We now consider the language L of the words C = (x, (c i ) s i= iw +1 ) such that there exist witnesses (A i , r i ) s i= iw +1 satisfying: A s = 1, for all i = x + 1, . . . , s, c i encrypts the bit A i with random coins r i , and, for i = , . . . , s, A i verifies the appropriate relation with A i 1 and A i 2 , for {i 1 , i 2 } = P(i). However, there are quadratic relations, we thus need additional variables to linearize the system. Now, let us show how to construct an SPHF on this language L which can be automatically used to construct an iZK using the framework defined in Section 4.3 for the above language i L . Concretely, we use an ElGamal encryption in basis g, with public key h, and we write

c i = (c i1 = g r i , c i2 = h r i g A i ). C = (x, (c i ) s i= iw +1
) is in L if and only if there exist Algorithm 1 Dynamic ABP Computation 1: procedure DAC(F, x) / / F is an ABP and x is its input 2:

A 0 ← 1 3:

for i = 1 to |V | do 4: A i ← 0 5:
for all v j ∈ prec(v i ) do 6:

A i ← A i + Φ((v j → v i ), x) • A j / / A 0 is set as the value of the predecessor of v 1 7: return (A i ) 2≤i≤|V | / / A |V | = F (x) (A i ) s i= x +1 ∈ {0, 1} s-x , (r i ) s i= x +1 ∈ Z s-x p , (µ i ) s i= x +1 ∈ Z s-x p
and (µ i ) s i= +1 ∈ Z s- p , such that:

g r i = c i1 and h r i • g A i = c i2 (c i1 ) A i • g -µ i = 1 and (c i2 /g) A i • h -µ i = 1
for i = x + 1, . . . , s and:

(c i 2 1 ) A i 1 • g -µ i = 1 and g β + i A i 1 • g β + i A i 2 • (c i 2 2 ) β × i A i 1 • h -β × i µ i • g -A i = g -β i
for i = + 1, . . . , s, with {i 1 , i 2 } = P(i), since the second of equations ensures µ i = r i A i and A i (A i -1) = 0 (i.e., A i is a bit), while the third one ensures µ i = r i 2 A i 1 and A i =

β i + β + i (A i 1 + A i 2 ) + β × i A i 1 A i 2 .
These linear equations (in the exponents) directly provides the matrix Γ(C), while θ(C) is defined by the right-hand sides of the relations. This then leads to an SPHF over L , based on the plain DDH.

iZK for any NP Language Defined by an ABP

Notations: Let F : Z p → Z p be a function computed by an ABP given by its directed acyclic graph (V, E), two special vertices µ, ν ∈ V and a labeling function Φ : E × Z p → Z p .

F takes as input z = (x, iw), where x ∈ Z x p and iw ∈ Z iw p such that x + iw = . Let s = |E| be the size of the ABP. We denote by (u → v) the edge from the vertex u to the vertex v. We consider the partial order on the set of vertices V defined by u v if there is a path from the gate u to the gate v (the graph is acyclic). Then, we index the vertices V = (v i ) s in an order-preserving way:

v i v j ⇒ i ≤ j, µ = v 1 and ν = v |V | .
For each node v = µ, we denote by prec(v) the set of direct predecessors of v, i.e., the vertices u such that (u → v) ∈ E. Algorithm 1 describes the way the ABP is evaluated in an input x. When the input x can be seen as a pair of tuples x = (x, iw) ∈ Z x p × Z iw p = Z p , we consider the problem, for a given x, of the existence of a witness iw such that F (x, iw) = 0. We want to build an iZK on the language of the words x with such witnesses iw.

Extended Language for F . As above, we want an iZK for the language

i L = {x ∈ Z x p | ∃iw ∈ Z iw p , F (x, iw) = 0}
. We can extend it, as above, with the ciphertexts c i of all the witnesses iw i and a i of all intermediate values A i of the dynamic ABP computation (except the special vertices A 1 = 1 and A |V | = 0). Then the witnesses are (r i ) iw i=1 and (s i )

|V |-1 i=2 , the random coins for the encryption. We now consider the language L of the words (x, (c i ) iw i=1 , (a i )

|V |-1 i=2 ) such that there exist witnesses ((r i , iw i ) iw i=1 , (s i , A i )

|V |-1 i=2 ) satisfying: for all i = 1, . . . iw , c i encrypts the scalar iw i with random coins r i , for i = 2, . . . , |V | -1, a i encrypts the scalar A i with random coins s i , and A i verifies the appropriate relation w.r.t. its predecessors, as well A 1 = 1 and A |V | = 0, which introduces again quadratic relations.

As above, using ElGamal encryption, we can write c i = (c i1 = g r i , c i2 = h r i g iw i ) and

a i = (a i1 = g s i , a i2 = h s i g A i ). The word C = (x, (c i ) iw i=1 , (a i ) |V |-1 i=2 ) is in L if and only if there exist (iw i ) i=1,..., iw ∈ Z iw p , (r i ) i=1,..., iw ∈ Z iw p , (A i ) |V |-1 i=2 ∈ Z |V |-2 p , (s i ) |V |-1 i=2 ∈ Z |V |-2 p
, and µ i,j ∈ Z p , for i = 2, . . . , |V | -1 and j = 1, . . . , iw (but actually for all the values iw j that appears in labels on edges leaving from v i ), such that:

g r i = c i1 and h r i • g iw i = c i2 for i = 1, . . . , x g s i = a i1 and h s i • g A i = a i2 for i = 2, . . . , |V | -1 (a i1 ) iw j • g -µ i,j = 1 for i = 2, . . . , |V | -1, for j = 1, . . . , iw g v j ∈prec(v i ) A i •Φ((v j →v i ),x)-A i = 1 for i = 2, . . . , |V |, with A |V | = 0
where x = (x, iw). We recall that Φ(v j → v i ) is an affine function (or a constant) in x (known by both players) and iw (encrypted in the c i 's). So quadratic terms A i iw j can be computed using the intermediate value µ i,j , as above, that implicitly corresponds to r i iw j to remove extra terms in h introduced by (a i2 ) iw j : (a i2 ) iw j • h -µ i,j is indeed g A i iw j when the first row is enforced.

A Concrete Example. Let us consider the following language

i L = {(x 1 , x 2 ) ∈ Z 2 p | ∃iw ∈ Z p , (iw 2 -x 1 )(iw 2 -x 2 ) = 0} of
pairs of integers modulo p such that at least one of the elements of the pair is a square. This language can be efficiently represented by the following ABP:

v 1 -x 1 v 3 -x 2 v 5 iw v 2 iw iw v 4 iw
Applying the dynamic ABP computation algorithm, we get

A 1 = 1, A 2 = iw, A 3 = iwA 2 - x 1 A 1 = iw 2 -x 1 , A 4 = iwA 3 , and A 5 = (iw 2 -x 2 )A 3 = (iw 2 -x 1 )(iw 2 -x 2 )
. Thus, we construct the extended language of words L = {(x 1 , x 2 ), (c 1 , c 2 ), (a i1 , a i2 ) 4 i=2 } such that there exists (µ i ) 4 i=2 ∈ Z 3 p so that the plaintexts iw, and (A 2 , A 3 , A 4 ) satisfy:

g r = c 1 and h r • g iw = c 2 g s i = a i1 , h s i • g A i = a i2 and (a i1 ) iw • g -µ i = 1 for i = 2, 3, 4
g iw • g -A 2 = 1 and (a 22 ) iw • h -µ 2 • g -A 3 = g x 1 (a 32 ) iw • h -µ 3 • g -A 4 = 1 and (a 42 ) iw • h -µ 4 = g x 2
We have 15 equations and 11 witnesses (iw, r,

(A i ) 4 2 , (s i ) 4 2 , (µ i = s i iw) 4
2 ). However, in this particular example, we can drop three equations and two witnesses: as the value A 2 is exactly the witness iw, we can drop (c 1 , c 2 ) and use (a 21 , a 22 ) instead. In addition, we can remove the two first equations and the equation g iw • g -A 2 = 1: we now have 12 equations and 10 witnesses ((A i ) 4 2 , (s i ) 4 2 , (µ i = s i iw) 4 2 ). We stress the fact that in particular applications with a "good" structure, it is often possible to get optimizations on the theoretical size of the corresponding iZK. This leads to a iZK with public key of size |ipk| = 30 and ciphertexts of size |c| = 24 (using the optimization of 4.3.7).

Applications

Semi-Honest to Malicious Transformation

In the seminal work [START_REF] Goldreich | How to Prove all NP-Statements in Zero-Knowledge, and a Methodology of Cryptographic Protocol Design[END_REF], Goldreich, Micali and Wigderson have proven that there exists a compiler which, given any two-party semi-honest interactive protocol, outputs an "equivalent protocol" for the malicious model. This compiler (which we call GMW compiler) is formally described in [START_REF] Goldreich | Foundations of Cryptography: Volume 2, Basic Applications[END_REF]. It is divided in three phases: the Input-Commitment Phase, where the players commit to their own inputs; the Coin-Generation Phase, where the players run an augmented coin-tossing protocol to generate unbiased random tapes while providing commitments on them for later validity proofs; and the Protocol Emulation Phase, where zero-knowledge proofs are used to ensure semi-honest behavior of all the players, from the committed inputs, the committed random tapes and the flows. This last phase is the one on which we focus in this section.

Indeed, while NIZK could be used to prove correct generation of the flows, they would either be quite inefficient (with general NIZK constructions) or require strong settings and assumptions (assumptions in bilinear groups for Groth-Sahai NIZK). On the other hand, interactive zero-knowledge proofs imply a blow-up in the interactivity of the protocol.

We present another compiler (see Figure 4.6) which is divided in four phases: there are still the Input-Commitment Phase and the Coin-Generation Phase, which end up with commitments of the inputs and of the unbiased random tapes of the two players, as in the GMW compiler. Note that if inputs should belong in a non-trivial language, validity of the commitments has to be proven as in the next phase. These are constant-round phases, which are then followed by the Protocol Emulation Phase: each flow x from the initial protocol is combined with an iZK, and so with a public key ipk, so that the other player can mask all the subsequent flows with K (or derivative masks) encapsulated in c. More precisely, from the ephemeral key K, we write k (i) for PRG (i) (K), and each flow is masked by all the previous keys, and so we use the next block from the PRG for any new mask. Hence, as soon as one player tries to cheat, all the subsequent flows sent by the other player will be masked by a random value. Eventually, a Verification Phase provides an explicit validity check: the two players have to prove they were able to extract all the ephemeral keys, which guarantees their semi-honest behavior during the whole protocol.

Proof Sketch. For the security proof, we first assume we are dealing with a deterministic function: on private inputs x and y, the first player receives f (x, y) and the second receives g(x, y). For the sake of simplicity, we also make the assumption that the semi-honest protocol provides execution traces with formats (size and number of flows) that are independent of the inputs. Eventually, we make use of extractable commitments.

We are thus given a simulator Sim for the semi-honest protocol P. And we describe a simulator Sim for the compiled protocol P : If both players are honest, Sim simply runs the simulator Sim to generate all the basic flows, and generates all the iZK proofs as well

x A1 x B1 x A2 x B2
. . .

x An

x Bn

Protocol Our Compiler GMW Compiler

Input-Commit Phase:

Protocol-Emulation Phase:

Commit A Commit B
Coin-Generation Phase:

x A1 , ipk A1 x B1 + k (0) A1 , ipk B1 , c A1 x A2 + k (0) B1 , ipk A2 , c B1 . . . x B2 + k (0) A2 + k (1) A1 , ipk B2 , c A2 x An + k (0) B(n-1) + • • • + k (n-2) B1 , ipk An , c B(n-1)
x Bn + k (0)

An + • • • + k (n-1)

A1

, ipk Bn , c An Verification Phase:

k (0) Bn + • • • + k (n-1) B1 , c Bn k (1) An + • • • + k (n) A1 Commit A Commit B x A1 , ZK-proof • • • • • • • • • . . .
x Bn , ZK-proof Figure 4.6: Semi-honest to malicious compilers as the verification flows, but using random keys K for deriving the masks. If one player is malicious, Sim first extracts its inputs and random coins from the extractable commitment, sends the inputs to the ideal functionality to learn the outcome and provides it to Sim to generate the basic flows of the honest player. This time, valid iZK proofs for the flows of the honest player have to be generated since the malicious player will be able to check them, and Sim has to be able to immediately detect dishonest behavior of the malicious player in order to replace all the subsequent flows by random flows: the trapdoor for the iZK, in the CRS, allows Sim to extract the ephemeral key even without a witness, and then to get back the plaintext sent by the malicious player; from the inputs and the random tape of the malicious player, as well as the previous flows already exchanged, Sim can anticipate and check the flow that should have been generated with a semi-honest behavior. As soon as a cheating attempt is detected, in the real world, the subsequent masks would become random looking to the malicious player, Sim can thus safely send random flows (the masked parts).

Secure Computation of Inner Products

In case of biometric authentication, a server S wants to compute the Hamming distance between a fresh user's feature and the stored template, but without asking the two players to reveal their own input: the template y from the server side and the fresh feature x from the client side. One can see that the Hamming distance between the -bit vectors x and y is the sum of the Hamming weights of x and y, minus twice the inner product of x and y. Let us thus focus on this private evaluation of the inner product: a client C has an input x = (x i ) i=1 ∈ {0, 1} and a server S has an input y = (y i ) i=1 ∈ {0, 1} . The server S wants to learn the inner product IP = i=1 x i y i ∈ {0, . . . , }, but nothing else, while the client C just learns whether the protocol succeeded or was aborted.

Semi-Honest Protocol. C can send an ElGamal encryption of each bit under a public key of her choice and then S can compute an encryption of IP + R, with R ∈ Z p a random mask, using the homomorphic properties of ElGamal, and sends this ciphertext. C finally decrypts and sends back g IP+R to S who divides it by g R to get g IP . Since IP is small, an easy discrete logarithm computation leads to IP.

Malicious Setting. To transform this semi-honest protocol into one secure against malicious adversaries, we could apply our generic conversion presented in Section 4.4.1. Here, we propose an optimized version of this transformation for this protocol. We use the ElGamal scheme for the encryption E pk , where pk is a public key chosen by C and the secret key is sk = (sk j ) log p j=1 , and the Cramer-Shoup scheme [START_REF] Cramer | A Practical Public Key Cryptosystem Provably Secure Against Adaptive Chosen Ciphertext Attack[END_REF] for commitments C, of group elements or multiple group elements with randomness reuse, where the public key is in the CRS. The CRS additionally contains the description of a cyclic group and a generator g of this group. The construction is presented on Figure 4.7. First, the client commits to her secret key (this is the most efficient alternative as soon as n

) and sends encryptions (c i ) i≤n of her bits. Then, the server commits to his inputs (y i ) i and to two random integers (R, R ), computes the encryption (û, ê) of g R•IP+R ), re-randomized with a randomness ρ, masked by an iZK to ensure that the c i 's encrypt bits under the key pk whose corresponding secret key sk is committed (masking one of the two components of an ElGamal ciphertext suffices). The client replies with g R•IP+R , masked by a SSiZK (this is required for UC security) to ensure that the C(g y i ) contains bits, and that the masked ciphertext has been properly built. The server then recovers g R•IP+R , removes R and R , and tries to extract the discrete logarithm IP. If no solution exists in {0, . . . , }, the server aborts. This last verification avoids the 2-round verification phase from our generic compiler: if the client tries to cheat on R • IP + R , after removing R and R , the result would be random, and thus in the appropriate range with negligible probability /p, since is polynomial and p is exponential. We prove in Section 4.4.4 that the above protocol is secure against malicious adversaries in the UC framework with static corruptions, under the plain DDH assumption, and in the common reference string setting. Efficiency and Comparison with Other Methodologies. In Section 4.4.3, we provide a detailed analysis of our inner product protocol in terms of complexity. Then, we estimate the complexity of this protocol when, instead of using iZK, the security against malicious adversaries in the UC model is ensured by using the Groth-Sahai methodology [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF] or Σ-protocols. In this section, we sum up our comparisons in a table. The notation > indicates that the given complexity is a lower bound on the real complexity of the protocol (we have not taken into account the linear blow-up incurred by the conversion of NIZK into SS-NIZK), and indicates a very loose lower bound. Details are given in Section 4.4.3. We stress Table 4.1: Comparison of the costs of various approaches for UC-secure two-party computation of the inner product that with usual parameter, an element of G 2 is twice as big as an element of G 1 (or G) and the number of rounds in the major efficiency drawback (see Section 4.1). The efficiency improvement of iZK compared to NIZK essentially comes from their "batch-friendly" nature (see Section 4.4.3). Estimations of the costs of the three approaches are given on Table 4.1. Moreover, our iZKs do not require pairings, which allows us to use more efficient elliptic curves than the best existing curves for the Groth-Sahai methodology. With a reasonable choice of two curves, one without pairing and one with pairing, for 128 bits of security, we get the results represented on Table 4.2 (counting efficiency as a multiple of the running time of an exponentiation in G 1 )

C pk, (c i = E pk (g x i )) i=1 S i=1 c y i i • E pk (g R ) ≡ E pk (g IP+R ) g IP+R C pk, C((g sk j ) log p j=1 ), (c i = (u i , e i ) = E pk (g x i )) i=1 , ipk C S C((g y i ) i=1 , g R , g R , u y i i , e y i i ), (û, ê), ipk S , c C g R•IP+R • K S , c S

Details on the Inner Product Protocols

We will now provide a detailed analysis of the performances of our UC-secure protocol to compute the inner product. Next, we compare the performances to the performances of a similar protocol whose security is based on the Groth-Sahai methodology [START_REF] Groth | Efficient Non-interactive Proof Systems for Bilinear Groups[END_REF] to illustrate the fact that, in applications where pairings are not fundamentally required for the protocol (meaning, the semi-honest version of the protocol can be done without pairings), being

Curve \ Efficiency Pairings Exponentiations in G 1 Exponentiations in G 2 Curve25519 [Ber06] no pairings 1 [BGM+10] ≈ 8 ≈ 3 ≈ 6
Table 4.2: Costs for computing exponentiations and pairings in different curves able to avoid them allows us to provide way more efficient solutions. We also provide the performances of a protocol based on the Schnorr proofs (Σ-proofs), which implies more interactivity.

