Abstract Bilinear pairings have emerged as a fundamental tool in public-key cryptography, enabling advanced protocols such as identity-based encryption, short signatures, and zero-knowledge proofs. This paper focuses on optimizing pairing computations on curves with embedding degree 2, addressing both theoretical foundations and practical implementations. We propose an optimized double-and-add ladder algorithm that leverages the technique of y -coordinate recovery, achieving superior performance for the Tate pairing on supersingular curves and the Omega pairing on non-supersingular curves. Our method is implemented based on the RELIC cryptographic library, demonstrating significant efficiency improvements over Miller’s algorithm. Specifically, it reduces the number of base field multiplications (respectively CPU clock cycles) by 17.53 % (respectively 13.58 %) for the reduced Tate pairing on supersingular curves with a 1536-bit field size and by 12.37 % (respectively 8.39 %) for the Omega pairing on non-supersingular curves of the same size. This work establishes the first comprehensive implementation framework for cubical-based pairing computations on curves with embedding degree 2, providing quantified optimizations for practical cryptographic deployment.
We introduce the ω-Protocol, a zero-knowledge proof framework for the verification of elliptic curve–based homomorphic digital signatures. The protocol is constructed on top of the Elliptic Curve Homomorphic Digital Signature Algorithm (EHDSA) and enables zero-knowledge verification of signature validity while preserving signer privacy. The core contribution of the ω-Protocol is a signature-integrated zero-knowledge construction that combines homomorphic properties of EHDSA with algebraic commitment mechanisms over elliptic curve groups. We formalize the protocol model and define security notions capturing zero-knowledge, soundness, and unlinkability of signature verification. Under standard cryptographic assumptions over elliptic curve groups, we prove that the ω-Protocol achieves zero-knowledge and unforgeability-preserving verification without revealing signature components or ephemeral key material. We further analyze the computational complexity of the protocol and show that it incurs only minimal overhead compared to standard EHDSA verification. Our results establish a principled cryptographic framework for zero-knowledge verification of homomorphic digital signatures and provide a foundation applicable to privacy-preserving authentication and verification protocols.
A set of multivariate polynomials is algebraically independent if they exhibit no non-trivial algebraic relations, and this notion is fundamental in algebra. When these polynomials are given as algebraic circuits, deciding algebraic independence has several applications in algebraic complexity theory. Over fields of zero (or exponentially large) characteristic, this problem is known to have an efficient randomized algorithm. Over finite fields of small characteristic, a sequence of works has culminated in showing that algebraic independence admits Arthur-Merlin proofs, in particular giving the complexity bound of AM∩coAM ([Guo et al., 2019]). We improve the complexity of deciding algebraic independence over finite fields by showing that it admits zero-knowledge proofs, in particular giving the upper bound of NISZK ⊆ AM∩coAM, the class of problems admitting non-interactive statistical zero-knowledge proofs. This is achieved by arguing that algebraically independent polynomials yield maps whose output distribution has high-entropy, while algebraically dependent polynomials yield maps with low-entropy. We can then reduce to the question of approximating entropy, which is a known NISZK-complete problem. We also more generally show that transcendence degree, which quantifies the independence of a set of possibly dependent polynomials, can be computed in NISZK.
A Modular DSP Architecture for Extreme-Precision Computation of π Author: José Ignacio Peinador SalaContact: joseignacio.peinador@gmail.comORCID: 0009-0008-1822-3452 🎯 TL;DR: What's This About? Problem: Calculating π at extreme precision hits a "Memory Wall" — parallel algorithms choke on shared memory access. Breakthrough: We discovered that π's calculation can be decomposed using modular arithmetic (mod 6), creating 6 independent computation channels with zero inter-thread communication. Key Insight: This decomposition is grounded in a formal isomorphism with polyphase filter banks in Digital Signal Processing (DSP), a bridge between number theory and engineering established in our companion work. Result: ✅ 100 million digits of π computed with just 6.8 GB RAM (95% parallelisation efficiency) ✅ Shared-Nothing architecture with strictly isolated memory per channel ✅ Stride-6 transition leaf with exact phase correction, compressing recursion depth by 2.6× ✅ Open-source implementation in Python/gmpy2, executable on Google Colab's free tier Why it matters: This architecture transforms an intrinsically memory-bound problem into a CPU-bound one, enabling near-linear scaling on commodity hardware without specialised HPC infrastructure. 