Blockchain Papers

Kyosuke Hatsugai, Kyoichi Asano, Yoshiki Abe

No abstract is available for this record.

Gabrielle De Micheli, Pierrick Gaudry, Cécile Pierrot

No abstract is available for this record.

Lennart Braun, Cyprien Delpech de Saint Guilhem, Robin Jadoul, Emmanuela Orsini · 6 authors

In this work, we extend the MPC-in-the-Head framework, used in recent efficient zero-knowledge protocols, to work over the ring $$\mathbb {Z}_{2^k}$$ , which is the primary operating domain for modern CPUs. The proposed schemes are compatible with any threshold linear secret sharing scheme and draw inspiration from MPC protocols adapted for ring operations. Additionally, we explore various batching methodologies, leveraging Shamir’s secret sharing schemes and Galois ring extensions, and show the applicability of our approach in RAM program verification. Finally, we analyse different options for instantiating the resulting ZK scheme over rings and compare their communication costs.

P. V. Sem’yanov, S. V. Grezina

Abstract— This article discusses the security of implementing encryption for the Bitcoin Core cryptocurrency wallet. Particular attention is paid to aspects of the practical use of cryptographic algorithms when encrypting the wallet.dat file with a password. Practical resistance to brute-force attacks using parallel computing on GPUs is also considered. It is discovered that Bitcoin Core does not implement changing the encryption key for the user’s private keys. This implementation makes it possible to carry out a second attack on the wallet without knowing the new password, if it has already been compromised previously. Changes to encryption algorithms are also been proposed to make brute-force attacks more difficult on the GPU.

Mohammed Mujeer Ulla, Preethi Preethi, Md. Sameeruddin Khan, Deepak S. Sakkari

Very recent attacks like ladder leaks demonstrated the feasibility of recovering private keys with side-channel attacks using just one bit of secret nonce. ECDSA nonce bias can be exploited in many ways. Some attacks on ECDSA involve complicated Fourier analysis and lattice mathematics. This paper will enable cryptographers to identify efficient ways in which ECDSA can be cracked on curves NIST256p, SECP256k1, NIST521p, and weak nonce, kind of attacks that can crack ECDSA and how to protect yourself. Initially, we begin with an ECDSA signature to sign a message using the private key and validate the generated signature using the shared public key. Then we use a nonce or a random value to randomize the generated signature. Every time we sign, a new verifiable random nonce value is created, and a way in which the intruder can discover the private key if the signer leaks any one of the nonce values. Then we use Lenstra–Lenstra–Lovasz (LLL) method as a black box, we will try to attack signatures generated from bad nonce or bad random number generator (RAG) on NIST256p, SECP256k1 curves. The combination of nonce generation, post-message signing, and validation in ECDSA helps achieve Uniqueness, Authentication, Integrity, and Non-Repudiation. The analysis is performed by considering all three curves for the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA). The comparative analysis for each of the selected curves in terms of computational time is done with the leak of nonce and with the Lenstra–Lenstra–Lovasz method to crack ECDSA. The average computational costs to break ECDSA with curves NIST256p, NIST521p, and SECP256k1 are 0.016, 0.34,0.46 respectively which is almost zero depicting the strength of the algorithm. The average computational costs to break ECDSA with curves SECP256K1 and NIST256p using LLL are 2.9 and 3.4 respectively

Iryna Strelkovska, Oleksiy Onatskiy, Larysa Yona

The paper proposes a cryptographic protocol two-factor authentication with the zero-knowledge over the extended field GF(2m) on elliptic curves using biometric data and private key of the user. The implementation of a cryptographic protocol with zero-knowledge proof based on elliptic curves allows significantly reducing the size of protocol parameters and increasing the cryptographic strength (computational complexity of the breaking). The cryptographic protocol was modeled in the High-Level Protocol Specification Language, the model validation and protocol verification was performed using the Security Protocol Animator tool for Automated Validation of Internet Security Protocols and Applications. The software verification of the cryptographic protocol was performed using the software modules On the Fly Model Checker and Constraint Logic based Attack Searcher.