Intuition on the Efficiency Improvements

First, let us provide an intuition of the reasons why we can expect some efficiency improvement over round-efficient protocols in the malicious setting based on NIZK.

Avoiding Pairings Saves Computations. Pairing are an expensive operation; on the best known curves such as [START_REF] Beuchat | High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves[END_REF], computing a pairing is roughly three time slower than computing an exponentiation. Moreover, not every elliptic curve has a pairing, and it turns out that the most efficient curves, such as [START_REF] Daniel | Curve25519: New Diffie-Hellman Speed Records[END_REF], have indeed no pairings. In the best curves without pairings, exponentiations in G are roughly three times faster than exponentiations in G 1 in the best curves with pairings, and even six times faster than exponentiations in G 2 .

iZK Can be Efficiently Batched. iZK are somewhat "batch-friendly": batch techniques, which reduce computation and communication, can always be used with an iZK without requiring more interactions. To batch a proof in NIZK-based protocols a seed is needed, so the prover has to first commit to his values, then he receives the seed and computes a short NIZK from it, that he sends back. This adds two rounds compared to the classical one-flow protocol in which the prover directly sends commitments plus a NIZK. But with iZKs, things are different: the prover sends commitments and an ipk, and the verifier replies with the next flow encrypted with ipk. It turns out that the prover and the verifier can agree on a batched version of the proof before even knowing the seed, so the prover can compute ipk without knowing the seed, and the verifier can just send the seed together with the masked second flow. Consequently, we can apply batch techniques to iZK-based protocols to reduce the communication without adding interactivity.

The Conversion of iZK into SSiZK is Efficient. We presented in Section 4.3 a generic construction of SSiZK from iZK. It is worth mentioning that this construct is efficient as it only adds a small constant number of group elements to the original iZK. Conversely, turning NIZK into simulation-sound NIZK comes at huge cost, a linear blow-up of the size of the proof. As soon as strong security requirements are considered, such as security in the UC framework, simulation-sound zero-knowledge proofs become, in the general case, unavoidable.

Setup

Let us provide some details about the iZK proofs which ensure the security of the inner product protocol described in Section 4.4. We work in a cyclic group G of prime order p, where the DDH assumption holds. We denote by λ the bit length of p, and by g a generator of the group. We also set the Cramer-Shoup public key to g 1 , g 2 , a, b,

(h i ) λ+ +2 i=1
, together with a universal hash function H(•). Since we apply the randomness-reuse technique for the Cramer-Shoup encryption, we need as many group elements h i as the maximal size of the vector we will encrypt. The value λ + + 2 is a clear upper-bound. The group description and this key (to be used for the commitment) are in the CRS.

Committing to the Secret Key. As described in Section 4.4, the client has to commit to her secret key; such a commitment adds O(λ) to the communication complexity of the protocol. However, the same requirement holds for any secure variant of the inner product protocol (based on the Groth-Sahai methodology or based on Σ-proofs), so, for the sake of simplicity, we omit this commitment (and the proof that it is indeed the secret key) in the protocols we are going to compare. The reason is that we focus on the setting λ (for example, in the biometric setting, we can have λ = 128 while ≈ 2000) so this O(λ) will not affect the overall comparison, even though the constants can differ from one protocol to the other.

Inner Product Protocol with iZK

Equations for the Language of the First Flow (i L C ). These equations ensure that all the encrypted values are bits. the i denote random values (used to batch the equations) which do not appear in the matrix of the SPHF associated to the iZK, so they will be picked by the server once he received the ciphertexts. i L C is the language of words (u i i , e i i ) i≤ such that there exists ((r i , x i ) i≤ , µ) satisfying:

1. for i = 1 to , u i i = g i r i and e i i = h i r i g i x i 2. 1 = ( u i x i i ) • g -µ and 1 = ( (e i /g) i x i ) • h -µ
The 2 + 2 equations involve 2 + 1 witnesses, (( i r i ) i≤ , ( i x i ) i≤ , µ). The witness µ corresponds to i r i x i . Omitting the constants, this lead to an iZK with public key ipk C of size 2 and ciphertext c C of size 2 .

Equations for the Language of the Second Flow

(i L S ). Let (d 1 , d 2 , (e i ) i≤ +4 , f ) denote the Cramer-Shoup commitments of the values ((g y i ) i≤ , g R , g R , u y i i , e y i i )
, and let (û, ê) denote the encryption of R • IP + R . These equations ensure that the first committed values are bits, that the two last committed values are u y i i and e y i i and that (û, ê) is a randomized encryption of the inner product additively and multiplicatively randomized by two committed values. The values are committed using randomness reuse techniques, which makes the commitment four times smaller but prevents us from batching our equations as we did in the first flow. i L S is the language of words (d 1 , d 2 , (e i ) i≤ +4 , f, û, ê) such that there exists ((y i ) i≤ , (µ i ) i≤ +1 , r , R, R , ρ) satisfying:

1. d 1 = g r 1 , d 2 = g r 2 , f = (ab ξ ) r 2. for i = 1 to , e i = h r i g y i , 1 = d y i 1 g -µ i and 1 = (e i /g) y i h -µ i i 3. e +1 = h r +1 g R , e +2 = h r +2 g R ans 1 = d R 1 g -µ +1 4. e +3 = h r +3 u y i i , e +4 = h r +4 e y i i 5. û = g ρ e R +3 h -µ +1 +3 , ê = h ρ e R +4 h -µ +1 +4 g R
The 3 +10 equations involve 2 +5 witnesses, ((y i ) i≤ , (µ i ) i≤ +1 , r , R, R , ρ). The witnesses (µ i ) i≤ correspond to the r y i 's and µ +1 corresponds to r R. ρ is the randomness used to randomize the ciphertext (û, ê). Omitting the constants, the corresponding SSiZK has a public key ipk S of size 2 and ciphertext c S of size 2 .

Communication Complexity. omitting the constants, the total communication complexity of the protocol, counting the ciphertexts, the commitments, the iZK and the SSiZK, is 2 + 2 + 4 + + 2 + 3 = 14 .

Computational Complexity. Exponentiations are required to compute the ciphertexts, the commitments, and elements of the iZK involved in the two iZKs: (hp, tp, H, tH, projH, tprojH). Recall that as (x i , y i ) i≤ are bits, exponentiations with these values are free.

• First iZK: 2 × 5 (for hp and tp), plus 2 × 2 (for H and tprojH), plus 2 × 2 (for tH and projH), plus 2 × 2 (for the ElGamal ciphertexts). Hence 20 exponentiations in total.

• Second iZK: 2 × 6 (for hp and tp), plus 2 × 2 (for H and tprojH), plus 2 × 4 (for tH and projH), plus 2 × (for the commitments). Hence 25 exponentiations in total.

Omitting the constants, the execution of the whole protocol requires 45 exponentiations.

Inner Product Protocol with Groth-Sahai NIZKs

Unlike our iZK-based protocol, we do not intend to fully construct a UC-secure protocol for the inner product with the Groth-Sahai methodology, but rather to provide a lower bound on the complexity of such a protocol, which is enough to assess our claim that iZKs provide consistent efficiency improvement over the Groth-Sahai methodology to design UC-secure protocols whose semi-honest version does not originally involve pairings. Notice that we can apply batch techniques to reduce drastically the number of equations needed for the NIZK of the first flow, as the client cannot gain knowledge from the second flow by cheating (IP is randomized by R and R ), but the same cannot be done for the second flow because the client cannot send the decrypted value without being sure that the server was honest.

Simulation-Soundness for Groth-Sahai NIZKs. The inner product protocol involves quadratic equations and pairing product equations. While very efficient (quasi-adaptive) simulation-sound NIZKs have been designed for linear equations, to our knowledge, the best simulation-sound NIZKs for quadratic equations and pairing product equations are those of [START_REF] Hofheinz | Tightly Secure Signatures and Public-Key Encryption[END_REF]. However, the conversion of a NIZK into a simulation-sound NIZK with this method incurs a huge additive overhead (because of the signature) and a linear blow-up of the size of the NIZK. As the conversion of NIZK into simulation-sound NIZK involves precise computations and optimizations, we have not attempted to evaluate it in this section; as a consequence, all the estimations are (loose) lower bounds on the real complexity of a Groth-Sahai-based UC-secure inner product protocol.

Communication Complexity.

To prove that all the committed values are bits, which is a quadratic equation, the x i 's have to be committed over G 1 and G 2 , and the randomness of the ElGamal ciphertexts (r i ) i≤ has to be committed over G 2 . These commitments and the ciphertexts represent in total 4 group elements over G 1 and 4 group elements over G 2 . However, all the equations (checking that the ElGamal ciphertexts are well-formed, checking that values committed over G 1 and G 2 are indeed the same, checking that all the x i are bits) can be batched. For the second flow, the server has to send commitments of the y i 's over G 1 and G 2 , together with encryptions of the y i 's (required for the simulatability, but randomness reuse can be applied here to reduce linearly the number of group elements) and commitments over G 2 of the randomness of the encryptions of the y i 's. Moreover, proving that the y i are bits involves quadratic equations, which represents 2 elements over G 1 and 2 elements over G 2 . As we explained, we cannot batch those equations without adding two rounds to the protocol. The proof that the ciphertexts do indeed encrypt the committed values costs group elements over G 1 and proving that values committed over G 1 and G 2 are indeed the same costs at least elements over G 1 . Thus, the second flow contains at least 7 group elements over G 1 and 6 group elements over G 2 .

Total. the communication complexity of the whole execution of a UC-secure inner product protocol using the Groth-Sahai methodology is lower bounded by 11 group elements over G 1 and 10 group elements over G 2 . G 2 being approximately twice as big as G 1 with usual settings, this represents roughly 31 elements over G 1 , which is 50% more than the iZK-based protocol.

Pairings and Exponentiations.

Counting the number of exponentiations of Groth-Sahai proofs is quite involved, as this number is quadratic O( 2 ) in the general case, but linear in nearly every specific application, if the correct optimizations are used. Instead of counting the exponentiations, we focus on a loose lower bound by counting only the exponentiations required to compute ciphertexts and commitments, without even considering the computations required for the construction and the verification of the proofs. this leads to a lower bound of 28 exponentiations over G 2 ans 6 exponentiations over G 1 . Moreover, several paper have lowered the number of pairing needed to verify the proofs; even if we consider that the verification of all the proofs can be batched into a single verification of a pairing-product equation, using the optimizations of [START_REF] Blazy | Batch Groth-Sahai[END_REF], at least 4 pairings are required for the first flow. For the second flow, which cannot be batched, verification (using [START_REF] Blazy | Batch Groth-Sahai[END_REF]) of one pairing-product equation, two multi-scalar multiplication equations and one quadratic equation is lower bounded by (4 + 2 + 2 + 2) = 10 pairings. The overall number of pairings is thus lower-bounded by 14 . As we can choose more efficient curves, with fast exponentiations, by avoiding the need of pairings, even these very loose values represent considerably more computations that the exponentiations required by the iZK-based protocol.

Inner Product Protocol with Schnorr Σ-Protocols

Let us now provide an estimation of the cost of an UC-secure protocol for the inner product relying on Σ-Protocols (i.e., protocols with a three-move structure, namely (commitments, challenge, response)). There are two ways of designing such a protocol:

1. One can rely on the OR trick to prove, for each ciphertext (u, e), that either (u, e) or (u, ge -1 ) is an encryption of 0 (a DDH tuple).

2. Alternatively, one can commit to (x 2 i ) i≤ , prove that the commitments contains the square of the encrypted values (using a Chaum-Pedersen proof of same discrete logarithm with different bases), and then batch all the proofs by proving a statement of the form

i=1 λ i (x i -x 2 i ) = 0,
for a random tuple of values (λ i ) i≤ chosen by the verifier after the prover has committed.

We will focus on the second technique for our estimation; both techniques seem roughly equivalent in terms of communication and computation. The commitment scheme used in this protocol is the Pedersen commitment scheme, which can be seen as the second part of an ElGamal ciphertext: c(m; r) = h r g m . The reader might refer to [START_REF] Ueli | Unifying Zero-Knowledge Proofs of Knowledge[END_REF] to get an intuition of the cost of the different proofs we are going to construct, as all our proofs can be seen as proving the knowledge of a preimage of a group homomorphism, which fits into the framework of [START_REF] Ueli | Unifying Zero-Knowledge Proofs of Knowledge[END_REF]. Moreover, all those proofs can be turned into simulation-sound ZK proofs at a small, constant additive cost, using the generic transformation of [START_REF] Garay | Strengthening Zero-Knowledge Protocols Using Signatures[END_REF]. The protocol goes as follow: (we omit the constants when we provide the number of elements exchanged) Protocol.

1. The client sends ElGamal ciphertexts (u i , e i ) i≤ and commitments (w i ) i≤ of the squares of the encrypted values. He also generates 3 randomness for the proof, hash them using a collision-resistant hash function, and commits to this value.

2. The server replies with a challenge c, ElGamal ciphertexts of his own values (required for the simulatability) plus the randomness (R, R ) (with his key), commitments of the squares of his values and an encryption (with the client key) of (R • IP + R ).

3. The client sends a proof, which contains 3 scalars and 3 openings of the randomness whose hash value he committed to in the first flow. he also sends a challenge c .

4. The server checks that the openings are correct, and if they are, that the proofs hold, i.e.that the values where indeed bits and that (λ i ) i≤ , the values λ i being computed from the challenge c with a pseudo-random generator. Then, he sends himself a similar proof, ensuring his values are bits (3 + 3 elements), plus a proof that the randomized scalar product was correctly computed (2 elements).

5. If the openings and the proofs are correct, the client sends the decrypted randomized inner product to the server.

For details on how Σ-protocols can be built for statements such as "I know openings of commitments such that one of them opens to the product of the two other committed values", the reader might refer to [START_REF] Ueli | Unifying Zero-Knowledge Proofs of Knowledge[END_REF]. We enhance the security of the original Σ-protocols by adding commitments to the randomness and revealing the openings after receiving the challenge; such enhanced protocols can be proven secure against malicious verifiers, and so are truly zero-knowledge.

Efficiency. The communication complexity can be easily counted from our description of the protocol: (2 + 1 + 2 + 1 + 3 + 3 + 3 + 3 + 2) = 20 . The computational complexity, counted as a number of exponentiations and omitting constant values and other operations, is 38 :

• 2 + for the ciphertexts and Pedersen commitments of the first flow.

• 3 + 3 for the random ciphertexts and Pedersen commitments hashed and committed in the first flow.

• 2 + for the ciphertexts and Pedersen commitments of the second flow.

• 3 + 3 for the random ciphertexts and Pedersen commitments hashed and committed in the second flow.

• 3 + 2 to check the opening of the random ciphertexts and Pedersen commitments hashed and committed in the first flow.

• 3 + 2 to check the proofs (3 for the commitments of squares of encrypted values, 2 for the batched proof of bit values)

• 3 + 2 to check the opening of the random ciphertexts and Pedersen commitments hashed and committed in the second flow.

• 3 + 2 to check the proofs (3 for the commitments of squares of encrypted values, 2 for the batched proof of bit values).

• 2 to check the proof that the inner product was correctly computed.

Proof of Security

In this section, we prove that (the malicious version of) our scheme in Section 4.4 is secure in the UC model [START_REF] Canetti | Security and Composition of Multiparty Cryptographic Protocols[END_REF], with authenticated channels and static corruptions.

Details on the Scheme. Here are some implicit details related to UC for the scheme in Section 4.4: all flows contains an identifier (1 for the first flow, 2 for the second flow and 3 for the third flow). Every flow not formatted correctly is ignored. Every commitment is supposed to be labeled with an identifier of the commitment (1 for the one of the first flow and 2 for the one of the second flow), the identifier of C and S, the session and sub-session identifiers sid and ssid. We use the labeled version of the Cramer-Shoup encryption scheme [START_REF] Canetti | Universally Composable Password-Based Key Exchange[END_REF] for that purpose. We recall that this scheme is IND-CCA secure.

Ideal Functionality. The ideal functionality is depicted in Figure 4.8. Basically, the client C sends its input (x i ) i=1 ∈ {0, 1} , then the server sends its input (y 1 ) i=1 , and finally, when the adversary or simulator Sim specifies it, the server gets back the inner product IP of (x i ) and (y i ). Corruptions of the client or the server are supposed to be static, i.e., before the first message Client-Send is sent (for a given session (sid, ssid, C, S)). The authentication and the flow identifiers above ensure that if one of the player is honest at the beginning, he remains honest during all the session and the adversary in the real world cannot modify his flow (though he may drop them as usual and attempt a denial-of-service attack).

Proof. We exhibit a sequence of games. The sequence starts from the real game, where the adversary A interacts with real players and ends with the ideal game, where we have built a simulator Sim that makes the interface between the ideal functionality F and the adversary A .

Game G 0 : This is the real game, where the simulator knows the inputs of all the honest players and honestly play their role (on their behalf).

Game G 1 : We first deal with the case when C and S are both honest. In that case, the simulator Sim replaces all commitments and ciphertexts of C and S by commitments and ciphertexts of random values. In addition, except if the adversary A drops some flows, the simulator Sim never abort on behalf of S and outputs the correct inner product IP = i=1 x i • y i he can compute since he still knows the inputs (x i ) of C and (y i ) of S. Sim also sends to the message Result-Send when required. This game is

The functionality F IP is parametrized by a security parameter k. It interacts with an adversary Sim and a set of parties via the following queries:

Upon receiving a query (Client-Send, sid, ssid, C, S, (x i ) i=1 ) from party C (client): Ignore the message if (x i ) i=1 / ∈ {0, 1} . Record the tuple (sid, ssid, C, S, (x i )) and send (Client-Sent, sid, ssid, C, S) to Sim. Ignore further Client-Send-message with the same (ssid, C, S) from C.