📖 Executive Summary This repository hosts the reference implementation and experimental validation of the Hybrid Stride-6 architecture for extreme-precision computation of π. The architecture exploits the arithmetic structure of the Chudnovsky series by decomposing it into six independent modular channels, each processed by a dedicated worker with its own memory space. The decomposition is not an ad hoc optimisation but rests on a rigorous mathematical foundation: the polyphase isomorphism between modular arithmetic on ℤ/6ℤ and multirate signal processing. This isomorphism guarantees perfect reconstruction (no information loss across channels) and orthogonality (no inter-channel interference). The architecture is validated through the 100M Barrier Run: computing 10⁸ digits of π on a resource-constrained Google Colab instance (2 vCPUs, 12 GB RAM) in under 20 minutes, with 95% parallelisation efficiency and a sustained throughput of over 83,000 digits per second. 🏆 Key Contributions 🔬 Theoretical Foundations (Summarised from Companion Work) Polyphase Isomorphism: Formal proof that modular decomposition of integer-indexed series is equivalent to polyphase decimation in DSP Hexagonal Lattice Connection: Geometric motivation via the A₂ lattice (densest circle packing in the plane) Perfect Reconstruction Guarantee: Mathematical proof that the six channels recombine without aliasing or leakage ⚡ Computational Architecture Shared-Nothing Design: Six independent Python processes with strictly isolated memory spaces Stride-6 Transition Leaf: Processes blocks of 6 consecutive terms in a single operation, reducing recursion tree depth by log₂6 ≈ 2.585 Critical Phase Correction: Direct accumulation of the linear term B(k) prevents off-by-one-stride phase errors 📊 Experimental Validation 100M Barrier Run: 100 million digits computed on 12 GB RAM with 95% parallel efficiency Orthogonality Verification: ℓ² norm of channel terms matches norm of original series to machine precision Reference Comparison: All 10⁸ digits match y-cruncher reference values exactly 📈 Performance Highlights 🚀 "The 100M Barrier Run" — Extreme Validation Metric Result Significance Digits Calculated 100,000,000 Exascale-capable architecture Total Time 1,194.32 s (19.90 min) Sustained performance on cloud hardware Parallel Efficiency 95% (1.90× speedup) Near-linear scaling on 2 cores Peak RAM Usage ~6.8 GB Runs within 12 GB Colab limit Throughput 83,729 digits/second Competitive with optimised implementations Numerical Integrity Bit-exact match with y-cruncher Zero cumulative error 🏗️ Architectural Comparison Aspect Monolithic Binary Splitting Hybrid Stride-6 (This Work) y-cruncher (State-of-Art) Memory Pattern Contiguous, saturates bus Local per core, optimises cache Sequential disk I/O Parallel Model Fine-grained synchronisation Embarrassingly parallel (6 processes) Optimised with locks Scalability Memory-bound CPU-bound, linear to 6 cores Disk-speed limited RAM Requirement Entire dataset in memory Working set reduced 6× Uses disk as RAM Design Philosophy Maximise single-thread speed Maximise resource efficiency Maximise absolute speed 🚀 Quick Start & Reproduction 1. Instant Online Experiment (Recommended) Click above to run the complete experimental validation in Google Colab — no installation required! 2. Key Experiments to Reproduce The companion notebook provides step-by-step reproduction of all manuscript claims: Theoretical Foundation: Verify the polyphase decomposition and energy conservation Stride-6 Algorithm: Test parallel computation with arbitrary precision (100k digits) 100M Barrier Run: Reproduce the full-scale benchmark (requires ~7 GB RAM) Performance Analysis: Measure speedup and parallel efficiency ⚙️ Technical Implementation Details The "Stride-6" Computational Engine Unlike conventional Binary Splitting (processes terms individually), our engine implements a compressed transition leaf that calculates the aggregate effect of 6 consecutive terms: def stride6_leaf(k_start): """Calculate compressed transition for block [k, k+5]""" P, Q, B_acc = 1, 1, 0 for m in range(6): n = k_start + m P_n, Q_n, B_n = compute_chudnovsky_term(n) P *= P_n Q *= Q_n B_acc += B_n # Critical phase accumulation T_leaf = Q * B_acc # Correct phase synthesis return P, Q, T_leaf Key Innovation: Direct accumulation of the linear term B(n) prevents phase drift, preserving arithmetic integrity at any scale. Shared-Nothing Architecture Each of the 6 workers operates in complete memory isolation: Independent address spaces (no shared memory locks) Local garbage collection (prevents heap fragmentation) Cache-optimised access patterns (maximises L1/L2 utilisation) Numerical Stability Guarantees Orthogonal decomposition — zero information loss (verified experimentally) Arbitrary precision backend (gmpy2) with proven numerical stability Exact phase correction in the Stride-6 leaf 📚 Citation & Academic Use If this work contributes to your research, please cite: @article{peinador2026modularDSP, title={A Modular DSP Architecture for Extreme-Precision Computation of π}, author={Peinador Sala, José Ignacio}, journal={Zenodo}, year={2026}, doi = {10.5281/zenodo.17768718}, url = {https://github.com/NachoPeinador/Arquitectura-de-Hibridacion-Algoritmica-en-Z-6Z} } The companion theoretical work establishing the polyphase isomorphism is: @article{peinador2026polyphase, title={Polyphase Isomorphism between Modular Arithmetic and Multirate Signal Processing}, author={Peinador Sala, José Ignacio}, year={2026}, publisher={Zenodo}, doi = {10.5281/zenodo.17680023} } 🌐 The Broader Research