Sending zero-knowledge proofs to the future

Abstract

Abstract Time-release cryptography is a flourishing research area with a long history and has been extensively studied. In this work, we enrich it by introducing a novel concept: a time-release zero-knowledge proof (TRZKP). A TRZKP is a non-interactive zero-knowledge proof that allows one to publish a proof for a given relation $$R_\mathcal {L}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:msub> <mml:mi>R</mml:mi> <mml:mi>L</mml:mi> </mml:msub> </mml:math> , such that anyone can only finish the verification after time $$\textbf{T}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>T</mml:mi> </mml:math> by performing a sequential computation. This work formalizes the concept of TRZKP and presents light constructions for the time-release version of any NIZK obtained from a public-coin protocol via Fiat-Shamir transformation. TRZKPs can be applied to provide time-release authentication, for example, they can be employed to construct verifiable timed signatures (VTS), introduced by Thyagarajan et al. (CCS’20). Through both theoretical and practical analysis, our construction has advantages over existing VTS for Fiat-Shamir signatures. Specifically, when instantiated with Shnorr signature, our VTS signing time remains basically unchanged as the delay time grows, and is preferable for longer delay times; our VTS verification time is significantly small (on the level of milliseconds, while existing works on the level of seconds), and our VTS size is 67 times smaller than the state-of-the-art. It also has the time-verifiability property, which ensures the signature is recoverable after the specified time.