Upon receiving a query (Server-Send, sid, ssid, C, S, (y i ) i=1 ) from party S (client): Ignore the message if (y i ) i=1 / ∈ {0, 1} . Ignore the message if (sid, ssid, C, S, (x i )) is not recorded (for some (x i )) and replace this record by (sid, ssid, C, S, (x i ), (y i )); otherwise mark the record as used and send (Server-Sent, sid, ssid, C, S) to Sim. Ignore further Server-Send-message with the same (ssid, C, S) from S. sid,ssid,C,S) from the adversary Sim: ignore the message if (sid, ssid, C, S, (x i ), (y i )) is not recorded (for some (x i ) and (y i )); otherwise remove the record and send (Result-Sent, sid, ssid, C, S, IP) to S (and to Sim if S is corrupted), with IP = i=1 x i • y i . Ignore further Result-Send-message with the same (ssid, C, S) from Sim. We remark that now, we do not need to know the exact inputs of honest players.

Upon receiving a query (Result

Game G 2 : We now deal with sessions between a malicious client C and a honest server S. Sim first extracts the commitment of the bits of the secret keys sk j , and recovers sk. If these commitments do not contains bit or if these bits do not correspond to a valid secret key sk (i.e., such that the sent public key pk = g sk ), then Sim chooses K C uniformly at random. Otherwise, Sim uses this secret key to decrypt the ciphertexts c i for i = 1, . . . , , and get bits x i . If the corresponding plaintexts are not bits, then Sim chooses K C uniformly at random. This game is statistically indistinguishable from the previous one, thanks to the soundness of the iZK.

Game G 3 : We now replace the CRS of the two iZK (which were generated by iSetup) by a CRS generated by TSetup and we remember the corresponding trapdoors i T . This game is computationally indistinguishable from the previous one, thanks to the setup indistinguishability of the iZK.

Game G 4 :

We now simulate all the iZK using iTKG and iTDec made by the simulator. This game is statistically indistinguishable from the previous one, thanks to the zeroknowledge property of the iZK.

Game G 5 : We now deal again with sessions between a malicious client C and a honest server S in this game and the following ones. We replace the commitment of g y i , g R and g R by commitments of random values. This game is computationally indistinguishable from the previous one, thanks to the IND-CCA property of the Cramer-Shoup encryption scheme used for the commitment (and the fact that extractions are always done with different labels), and the fact that the random coins used by these commitments are no more necessary to decrypt the iZK ciphertexts c C (thanks to the previous game).

Game G 6 : Sim directly generates c as an encryption of g RIP+R , by computing IP as i=1 x i • y i (x i being extracted by the encryption c i and y i being given as inputs to S). This is perfectly indistinguishable to the previous game. Game G 7 : Sim now aborts on behalf of S if the last flow if not g RIP+R instead of just aborting when it is not such that g RIP +R with IP ∈ {0, . . . , }. In addition, if S does not abort, instead of computing IP from the last flow (and so potentially getting IP ),

Sim directly outputs IP. We remark that for any IP and any fixed value for u, for any value of the last flow different than g RIP+R , the probability this flow is g RIP +R with IP ∈ {0, . . . , } (so with IP = IP ), when R and R are chosen uniformly at random conditioned by u = RIP + R , is at most /p, which is negligible. Since the adversary A does not know R and R but only RIP + R , this game is statistically indistinguishable from the previous one.

Game G 8 : Sim now generates c as an encryption of g S for a random S and aborts when the last flow is not g S . This game is perfectly indistinguishable from the previous one.

Game G 9 : Sim now sends (Client-Send, sid, ssid, C, S, (x i )) in behalf of C to the ideal functionality with (x i ) the extracted values of the malicious client C. If S does not abort, Sim also sends (Result-Send, sid, ssid, C, S) to the ideal functionality. In addition Sim let the ideal functionality generate the output for S. This game is perfectly indistinguishable from the previous one, since both will output the same value IP.

Game G 10 : We now deal again with sessions between a honest client C and a malicious server S in this game and the following ones. Sim now returns g RIP+R in the last flow (if C did not abort) instead of decrypting c. This game is perfectly indistinguishable from the previous one.

Game G 11 : In this game, we now replace the commitments of sk j by commitments of random values. This game is computationally indistinguishable from the previous one under the IND-CCA property of the commitment scheme. We remark that we do not use anymore sk.

Game G 12 : In this game, Sim now encrypts random values in c i instead of the x i 's. This game is computationally indistinguishable from the previous one under the IND-CPA property of the commitment scheme. We remark that we do not use anymore the x i 's.

Game G 13 : Sim now extracts the commitment of the bits y i , together with g R and g R . If y i are not bits or if the ciphertext c received by S (under pk for which Sim knows the secret key sk) does not contain g RIP+R (with IP = i=1 x i • y i , with the extracted y i 's and the x i given as inputs to C), then Sim chooses K S uniformly at random. This game is statistically indistinguishable from the previous one, thanks to the simulation-soundness of the second iZK.

Game G 14 : Sim now sends (Server-Send, sid, ssid, C, S, (y i )) in behalf of S to the ideal functionality with (y i ) the extracted values of the malicious server S. If C does not abort, Sim also sends (Result-Send, sid, ssid, C, S) to the ideal functionality, and get the value of IP. This game is perfectly indistinguishable from the previous one, since the computed value of IP (as i=1 x i • y i with (x i ) the input of C and (y i ) extracted from S) is always equal to the value IP returned by the functionality.

Game G 15 : In last game, Sim does not use anymore the inputs given to the honest parties. So this game is exactly the game in the ideal world.

Introduction

In this chapter, we turn our attention to the security of interactive zero-knowledge argument systems. Specifically, we consider zero-knowledge arguments over the integers, a useful type of interactive zero-knowledge arguments that allows to directly and efficiently manipulate statements over the integers. For preliminaries on zero-knowledge arguments over the integers, we refer the reader to Section 3.7, but in short, these arguments consist in proving relations between values committed with integer commitment schemes. The first integer commitment scheme was introduced by Okamoto and Fujisaki [START_REF] Fujisaki | Statistical Zero Knowledge Protocols to Prove Modular Polynomial Relations[END_REF], and was later generalized in [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF]. Unlike classical commitment schemes, an integer commitment scheme allows to commit to any m ∈ Z. Intuitively, this is done by committing to m in a group Z τ of unknown order, where division by units cannot be performed in general. Integer zero-knowledge arguments have turned out to be particularly suited to efficiently handle statements that can be expressed as Diophantine relations. A typical case of such statements are range arguments, where the goal is to show that some committed value belongs to some specific interval. Such range arguments have found many applications in various cryptographic primitives.

Assumptions for Proofs on Integer Commitments. Unfortunately, we do not have a wide variety of integer commitment schemes at our disposal. In fact, the Damgård-Fujisaki commitment scheme is essentially the only known integer commitment scheme to be both compact (a commitment to a message m ∈ Z of arbitrary size has a size independent of |m|) and additively homomorphic over Z. Nonetheless, the security properties of this scheme are well understood: the binding property of the Damgård-Fujisaki commitment scheme relies on the hardness of factoring composite integers, and its hiding property holds statistically. However, even though the intractability of factoring is widely considered as a mild computational assumption, when the Damgård-Fujisaki commitment scheme is used as a component for zero-knowledge arguments over the integers, the state of affairs is less satisfying. Indeed, the knowledge-extractability of zero-knowledge arguments using the Damgård-Fujisaki commitment scheme relies on the Strong-RSA assumption [BP97; FO97], which is a much stronger assumption. We refer the reader to Section 2.2.2.3 for definitions and discussions related to the Strong-RSA assumption, but in short, this assumption states that, given a composite integer n and a random element u ∈ Z * n , it is hard to find a pair (v, e) such that u = v e mod n. Unlike the RSA assumption [START_REF] Rivest | A Method for Obtaining Digital Signature and Public-Key Cryptosystems[END_REF], where the exponent e > 1 is imposed, there are exponentially many solutions to a given instance of the Strong-RSA problem, which makes it less desirable. This implies, in turn, that all cryptographic applications relying on zero-knowledge arguments over the integers of any kind need to assume the Strong-RSA assumption.

Range Proof. As discussed in Section 3.7, the most widespread reason to work over the integers is to prove that a committed value x lies in a public integer range a ; b . Indeed, working over the integers allows to show that xa and bx are positive by demonstrating that they can be decomposed as a sum of four squares, following the well-known Lagrange's result. Lipmaa [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] was the first to propose such a method by relying on a commitment over the integers. As a consequence, the knowledge extractability of his range proof requires the Strong-RSA assumption.

Applications of Range Proofs. Range proofs have found numerous applications in cryptography. They have been used in the context of privacy-preserving data mining and statistical analysis [GLLM05; GMS10], voting [START_REF] Groth | Non-interactive Zero-Knowledge Arguments for Voting[END_REF], anonymous credentials [START_REF] Camenisch | Efficient attributes for anonymous credentials[END_REF], secure generation of RSA keys [JG02; DM10; HMRT12], zero-knowledge watermarking detection [START_REF] Adelsbach | Overcoming the obstacles of zero-knowledge watermark detection[END_REF], sanitizable signatures [START_REF] Tsz Hon Yuen | Sanitizable Signatures Revisited[END_REF], private information retrieval [START_REF] Kiayias | Optimal rate private information retrieval from homomorphic encryption[END_REF], and multiparty computation [START_REF] Couteau | Encryption Switching Protocols[END_REF], among others. As a consequence, the security analysis of efficient instantiations of these applications, relying on Lipmaa's range proof over the integers, must assume the Strong-RSA assumption.

Our Contribution

In this chapter, we revisit the Damgård-Fujisaki integer commitment scheme and show that the security of arguments of knowledge of openings can be based on the standard RSA assumption, instead of the Strong-RSA assumption. In the reduction, we use the rewinding technique in another way than in [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF] as well as the splitting lemma [PS96; PS00]. Our result extends to any protocols involving argument or relation between committed integers which first prove the knowledge of the inputs before proving that the relation is satisfied. This implies that the security of numerous protocols, such as two-party computation [JS07; CPP15a], e-cash [START_REF] Camenisch | Compact E-Cash[END_REF], e-voting [LAN01; Gro05], secure generation of RSA keys [JG02; DM10; HMRT12], zero-knowledge primality tests [START_REF] Camenisch | Proving in Zero-Knowledge that a Number Is the Product of Two Safe Primes[END_REF], password-protected secret sharing [START_REF] Jarecki | Round-Optimal Password-Protected Secret Sharing and T-PAKE in the Password-Only Model[END_REF], and range proofs [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF], among many others, can be proven under the RSA assumption instead of the Strong-RSA assumption for free. In addition, we believe that the ideas on which our proof relies could be used in several other constructions whose security was proven under the Strong-RSA assumption, and might allow to replace the Strong-RSA assumption by the standard RSA assumption in such constructions.

Related Works

The Damgård-Fujisaki commitment scheme [FO97; DF02] is the only known homomorphic statistically-hiding commitment scheme over the integers. Arguments of knowledge over the integers were studied in [Lip03; KTY04; CCT07].

Range proofs were introduced in [START_REF] Brickell | Gradual and Verifiable Release of a Secret[END_REF]. They are a core component in numerous cryptographic protocols, including e-cash [START_REF] Camenisch | Compact E-Cash[END_REF], e-voting [START_REF] Groth | Non-interactive Zero-Knowledge Arguments for Voting[END_REF], private auctions [START_REF] Helger Lipmaa | Secure Vickrey Auctions without Threshold Trust[END_REF], group signatures [START_REF] Camenisch | Separability and Efficiency for Generic Group Signature Schemes[END_REF], and anonymous credentials [START_REF] Camenisch | An Efficient System for Nontransferable Anonymous Credentials with Optional Anonymity Revocation[END_REF], among many others. There are two classical methods for performing a range proof:

• Writing the number in binary notation [START_REF] Brickell | Gradual and Verifiable Release of a Secret[END_REF][START_REF] Groth | Efficient Zero-Knowledge Arguments from Two-Tiered Homomorphic Commitments[END_REF] or u-ary notation [START_REF] Camenisch | Efficient Protocols for Set Membership and Range Proofs[END_REF],

committing to its decomposition and performing a specific proof for each of these commitments For example, membership to 0 ; 2 is proven in communication O( /(loglog log )) in the protocol of [START_REF] Camenisch | Efficient Protocols for Set Membership and Range Proofs[END_REF], and in communication O( 1/3 ) in the protocol of [START_REF] Groth | Efficient Zero-Knowledge Arguments from Two-Tiered Homomorphic Commitments[END_REF] (counting the number of group elements). Both rely on pairing-based assumptions, namely, the computational double pairing assumption (which is implied by the decisional Diffie-Hellman assumption) and the q-Strong Diffie-Hellman assumption [START_REF] Boneh | Short Signatures Without Random Oracles[END_REF].

• Using an integer commitment scheme [Bou00; Lip03; Gro05].

Note that protocols such as [START_REF] Hui Chan | Easy Come -Easy Go Divisible Cash[END_REF] do also allow to prove that a committed integer x lies in a given interval 0 ; a , but not exactly: the proof shows only membership to 0 ; (1 + δ)a for some accuracy parameter δ > 0.

Eventually, several papers have proposed signatures based on the standard RSA assumption [HW09; HJK11; BHJ+13] as alternatives to classical signature schemes based on the Strong-RSA assumption. Our work is in the same vein than these papers, replacing the Strong-RSA assumption by the RSA assumption in arguments over the integers. However, note that we do not actually propose a new argument system to get rid of the Strong-RSA assumption, but rather show that the security of the classical argument system is implied by the RSA assumption. As a consequence, the schemes using arguments over the integers do not need to be modified to benefit from our security analysis.

Organization

Section 5.2 recalls the Damgård-Fujisaki commitment scheme, its properties, and the argument of knowledge of [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF]. A new security proof of the latter, under the standard RSA assumption, is given in details Section 5.3. Section 5.4 illustrates some extensions of our result. First, we show how one can commit to vectors at once with generalized commitments. And then, we show how one can make range proofs under the standard RSA assumption.

For the sake of completeness, in Section 5.4.4 we exhibit a flaw in the optimized version of Lipmaa's range proof [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF]Annex B]. We then propose a fix and prove it.

Commitment of Integers Revisited

In [START_REF] Fujisaki | Statistical Zero Knowledge Protocols to Prove Modular Polynomial Relations[END_REF], Okamoto and Fujisaki proposed a statistically-hiding commitment scheme allowing commitment to arbitrary-size integers. Their commitment was later generalized in [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF]. It relies on the fact that when the factorization is unknown, it is infeasible to know the order of the sub-group QR n of the squares in Z * n , where n is a strong RSA modulus. Hence, the only way for a computationally-bounded committer to open a commitment is to do it over the integers.

In addition, [START_REF] Fujisaki | Statistical Zero Knowledge Protocols to Prove Modular Polynomial Relations[END_REF] gave an argument of knowledge of an opening of a commitment and proved that the knowledge extractability of the argument is implied by the Strong-RSA assumption. A flaw in the original proof was later identified and corrected in [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF]. We will revisit the argument of knowledge of an opening due to Damgård-Fujisaki [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF] and provide a new proof for its knowledge extractability, in order to remove the requirement of the Strong-RSA assumption. Our proof requires the standard RSA assumption only, with an exponent randomly chosen in a polynomially-bounded set.

Commitments over the Integers

Description. Let us recall the commitment of one integer m (for the definition of the algorithm GenMod, refer to Section 2.2.2):

• Setup(1 κ ) runs (n, (p, q)) $ ← GenMod(1 κ ), and picks two random generators g, h of QR n . It returns pp = (n, g, h);

• Commit(pp, m; r), for pp = (n, g, h), a message m ∈ Z, and some random coins r $ ← 0 ; n/4 , computes c = g m h r mod n, and returns (c, d) with d = r;

• Verify(pp, c, d, m) parses pp as pp = (n, g, h) and outputs 1 if c = ±g m h d mod n and 0 otherwise.

One should note that an honest user will always open such that c = g m h d mod n. But the binding property cannot exclude the change of sign. In this description, we provide a trusted setup algorithm. But as we see below, the guarantees for the prover (the hiding property of the commitment) just rely on the existence of α such that g = h α mod n. For the verifier to be convinced, one can just let him generate the parameters (n, g, h), and prove the existence of such an α to the prover.

Security Analysis. The above commitment scheme is obviously correct. The hiding property relies on the existence of α such that g = h α mod n (they are both generators of the same subgroup QR n ), and so, for any m ∈ Z,

c = Commit(pp, m; r) = g m h r = h r+αm = h (r+α(m-m ))+αm = g m h r+α(m-m ) = Commit(pp, m ; r ), with r ← [r + α(m -m ) mod p q ],
that is smaller than n and follows the same distribution as r (statistically), as p q ≈ n/4. The binding property relies on the Integer Factorization assumption: indeed, from two different openings m 0 , d 0 , m 1 , d 1 for a commitment c, with d 1 > d 0 , the validity checks show that g m 0 h d 0 = ±g m 1 h d 1 mod n, and so g m 0 -m 1 = ±h d 1 -d 0 mod n. Since g and h are squares, and -1 is not a square, necessarily g m 0 -m 1 = h d 1 -d 0 mod n. The Fact 2 from Proposition 2.2.7 leads to a non-trivial factor of n.

Zero-Knowledge Argument of Opening

Let us now study the argument of knowledge of a valid opening for such a commitment. The common inputs are the public parameters pp and the commitment c = g x h r mod n, together with the bit-length k x of the message x, that is then assumed to be in -2 kx ; 2 kx , while r ∈ 0 ; n and x are the private inputs, i.e.the witness of the prover. We stress that k x is chosen by the prover, since this reveals some information about the integer x, while r is always in the same set, whatever the committed element x is.

Description of the Protocol. The protocol works as follows:

Initialize: P and V decide to run the protocol on input (pp, κ, c, k x );

Commit: P computes d = g y h s mod n, for randomly chosen y $ ← 0 ; 2 kx+2κ and s $ ← 0 ; 2 |n|+2κ , and sends d to the V; Challenge: V outputs e $ ← 0 ; 2 κ ;

Response: P computes and outputs the integers z = ex + y and t = er + s;

Verify: V accepts the proof and outputs 1 if c e d = g z h t mod n. Otherwise, V rejects the proof and outputs 0.

In the rest of this section, we prove this protocol is indeed a zero-knowledge argument of knowledge of an opening. Which means it is correct, zero-knowledge, and knowledgeextractable.

Correctness. First, the correctness is quite obvious: if c = g x h r mod n, with z = ex + y and t = er + s, we have g z h t = (g x h r ) e • g y h s = c e d mod n.