Programme This architecture is one component of a larger investigation into the computational and physical consequences of the ℤ/6ℤ modular symmetry. Related projects include: Polyphase Isomorphism: Formal mathematical proof of the isomorphism between modular arithmetic and DSP. Modular Substrate Theory: Unified framework for cosmology and hadronic physics. Topological State Preparation: Quantum register initialisation and dissipative protection via ℤ/6ℤ superselection. Common Thread: All projects leverage modular arithmetic (ℤ/6ℤ) as a fundamental organising principle across mathematics, physics, and computation. ⚖️ Licensing & Usage ✅ Academic & Research Use (Free) Available under PolyForm Noncommercial License 1.0.0: Permitted: Academic research, teaching, personal projects, non-commercial forks Requirements: Attribution, license preservation, non-commercial use ⛔ Commercial Use (License Required) Commercial applications require explicit permission, including: Integration into proprietary software products Commercial hardware benchmarking services SaaS platforms and cloud computing services 💼 For Commercial Licensing Inquiries:Contact: joseignacio.peinador@gmail.comSubject: "Commercial License Inquiry — Modular π Architecture" 🌟 Acknowledgments This independent research was enabled by: Infrastructure & Tools Google Colab for democratised computational resources Python ecosystem (gmpy2, NumPy, SciPy, Jupyter) for scientific computing GitHub for open collaboration infrastructure Data & References y-cruncher for validation benchmarks Digital Signal Processing community for foundational theory Community & Inspiration The open-source scientific community for collective knowledge advancement Independent researchers worldwide pushing boundaries outside traditional institutions Last updated: June 2026 | Version: 3.0 | Status: Actively Maintained
Barrett's algorithm is one of the most widely used methods for performing modular multiplication, a critical nonlinear operation in modern privacy computing techniques such as homomorphic encryption (HE) and zero-knowledge proofs (ZKP). Since modular multiplication dominates the processing time in these applications, computational complexity and memory limitations significantly impact performance. Computing-in-Memory (CiM) is a promising approach to tackle this problem. However, existing schemes currently suffer from two main problems: 1) Most works focus on low bit-width modular multiplication, which is inadequate for mainstream cryptographic algorithms such as elliptic curve cryptography (ECC) and the RSA algorithm, both of which require high bit-width operations; 2) Recent efforts targeting large number modular multiplication rely on inefficient in-memory logic operations, resulting in high scaling costs for larger bit-widths and increased latency. To address these issues, we propose LaMoS, an efficient SRAM-based CiM design for large-number modular multiplication, offering high scalability and area efficiency. First, we analyze the Barrett's modular multiplication method and map the workload onto SRAM CiM macros for high bit-width cases. Additionally, we develop an efficient CiM architecture and dataflow to optimize large-number modular multiplication. Finally, we refine the mapping scheme for better scalability in high bit-width scenarios using workload grouping. Experimental results show that LaMoS achieves a $7.02\times$ speedup and reduces high bit-width scaling costs compared to existing SRAM-based CiM designs.
Zero-Knowledge Proofs (ZKP) are protocols which construct cryptographic proofs to demonstrate knowledge of a secret input in a computation without revealing any information about the secret. ZKPs enable novel applications in private and verifiable computing such as anonymized cryptocurrencies and blockchain scaling and have seen adoption in several real-world systems. Prior work has accelerated ZKPs on GPUs by leveraging the inherent parallelism in core computation kernels like Multi-Scalar Multiplication (MSM). However, we find that a systematic characterization of execution bottlenecks in ZKPs, as well as their scalability on modern GPU architectures, is missing in the literature. This paper presents ZKProphet, a comprehensive performance study of Zero-Knowledge Proofs on GPUs. Following massive speedups of MSM, we find that ZKPs are bottlenecked by kernels like Number-Theoretic Transform (NTT), as they account for up to 90% of the proof generation latency on GPUs when paired with optimized MSM implementations. Available NTT implementations under-utilize GPU compute resources and often do not employ architectural features like asynchronous compute and memory operations. We observe that the arithmetic operations underlying ZKPs execute exclusively on the GPU's 32-bit integer pipeline and exhibit limited instruction-level parallelism due to data dependencies. Their performance is thus limited by the available integer compute units. While one way to scale the performance of ZKPs is adding more compute units, we discuss how runtime parameter tuning for optimizations like precomputed inputs and alternative data representations can extract additional speedup. With this work, we provide the ZKP community a roadmap to scale performance on GPUs and construct definitive GPU-accelerated ZKPs for their application requirements and available hardware resources.