Qinghua Hu, Chunxiang Xu, Wanpeng Li

The utilization of the broadband subliminal channel allows a sender to covertly transmit a message to a receiver through digital signatures. This method requires the sender to relinquish the signing key to the receiver. As a result, the receiver has the ability to employ the signing key to sign any data on behalf of the sender without the sender’s knowledge or consent. Meanwhile, difficulties may arise if the sender is unwilling to disclose the signing key to the receiver. In this paper, we propose a broadband subliminal channel that can be used in digital signature schemes (e.g., DSA, ECDSA, ElGamal, and Schnorr) without disclosing the signing key to the receiver. As it writes the message on a digital signature, we call it WMoS. We first implement WMoS in the Elliptic Curve Digital Signature Algorithm (ECDSA). We then provide the security proof to show that signatures generated in WMoS have the same security level as standard ECDSA signatures. Moreover, we discuss the variants of WMoS in ECDSA and use them to construct applications. Furthermore, we use the implementation of WMoS to generate a signature for an Ethereum transaction to demonstrate its feasibility. We also evaluate the efficiency of WMoS in ECDSA, and the results show that WMoS in ECDSA can generate a signature as efficiently as the standard ECDSA.

Cheng Wang, Mingyu Gao

With an increasing focus on data security in today's computer systems, homomorphic encryption and zero-knowledge proofs are becoming widely used tools in privacy-preserving computing. Number theoretic transform (NTT) is a key primitive that dominates the performance of these algorithms, and thus becomes an attractive target for domain-specific acceleration. Prior NTT accelerators mostly support only fixed and small NTT sizes, which are insufficient for the diverse parameter requirements of different cryptographic algorithms and applications. In this paper, we propose an FPGA-based, scalable NTT accelerator that uses multi-dimensional decomposition to efficiently support various NTT sizes. The hardware uses a limited and fixed amount of compute and storage resources on-chip. An arbitrary-sized NTT task is decomposed into fixed-sized small NTT kernels that match the on-chip hardware and thus execute with high efficiency. We further incorporate techniques to optimize both off-chip and on-chip data transfers under such complicated decomposed execution. Overall, our accelerator balances between on-chip compute throughput and off-chip memory bandwidth. It can flexibly scale to very large NTT tasks, and outperforms prior FPGA-based NTT accelerators by over 2× at these large sizes.

Thibauld Feneuil

Signatures post-quantiques à partir de techniques de calcul multipartite Le développement actuel des ordinateurs quantiques pousse la communauté cryptographique à mettre au point de nouveaux cryptosystèmes dont la sécurité se fonde sur la difficulté à résoudre des problèmes cryptographiques résistant au calcul quantique. Dans le cadre de cette thèse, nous nous sommes focalisés sur la conception de schémas de signatures électroniques construits à partir de preuves à divulgation nulle de connaissance (zero-knowledge proofs of knowledge). Plus précisément, nous nous sommes intéressés au paradigme “MPC-in-the-Head” (littéralement, “calcul-multipartite-dans-la-tête”) qui fournit une méthode générique de construire de telles preuves en utilisant des techniques de calcul multipartite sécurisé. Nous proposons plusieurs nouveaux schémas de signatures utilisant le paradigme “MPC-in-the-Head”. La plupart d’entre eux sont compétitifs avec les schémas existants dans l’état de l’art post-quantique. Ils produisent des signatures ayant des tailles entre 5 et 20 kylo-octets (pour un niveau de sécurité de 128 bits) et possèdent de très petites clés (de moins de 200 octets). Les problèmes difficiles sur lesquels la sécurité de ces schémas se fonde sont très variés. Certains schémas s’appuient sur des hypothèses de sécurité issues de la théorie des codes correcteurs d’erreurs, telle que celle sur la difficulté à résoudre le problème de décodage par syndrome pour des codes linéaires aléatoires. Les autres schémas s’appuient sur la difficultés à résoudre un système d’équations quadratiques, le problème de la somme de sous-ensembles ou le problème MinRank. Nous avons également mis au point deux nouvelles techniques de MPC-in-the-Head. La première vise à gérer efficacement les situations où le secret est de petite taille avec un grand modulus. La seconde consiste en une nouvelle méthode pour transformer un protocole de calcul multipartite en preuve de divulgation nulle de connaissance. Cette nouvelle transformation offre des nouveaux compromis entre coût de communication et temps de calcul. En particulier, elle permet de produire des algorithmes de vérification très rapides. Plusieurs soumissions à l’appel du NIST pour des schémas de signatures post-quantiques supplémentaires s'appuient (parfois partiellement) sur des idées développées dans le cadre de cette thèse.