Zero-Knowledge. For the zero-knowledge property, in the honest-verifier setting, the simulator Sim (that is Sim ZK in this case) can simply do as follows:

D 0 y $ ← 0 ; 2 kx+2κ , s $ ← 0 ; 2 |n|+2κ , e $ ← 0 ; 2 κ , z = xe + y, t = re + y, d = g y h s mod n D 1 z $ ← xe ; 2 kx+2κ + xe , t $ ← re ; 2 |n|+2κ + re , e $ ← 0 ; 2 κ , d = g z-xe h t-re mod n D 2 z $ ← xe ; 2 kx+2κ + xe , t $ ← re ; 2 |n|+2κ + re , e $ ← 0 ; 2 κ , d = g z h t c -e mod n D 3 z $ ← 0 ; 2 kx+2κ , t $ ← 0 ; 2 |n|+2κ , e $ ← 0 ; 2 κ , d = g z h t c -e mod n
∆ z = 2 kx+2κ +xe Z=0 | Pr[z $ ← Z 2 : z = Z] -Pr[z $ ← Z 3 : z = Z]| = xe-1 Z=0 2 -kx-2κ + 2 kx+2κ +xe Z=2 kx+2κ +1 2 -kx-2κ = 2 • xe • 2 -kx-2κ ≤ 2 • 2 kx+κ • 2 -kx-2κ
that is bounded by 2 • 2 -κ . Similarly, ∆ t ≤ 2 • 2 -κ . Hence the statistical zero-knowledge property, since the real distribution D 0 and the simulated distribution D 3 have a negligible distance bounded by 2 -κ+2 .

Knowledge-Extractability. The last property is the most intricate, and this is the one that required the Strong-RSA assumption in the original proof of Damgård and Fujisaki [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF].

In the next section, we will prove the following theorem:

Theorem 5.2.1. Given a prover P' able to convince a verifier V of its knowledge of an opening of c for random system parameters pp = (n, g, h) with probability greater than ε within time t, one either breaks the RSA assumption with expected time upper-bounded by 256t/ε 3 , or extracts a valid opening with expected time upper-bounded by 16t/ε 2 .

Let us first provide an intuition of our proof, starting from the original proof of Damgård and Fujisaki, and explaining our refinements. The starting point of Damgård and Fujisaki is the natural approach to prove the knowledge of extractability of Schnorr-like protocols: the simulator will run the malicious prover twice, and get (with non-negligible probabilities) two accepting transcripts corresponding to the same first flow (commit phase). Writing (z 0 , t 0 ) and (z 1 , t 1 ) those two accepting transcripts, corresponding to two challenges (e 0 , e 1 ) sent by the simulator, as well as the same first flow d, the simulator obtains:

c e 0 d = g z 0 h t 0 mod n c e 1 d = g z 1 h t 1 mod n
Dividing the two equations to cancel the d terms gives c e 0 -e 1 = g z 0 -z 1 h t 0 -t 1 mod n If the protocol had been executed over a group of known order, this would be essentially over, as ((z 0z 1 )(e 0e 1 ) -1 mod ϕ(n), (t 0t 1 )(e 0e 1 ) -1 mod ϕ(n)) would form a valid opening to c. However, the issue here is that we cannot compute (e 0e 1 ) -1 mod ϕ(n) without knowing the factorization of n. In their proof, Damgård and Fujisaki are therefore left with distinguishing two cases.

1. If (e 0e 1 ) divides both (z 0z 1 ) and (t 0t 1 ), we are essentially fine: we can compute an opening to c as in the Schnorr protocol. In practice, things are slightly more complicated, but it can be shown that either a valid opening will be computed, or a non-trivial square root of 1 will be obtained, which would break the factorization assumption.

2. If (e 0e 1 ) does not divide either (z 0z 1 ) or (t 0t 1 ), then a more careful analysis is required.

For the second case above, Damgård and Fujisaki start by observing that when this happens, then with probability at least 1/2, it must hold that (e 0 -e 1 ) does not divide α(z 0 -z 1 )+(t 0 -t 1 ) (recall that g = h α mod n). In essence, this stems from the fact that h α only leaks α mod ϕ(n) to an unbounded adversary; by picking α to be large enough in the setup, the verifier can therefore ensure that a large part of α remains information-theoretically hidden. Building on this observation, Damgård and Fujisaki develop an information-theoretic argument to conclude that (e 0e 1 ) does not divide α(z 0z 1 ) + (t 0t 1 ), with non-negligible probability.

From this point, they invoke a method commonly known as 'Shamir's gcd-in-the-exponent trick' which exploits the Bézout relation to find a non-trivial root of h, for some exponent x equal to gcd(e 0e 1 , α(z 0z 1 ) + (t 0t 1 )). This gives a solution to a Strong-RSA challenge with exponent x, and the knowledge-extractability of the scheme therefore follows, under this assumption.

At first sight, it is not obvious that this result can be improved: the exponent x clearly depends on the answers (z 0 , z 1 , t 0 , t 1 ) of the prover, which has therefore some control over it, hence it is unlikely that the simulator could force him to solve an RSA challenge, whose exponent is sampled before the protocol and not chosen by the prover. Our solution proceeds as follow: we will show that, even though the prover has some freedom upon choosing the exponent x, he must choose x to be small. More precisely, we show that x must be inversely related to the success probability of the adversary. Therefore, if the adversary has non-negligible success probability, then x is of polynomial size.

Then, we essentially guess the small exponent that the adversary will choose: we rely on a variant of the RSA assumption where the exponent is drawn uniformly at random from a set of polynomial size. The simulator ensures that no information leaks about the exponent that was drawn when interacting with the prover; hence, when extracting an exponent x from this prover, it must be that this exponent has non-negligible probability of being the exponent initially drawn, which allows to break the RSA assumption with non-negligible probability.

It remains to explain why the exponent x is inversely related to the success probability of the prover. To show this, we consider a simulator that executes a third rewind, getting a third successful answer from the prover with non-negligible probability. With the two first transcripts, as we saw previously, the simulator had obtained a relation of the form c e = g z h t mod n (with e = e 0e 1 , z = z 0z 1 , and t = t 0t 1 ). Similarly, with the first and the last transcript, the simulator gets a relation of the form c e = g z h t mod n. Raising the first relation to the power of e, the second to e , and dividing the two relations gives g e z-ez = h et -e t Now, we know that if we can find two integers (a, b) such that g a = h b , we can solve the factorization (see Proposition 2.2.7). Therefore, under the factorization assumption, it must be that these two exponents are trivial:

e z -ez = et -e t = 0
Note that these equations depend on values (e, e ), which are differences between challenges picked by the simulator. By the pigeonhole principle, and using the fact that an integer k has about O(1/k) divisors, we can show that if x = gcd(e, αz + t) is too large, then there is a non-negligible probability that the above equation will not hold (upon random choices of the challenge difference e ), which would contradict the factorization assumption. Therefore, it must be that x remains small, which concludes the proof. Below, we give a formal and detailed proof that follows this intuition.

Proof of Theorem 5.2.1

We start with some preliminaries, and then discuss various cases.

Preliminaries

The proof will make use of the splitting lemma [PS96; PS00], that we recall below:

Lemma 5.3.1. Let A ⊂ X × Y such that Pr[(x, y) ∈ A] ≥ ε. For any ε < ε, if one defines B = (x, y) ∈ X × Y | Pr y ∈Y [(x, y ) ∈ A] ≥ ε -ε , then it holds that: (i) Pr[B] ≥ ε (ii) ∀(x, y) ∈ B, Pr y ∈Y [(x, y ) ∈ A] ≥ ε -ε (iii) Pr[B | A] ≥ ε /ε.
In the proof, we will consider an adversary with a random tape R who succeeds with some probability ε in any run of the full argument. Our proof will make use of rewinding: we will rewind the adversary several time to get several transcripts of the protocol for the same random tape R, and various challenges. The purpose of the splitting lemma is therefore to get a bound on the probability of getting valid transcripts when we fix R and run the adversary on various challenges.

Detailed Proof

Let us suppose the extractor Sim (that is Sim KE in this case) is given a 4/ε-RSA challenge (n, e, u), which means that the exponents e is randomly chosen prime to ϕ(n) but also in the set [1, 4/ε]. It sets h ← u 2 mod n and g ← h α mod n for a random exponent α $ ← Z n 2 . It sets pp = (n, g, h). Note that as u is random in Z * n , (g, h) are indeed distributed as in the real protocol. We consider an adversary A that provides a convincing proof of knowledge of an opening of c with probability ε, with the parameters (pp = (n, g, h), κ, c, k x ).

Note that the probability distribution of a protocol execution is D = (R, e 0 ), where R is the adversary's random tape that determines d and e 0 is the random challenge from the honest verifier. Since this is a "good" adversary, we assume that on a random pair (R, e 0 ), its probability to output a valid transcript (d, e 0 , z 0 , t 0 ) is greater than ε. We apply the splitting lemma with ε = ε/2 for the distribution D = {R} × {e}: after one execution, with probability greater than ε, we obtain a successful transcript (d, e 0 , z 0 , t 0 ). In such a case, with probability greater than 1/2, R is a good random tape, which means that another execution with the same R but a random challenge e i will lead to another successful transcript (d, e i , z i , t i ) with probability ε = ε/2. Note that since R is kept unchanged, d is the same. Globally, with probability greater than ε 2 /4, after 2 executions of the protocol, one gets two related successful transcripts: (d, e 0 , z 0 , t 0 ) and (d, e 1 , z 1 , t 1 ).

Without loss of generality, we may assume e 0 ≥ e 1 . Writing e 1 ← e 0e 1 , z 1 ← z 0z 1 , and t 1 ← t 0t 1 , the two valid tuples lead to the relation c e 1 = g z 1 h t 1 mod n. We now consider three cases.

Case 1: e 1 divides both z 1 and t 1 with probability greater than ε 2 /8. Sim simply outputs the pair of integers (x 1 , r 1 ) ← (z 1 /e 1 , t 1 /e 1 ). If e 1 is odd, and thus prime to ϕ(n), we have c = g x 1 h r 1 mod n. However, if e 1 = 2 v ρ for an odd ρ and v ≥ 1, (c -1 g x 1 h r 1 ) 2 v = 1 mod n: from the Fact 1 from Proposition 2.2.7, (c -1 g x 1 h r 1 ) 2 = 1 mod n:

• either c -1 g x 1 h r 1 = ±1 mod n, and so c = ±g x 1 h r 1 mod n (valid opening);

• or we have a non-trivial square root of 1, which leads to the factorization of n (see Proposition 2.2.7). As the RSA assumption is stronger than the factorization, when we solve the factorization, we can compute the solution to the RSA challenge.

Case 2: e 1 divides αz 1 + t 1 (but does not divide both z 1 and t 1 ). Let us argue e 1 cannot divide αz 1 + t 1 with probability greater than 1/2 when e 1 does not divide both z 1 and t 1 (independently of the actions of A). Note that this is exactly the case 2 from [START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF].

The intuition behind the proof is that the only information that A can get about α is from g = h α mod n. However, this leaks only α mod p q , while α was taken at random in Z n 2 : all the information on its most significant bits is statistically hidden. We recall below the proof given by Damgård and Fujisaki, for completeness.

Let Q be a prime factor of e 1 and j be the integer such that Q j divides e 1 but Q j+1 does not divide e 1 , and at least one of z 1 or t 1 is non-zero modulo Q j . Since e 1 does not divide both z 1 and t 1 , so such a pair (Q, j) does necessarily exist. Actually, if Q j divides z 1 , as it divides e 1 , it must also divide αz 1 + t 1 and therefore t 1 , which was excluded (at least one of

z 1 or t 1 is non-zero modulo Q j ). Therefore, z 1 = 0 mod Q j .
We can write α = [α mod p q ] + λp q for some λ. Let us denote µ = [α mod p q ]. The tuple (n, g, h) uniquely determines µ, whereas λ is statistically unknown to the prover. As Q j divides e 1 , it also divides αz 1 + t 1 :

αz 1 + t 1 = λz 1 p q + µz 1 + t 1 = 0 mod Q j .
Note that p q = 0 mod Q, since p and q are κ-bit primes and the challenges are less than 2 κ . And from the view of the adversary, λ is uniformly distributed in Z n , while it must satisfy the above equation for Case 2 to occur. But since this equation has at most gcd(z 1 p q , Q j ) solutions, which is a power of Q (and at most Q j-1 ), and since n is larger than Q j by a factor (far) bigger than 2 κ , the distribution of λ mod Q j is statistically close to uniform in Z Q j , and the probability that λ satisfies the above equation is bounded by 1/Q -2 -κ ≤ 1/2, independently of the actions of A. Hence,when Case 1 does not happen, Case 2 cannot occur either with probability greater than 1/2 when one gets two related successful transcripts. Overall, when Case 1 does not happen, we are necessarily in the following situation: Case 3: e 1 does not divide αz 1 + t 1 with probability greater than ε 2 /16. We will now prove that when Case 3 occurs, Sim can solve an RSA instance, which is the difference with the original proof. Let β 1 = gcd(e 1 , αz 1 + t 1 ). Since e 1 does not divide αz 1 + t 1 , we necessarily have 1 ≤ β 1 < e 1 . Let Γ 1 ← e 1 /β 1 and F 1 ← (αz 1 + t 1 )/β 1 : F 1 /Γ 1 is the irreducible fraction form of (αz 1 + t 1 )/e 1 and e 1 ≥ Γ 1 > 1.

We now consider the following complementary situations:

• Subcase 3.a. Γ 1 ≤ 4/ with probability at least ε 2 /32

• Subcase 3.b. Γ 1 > 4/ with probability at least ε 2 /32 Subcase 3.a. If Γ 1 ≤ 4/ε, since β 1 < e 1 , we must have Γ 1 ∈ 2 ; 4/ε . In order to simplify the notations, after one rewind, we get (e , z , t ) so that c e = g z h t mod n and β = gcd(e , αz +t ) with 1 < Γ 1 = e /β ≤ 4/ε.

We note e = βΓ 1 and αz + t = βk for relatively prime integers Γ 1 and k. Since h = u 2 mod n and c e = h αz +t mod n, we have c e = u 2(αz +t ) mod n, which reduces to c Γ 1 = c e /β = ±u 2(αz +t )/β = ±u 2k mod n, where Γ 1 and k are relatively prime, and Γ 1 > 1.

We now consider two additional complementary situations:

• if Γ 1 = 2 a with a ≥ 1 with probability at least ε 2 /64, we thus have with probability ε 2 /64 an odd k such that c 2 a = u 2k mod n: c 2 a-1 and u k are two square roots of the same value. Since no information leaks about the actual square roots {u, -u} known for h, nor for h k mod n, so c 2 a-1 = ±u k mod n with probability 1/2, which leads to the factorization of n with probability 1/2 (see Proposition 2.2.7). Hence, when Case 3 happens and in the case of this situation, we solve the RSA challenge with probability at least ε 2 /128.

• If Γ 1 = 2 a v with an odd v > 1 with probability at least ε 2 /64, it thus holds with probability ε 2 /64 that C v = u 2k mod n, for C = ±c 2 a and gcd(v, 2k) = 1, since v|Γ 1 and v is odd. Using Proposition 2.2.9, one gets the v-th root of u modulo n, for v ∈ 3 ; 4/ε ∩ P n . Since our simulation that uses the RSA challenge (n, u, e) does not leak any information about e, v = e with probability greater than ε/2, if the exponent e is randomly chosen in 2 ; 4/ε ∩ P n (this set being exactly the set of odd integers smaller than 4/ε, it contains approximately 2/ε elements). Hence, when Case 3 happens and Γ 1 ≤ 4/ε, if we are in this situation, we solve an RSA challenge with probability at least ε 2 /64 × ε/2 = ε 3 /128.

Overall, each time Case 3 happens and we are in the situation 3.a., we get a solution to the RSA challenge with probability at least ε 3 /128. Subcase 3.b. We now assume that when Case 3 occurs, Γ 1 > ε/4 with probability at least ε 2 /32. When Γ 1 > ε/4, the simulator rewinds the protocol once more. Now, consider all the possible challenges e 2 for this rewinding. For random challenges e 2 , the differences |e 0e 2 | are uniformly distributed over 0 ; 2 κ , and the number of challenge-differences that Γ 1 divides is at most (2 κ + 1)/Γ 1 < 4(2 κ + 1)/ε. Therefore, the probability that Γ 1 divides |e 0e 2 | for a random e 2 is at most ε/4. Recall that if the first rewinding succeeds, by the splitting lemma, rewinding the protocol once more produces a successful transcript with probability at least ε/2; therefore, when one rewinds the protocol with challenge e 2 and gets a successful transcript, Γ 1 does not divide |e 0e 2 | with probability at least 1/2. Therefore, when rewinding the protocol with challenge e 2 , one gets a successful transcript such that Γ 1 does not divide |e 0e 2 | with probability at least ε/4. When this happens, the value Γ 2 (defined in the same way than Γ 1 ), which does divide |e 0e 2 | by definition, cannot be equal to Γ 1 . Keeping this in mind, suppose we got the following two relations from two successful rewindings: c e 1 = g z 1 h t 1 mod n and c e 2 = g z 2 h t 2 mod n, and so c e 1 e 2 = g e 2 z 1 h e 2 t 1 = g e 1 z 2 h e 1 t 2 mod n. This leads, for ∆ z = e 2 z 1e 1 z 2 and ∆ t = e 2 t 1e 1 t 2 , to g ∆z = g e 2 z 1 -e 1 z 2 = h e 1 t 2 -e 2 t 1 = h -∆t mod n.

If ∆ z = ∆ t = 0, then it holds that z 2 /e 2 = z 1 /e 1 and t 2 /e 2 = t 1 /e 1 :

F 2 Γ 2 = αz 2 + t 2 e 2 = α • z 2 e 2 + t 2 e 2 = α • z 1 e 1 + t 1 e 1 = αz 1 + t 1 e 1 = F 1 Γ 1 .
Since they are both the irreducible notations of the same fraction, we necessarily have Γ 1 = Γ 2 and F 1 = F 2 . But recall that we have shown that with probability ay least 1/2, this does not happen. Hence, when subcase 3.b happens and Γ

Classical Extensions and Applications

We revisit the natural implications of the commitment scheme of Section 5.2 and its argument of knowledge. More precisely, we generalize the results of previous sections while we commit to vectors of integers. Then, we also show the security of Lipmaa's range proofs [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] under the RSA assumption to illustrate how the result of Section 5.3 extends to more general arguments over the integers.