In our research, we propose the first practically deployable construction of a multi-prover zero-knowledge succinct non-interactive argument of knowledge (zkSNARK) protocol specifically tailored for restricted multiplication straight-line (RMS) programs, a computation model widely applicable in evaluating polynomials. Our protocol ensures input privacy, zero-knowledge, and security against fully malicious provers, all while eliminating the need for any inter-prover communication, making it highly suitable for distributed cloud environments. At the core of our approach is the introduction of the Restricted Quadratic Arithmetic Program model, an algebraic structure aligned with RMS semantics that enables provers to independently generate local proofs. We instantiate our framework using the Pinocchio protocol, resulting in a system that requires only 9 group elements per proof and 10 pairings for verification, nearly matching the efficiency of its single-prover counterpart. By leveraging our multi-prover zkSNARK protocol within a multi-server verification computation framework, we enable secure outsourcing of computations to the cloud of fully untrusted cloud servers. Compared to existing works, our protocol uniquely eliminates the need for any inter-server communication while achieving security even against adversaries controlling all servers.
Arguments à divulgation nulle de connaissance efficaces et succincts dans le cadre du chiffrement CL et applications Le schéma de chiffrement CL est un système de chiffrement à clé publique linéairement homomorphe, proposé en 2015 par Castagnos et Laguillaumie. Il repose sur l’utilisation de groupes de classes de corps quadratiques imaginaires. Ces groupes finis ont la particularité d’être considérés d’ordre inconnu, c’est-à-dire que l’ordre d’un tel groupe est difficile à déterminer de manière algorithmique. Cet ordre inconnu est un atout précieux pour les applications cryptographiques, et est central dans la construction du chiffrement CL. Cependant, il est aussi à l’origine d’importantes difficultés techniques liées à la manipulation de chiffrés CL. Dans ce contexte, la construction d’arguments, et à fortiori d’arguments de connaissance, à divulgation nulle de connaissance est particulièrement exigeante, et constitue un défi majeur à relever. En effet, les techniques classiques permettant d’améliorer l’efficacité des preuves dans le cas d’un groupe d’ordre premier, et en particulier celles liées à la robustesse, s’adaptent mal au cas de l’ordre inconnu. Les arguments de connaissance existants sont donc souvent peu efficaces, avec des coûts de communication et de calcul élevés. Dans cette thèse, nous concevons de nouveaux protocoles à divulgation nulle de connaissance spécifiquement adaptés au cadre du chiffrement CL, afin d’obtenir des preuves plus courtes et efficaces que les protocoles existants. Nos protocoles reposent sur deux outils principaux : le premier est l’hypothèse C-rough, introduite par Braun, Damgard et Orlandi en 2023. Cette hypothèse algorithmique spécifique au cadre de CL stipule qu’il est difficile de décider si l’ordre d’un groupe de classes engendré par l’algorithme d’initialisation de CL possède des facteurs premiers plus petit qu’un seuil C. Le second est un concept novateur appelé extractabilité partielle, qui correspond à une notion affaiblie de robustesse de la connaissance. Cette notion est particulièrement adaptée au cadre de CL, car elle permet de traiter séparément les textes clairs et les aléas apparaissant dans les chiffrés CL. En particulier, elle permet d’exploiter les techniques du cas de l’ordre premier pour obtenir de l’information sur les textes clairs – définis modulo un nombre premier connu – même si les aléas sont définis modulo un entier composé et, surtout, inconnu. Grâce à ces deux outils, nous construisons des protocoles à divulgation nulle de connaissance permettant de prouver, d’une part, des énoncés classiques, comme le fait qu’un chiffré CL est bien formé, et d’autre part, des énoncés plus spécifiques, tels que le mélange aléatoire de chiffrés. Les preuves à divulgation nulle de connaissance sont essentielles à la sécurité des protocoles de calcul multipartite, en particulier face à des adversaires malveillants, car elles permettent de garantir que les participants se comportent conformément au protocole. Ainsi, disposer de preuves efficaces pour le chiffrement CL représente une étape fondamentale dans la construction de protocoles de calcul distribué pratiques et sûrs utilisant CL. En application de nos techniques, nous présentons un protocole, sûr en présence d’un adversaire malveillant, qui réalise la fonctionnalité “PSI-sum” – une variante de l’intersection privée d’ensembles. Cet exemple pratique met en évidence l’intérêt du chiffrement CL comme bloc de base pour réaliser des fonctionnalités avancées de calcul multipartite.