Yuan Tian, Yongda Pang, Xinke Tian

In large-scale private computing applications, various arithmetic relations appear as or can be reduced to matrix relations. In this paper, we establish the efficient zero-knowledge proof (ZKP) for the quadratic matrix relation over finite field Fp with three or four witness matrices. In private computing tasks, lots of arithmetic relations are instances or special cases of such form, particularly some matrix structural decomposition relations. Different from the widely applied vectorspecific method, our method is matrix-specific. The matrix equation is treated as a tensor equality and probabilisticequivalent reduction techniques are applied to reduce the non-linear matrix relation to simple vector relation. To the authors’ best knowledge, currently, there are no matrix-specific methods to ZKP for nonlinear matrix relations. Compared against the current general linearization (vector-specific) method, our method substantially outperforms it in all critical aspects, e.g., for n-by-t matrix witnesses the required size of common reference string (c.r.s.) can be compressed by a factor of 2nt and the number of rounds, group and field elements in messages are all decreased by a factor of ≈2 for large-size witnesses. Computational complexities are almost the same in both methods.

Yuan Tian, Yongda Pang, Xinke Tian

In large-scale private computing applications, various arithmetic relations appear as or can be reduced to matrix relations. In this paper, we establish the efficient zero-knowledge proof (ZKP) for the quadratic matrix relation over finite field Fp with two witness matrices. In private computing tasks, lots of typical relations are instances or special cases of this form, e.g., matrix multiplicative relation, inverse relation, isometric relation, etc. Different from the widely-applied vectorspecific method, our method is matrix-specific. The matrix equation is treated as a tensor equality and probabilisticequivalent reduction techniques are applied to reduce the non-linear matrix relation to simple vector relation. To the authors’ best knowledge, currently, there are no matrix-specific methods to ZKP for nonlinear matrix relations. Compared against the current (vector-specific) method, our method substantially outperforms it in all critical aspects, e.g., for n-raw t-column matrix witnesses, the required size of common reference string (c.r.s.) can be compressed by a factor of 2nt and the number of messages, group and field elements are all reduced by a factor of ≈2 for large-size witnesses. Computational complexities in both methods are almost the same.

Mohammed Mujeerulla, Preethi Preethi, Md. Sameeruddin Khan, Deepak S. Sakkari

No abstract is available for this record.