Generalized Commitment of Integers

The following commitment scheme allows committing to a vector of integers (m 1 , . . . , m ) with a single element of the form c = g m 1 1 • • • g m h r mod n:

• Setup(1 κ , ) runs (n, (p, q)) $ ← GenMod(1 κ ), and picks +1 random generators (g 1 , . . . , g , h) of QR n . It returns pp = (n, g 1 , . . . , g , h);

• Commit(pp, #" m; r), for pp = (n, g 1 , . . . , g , h), a vector #" m = (m 1 , . . . , m ) ∈ Z , and some random coins Again, the above commitment scheme is obviously correct. The hiding property relies on the existence of α i such that g i = h α i mod n for i = 1, . . . , , and so

r $ ← 0 ; n/4 , computes c = g m 1 1 • • • g m h r mod n,
c = Commit(pp, #" m; r) = g m 1 1 • • • g m h r = h r+ α i m i = h (r+ α i (m i -m i ))+ α i m i = g m 1 1 • • • g m h r+ α i (m i -m i ) = Commit(pp, #" m ; r ), for any #" m = (m 1 , . . . , m ) ∈ Z, with r ← [r + α i (m i -m i ) mod p q ], that is smaller than n.
The binding property relies on the Integer Factorization assumption: indeed, from two different openings ( #" m, d) and ( #" m , d ) for a commitment c, with d > d, the validity checks show that g m

1 1 • • • g m h d = g m 1 1 • • • g m h d mod n,
and so, if one has chosen β i such that g i = g β i mod n, for a random square g, then one knows g β i (m i -m i ) = h d -d mod n. The Fact 2 from Proposition 2.2.7 leads to the conclusion.

To avoid a trusted setup, one can note that the guarantees for the prover (the hiding property) just rely on the existence of α i such that g i = h α i mod n for i = 1, . . . , . The well-formedness of the RSA modulus is for the security guarantees against the verifier. It is important for him that the prover cannot break the RSA assumption. So the setup can be run by the verifier, with an additional proof of existence of α i such that g i = h α i mod n for i = 1, . . . , to the prover.

Zero-Knowledge Argument of Opening

An argument of knowledge of an opening of a commitment c = g x 1 1 • • • g x h r mod n in the general case can be easily adapted from the normal case leading to a transcript of the form (d, e, (z 1 , . . . , z , t)) with d = g y 1 1 • • • g y h s , and c e d = g z 1 1 • • • g z h t mod n. As above, the knowledge-extractor rewinds the execution for the same d, but two different challenges e 0 = e 1 . Doing the quotient of the two relations, d cancels out:

c e = g z 1 1 • • • g z h t mod n.
Let us assume that one would have set g i = g a i h b i mod n, we would have c e = g a i z i h b i z i +t mod n. Under the RSA assumption, we are in the above case 1: e divides both a i z 1 and b i z i + t with non-negligible probability. Since the coefficients a i 's and b i 's are random, this means that e divides all the z i 's and t . Hence, one can set µ i = z i /e , for i = 1, . . . , and τ = t /e , and c = g µ 1 1 • • • g µ h τ mod n is a valid opening of c.

Equally Efficient Range Proofs from RSA

We show that Lipmaa's range proof [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] also benefits from our technique as the Strong-RSA assumption can also be avoided in the security analysis.

Range Proof from Integer Commitment Scheme. Let c = g x h r mod n be a commitment of a value x and a ; b be a public interval. As the commitment is homomorphic, one can efficiently compute a commitment c a of xa and a commitment c b of bx from c. To prove that x ∈ a ; b , this is enough to show that c a and c b commit to positive values. Let us focus on the proof that c a = g x-a h r mod n commits to a positive value, since the same method applies for c b . To do so, the prover computes (x 1 , x 2 , x 3 , x 4 ) such that

xa = 4 i=1 x 2 i . By a famous result from Lagrange, such a decomposition exists if and only if xa ≥ 0. Moreover, this decomposition can be efficiently computed by the Rabin-Shallit algorithm [START_REF] Michael | Randomized algorithms in number theory[END_REF], for which Lipmaa [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] also suggested some optimizations. The prover commits to (x 1 , x 2 , x 3 , x 4 ) in (c 1 , c 2 , c 3 , c 4 ), where c i = g x i h r i mod n for each i = 1 to 4. Now, the prover proves his knowledge of openings xa, x 1 , x 2 , x 3 , x 4 (along with random coins r, r 1 , r 2 , r 3 , r 4 ) of c a , c 1 , c 2 , c 3 , c 4 satisfying 4 i=1 x 2 i = xa over the integers. The reason allowing to solely rely on the RSA assumption in the range proof comes from the fact that the first part of the argument reduces to an argument of knowledge of openings x 1 , x 2 , x 3 , x 4 of c 1 , c 2 , c 3 , c 4 while the remaining part simply ensures the relation 4 i=1 x 2 i = xa to hold. Indeed, once the witnesses are extracted, this is implied by the representation c a = 4 i=1 c x i i h r-x i r i mod n which can be seen as generalized commitment scheme with basis (c 1 , c 2 , c 3 , c 4 , h) from which the opening cannot change. Therefore, the argument can be seen as five parallel arguments of knowledge, the fifth one being an argument of knowledge for a generalized commitment, where the opening for the last argument is the vector of the openings for the other arguments. A formal proof of an optimized version of this protocol under the intractability of the RSA assumption is presented in the next chapter, in Section 5.4.4.

Extension. Since most of the arguments of knowledge of a solution to a system of equations over the integers [START_REF] Canard | Complex Zero-Knowledge Proofs of Knowledge Are Easy to Use[END_REF] can be split into parallel arguments of knowledge of values assigned to the variables and a proof of membership (in the language composed of all the solutions of the system), which is expressed as representations corresponding to generalized commitments, our analysis extends to all "discrete-logarithm relation set" (see [START_REF] Kiayias | Traceable Signatures[END_REF]): the description of the protocol is unchanged but the security only relies on the standard RSA assumption.

A Correction on Lipmaa's Argument for Positivity

For the sake of completeness, in this section, we outline a flaw in the protocol of [Lip03, Annex B]. We then construct a corrected protocol and prove its security. We notified the author of our finding, who acknowledged the issue.

Initial Protocol

Lipmaa [Lip03, Annex B] proposed an efficient zero-knowledge argument of positivity. Since the exact protocol was not fully detailled, we found that the protocol could be understood in two different way. If one closely follow the description of the protocol, then the resulting scheme does not satisfy correctness; the proof of correctness seems to assume a different scheme.

We describe on Figure 5.2 our understanding from reading its proof of correctness. Unfortunately, it is not sound, and the flaw comes from the fact that the original protocol is described as using a generalized Damgård-Fujisaki commitment scheme. However, the same basis is used to commit to masks m 1 , m 2 , m 3 , m 4 , which implies that the prover will only be (computationally) bound to i x i in the argument.

P knows (x, r) such that c = g x h r mod n and x ≥ 0. V knows c.

1. P computes (x i ) i≤4 such that x = 4 i=1 x 2 i . P commits the x i 's with fresh random coins r i $ ← 0 ; n as c i = g x i h r i mod n. P sends c 1 , c 2 , c 3 , c 4 to V.

P picks (m

i ) 4 i=1 $ ← 0 ; 2 B/2+2κ 4 , s 1 $ ← 0 ; 2 2κ+|n| , and s 2 $ ← 0 ; 2 B/2+|n|+2κ . Then, P sends d 1 = g m 1 +m 2 +m 3 +m 4 • h s 1 mod n and d 2 = c m 1 1 c m 2 2 c m 3 3 c m 4 4 • h s 2 mod n.
3. V picks a challenge e $ ← 0 ; 2 κ and sends it to P. Actually, it does not seem possible to rely on generalized commitments to get a more efficient protocol. Concretely, let us consider a prover P * holding (x, r) such that c = g x h r and x = -1. P * commits x 1 = 0, x 2 = 1, x 3 = 0 and x 4 = 0, and computes d 1 , d 2 honestly. After receiving a challenge, however, P * sets x1 = 2, x2 = -1, x1 = 0, x1 = 0, and sends zi = ex i + m i for i = 1 to 4 instead of the correct z i , and t2 = e(ri xi r i ) + s 2 instead of the correct t 2 . The values xi were chosen so that i xi = i x i , hence i zi = e( i xi )+ i m i = e( i x i ) + i m i = i z i , and so the check that (c 1 c 2 c 3 c 4 ) e • d 1 = g z1 +z 2 +z 3 +z 4 h t 1 succeeds. The second verification is equivalent to checking that i x i • xi = x, which is the case here (-1 = 0 × 2 + 1 × (-1) + 0 × 0 + 0 × 0): V accepts the argument even though the value x known by P * is strictly negative.

P computes and sends z

i = ex i + y i , for i = 1 to 4, t 1 = e i r i + s 1 and t 2 = e(r -i x i r i ) + s 2 . 5. V accepts the argument if both (c 1 c 2 c 3 c 4 ) e • d 1 = g z 1 +z 2 +z 3 +z 4 h t 1 and c e • d 2 = c z 1 1 c z 2 2 c z 3 3 c z 4 4 • h t 2 .
A natural way to fix this flaw without increasing the communication would be to require the verifier to send a seed λ between step 1 and step 2, from which pseudo-random values λ 1 , λ 2 , λ 3 , λ 4 are stretched, to send d 1 = i λ i m i , t 1 = e i λ i r i + s 1 and to adapt the verification equation accordingly. However, an attack quite similar to the one we've just described succeeds with good probability in this case (it is sufficient that the gcd of λ i and λ j is small, for some i = j, for the attack to succeed). The interesting point is that we cannot batch the arguments of knowledge and the proof of membership at the same time.

Corrected Protocol

In this section, we propose a variant of Lipmaa's protocol [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] proving that a committed

x is a sum of four squares. There are two correct ways to construct an optimized argument of positivity. A first possibility is to rely on a collision-resistant hash function to strongly reduce the length of the flow sent by P in step 2 (note that we only require the hash function to be collision-resistant, hence the protocol is in the standard model). An alternative would be to let P send all individual values (d i ) i and d in step 2 instead of a single hash, and to stretch pseudo-random values from e in step 4 to batch all the t i into a single value. We describe the former solution, on Figure 5.3, as it is slightly more efficient than the latter in terms of communication and enjoys a better security reduction.

P knows (x, r) such that c = g x h r and x ≥ 0. V knows c. Let H : Z 5 n → {0, 1} 2κ be a collision-resistant hash function.

1. P computes (x i ) i≤4 such that x = 4 i=1 x 2 i . P commits the x i 's with fresh random coins r i $ ← 0 ; n as c i = g x i h r i mod n. P sends c 1 , c 2 , c 3 , c 4 to V.

P picks (m

i ) 4 i=1 $ ← 0 ; 2 B/2+2κ 4 , (s i ) 4 i=1 $ ← 0 ; 2 2κ n 4 , s $ ← 0 ; 2 B/2+2κ n , com- putes (d i = g m i h s i mod n) 4 i=1 , d = 4 i=1 c m i i h s , and sends the commitment ∆ = H(d 1 , d 2 , d 3 , d 4 , d) to V.

V picks a challenge e $

← 0 ; 2 κ and sends it to P.

4. P computes and sends z i = ex i + m i and t i = er i + s i for i = 1 to 4, and t = e(rx i r i ) + s. Zero-Knowledge Property. We now argue that the protocol is honest-verifier zeroknowledge: given c and a challenge e, the simulator Sim ZK sends random group elements c 1 , c 2 , c 3 , c 4 , and picks random (z i , t i ) $ ← 0 ; 2 B/2+2κ × 0 ; 2 2κ n for i = 1 to 4, and a random

V accepts the argument if ∆ = H (g z

i h t i c -e i mod n) 4 i=1 , 4 i=1 c z i i h t c -e mod n .
t $ ← 0 ; 2 B/2+2κ n . In step 2, Sim ZK sends ∆ = H (g z i h t i c -e i mod n) 4 i=1 , 4 i=1 c z i i h t c -e mod n .
The commitments (c i ) i are perfectly indistinguishable from valid commitments, and ((z i ) i , (t i ) i , t) are statistically indistinguishable from honestly computed integers, with a similar analysis as in Section 5.2.

Knowledge Extractability.

Let us now prove the knowledge extractability of the protocol under the RSA assumption. A prover P which succeeds in providing a convincing proof with probability ε is rewinded, to provide two valid proofs for the same initial commitments c 1 , c 2 , c 3 , c 4 , ∆. Under the collision-resistance of the hash function:

g z i h t i c -e i = g z i h t i c -e i mod
n, for i = 1 to 4, and c z i i h t c -e = c z i i h t c -e mod n. Hence, we have, for i = 1 to 4, c e -e i = g z i -z i h t i -t i mod n, and c e -e = c z i -z i i h t-t mod n. Using a similar argument as in the proof of Theorem 5.2.1, unless one can break the RSA assumption, ee likely divides all the other differences and so, with ρ i = (z iz i )/(ee) and w i = (t it i )/(ee) for i = 1 to 4, and w = (tt )/(ee), we have c i = g ρ i h w i , and

c = 4 i=1 c ρ i i h w . Altogether, this implies that c = 4 i=1 g ρ 2 i h w i ρ i h w = g ρ 2 i h w+ w i ρ i mod n. The commit- ment c thus contains x = ρ 2
i , that is necessarily positive.

6

More Efficient Zero-Knowledge Arguments over the Integers

Introduction

In this chapter, we continue the study of zero-knowledge arguments over the integers, by providing new constructions of such arguments. Compared with existing techniques, our new constructions save communication and greatly reduce the work of the verifier, in exchange for an increased work for the prover. Therefore, they are well-suited for use in secure computation protocols based on a client-server model, where a computationally weak client asks a powerful server to perform some computation, and must verify efficiently that the server behaved honestly. We note that the constructions presented in this chapter do also benefit from the new analysis developped in Chapter 5. Therefore, their security is based on the RSA assumption.

Our Method in a Nutshell

As a starting point, we revisit a commitment scheme which was formally introduced in [START_REF] Gennaro | Multi-trapdoor Commitments and Their Applications to Proofs of Knowledge Secure Under Concurrent Man-in-the-Middle Attacks[END_REF], where a commitment for a message m ∈ Z π with randomness R ∈ Z * n is computed as c ← g m R π mod n. This commitment scheme is perfectly hiding, and its binding property relies on the RSA assumption with prime exponent π in Z * n . As for the Damgård-Fujisaki commitment scheme, the security of an argument of knowledge of an opening can be based on the classical RSA assumption. In addition, we identify an interesting property that is satisfied by this commitment, which corresponds informally to the possibility to see this commitment scheme either as an integer commitment scheme (i.e., c = g m h r mod n), or, after some secret exponent has been revealed, as a commitment scheme over Z π for some prime π (i.e., c = g m R π mod n). Note that in both situations, the security of the commitment scheme and the argument of knowledge relies on the RSA assumption only. More specifically, it relies on two different variants of the RSA assumption, with respect to the distribution of random small exponents, or with respect to the distribution of random prime exponents.

We show how one can take advantage of this feature to improve the efficiency of zeroknowledge arguments over the integers as the knowledge of the order π is delayed in the protocol. Note, however, that this comes at the cost of making the argument private coin (hence, unlike classical Σ-protocols, it cannot be made non-interactive in the random oracle model anymore). Our method allows to save communication and greatly reduces the work of the verifier, compared with a classical zero-knowledge argument for the same statement. We illustrate our method on range proofs [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF], a zero-knowledge argument of knowledge of an input to a commitment such that the input belongs to some public interval.

Organization

Section 6.2 revisits the commitment scheme of [START_REF] Gennaro | Multi-trapdoor Commitments and Their Applications to Proofs of Knowledge Secure Under Concurrent Man-in-the-Middle Attacks[END_REF] and shows how, by switching from the previous commitment to this one, we can get a new method for performing zero-knowledge arguments over the integers, that is more efficient. Eventually, Section 6.3 illustrates our method on range proofs, with concrete efficiency comparisons.

Commitment with Knowledge-Delayed Order

In this section, we show that the Damgård-Fujisaki commitment scheme can be efficiently combined with another RSA-based commitment scheme which, as far as we know, was proposed by Gennaro [START_REF] Gennaro | Multi-trapdoor Commitments and Their Applications to Proofs of Knowledge Secure Under Concurrent Man-in-the-Middle Attacks[END_REF]: we show how Damgård-Fujisaki commitments (which are homomorphic over the integers) can be converted into Gennaro commitments (which are homomorphic over Z π for some prime π). We rely on this feature to design a method to improve the efficiency of zero-knowledge arguments over the integers on several aspects, by allowing the players to perform some of the computations over Z π rather than over the integers. We then illustrate our technique on the famous example of range proofs.

RSA-based Commitments with Known Order

We recall the homomorphic commitment scheme over Z π of [START_REF] Gennaro | Multi-trapdoor Commitments and Their Applications to Proofs of Knowledge Secure Under Concurrent Man-in-the-Middle Attacks[END_REF]. The order of the commitment is a known prime π > 2 κ . Description of the Generalized Commitment Scheme. Let us describe the commitment of vectors of integers (m 1 , . . . , m ):

• Setup(1 κ ) : runs (n, (p, q)) $ ← GenMod(1 κ ), and picks random generators g 1 , . . . , g of QR n . Then, it picks a random prime π ∈ 2 κ+1 ; 2 κ+2 , and returns pp = (n, g 1 , . . . , g , π);

• Commit(pp, #" m; r) : for pp = (n, g 1 , . . . , g , π), a vector #" m = (m 1 , . . . , m ) ∈ Z π , and some random coins r ,c,d,#" m) : parses pp as pp = (n, g 1 , . . . , g , π) and outputs 1 if c = g m 1 1 • • • g m r π mod n, and 0 otherwise.