Nominative signatures allow us to indicate who can verify a signature, and they can be employed to construct a non-transferable signature verification system that prevents the signature verification by a third party in unexpected situations. For example, this system can prevent IOU/loan certificate verification in unexpected situations. However, nominative signatures themselves do not allow the verifier to check whether the funds will be transferred in the future or have been transferred.It would be desirable to verify the fact simultaneously when the system involves a certain money transfer such as cryptocurrencies/cryptoassets. In this paper, we propose a smart contract-based non-transferable signature verification system using nominative signatures. We pay attention to the fact that the invisibility, which is a security requirement to be held for nominative signatures, allows us to publish nominative signatures on the blockchain. Our system can verify whether a money transfer actually will take place, in addition to indicating who can verify a signature. We transform the Hanaoka-Schuldt nominative signature scheme (ACNS 2011, IEICE Trans. 2016) which is constructed over a symmetric pairing to a scheme constructed over an asymmetric pairing, and evaluate the gas cost when a smart contract runs the verification algorithm of the modified Hanaoka-Schuldt nominative signature scheme.
Efficiently verifying mathematical proofs and computations has been a heavily researched topic within Computer Science. Particularly, even repetitive steps within a proof become much more complex and inefficient to validate as proof sizes grow. To solve this problem, we suggest viewing it through the lens of Incrementally Verifiable Computation (IVC). However, many IVC methods, including the state-of-the-art Nova recursive SNARKs, require proofs to be linear and for each proof step to be identical. This paper proposes Lova, a novel framework to verify mathematical proofs end-to-end that solves these problems. Particularly, our approach achieves a few novelties alongside the first-of-its-kind implementation of Nova: (i) an innovative proof splicing mechanism to generate independent proof sequences, (ii) a system of linear algorithms to verify a variety of mathematical logic rules, and (iii) a novel multiplexing circuit allowing non-homogeneous proof sequences to be verified together in a single Nova proof. The resulting Lova pipeline has linear prover time, constant verifying capability, dynamic/easy modification, and optional zero-knowledge privacy to efficiently validate mathematical proofs. We offer potential use cases for Lova to secure entire Cyber-Physical Systems (CPS) pipelines, as well as localized CPS systems in automotive and healthcare devices. Code is available at https://github.com/noelkelias/lova.
In the context of cloud computing, services are held on cloud servers, where the clients send their data to the server and obtain the results returned by server. However, the computation, data and results are prone to tampering due to the vulnerabilities on the server side. Thus, verifying the integrity of computation is important in the client-server setting. The cryptographic method known as Zero-Knowledge Proof (ZKP) is renowned for facilitating private and verifiable computing. ZKP allows the client to validate that the results from the server are computed correctly without violating the privacy of the server’s intellectual property. Zero-Knowledge Succinct NonInteractive Argument of Knowledge (zkSNARKs), in particular, has been widely applied in various applications like blockchain and verifiable machine learning. Despite their popularity, existing zkSNARKs approaches remain highly computationally intensive. For instance, even basic operations like matrix multiplication require an extensive number of constraints, resulting in significant overhead. In addressing this challenge, we introduce $z k V C$, which optimizes the ZKP computation for matrix multiplication, enabling rapid proof generation on the server side and efficient verification on the client side. zkVC integrates optimized ZKP modules, such as Constraint-reduced Polynomial Circuit (CRPC) and Prefix-Sum Query (PSQ), collectively yielding a more than $\mathbf{1 2}$-fold increase in proof speed over prior methods. The code is available at https://github.com/UCF-Lou-Lab-PET/zkformer.
Delaram Kahrobaei, Ludovic Perret, Martina Vigorito
Abstract Bidoux and Gaborit introduced a new general technique to improve zero-knowledge ( ZK ) proof-of-knowledge ( PoK ) schemes for a large set of well-known post-quantum hard computational problems such as the syndrome decoding, the permuted kernel, the rank syndrome decoding, and the multivariate quadratic ( MQ ) problems. In particular, the authors’ idea in the study of Bidoux and Gaborit was to use the structure of these problems in the multi-instance setting to minimize the communication complexity of the resulting ZK PoK schemes. The security of the new schemes is then related to new hard problems. In this article, we focus on the new multivariate-based ZK PoK and the corresponding new underlying problem: the so-called <m:math xmlns:m="http://www.w3.org/1998/Math/MathML"> <m:msub> <m:mrow> <m:mi mathvariant="monospace">DiffMQ</m:mi> </m:mrow> <m:mrow> <m:mi mathvariant="normal">H</m:mi> </m:mrow> </m:msub> </m:math> {{\mathtt{DiffMQ}}}_{{\rm{H}}} . We present a new efficient probabilistic algorithm for solving the <m:math xmlns:m="http://www.w3.org/1998/Math/MathML"> <m:msub> <m:mrow> <m:mi mathvariant="monospace">DiffMQ</m:mi> </m:mrow> <m:mrow> <m:mi mathvariant="normal">H</m:mi> </m:mrow> </m:msub> </m:math> {{\mathtt{DiffMQ}}}_{{\rm{H}}} which is polynomial-time if <m:math xmlns:m="http://www.w3.org/1998/Math/MathML"> <m:mi>m</m:mi> <m:mo>−</m:mo> <m:mi>n</m:mi> <m:mo>∈</m:mo> <m:mi>O</m:mi> <m:mrow> <m:mo>(</m:mo> <m:mrow> <m:mn>1</m:mn> </m:mrow> <m:mo>)</m:mo> </m:mrow> </m:math> m-n\in O\left(1) . We also present experimental results showing that the algorithm is efficient in practice.
Hotaru Beam is a logic puzzle which objective is to connect circles placed on a grid by drawing only lines with specified starting points and numbers of bends. A zero-knowledge proof is a communication protocol that allows one player to persuade the other that they are in possession of a certain piece of information without actually revealing it. We show that Hotaru Beam is NP-complete and present a physical zero-knowledge proof (i.e. implementable using physical items) for proving that one knows a solution to the puzzle.
Katharina Koschatko, Reinhard Lüftenegger, Christian Rechberger
Gröbner basis cryptanalysis of hash functions and ciphers, and their underlying permutations, has seen renewed interest recently. Anemoi (Crypto’23) is a permutation-based hash function that is efficient for a variety of arithmetizations used in zero-knowledge proofs. In this paper, exploring both theoretical bounds as well as experimental validation, we present new complexity estimates for Gröbner basis attacks on the Anemoi permutation over prime fields.We cast our findings in what we call the six worlds of Gröbner basis cryptanalysis. As an example, keeping the same security arguments of the design, we conclude that at least 41 instead of 37 rounds would need to be used for 256-bit security, whereby our suggestion does not yet include a security margin.
Open access
Polynomial and algebraic computation
Cryptography and Residue Arithmetic
Mathematics, Computing, and Information Processing
Abstract In an Instance-Hiding Interactive Proof (IHIP) (Beaver et al., in: Menezes and Vanstone (eds) Advances in cryptology—CRYPTO 1990, proceedings, lecture notes in computer science (including subseries lecture notes in artificial intelligence and lecture notes in bioinformatics), Springer, pp 326–338, 1990), an efficient verifier with a private input x interacts with an unbounded prover to determine whether x is contained in a language $$\mathcal {L}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mi>L</mml:mi> </mml:math> . In addition to completeness and soundness, the instance-hiding property requires that the prover should not learn anything about x in the course of the interaction. Such proof systems capture natural privacy properties and may be seen as a generalization of the influential concept of randomized encodings (Ishai and Kushilevitz, in: Proceedings 41st annual symposium on foundations of computer science, pp 294–304, 2000; Applebaum et al., in: 45th annual IEEE symposium on foundations of computer science, pp 166–175, 2004; Agrawal et al., in: Halldórsson, Iwama, Kobayashi, Speckmann (eds) Automata, languages, and programming, Springer, Berlin, Heidelberg, pp 1–13, 2015) and as a counterpart to zero-knowledge proofs (Goldwasser et al., in: Symposium on the theory of computing, 1985). We investigate the properties and power of such instance-hiding proofs and show the following: Any language with an IHIP is contained in $${\mathsf {NP/poly}}\cap {\mathsf {coNP/poly}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mrow> <mml:mi>NP</mml:mi> <mml:mo>/</mml:mo> <mml:mi>poly</mml:mi> </mml:mrow> <mml:mo>∩</mml:mo> <mml:mrow> <mml:mi>coNP</mml:mi> <mml:mo>/</mml:mo> <mml:mi>poly</mml:mi> </mml:mrow> </mml:mrow> </mml:math> . If an average-case hard language has a constant-round IHIP, then infinitely often non-uniform one-way functions exist. There is an oracle with respect to which there is a language that has an IHIP but not an SZK proof. IHIP’s are closed under composition with any efficiently computable function. We further study a stronger version of IHIP (that we call Simulatable IHIP) where the view of the honest prover can be efficiently simulated. For these, we obtain stronger versions of some of the above: Any language with a Simulatable IHIP is contained in $${\textsf{AM}}\cap {\textsf{coAM}}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>AM</mml:mi> <mml:mo>∩</mml:mo> <mml:mi>coAM</mml:mi> </mml:mrow> </mml:math> . If a worst-case hard language has a Simulatable IHIP, then explicit uniform one-way functions exist.