$ ← Z n , computes c = g m 1 1 • • • g m r π mod n,
The above commitment scheme is obviously correct. The hiding property relies on the bijectivity of the π-th power modulo n (as π is prime): for any message #"

m = (m 1 , . . . , m ) ∈ Z π , we have c = g m 1 1 • • • g m × g m 1 -m i 1 • • • g m -m i × r π mod n. By noting s the π-th root of g m 1 -m i 1 • • • g m -m i , c = Commit(pp, #" m ; rs).
The binding property uses an extension of Proposition 2.2.9 from Section 2.2.2.2: if one has chosen β i such that

g i = u 2β i , for a challenge RSA u ∈ Z * n , two distinct openings ( #" m, r) = ( #" m , s) satisfy g m 1 1 • • • g m r π = g m 1 1 • • • g m s π
mod n, and so (s/r) π = u 2a mod n, where a = β i (m im i ) = a 1 π + a 0 , with 0 ≤ a 0 < π. Let us note α and β the integers such that απ + β2a 0 = gcd(π, 2a 0 ) = 1, and output u 0 := u α-2a 1 β • (s/r) β mod n, then

u π 0 = u απ-2a 1 βπ • (s/r) βπ = u 1-2(a 0 +a 1 π)β • u 2aβ = u mod n.
This breaks the RSA assumption with exponent π.

Homomorphic-Opening. In addition, this commitment scheme is homomorphic in

Z π : given c = g m 1 1 • • • g m r π mod n and d = g m 1 1 • • • g m s π
mod n with known openings, we can efficiently open the commitment c • d mod n to #" m = ( m1 , . . . , m ), with mi = m i + m i mod π for 1 ≤ i ≤ , and a random coin rs g (m i +m i )÷π i mod n, where a ÷ b is the quotient of the Euclidean division. We emphasize this property to be essential to avoid working with integers in the arguments of knowledge of an opening: the prover can "reduce" its openings since π is known.

Argument of Opening. Given pp = (n, g 1 , . . . , g , π) and c = g x 1 1 • • • g x r π mod n, with witness (x 1 , . . . , x , r), we can describe a standard argument of knowledge of an opening: Initialize: P and V decide to run the protocol on input (pp, κ, c);

Commit: P computes d = g y 1 1 • • • g y s π , for y i $ ← Z π ,
+ y i = k i π + z i , with 0 ≤ z i < π, and t = g k 1 1 • • • g k • r e s mod n. P outputs (z = (z i ) i , t);
Verify: V accepts the proof and outputs 1 if, for each i, 0 ≤ z i < π, and c e d = g z 1 1 • • • g z t π mod n. Otherwise, V rejects the proof and outputs 0.

Completeness and zero-knowledge are straightforward. Then, let us focus on the knowledgeextractability: From two related valid transcripts, for the same d, we get as usual c e-e = g

z 1 -z 1 1 • • • g z -z • (t/t ) π mod n.
Since the prime π > 2 κ ≥ ||ee ||, the simulator can compute α(ee ) + βπ = 1 and we have

c 1-βπ = c α(e-e ) = g α(z 1 -z 1 ) 1 • • • g α(z -z ) • (t/t ) απ mod n. Then, for α(z i -z i ) = l i π + x i with 0 ≤ x i < π, and T = c β • g l 1 1 • • • g l • (t/t
) α mod n, we have a valid opening (x 1 , . . . , x , T ) of c.

Commitment with Knowledge-Delayed Order

Now, we show how we can hide the above commitment scheme with known prime order π into a commitment scheme of Section 5.2 with hidden order. Description of the Commitment Scheme. As explained earlier, the setup could have been run by the verifier, with an additional proof of existence of α, such that g = h α mod n, to guarantee the hiding property. In this protocol, the verifier runs the setup:

• Setup(1 κ ) runs (n, (p, q)) $ ← GenMod(1 κ ), and picks h 0 $ ← QR n and a random prime π ∈ 2 κ+1 ; 2 κ+2 . Then, it picks ρ $ ← 0 ; n 2 π and sets g ← h ρ 0 mod n and h ← h π 0 mod n. Finally, it returns pp = (n, g, h) and keeps sk = (π, h 0 ). Actually, we have h ρ = g π mod n. So, if one sets α = ρ • π -1 mod ϕ(n), one has g = h α mod n, and proves it;

• Commit(pp, m; r) parses pp as above and commits to m ∈ Z by picking r $ ← Z n/4 and computing c = g m h r mod n. It returns (c, r);

• Verify(pp, c, m, r) parses pp = (n, g, h) and outputs 1 if c = ±g m h r mod n and 0 otherwise;

• Reveal(pp, sk) returns sk = (π, h 0 );

• Adapt(pp, sk, c, m, r) first parses sk = (π, h 0 ) and checks whether h = h π 0 mod n. Then, it adapts the opening by computing m = kπ + m for 0 ≤ m < π and t = g k h r 0 mod n. It outputs ( m, t);

• Verify (pp, π, c, m, t) outputs 1 if c = g mt π mod n, and 0 otherwise. This construction easily extends to commitments of vectors. Note that from g mt π = c = g m t π mod n, with m = m mod π, setting h 0 = y 2 from an RSA challenge (n, y) of exponent π > 2 κ , we obtain y 2ρ( m-m ) = (t /t) π mod n, with 2ρ( mm ) = 0 mod π, which leads to the π-th root of y modulo n (using Proposition 2.2.9 from Section 2.2.2.2).

Switching between Commitments.

Our goal is to use the more efficient commitment scheme of Gennaro, that we denote com π , and also the associated proofs of relations in Z π : in the case of a single integer m ∈ Z π , com π (m; r) = g m r π mod n, for r $ ← Z * n . But let V run the setup from Section 6.2.2, which outputs pp = (n, g, h) (while keeping sk = (π, h 0 )), as in Section 5.2: this reveals no information about π (in an information-theoretic way). Now, P can use (n, g, h) for the Damgård-Fujisaki integer commitment scheme that we denote com: for an integer m ∈ Z and r $ ← Z n , c = com(m; r) = g m h r mod n. After some time, V reveals (π, h 0 ), which allows P to open c as a commitment over Z π of r π (m) = m mod π:

com(m; r) = com π (r π (m); g qπ(m) h r 0 ), (6.1)
where q π (m) and r π (m) indeed denote the quotient and remainder of the euclidean division of m by π. This then allows to use efficient proofs on com π , but still with good properties on the integers, since the prover did not know π at the commit time.

Improving Zero-Knowledge Arguments over the Integers

In this section, we introduce our new technique to build zero-knowledge arguments for statements over the integers, while using com π . We restrict our attention to statements that can be expressed as membership to a set S ∈ D. For preliminaries on the class D and on Diophantine equations, we refer the reader to Section 3.7. Our technique allows us to provide more efficient membership arguments, with a lower communication and a smaller verifier computation (applying the technique delegates some of the work of the verifier to the prover). As all the protocols considered in this paper, the protocol we describe is honest-verifier zero-knowledge, but can be improved to full-fledged zero-knowledge using standard methods (see the end of this section).

Membership Argument for D. Let us consider a set S ∈ D with representing polynomial P S with k-vector input and -vector witness. We assume that P and V have agreed on a bound t such that each #" x ∈ S has a witness #" w of size || #" w|| 1 ≤ (|| #" x || 1 ) t (S ∈ D, so there is always such a t. As shown in [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF], t < 2 is sufficient for most cryptographic applications).

Let #" x be a secret vector held by P, and #" w be a witness for #" x ∈ S (i.e., a vector satisfying P S ( #" x , #" w) = 0). It is known that zero-knowledge arguments can be constructed for polynomial relations over committed inputs (see e.g. [START_REF] Bresson | Proofs of Knowledge for Non-monotone Discrete-Log Formulae and Applications[END_REF]). Intuitively, this is done by committing to intermediate values, and proving additive and multiplicative relationships between those values and the inputs. To prove a multiplicative relationship z = xy between values (x, y, z) committed in (c x , c y , c z ), P proves knowledge of inputs (x, y, z) and random coins (r x , r y , r z ) such that c x = g x r π

x mod n, c y = g y r π y mod n, and c z = c y x r π z . Let us now consider the following situation, where commitments are applied component-wise:

1. P picks random coins ( #" r x , # " r w ) and commits to ( #" x , #" w) with ( #" r x , # " r w ) as ( #" c x , # " c w ) ← (com π ( #" x ; #" r x ), com π ( #" w; # " r w ));

2. P performs a zero-knowledge argument with V to prove his knowledge of four vectors ( #" x , #" w, #" r x , # " r w ) such that ( #" c x , # " c w ) = (com π ( #" x ; #" r x ), com π ( #" w; # " r w )) and P S ( #" x , #" w) = 0 mod π.

As com π is a commitment scheme over Z π , this protocol is an argument of knowledge of ( #" x , #" w) such that P S ( #" x , #" w) = 0 mod π. But this by no means proves the knowledge of integers belonging to the Diophantine set S. However, our main observation is that com π can also be seen as an integer commitment scheme (the commitment scheme we denoted com).

Argument of knowledge of the inputs and witnesses.

1. V runs the setup from the Section 6.2.2, which generates pp = (n, g, h) and sk = (π, h 0 ): this defines com : (x; r) → g x h r mod n. It additionally proves the existence of α such that g = h α mod n;

2. P picks random coins ( #" r x , # " r w ) and commits to ( #" x , #" w) with ( #" r x , # " r w ) as ( #" c x , # " c w ) ← (com( #" x ; #" r x ), com( #" w; # " r w ));

3. P performs a ZKAoK{( #" x , #" w, #" r x , # " r w ) | #"

c x = g #" x h #" rx ∧ # " c w = g #" w h # "
rw }, we thereafter refer to ZK 1 , with V. If the argument fails, V aborts the protocol.

Argument of knowledge of ( #"

x , #" w ) such that P S ( #"

x , #" w ) = 0 mod π.

1. V reveals (π, h 0 ) to P who checks whether h = h π 0 mod n or not, to switch to com π . Let ( #" x , #" w ) = (r π ( #" x ), r π ( #" w)) = ( #" x , #" w) mod π.

2. P performs a ZKAoK{( #" x , #" w , # " R x , # " R w )}, we thereafter refer to ZK 2 , such that ( #" c x , # " c w ) = (com π ( #" x ;

# " R x ), com π ( #" w; # " R w )) and P S ( #" x , #" w) = 0 mod π. Note that ( #" c x , # " c w ) are now seen as commitments over Z π , using the fact that com( #" x ; #" r x ) = com π (r π ( #" x ); # " R x ) and com( #" w; # " r w ) = com π (r π ( #" w); # " R w ), with appropriate ( # " R x , # " R w ). If the argument succeeds, V returns accept. Theorem 6.2.1. Under the RSA assumption, the above protocol is a statistical zero-knowledge argument of knowledge of openings of ( #" c x , # " c w ) to vectors of integers ( #" x , #" w) such that P S ( #" x , #" w) = 0: which proves that #" x ∈ S.

Proof. The intuition behind Theorem 6.2.1 is that ZK 1 proves that P knows ( #" x , #" w) in ( #" c x , # " c w ), and ZK 2 proves that P S ( #" x , #" w) = 0 mod π for a κ-bit prime π which was revealed after ( #" x , #" w) were committed. Hence, P knew vectors of integer ( #" x , #" w) such that P S ( #" x , #" w) = 0 mod π for a random κ-bit prime π. This has a negligible probability to happen unless P S ( #" x , #" w) = 0 holds over the integers, since P S is a polynomial. The full proof consists of the three properties: correctness, zero-knowledge, and knowledge-extractability.

Correctness. It easily follows from the correctness of ZK 1 and ZK 2 : if P knows ( #" x , #" w, #" r x , # " r w ) such that ( #" c x , # " c w ) = (com( #" x ; #" r x ), com( #" w; # " r w )) and P S ( #" x , #" w) = 0, then the argument of knowledge of ( #" x , #" r x ) such that #" c x = com( #" x ; #" r x ) will succeed, and it holds that ( #" c x , # " c w ) = (com π ( #" x mod π; v qπ( #" x ) h #" rx ), com π ( #" w mod π; v qπ( #" x ) h #" rx )). Moreover, as P S is a polynomial, the modular reduction applies, and leads to P S ( #" x mod π, #" w mod π) = P S ( #" x , #" w) = 0 mod π. Zero-Knowledge. It also follows from the zero-knowledge of ZK 1 and ZK 2 , and the hiding property of the commitments. Let Sim ZK be the following simulator: one first generates dummy commitments ( #" c x , # " c w ), which does not make any difference under the hiding property, and runs the simulator of ZK 1 . Once (π, h 0 ) is revealed, Sim ZK runs the simulator of ZK 2 .

Since the commitment is statistically hiding, ZK 1 is our statistically zero-knowledge argument of knowledge of opening from Section 5.2 and ZK 2 is an argument of relations on commitments with known order π (since h = h π 0 mod n) that is possible in statistical zero-knowledge, the full protocol is statistically zero-knowledge. Knowledge Extractability. Consider a P' which succeeds in providing a convincing argument with probability ε, which means that the two protocols ZK 1 and ZK 2 succeed with probability greater than ε.

We first use the extractor of ZK 1 to extract the inputs-witnesses and random coins ( #" x , #" w, #" r x , # " r w ) such that #"

c x = g #" x h #"
rx and # " c w = g #"

w h # "
rw . This extraction is successful under the RSA assumption.

Then, (π, h 0 ) is revealed and we use the extractor of ZK 2 to extract the inputs-witnesses and random coins ( #" x , #" w , # " R x , # " R w ) such that both relations ( #" c x , # " c w ) = (com π ( #" x ; # " R x ), com π ( #" w ; # " R w )) and P S ( #" x , #" w ) = 0 mod π are satisfied. Again, this extraction is successful under the RSA assumption. Now, let us consider two situations:

• If #" x = #" x mod π and #" w = #" w mod π, then the value committed over the integers, before π was revealed, satisfy P S ( #" x , #" w) = 0 mod π, for a random π ∈ 2 κ+1 ; 2 κ+2 . We stress that the view of (n, g, h) does not reveal any information on the prime π.

Since there are approximately 2 κ+1 /κ primes in this set, and this extraction works with probability greater than ε 2 , P S ( #" x , #" w) = 0 mod Q, for Q ≥ 2 2 κ /ε 2 , which is much larger than the values that can be taken in the integers, since the inputs and the witnesses have a size polynomial in κ, and the polynomial P S has a bounded degree.

• If #" x = #" x mod π or #" w = #" w mod π, wlog, we can assume that #" x = #" x mod π: one knows -( #" x , #" r x ) such that (1) #" c x = ±g #" x h #" rx = g rπ( #" x ) (±g qπ( #" x ) h #" rx 0 ) π mod n; and ( #" x , # " R x ) such that (2) #" c x = g #" x # " R x π mod n. Hence, g rπ( #" x ) (±g qπ( #" x ) h #" rx 0 ) π = g #" x # " R x π mod n, and so g rπ( #" x )-#" x = S π mod n, for S = # " R x /(±g qπ( #" x ) h #" rx 0 ) mod n. If one would have set h 0 = y 2 from an RSA challenge (n, y, π) revealing the order of the commitment between ZK 1 and ZK 2 allows to use any tricks that were only available for discrete-log based proofs of statement over (pairing-free) known-order groups. For instance, we can get a sub-linear size argument to show that a committed matrix is the Hadamard products over the integers of two other committed matrices. Indeed, we can commit the rows of the matrices using a generalized commitment and make a batch proof for ZK 1 , which remain sub-linear in the number of entries, and then we can import the results of [START_REF] Groth | Linear Algebra with Sub-linear Zero-Knowledge Arguments[END_REF][START_REF] Bayer | Efficient Zero-Knowledge Argument for Correctness of a Shuffle[END_REF] to ZK 2 , preserving its sub-linearity.

Full-Fledged Zero-Knowledge. With an honest verifier, there is no need to prove the existence of α such that g = h α . In the malicious setting, this proof guarantees the hiding property of the commitments to the prover, who additionally checks h = h π 0 mod n when they are revealed. Then we can use classical techniques to convert the HVZK protocol into a ZK protocol, such as an equivocable commitment of the challenge by the verifier, before the commitments from the prover.

Application to Range Proofs

Lipmaa's Compact Argument for Positivity

As explained before, Lipmaa [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] proposed an efficient argument for positivity, using generalized Damgård-Fujisaki commitments, and the proof that an integer is positive if and only if it can be written as the sum of four squares. However, it appears that the explicit construction given in [Lip03, annex B] is flawed -although the high-level description is correct: any prover can provide a convincing argument for positivity, regardless of the sign of the committed integer, and so without holding valid witnesses. This might raise some concerns as the protocol of Lipmaa is the 'textbook' range proof based on hidden order groups (the protocol is suggested in several papers, and was implemented in e.g. [START_REF] André | Non-interactive Watermark Detection for a Correlation-Based Watermarking Scheme[END_REF]). For this reason, in Section 5.4.4, we recall the argument of [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF], identify its flaw, and provide a correct optimized version together with a full proof of security (the author of [START_REF] Lipmaa | On Diophantine Complexity and Statistical Zero-Knowledge Arguments[END_REF] has been notified of this flaw).

In the following, we describe a range proof in the same vein as the positivity argument of Lipmaa: an integer x belongs to an interval a ; b if and only if (xa)(bx) ≥ 0. In addition, we take into account the following improvement suggested by Groth [START_REF] Groth | Non-interactive Zero-Knowledge Arguments for Voting[END_REF]: x is positive if and only if 4x + 1 can be written as the sum of three squares, and such a decomposition can be computed in polynomial time by the prover. We view this range proof as an optimized version of the textbook range proof with integer commitments, to which we will compare our new method with knowledge-delayed order commitments.

Three-Square Range Proof

To prove that x ∈ a ; b , for x committed with an integer commitment scheme, we prove that 4(xa)(bx) + 1 can be written as the sum of three squares. Let (n, g, h) be the public parameters of the Damgård-Fujisaki commitment scheme, generated by the verifier. The three-square range proof (3SRP) is described in full details on Figure 6.1. Basically, both P and V know that c a contains 4(xa) and c 0 contains (bx). The latter, with c 1 , c 2 , c 3 containing respectively x 1 , x 2 , x 3 , is proven in a classical way, and the last part of the proof shows that c x 0 a g, which implicitly contains 4(xa)(bx) + 1 also contains x 2 1 + x 2 2 + x 2 3 .