Open access
2 source records
Cryptography and Data Security
Advanced Steganography and Watermarking Techniques
Biscuit is a recent multivariate signature scheme based on the MPC-in-the-Head paradigm. It has been submitted to the NIST competition for additional signature schemes. Signatures are derived from a zero-knowledge proof of knowledge of the solution of a structured polynomial system. This extra structure enables efficient proofs and compact signatures. This short note demonstrates that it also makes these polynomial systems easier to solve than random ones. As a consequence, the original parameters of Biscuit failed to meet the required security levels and had to be upgraded.
Nicholas Brandt, Dennis Hofheinz, Michael Klooß, Michael Reichle
We construct the first blind signature scheme that achieves all of the following properties simultaneously: – it is tightly secure under a standard (i.e., non-interactive, non-q-type) computational assumption, – it does not require pairings, – it does not rely on generic, non-black-box techniques (like generic NIZK proofs). The third property enables a reasonably efficient solution, and in fact signatures in our scheme comprise 10 group elements and 29 Zp-elements. Our scheme starts from a pairing-based non-blind signature scheme (Abe et al., JoC 2023), and uses recent techniques of Chairattana-Apirom, Tessaro, and Zhu (CRYPTO 2024) to replace the pairings used in this scheme with non-interactive zero-knowledge proofs in the random oracle model. This conversion is not generic or straightforward (also because the mentioned previous works have converted only significantly simpler signature schemes), and we are required to improve upon and innovate existing techniques in several places. As an interesting side note, and unlike previous works, our techniques only require a non-programmable random oracle, and our signature scheme achieves predicate blindness (which means that the user can prove state ments about the signed message during the signing process).
Zero-knowledge proof (ZKP) systems have surged attention and held a fundamental role in contemporary cryptography. Zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) protocols dominate the ZKP usage, implemented through arithmetic circuit programming paradigm. However, underconstrained or overconstrained circuits may lead to bugs. The former refers to circuits that lack the necessary constraints, resulting in unexpected solutions and causing the verifier to accept a bogus witness, and the latter refers to circuits that are constrained excessively, resulting in lacking necessary solutions and causing the verifier to accept no witness. This article introduces a novel approach for pinpointing two distinct types of bugs in ZKP circuits. The method involves encoding the arithmetic circuit constraints to polynomial equation systems and solving them over finite fields by the computer algebra system . The classification of verification results is refined, greatly enhancing the expressive power of the system. A tool, AC 4 , is proposed to represent the implementation of the method. Experiments show that AC 4 demonstrates an increase in the solved rate, showing a 36.7% improvement over Picus and CIVER, and a slight improvement over halo2-analyzer, a checker for halo2 circuits. Within a solvable range, the checking time has also exhibited noticeable improvement, demonstrating a magnitude increase compared to previous efforts.
Signatures post-quantiques à partir de techniques de calcul multipartite Le développement actuel des ordinateurs quantiques pousse la communauté cryptographique à mettre au point de nouveaux cryptosystèmes dont la sécurité se fonde sur la difficulté à résoudre des problèmes cryptographiques résistant au calcul quantique. Dans le cadre de cette thèse, nous nous sommes focalisés sur la conception de schémas de signatures électroniques construits à partir de preuves à divulgation nulle de connaissance (zero-knowledge proofs of knowledge). Plus précisément, nous nous sommes intéressés au paradigme “MPC-in-the-Head” (littéralement, “calcul-multipartite-dans-la-tête”) qui fournit une méthode générique de construire de telles preuves en utilisant des techniques de calcul multipartite sécurisé. Nous proposons plusieurs nouveaux schémas de signatures utilisant le paradigme “MPC-in-the-Head”. La plupart d’entre eux sont compétitifs avec les schémas existants dans l’état de l’art post-quantique. Ils produisent des signatures ayant des tailles entre 5 et 20 kylo-octets (pour un niveau de sécurité de 128 bits) et possèdent de très petites clés (de moins de 200 octets). Les problèmes difficiles sur lesquels la sécurité de ces schémas se fonde sont très variés. Certains schémas s’appuient sur des hypothèses de sécurité issues de la théorie des codes correcteurs d’erreurs, telle que celle sur la difficulté à résoudre le problème de décodage par syndrome pour des codes linéaires aléatoires. Les autres schémas s’appuient sur la difficultés à résoudre un système d’équations quadratiques, le problème de la somme de sous-ensembles ou le problème MinRank. Nous avons également mis au point deux nouvelles techniques de MPC-in-the-Head. La première vise à gérer efficacement les situations où le secret est de petite taille avec un grand modulus. La seconde consiste en une nouvelle méthode pour transformer un protocole de calcul multipartite en preuve de divulgation nulle de connaissance. Cette nouvelle transformation offre des nouveaux compromis entre coût de communication et temps de calcul. En particulier, elle permet de produire des algorithmes de vérification très rapides. Plusieurs soumissions à l’appel du NIST pour des schémas de signatures post-quantiques supplémentaires s'appuient (parfois partiellement) sur des idées développées dans le cadre de cette thèse.