For pp = (n, g, h) generated by V, P has sent c, for which he knows (x, r) such that c = g x h r mod n and x ∈ a ; b . Let H : Z 5 n → {0, 1} 2κ be a collision-resistant hash function. V compute c a = (cg -a ) 4 mod n and c 0 = c -1 g b mod n; P computes c a .

1. P computes (x i ) 1≤i≤3 such that 4(bx)(xa) + 1 = 3 i=1 x 2 i . P commits to (x i ) 1≤i≤3 with random coins (r i ) 1≤i≤3 $ ← 0 ; n 3 as (c i = g x i h r i mod n) 1≤i≤3 . Let x 0 ← (bx) and r 0 ← r. 3. V picks a challenge e $ ← 0 ; 2 κ and sends it to V.

4. P computes and sends z i = ex i + m i and t i = er i + s i for i ∈ {0, 1, 2, 3}, and τ = σ + e(x 0 r 0 -3 i=1 x i r i ). 5. V accepts the argument if ∆ = H (g z i h t i c -e i mod n) 0≤i≤3 , h τ g e c z 0 We then illustrate the technique introduced in Section 6.2.3 on this 3SRP protocol. The full converted protocol, denoted 3SRP-KDO, is described on Figure 6.2.

Results

Let B = log(ba). Note that for all i ∈ {0, 1, 2, 3}, x 2 i ≤ (ba) 2 hence log x i ≤ B. An exponentiation by a t-bit value takes 1.5t multiplications using a square-and-multiply algorithm; we do not take into account possible optimizations from multi-exponentiation algorithms. Table 6.1 sums up the communication complexity and the computational complexity of both the 3SRP and the 3SRP-KDO arguments for the execution of N parallel range proofs on the same interval a ; b , as classical batch techniques [START_REF] Bellare | Batch Verification with Applications to Cryptography and Checking[END_REF][START_REF] Bellare | Fast Batch Verification for Modular Exponentiation and Digital Signatures[END_REF] allow to batch arguments of knowledge.

Note that we omit constant terms. The communication is given in bits, while the work is given as a number of multiplications of elements of QR n . When comparing the work of the prover, we also omit the cost of the decomposition in sum of squares, as it is the same in both protocols. Similarly, we omit the cost of the initial proof of g = h α mod n by the verifier to the prover. Efficiency Analysis. We now provide a detailed comparison between the 3SRP and the 3SRP-KDO protocols. We set the order of the modulus n to 2048 bits and the security parameter κ to 128. As the communication of the protocols does also depend on the bound 2 B on the size of the interval, we consider various bounds in our estimation. For the sake of simplicity, we assume B = log b.

Small Intervals and Large Intervals. As pointed out in [START_REF] Camenisch | Efficient Protocols for Set Membership and Range Proofs[END_REF], most practical 'direct For pp = (n, g, h) and sk = (π, h 0 ) generated by V, P has sent c, for which he knows (x, r) such that c = g x h r mod n and x ∈ a ; b . Let H : Z 6 n → {0, 1} 2κ be a collision-resistant hash function. V compute c a = (cg -a ) 4 mod n and c 0 = c -1 g b mod n; P computes c a .

1. P computes (x i ) 1≤i≤3 such that 4(bx)(xa) + 1 = 3 i=1 x 2 i . P commits to (x i ) 1≤i≤3 with random coins (r i ) 1≤i≤3 $ ← 0 ; n 3 as (c i = g x i h r i mod n) 1≤i≤3 . Let x 0 ← (bx) and r 0 ← r.

P picks m $

← 0 ; 2 B+3κ , (m 0 , • • • , m 3 ) $ ← 0 ; 2 κ 4 , s $ ← 0 ; 2 3κ n , (s 0 , • • • , s 3 ) $ ← 0 ; n 4 , σ $ ← 0 ; 2 B+2κ n , and sends ∆ = H(g m h s mod n, (g m i h s i mod n) 0≤i≤3 , h σ c m 0 a 3 i=1 c -m i i mod n).

3. V picks a challenge e $ ← 0 ; 2 κ and sends (e , π, h 0 ) to P.

4. P extends the challenge e into (e, (λ i ) 0≤i≤3 ) ∈ 0 ; 2 κ 5 , computes and sends z = e λ i x i + m and t = e λ i r i + s, as well as z i = r π (ex i + m i ) and T i = h er i +s i 0 g qπ(ex i +m i ) mod n for i ∈ {0, 1, 2, 3}, and T = h σ+e(x 0 r 0 - applications' of range proofs, such as e-voting [START_REF] Groth | Non-interactive Zero-Knowledge Arguments for Voting[END_REF] and e-cash [START_REF] Camenisch | Compact E-Cash[END_REF], involve quite small intervals (say, of size at most 2 30 , and so B ≤ 30). However, when range proofs are used instead as a basis to construct cryptographic schemes, very large intervals are commonly involved. Examples include anonymous credentials [START_REF] Camenisch | An Efficient System for Nontransferable Anonymous Credentials with Optional Anonymity Revocation[END_REF], mutual private set intersection protocols [START_REF] Kim | Mutual Private Set Intersection with Linear Complexity[END_REF], secure generation of RSA keys [JG02; DM10], zero-knowledge primality tests [START_REF] Camenisch | Proving in Zero-Knowledge that a Number Is the Product of Two Safe Primes[END_REF], and some protocols for performing non-arithmetic operations on Paillier ciphertexts [START_REF] Guajardo | Modulo Reduction for Paillier Encryptions and Application to Secure Statistical Analysis[END_REF][START_REF] Couteau | Encryption Switching Protocols[END_REF]. In such protocols, B typically range from 1024 to 4096 (and is even larger is some cases). We note that such intervals are exactly the ones for which range proofs based on groups of hidden order are likely to be used, since for for small intervals, protocols based on some u-ary decomposition of the input [CCs08; Gro11] will in general have better performances (essentially because they avoid the need of the Rabin-Shallit algorithm, which is computationally involved).

Comparisons. Table 6.2 gives a summary of our results. As already noted, the overhead of the work of the prover in 3SRP-KDO is measured by comparing the works without considering the cost of the Rabin-Shallit algorithm; the latter one, however, is by far the dominant cost when B is large (as it runs in expected O(B 2 log B • M (log B)) time, where M (log B) is the time taken to perform a multiplication of (log B)-bit integers). Therefore, for a large B, the overhead of the work of the prover in 3SRP-KDO is very small, whereas there is a huge gain for the verifier. As expected, the 3SRP-KDO protocol provides interesting performances in • The verifier is computationally weak (e.g. in secure Cloud computing), and/or

• Multiples range proofs are likely to be used in parallel, and/or

• The intervals are large.

Conclusion and Open Questions

There are no problems, just pauses between ideas.

-The Brotherhood of the Rose I have not failed. I've just found 10,000 ways that won't work.

-Thomas Edison

Conclusion

The contributions presented in this thesis focus on the design and the analysis of zeroknowledge systems, and target their applications to secure computation. To this aim, we have developed a new type of zero-knowledge proof system, called implicit zero-knowledge arguments, which can be seen as a weak form of (designated-verifier) non-interactive zeroknowledge. Unlike classical non-interactive zero-knowledge, implicit zero-knowledge arguments can be based on a large variety of standard assumption, and in particular, do not require pairings. They also have better computational and communication efficiency, and can therefore advantageously replace them in round-efficient two-party computation.

We have also studied zero-knowledge argument systems over the integers, which have found applications in a variety of secure computation protocols such as electronic voting, e-cash, and anonymous credentials. Our main contribution is a new security analysis of the existing argument systems over the integers which shows that, unlike what had been assumed for the last two decades, their security can be based directly on the well-studied RSA assumption. Our proof involves novel ideas, and essentially all applications of zero-knowledge arguments over the integers benefit from our improved analysis.

In addition, we have constructed new arguments over the integers, which provide communication improvements in some scenarios, and which strongly reduce the work of the verifier in general, making them well-suited for use in client-server settings for secure computation.

Open Questions

Our work on implicit zero-knowledge arguments aims at providing an efficient alternative to NIZKs for round-efficient secure computation, under well-studied assumptions. Still, publiclyverifiable NIZK proof systems have a wider range of applications, and are a core primitive in -127 -cryptography. Therefore, we believe that it is a problem of great interest to find out new efficient constructions of NIZKs, under standard assumptions. This leads us to a first open question: Question 7.1. Is it possible to build efficient publicly-verifiable non-interactive zero-knowledge proof (or argument) systems, without pairing-based assumptions, in the standard model?

We point out that efficient NIZKs are known in the random oracle model (using the Fiat-Shamir heuristic), and inefficient NIZKs are known from (strong variants of) trapdoor permutations. However, apart from the breakthrough work of Groth and Sahai on pairingbased NIZKs, the research on efficient NIZKs in the standard model has proven elusive. In fact, using DDH-like assumptions, or lattice-based assumptions, we do not even know inefficient constructions. This suggests an alternative open question, which is more of theoretical interest, as it calls for a better understanding of the structure of non-interactive zero-knowledge: Question 7.2. Is it possible to build (possibly inefficient) public-verifiable non-interactive zero-knowledge proof (or argument) systems in the standard model, under DDH-like assumption (in pairing-free groups) or lattice-based assumptions?

We note that a candidate answer to the above question based on indistinguishability obfuscation has been given in [START_REF] Bitansky | ZAPs and Non-Interactive Witness Indistinguishability from Indistinguishability Obfuscation[END_REF]. However, indistinguishability obfuscation implies the existence of multilinear maps where the multilinear analogue of DDH holds [START_REF] Albrecht | Multilinear Maps from Obfuscation[END_REF]; it therefore implies in particular the existence of pairing-friendly groups in which the Groth-Sahai methodology can be instantiated.

Implicit zero-knowledge arguments can be seen as a weak type of designated-verifier NIZKs (by interpreting the first flow as a word-dependent common reference string generated by the verifier). Whether full-fledged designated-verifier NIZK proof systems can be constructed without pairing-based assumptions seems to be a more tractable question, which remains a very interesting one in our opinion.

Question 7.3. Is it possible to build efficient designated-verifier non-interactive zeroknowledge proof (or argument) systems in the standard model, under well-studied assumptions, for natural and interesting languages? Some results have already been obtained in this direction [DFN06; CG15], but numerous questions have been left open. In particular, designated-verifier NIZKs with unbounded soundness (where the soundness holds even if the prover received polynomially feedbacks on previous proofs) are only known in the generic group model, and while efficient designatedverifier NIZK arguments are known for interesting languages, we do not yet know of efficient designated-verifier NIZK proofs.

Other iZK-related questions can be envisioned, such as studying the relations of iZK to other cryptographic primitives (in particular, iZK seems to be closely-related to dual-mode encryption [START_REF] Peikert | A Framework for Efficient and Composable Oblivious Transfer[END_REF]), and generalizing the results of Chapter 4 to the multiparty setting.

Turning our attention to zero-knowledge arguments for integer commitment schemes, let us quote a paragraph from the introduction of [CDP12]: 'A multiplication protocol for integer commitments was proposed in [START_REF] Fujisaki | Statistical Zero Knowledge Protocols to Prove Modular Polynomial Relations[END_REF][START_REF] Damgård | A Statistically-Hiding Integer Commitment Scheme Based on Groups with Hidden Order[END_REF]. This protocol has essentially optimal communication complexity Θ(κ + + k), where k is the size in bits of the prover's secret integers, but it requires an extra assumption, namely, the strong RSA assumption. If we only want to assume what the commitment scheme requires (factoring), the best known complexity is Θ((κ + k) ).' This observation was used in [START_REF] Cramer | On the Amortized Complexity of Zero Knowledge Protocols for Multiplicative Relations[END_REF] to motivate the design of efficient zero-knowledge proofs of integer commitment schemes in an amortized setting, where many proofs are performed, under the minimal assumptions required by the scheme. Our work in Chapter 5 improves this state of affair, by showing that the standard RSA assumption does in fact suffice for the zero-knowledge argument mentioned above (where amortization is not necessary to get an efficient proof). However, the interesting question of designing an efficient zero-knowledge argument system for relations between integer commitments under minimal assumptions remain open: Question 7.4. Is it possible to build an efficient zero-knowledge argument system for integer commitment schemes whose knowledge-extractability property can be based on the factorization assumption?

More broadly, and without pointing specific open questions, RSA groups enjoy many nontrivial features that we usually expect to see in pairing-friendly groups -they allow for the construction of NIZKs (albeit inefficient ones), and identity-based encryption schemes [START_REF] Cocks | An Identity Based Encryption Scheme Based on Quadratic Residues[END_REF], both of which are more commonly built in pairing-friendly groups. It is also possible to build some form of (designated-verifier) decision Diffie-Hellman oracle in RSA groups, under the factorization assumption [START_REF] Hofheinz | The Group of Signed Quadratic Residues and Applications[END_REF], which is again a natural feature of (symmetric) pairingfriendly groups. It seems likely that the rich structure of RSA groups remains insufficiently explored, and that many more applications that are known from pairing-friendly groups could be built in RSA groups.

Notation

Mots Clés

cryptographie, sécurité prouvée, hypothèses calculatoire, preuves à divulgation nulle de connaissance, calcul sécurisé.

Abstract

In this thesis, we study zero-knowledge proofs, a cryptographic primitive that allows to prove a statement while yielding nothing beyond its truth, and their applications to secure computation. Specifically, we first introduce a new type of zero-knowledge proofs, called implicit zero-knowledge arguments, that stands between two existing notions, interactive zeroknowledge proofs and non-interactive zero-knowledge proofs. Our new notion provides the same efficiency benefits than the latter when used to design roundefficient secure computation protocols, but it can be built from essentially the same cryptographic assumptions than the former, which allows to get improved efficiency and security guarantees. Second, we revisit a zero-knowledge proof system that is particularly useful for secure computation protocols manipulating integers, and show that the known security analysis can be improved to base the proof system on a more wellstudied assumption. Eventually, we introduce a new method to build zero-knowledge proof systems over the integers, which particularly improves over existing methods in a client-server model, where a weak client executes a secure computation protocol with a powerful server.

Figure 2 . 1 :

 21 Figure 2.1: Template for representing an experiment Exp sec A (1 κ ) with a challenger and an adversary A

Assumption 2.2. 3 .

 3 (Decisional Diffie-Hellman Assumption (DDH)) For any efficient algorithm A , it holds that Adv ddh (A , κ) = negl(κ). The experiments Exp ddh-b A (G, g, 1 κ ), indexed by a bit b, are represented Figure 3.2. The DDH assumption states that any efficient algorithm A has negligible advantage in distinguishing Exp ddh-0 A from Exp ddh-1 A

mod n then return 1 else return 0 Figure 2

 02 Figure 2.8: Experiment Exp srsa A (1 κ ) for the Strong-RSA assumption

Figure 2 . 9 :A( 1 κ 1 A( 1 κ

 29111 Figure 2.9: Experiments Exp hiding-0 A

Definition 2. 3 . 3 . 1 A( 1 κ

 3311 (Correctness of a Commitment Scheme) A commitment scheme Π is correct if for any public parameters pp $ ← Π.Setup(1 κ ), any message m ∈ M, and any random coin r ∈ R, for (c, d) ← Π.Commit(pp, m; r), it holds that Π.Verify(pp, c, d, m) = 1. We define the hiding property of a commitment scheme. The experiments Exp hiding-0 A (1 κ ) and Exp hiding-) for the hiding property of a commitment scheme Π are represented Figure 2.9. Definition 2.3.4. (Hiding Property of a Commitment Scheme) A commitment scheme Π is hiding if for any PPT adversary A , it holds that Adv hiding (A , κ) = negl(κ).

else return 0 Figure 2 ( 1 κ

 021 Figure 2.10: Experiment Exp binding A

  One-Way Functions. It has been established early that one-way functions can be used to construct computationally hiding, statistically binding commitment schemes [HILL99; Nao91]. More recently, one-way functions have also been shown to imply statistically hiding, computationally binding commitment schemes [NOV06; HR07]. Proposition 2.3.7. If one-way functions exist, there are both statistically binding, computationally hiding commitment schemes, and statistically hiding, computationally binding commitment schemes.

•

  Π.Decrypt(sk, c), output a message m ∈ M; which satisfies the correctness and IND-CPA security properties defined below. Definition 2.3.9. (Correctness of an Encryption Scheme) A public-key encryption scheme Π is correct if for any pair (pk, sk) $ ← Π.KeyGen(1 κ ), any message m ∈ M, and any random coin r ∈ R, decryption is the reverse operation of encryption: Π.Decrypt(sk, Π.Encrypt(pk, m; r)) = m. The experiments Exp ind-cpa-0 A (1 κ ) and Exp ind-cpa-1 A (1 κ ) for the IND-CPA security property of a public-key encryption scheme Π are represented Figure 2.11.

Contents 3 . 1

 31 Interactive Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.1.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.1.2 Historical Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.2 Interactive Zero-Knowledge Proofs . . . . . . . . . . . . . . . . . . . . 39 3.2.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 3.2.2 Brief Survey of Known Results . . . . . . . . . . . . . . . . . . . . . . . 42 3.3 Interactive Zero-Knowledge Arguments . . . . . . . . . . . . . . . . . 43 3.3.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 3.3.2 Historical Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 3.4 Proofs and Arguments of Knowledge . . . . . . . . . . . . . . . . . . 44 3.4.1 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 3.5 Σ-Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.5.1 Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.6 The Common Reference String Model . . . . . . . . . . . . . . . . . . 50 3.6.1 Trusted Setup Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . 51 3.6.2 Proving Security of Zero-Knowledge Proof Systems . . . . . . . . . . . . 51 3.6.3 Simulation Soundness . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.7 Zero-Knowledge Arguments over the Integers . . . . . . . . . . . . . 53 3.7.1 Zero-Knowledge Proofs of Non-Algebraic Statements . . . . . . . . . . . 53 3.7.2 Range Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 -35 -

3 .

 3 P sends (Color u , d u ) and (Color v , d v ) to V. The latter accepts if and only if Color u =

Figure 3 . 1 :

 31 Figure 3.1: The Schnorr Σ-protocol for proving knowledge of a discrete logarithm

Protocol: 1 .

 1 P : pick a random challenge e 1-b $ ← Z p . Compute the first message m b of the protocol Π b honestly, and use the zero-knowledge simulator of Π 1-b to build a simulated first message m 1-b , using the challenge e 1-b . Send (m 0 , m 1 ). 2. V : pick e $ ← Z p , send e. 3. P : set e b ← ee 1-b mod p. Compute the last message m b of the protocol Π b with challenge e b from the verifier, and simulate the last message m 1-b of Π 1-b using the zero-knowledge simulator with challenge e 1-b . Send (e 0 , m 0 , m 1 ).

Figure 3 . 3 :

 33 Figure 3.3: Σ-protocol for proving the disjunction of statements S = S 0 ∨ S 1

F

  crs is parametrized by a distribution D and maintains a dictionary Dict of stored values, which is initially empty. When activated on an input (input, sid) for a session identifier sid, F crs retrieves Dict[sid].• If Dict[sid] is empty, F crs picks crs $ ← D, returns crs to the activating party, and stores Dict[sid] ← crs.• If Dict[sid] = crs, returns crs to the activating party.

Figure 3 . 4 :

 34 Figure 3.4: The common reference string ideal functionality [CF01]

Definition 3 . 8 . 4 .

 384 (Non-Adaptive Soundness) A NIZK proof system (Setup, P, V) for a family of languages {L crs } crs with relations R Lcrs satisfies the non-adaptive soundness property if for any crs $ ← Setup(1 λ ), every x / ∈ L crs , and every prover P * , Pr[π ← P * (crs, x) : V(crs, x, π) = 1] = negl(λ)

Figure 4 . 1 :

 41 Figure 4.1: Enforcing semi-honest behavior of Alice (A)

Figure 4 .

 4 Figure 4.2: Experiments Exp iZK-zk-b for zero-knowledge of iZK, and Exp iZK-ss-b for simulationsoundness of SSiZK

Figure 4 . 4 :

 44 Figure 4.4: Construction of iZK

Figure 4 . 5 :

 45 Figure 4.5: Experiments Exp iZK-zk-b for zero-knowledge of iZK

Figure 4 . 3 iZK

 43 Figure 4.7: Semi-Honest and Malicious Protocols for Secure Inner Product Computation

Figure 4 .

 4 Figure 4.8: Ideal Functionality for Inner Product F IP

Figure 5 . 1 : 3 .

 513 Figure 5.1: Distributions for the Zero-Knowledge Property

  and returns (c, d) with d = r; • Verify(pp, c, d, #" m) parses pp as pp = (n, g 1 , . . . , g , h) and outputs 1 if c = g m 1 1 • • • g m h d mod n and 0 otherwise.

Figure 5 .

 5 Figure 5.2: Lipmaa's Compact Argument for Positivity

Figure 5 . 3 : 5 . 4 . 4 . 3

 535443 Figure 5.3: Variant of Lipmaa's Compact Argument for Positivity

  and returns (c, d) with d = r; • Verify(pp

  2. P picks (m0 , • • • , m 3 ) $ ← 0 ; 2 B+2κ 4 , (s 0 , • • • , s 3 ) $ ← 0 ; 2 2κ n 4 , σ $ ← 0 ; 2 B+2κ n , and sends ∆ = H((g m i h s i mod n) 0≤i≤3 , h σ c m 0 a 3 i=1 c -m i i mod n).

Figure 6 . 1 :

 61 Figure 6.1: Three-Square Range Proof (3SRP)

3 g z h t 3 i=0Figure 6 . 2 :

 362 Figure 6.2: Three-Square Range Proof with Knowledge-Delayed Order (3SRP-KDO)

  Thomas Peters, and David Pointcheval. "Encryption Switching Protocols". In: CRYPTO 2016, Part I. Ed. by Matthew Robshaw and Jonathan Katz. Vol. 9814. LNCS. Springer, Heidelberg, Aug. 2016, pp. 308-338.

	[CPP16]	Geoffroy Couteau, doi: 10.1007/978-3-662-53018-4_12 (cit. on p. 9).
	[CPP17]	Geoffroy Couteau, Thomas Peters, and David Pointcheval. "Removing the Strong RSA Assumption from Arguments over the Integers". In: EUROCRYPT 2017, Part II. Ed. by Jean-Sébastien Coron and Jesper Buus Nielsen. Vol. 10211. LNCS. Springer, Heidelberg, May 2017, pp. 321-350 (cit. on p. 6).
	[Cou16a]	Geoffroy Couteau. Efficient Secure Comparison Protocols. Cryptology ePrint Archive, Report 2016/544. http://eprint.iacr.org/2016/544. 2016 (cit. on p. 10).
	[Cou16b]	Geoffroy Couteau. Revisiting Covert Multiparty Computation. Cryptology ePrint Archive, Report 2016/951. http://eprint.iacr.org/2016/951. 2016 (cit. on p. 10).
	[CPP15b]	Geoffroy Couteau, Thomas Peters, and David Pointcheval. "Secure Distributed Computation on Private Inputs". In: International Symposium on Foundations and Practice of Security. Springer. 2015, pp. 14-26 (cit. on p. 9).

[BCG+17] Elette Boyle, Geoffroy Couteau, Niv Gilboa, Yuval Ishai, and Michele Orrù. "Homomorphic Secret Sharing: Optimizations and Applications". In: ACM CCS 17. ACM Press, 2017, pp. 1-2 (cit. on pp. 9, 10). [BCPW15] Fabrice Benhamouda, Geoffroy Couteau, David Pointcheval, and Hoeteck Wee. "Implicit Zero-Knowledge Arguments and Applications to the Malicious Setting". In: CRYPTO 2015, Part II. Ed. by Rosario Gennaro and Matthew J. B. Robshaw. Vol. 9216. LNCS. Springer, Heidelberg, Aug. 2015, pp. 107-129. doi: 10.1007/978-3-662-48000-7_6 (cit. on pp. 6, 73).

Contents 2.1 Notation and Preliminaries

  Discrete-Logarithm-Based Assumptions . . . . . . . . . . . . . . . . . . 18 2.2.2 Factorization-Based Assumptions . . . . . . . . . . . . . . . . . . . . . . 22 2.

. . . . . . . . . . . . . . . . . . . . . . . . 14 2.1.1 Mathematical Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.1.2 Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 2.1.3 Provable Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 2.2 Computational Assumptions . . . . . . . . . . . . . . . . . . . . . . . . 17 2.2.1

3 Cryptographic Primitives . . . . . . . . . . . . . . . . . . . . . . . . . 26 2

  .3.1 One-Way Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.3.2 Commitment Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 2.3.3 Public-Key Encryption Schemes . . . . . . . . . . . . . . . . . . . . . . 29 2.3.4 Smooth Projective Hash Functions . . . . . . . . . . . . . . . . . . . . . 30

-13 -

b) then return 1 else return 0

	Figure 2.6: Experiment Exp fact A (1 κ ) for the factorization assumption
	2. any square a ∈ QR n has four square roots, with exactly one in QR n .

•

  Knowledge Extraction. (P, V) is knowledge-extractable with knowledge error κ, if there exists an efficient algorithm Ext and a polynomial p such that for any input x, for any prover P * , the oracle algorithm Ext nmx,w;r[P

* ] runs in expected polynomial time and satisfies Pr[w ← Ext nmx,w;r[P * ] : R L

  All in all, each time Case 3 occurs, in any of the two complementary situations 3.a. and 3.b., we get a solution to the RSA challenge with probability at least ε 3 /256. But we have already seen that when Case 1 does not occur, Case 3 occurs necessarily; hence, each time Case 1 does not occur, we get a solution to the RSA challenge with probability at least ε 3 /256. Suppose now that Case 1 occurs. There are two complementary situations: either we get a valid opening with probability at least ε 2 /16, or we get a non-trivial square root of 1 with probability at least ε 2 /16. Overall, whichever case occurs, we either get a valid opening with probability at least ε 2 /16, or we solve an RSA challenge with probability at least ε 3 /256.

1 > ε/4, the next rewinding produces a successful transcript such that the pair (∆ z , ∆ t ) is non-trivial with probability at least ε/4, which leads to the factorization of n with probability 1/2, from the Fact 2 from Proposition 2.2.7. Overall, when Case 3 occurs and we are in the situation 3.b., we get a solution to the RSA challenge with probability at least ε 2 /32 × ε/4 × 1/2 = ε 3 /256. Overall Success Probability.

Table 6

 6 This is for various interval sizes (2 B ) and numbers N of parallel executions Percentages indicate 100 × (cost(3SRP-KDO)cost(3SRP))/cost(3SRP), where prover's cost does not consider the 3-square decomposition.

		3SRP			3SRP-KDO
	Communication (in bits) Prover's work (ex-ponentiations)	N (8 log n + 18κ + 5B) + 3κ 1.5N (8 log n + 12B + 26κ + log a)	N (8 log n + 4κ) + 10κ + 2 log n + B + log N 1.5(N (13 log n + 13B + 18κ + log a) + log n + B + 6κ + log N )
	Verifier's work (ex-ponentiations)	1.5(N (5 log n + 9B + 30κ + log a + log b) + κ)	1.5(N (12κ+log a+log b)+log n+B + 10κ + log N )
		Table 6.1: Complexities of 3SRP and 3SRP-KDO
			communication overhead	prover's work overhead	verifier's work overhead
	B = 30, N = 1 B = 1024, N = 1 B = 2048, N = 1 B = 30, N = 10 B = 1024, N = 10 B = 2048, N = 10	+16% -3.7% -17% -7.6% -26.5% -39.1%		+60.2% +44% +36.4% +47.5% +33.2% +26.5%	-66% -71.7% -74.1% -86.8% -87.7% -88%

.2: Comparison between the 3SRP and the 3SRP-KDO settings where:

  Succ sec (A , κ) success of A in the experiment sec Adv sec (A , κ) advantage of A in experiment sec Résumé Dans cette thèse, nous étudions les preuves à divulgation nulle de connaissance, une primitive cryptographique permettant de prouver une assertion en ne révélant rien de plus que sa véracité, et leurs applications au calcul sécurisé. Nous introduisons tout d'abord un nouveau type de preuves à divulgation nulle, appelées arguments implicites à divulgation nulle, intermédiaire entre deux notions existantes, les preuves interactives et les preuves noninteractives à divulgation nulle. Cette nouvelle notion permet d'obtenir les mêmes bénéfices en terme d'efficacité que les preuves non-interactives dans le contexte de la construction de protocoles de calcul sécurisé faiblement interactifs, mais peut être instanciée à partir des mêmes hypothèses cryptographiques que les preuves interactives, permettant d'obtenir de meilleures garanties d'efficacité et de sécurité. Dans un second temps, nous revisitons un système de preuves à divulgation nulle de connaissance qui est particulièrement utile dans le cadre de protocoles de calcul sécurisé manipulant des nombres entiers, et nous démontrons que son analyse de sécurité classique peut être améliorée pour faire reposer ce système de preuve sur une hypothèse plus standard et mieux connue. Enfin, nous introduisons une nouvelle méthode de construction de systèmes de preuves à divulgation nulle sur les entiers, qui représente une amélioration par rapport aux méthodes existantes, tout particulièrement dans un modèle de type client-serveur, où un client à faible puissance de calcul participe à un protocole de calcul sécurisé avec un serveur à forte puissance de calcul.

	Mathematical Notations N set of non-negative integers Z set of integers a ; b integer interval {0, 1} k set of length-k bitstrings |s| bit-length of s ||s|| absolute value of s (Z k , +) additive group of integers modulo k (Z * k , •) multiplicative groups of invertible integers modulo k (Z k , +, •) ring of integers modulo k G cyclic group #" x row vector x $ ← S uniformly random assignment of an element of S to x p, q primes ϕ Euler totient function
	J st L P BPP NP IP PSPACE PZK, SZK, CZK (P, S, C)ZKA (P, S, C)ZKPoK negl(x) κ A , A O Exp sec A	state of an algorithm language the class of problems decidable by polytime algorithms the class of problems decidable by randomized polytime algorithms with bounded error the class of decision problems with efficiently verifiable solutions the class of decision problems with interactive proofs the class of problems decidable by polynomial space algorithms the class of problems admitting a (perfect,statistical,computational) zero-knowledge proof the class of problems admitting a (perfect,statistical,computational) zero-knowledge argument the class of problems admitting a (perfect,statistical,computational) zero-knowledge proof of knowledge a negligible function in x the security parameter an adversary, without and with oracle access to O experiment sec with adversary A

n the group of elements of Z * n , with n = pq, with Jacobi symbol 1 QR n the group of quadratic residues modulo n = pq Algorithms and Complexity

y ← A(x)

y is the output of the algorithm A on input x y $ ← A(x) output of A on x, where A is a randomized algorithm

In fact, publicly-verifiable non-interactive zero-knowledge proofs are also known from factorization-based assumptions, but they are rather inefficient and mainly of theoretical interest [BFM88; BDMP91].

Preliminaries

When considering interactive proof systems, the soundness error can also be made small via parallel repetition of the protocol [Bab85; Gol98], preserving the round efficiency. However, this is not true for every variant of interactive proofs -such as interactive arguments and zero-knowledge proofs -while sequential repetitions do always allow to reduce the soundness error.

According to[ECR], an exponentiation takes about

200,000 cycles. 2 Assuming exponentiations can be made in parallel, which is the case for our iZKs.

In our formalization, actually, it is the flow together all the previous flows. But we just say it is the flow to

The construction can be trivially extended to DLIN, or any MDDH assumption[START_REF] Escala | An Algebraic Framework for Diffie-Hellman Assumptions[END_REF] though.

Contrary to[START_REF] Abdalla | Disjunctions for Hash Proof Systems: New Constructions and Applications[END_REF] however, our matrix Γt depends on the words Ct, which is why we get this more efficient construction.

The classical trick that consists of using λi = λ i is not efficient here since we are in the integers, and so no reduction can be applied.

Acknowledgments

Acknowledgments vii

Protocol Π DDH Common Input: the description of a prime-order group G of (exponentially large) order p, and four group element (u, v, u , v ).

Prover Witness: A value y ∈ Z p such that u y = u and v y = v .

Protocol:

1. P: pick r $ ← Z p , send (ρ, σ) ← (u r , v r ). 2. V: pick e $ ← Z p , send e. The intuition behind this protocol is that P will chose in advance one of the two challenges for (Π 0 , Π 1 ) -the challenge corresponding the statement for which he does not know a witness. The two challenges used by V are (e 0 , e 1 ) such that e 0 + e 1 = e, where e is a random challenge picked by V in step 2. This ensures that P can choose in advance one of (e 0 , e 1 ), but has absolutely no information on the remaining challenge before e is sent. Hence, P can simulate one of the two proofs, but is forced to honestly play the other one. Zero-knowledge is implied by the zero-knowledge property of Π 0 , Π 1 , as the simulated proofs are indistinguishable from honest proofs. Knowledge extraction also follows from the knowledge extraction property of Π 0 , Π 1 and ensures that a simulator can extract a witness for one of the two statements from any successful prover. As it also has the required structure, the protocol Π S is a Σ-protocol. Applying this method to Π dlog and Π DDH immediately leads to a protocol for the statement given at the beginning of this section.

5

Zero-Knowledge Arguments over the Integers under the RSA Assumption -99 -of exponent π > 2 κ , and thus g = y 2ρ , using Fact 2.2.9 from Proposition 2.2.7, one gets the π-th root of y modulo n.

This concludes the proof of the knowledge-extractability of the protocol, under the RSA assumption over Z n .

On the Efficiency of the Method. The advantages of this method compared to the classical method are twofold. First, most of the work in the protocol comes from the computation of exponentiations; with our technique, most of the work is transfered from V to P. This comes from the fact that verifying an equation such as #" c = com(x; r) involves exponentiations by integers of size O(log n + κ) while verifying the equation #" c = com π (x mod π; R) involves only two exponentiations by κ-bit values, so the work of V is reduced. However, P will have to compute exponentiations by integers of size O(log n + κ) to construct the random coin R associated to the commitment mod π (using the identity 6.1 in Section 6.2.2). V will still need to perform exponentiations by integers during ZK 1 , but his work during this step can be made essentially independent of the number N of inputs and witnesses (up to a small log N additive term) and completely independent of the degree of the representing polynomial.

Second, our method separates the argument of knowledge of inputs to a Diophantine equation from the argument that they do indeed satisfy the equation. The arguments of knowledge of an opening of a commitment can be very efficiently batched: if

, the verifier can simply send a random seed λ $ ← {0, 1} κ from which both players compute (λ 1 , • • • , λ N ) using a pseudo-random generator 1 . Then, P performs a single argument of knowledge of an opening ( i λ i x i ; i λ i r i ) of the commitment i c λ i i (see [START_REF] Bellare | Batch Verification with Applications to Cryptography and Checking[END_REF][START_REF] Bellare | Fast Batch Verification for Modular Exponentiation and Digital Signatures[END_REF] for more details). Therefore, when performing multiple membership arguments, P and V will have to perform a single argument for ZK 1 (of size essentially independent of the number of committed values).

In general, the higher the degree of the representing polynomial, the better our method will perform (in terms of communication). Still, we show in the following section that even for the case of range proofs, which can be seen as membership proofs to a Diophantine set whose representing polynomial is of degree 2, our method provides efficiency improvements.

Further Improvements. V can set h to h i π i 0 for several primes π i instead of h π . For some integer i, let p i ← j =i π j . Doing so allows V to reveal (h p i 0 , π i ) instead of (h 0 , π) in our method. Hence, in addition to allowing arbitrary parrallel arguments with a single prime π, a single setting is sufficient to perform a polynomial number of sequential arguments (fixed in advance) with different primes π i . In addition, we explained that commitments with knowledge-delayed order allow splitting the arguments of knowledge of the witnesses, denoted ZK 1 , and the argument that they indeed belong to a Diophantine set, denoted ZK 2 . The arguments ZK 1 can be batched as described above but, for efficiency reason, we should not generate (λ 1 , λ 2 . . . , λ N ) as (λ, λ 2 , . . . , λ N ). Indeed, |λ j | grows linearly with j over the integers. However, for the argument ZK 2 , the order of the commitment has been revealed. Hence, we can now use batching technique with such λ j = λ j since the prover is able to reduce the exponents modulo π at this stage. That means that our technique consisting of efficiently

Abbreviations