The objective of this memory is to give a purely algebraic proof of the Sauer- Shelah-Perles Lemma (inspired by the elegant proof in [FrPa,1983]), based only in duality in the Q−algebra Q[Vn] of polynomial functions de_ned on the zero-dimensional algebraic variety of subsets of the set [n] := {1, 2, . . . , n}. In fact, two di_erent proofs of this lemma will be given. Furthermore, we prove how several other classical results from Combinatorics are particular examples of a Trace (Inversion) Formula in _nite Q−algebras. For instance, one of this results is the general form of the Inclusion-Exclusion Principle (both with direct and reverse order associated to subsets inclusion). This approach also allows us to show a basis of the space of null t−designs, which di_ers from the one described in Theorem 4 of [DeFr,1982]. All results are still true if we replace Q[Vn] by K[Vn], where K is a perfect _eld of characteristic di_erent from 2. This memory has then the underlying purpose of connecting two _elds of mathematical knowledge that are not usually connected, at least not in this form.
Метою роботи є оптимізувати множення точок еліптичної кривої на скаляр за допомогою модернізованого метода “Подвійне скалярне множення з використанням трюку Штрауса-Шаміра з урахуванням Skew representation” та багато інших підходів. Ще однією метою роботи - зробити використання множення точок еліптичної кривої на скаляр безпечним в межах протоколу Zero-knowledge proof. З'ясувати, який метод множення буде найдешевшим в контексті визначеної метрики. Об’єктом дослідження є множення точок еліптичної кривої на скаляр в системі гаджет бібліотеках рекурсивних zk-Snark’s. Множення повинно виконуватися до стандартів протоколу Zero-knowledge proof. Також розглянуто варіанти практичного застосування описаних методів. У роботі виконане теоретичне та практичне дослідження, огляд алгоритмів та методів розв’язання задачі оптимізації з використанням різноманітних хитростей та підходів. Кодова база була написана мовою програмування Rust в бібліотеці franklin-crypto. Арифметизація, яка застосовується в бібліотеці – Plonkish та lookup table. Крива, яка була використана для тестування множення – Bn256. Ключові слова : точки еліптичної кривої, Zero-knowledge proof, мовою програмування Rust.
Electronic voting is one of the most interesting application of modern cryptography, as it involves many innovative tools (such as homomorphic public-key encryption, non-interactive zero-knowledge proofs, and distributed cryptography) to guarantee several a priori contradictory security properties: the integrity of the tally and the privacy of the individual votes. While many efficient solutions exist for honest-but-curious voters, that follow the official procedure but try to learn more than just the public result, preventing attacks from malicious voters is much more complex: when voters may have incentive to send biased ballots, the privacy of the ballots is much harder to satisfy, whereas this is the crucial security property for electronic voting. We present a new technique to prove that an ElGamal ciphertext contains a message from a specific subset (quasi-adaptive NIZK of subset membership), using linearly-homomorphic signatures. The proofs are both quite efficient to generate, allowing the use of low-power devices to vote, and randomizable, which is important for the strong receipt-freeness property. They are well-suited to prevent vote-selling and replay attacks, which are the main threats against the privacy in electronic voting, with security proofs in the generic group model and the random oracle model.
Alex Ozdemir, Gereon Kremer, Cesare Tinelli, Clark Barrett
Abstract We study satisfiability modulo the theory of finite fields and give a decision procedure for this theory. We implement our procedure for prime fields inside the cvc5 SMT solver. Using this theory, we construct SMT queries that encode translation validation for various zero knowledge proof compilers applied to Boolean computations. We evaluate our procedure on these benchmarks. Our experiments show that our implementation is superior to previous approaches (which encode field arithmetic using integers or bit-vectors).