Ramiro Pinilla

(English) The main goal of this dissertation is to develop new lattice-based cryptographic schemes. Most of the cryptographic protocols that each and every one of us use on a daily basis are only secure under the assumption that two mathematical problems, namely the discrete logarithm on elliptic curves and the factorization of products of two primes, are computationally hard. That is believed to be true for classical computers, but quantum computers would be able to solve these problems much more efficiently, demolishing the foundations of plenty of cryptographic constructions. This reveals the importance of post-quantum alternatives, cryptographic schemes whose security relies on different problems intractable for both classical and quantum computers. The most promising family of problems widely believed to be hard for quantum computers are lattice-based problems. We increase the supply of lattice-based tools providing new Zero-Knowledge Proofs of Knowledge for the Ring Learning With Errors (RLWE) problem, perhaps the most popular lattice-based problem. Zero-knowledge proofs are protocols between a prover and a verifier where the prover convinces the verifier of the validity of certain statements without revealing any additional relevant information. Our proofs extend the literature of Stern-based proofs, following the techniques presented by Jacques Stern in 1994. His original idea involved a code-based problem, but it has been reiteratedly improved and generalized to be used with lattices. We illustrate our proposal defining a variant of the commitment scheme, a cryptographic primitive that allows us to ensure some message was already determined at some point without revealing it until a future time, defined by Benhamouda et al. in ESORICS 2015, and proving in zero-knowledge the knowledge of a valid opening. Most importantly we also show how to prove that the message committed in one commitment is a linear combination, with some public coefficients, of the committed messages from two other commitments, again without revealing any further information about the messages. Finally, we also present a zero-knowledge proof analogous to the previous one but for multiplicative relations, something much more involved that allows us to prove any arithmetic circuit. We give first an interactive version of these proofs and then show how to construct a non-interactive one. We diligently prove that both the commitment and the companion Zero-Knowledge Proofs of Knowledge are secure under the assumption of the hardness of the underlying lattice problems. Furthermore, we specifically develop such proofs so that the arising conditions can be directly used to compute parameters that satisfy them. This way we provide a general method to instantiate our commitment and proofs with any desired security level. Thanks to this practical approach we have been able to implement all the proposed schemes and benchmark the prototype im-plementation with actually secure parameters, which allows us to obtain meaningful results and compare its performance with the existing alternatives. Moreover, provided that multiplication of polynomials in the quotient ring ℤₚ[𝑥]/⟨𝑥ⁿ + 1⟩, with 𝑝 prime and 𝑛 a power of two, is the most basic operation when working with ideal lattices we comprehensively study what are the necessary and sufficient conditions needed for applying (a generalized version of) the Fast Fourier Transform (FFT) to obtain an efficient multiplication algorithm in quotient rings as ℤₘ[𝑥]/⟨𝑥ⁿ − 𝑎⟩ (where we consider any positive integer 𝑚 and generalize the quotient), as we think it is of independent interest. We believe such a theoretical analysis is fundamental to be able to determine when a given generalization can also be applied to design an efficient multiplication algorithm when the FFT is not defined for the ring we are considering. That is the case of the rings used for the commitment and proofs described before, where only a partial FFT is available. (Español) El objetivo principal de esta tesis es obtener nuevos esquemas criptográficos basados en retículos. La mayoría de los protocolos criptográficos que usamos a diario son únicamente seguros bajo la hipótesis de que el problema del logaritmo discreto en curvas elípticas y la factorización de productos de dos primos son computacionalmente difíciles. Se cree que esto es cierto para los ordenadores clásicos, pero los ordenadores cuánticos podrían resolver estos problemas de forma mucho más eficiente, acabando con las bases sobre las que se fundamenta una multitud de construcciones criptográficas. Esto evidencia la importancia de las alternativas poscuánticas, cuya seguridad se basa en problemas diferentes que sean inasumibles tanto para los ordenadores clásicos como los cuánticos. Los problemas de retículos son los candidatos más prometedores, puesto que se considera que son problemas difíciles para los ordenadores cuánticos. Presentamos nuevas herramientas basadas en retículos con unas Pruebas de Conocimiento Nulo para el problema Ring Learning With Errors (RLWE), seguramente el problema de retículos más popular. Las pruebas de Conocimiento Nulo son protocolos entre un probador y un verificador en los que el primero convence al segundo de la validez de una proposición, sin revelar ninguna información adicional relevante. Nuestras pruebas se basan en el protocolo de Stern, siguiendo sus técnicas presentadas en 1994. Su idea original involucraba un problema de códigos, pero se ha mejorado y generalizado reiteradamente para poder aplicarse a retículos. Ilustramos nuestra propuesta definiendo una variante del esquema de compromiso, una primitiva criptográfica que nos permite asegurar que un mensaje fue determinado en cierto momento sin revelarlo hasta pasado un tiempo, definido por Benhamouda et al. en ESORICS 2015, y probando que conocemos una apertura válida. Además mostramos cómo probar que el mensaje comprometido es una combinación lineal, con coeficientes públicos, de los mensajes comprometidos en otros dos compromisos. Finalmente también presentamos una prueba de Conocimiento Nulo análoga a la anterior pero para relaciones multiplicativas, algo mucho más laborioso que nos permite realizar circuitos aritméticos. Todo esto sin revelar ninguna información adicional sobre los mensajes. Mostramos tanto una versión interactiva como una no interactiva. Probamos que tanto el compromiso como las pruebas de Conocimiento Nulo que le acompañan son seguras bajo la hipótesis de que el problema de retículos subyacente sea difícil. Además planteamos estas pruebas específicamente con el objetivo de que las condiciones que surjan puedan ser utilizadas directamente para calcular los parámetros que las satisfagan. De esta forma proporcionamos un método genérico para instanciar nuestro compromiso y pruebas con cualquier nivel de seguridad. Gracias a este enfoque práctico hemos podido implementar todos los esquemas propuestos y evaluar el rendimiento con parámetros seguros, lo que nos permite obtener resultados relevantes que poder comparar con las alternativas existentes. Por otra parte, dado que la multiplicación de polinomios en el anillo cociente ℤₚ[𝑥]/⟨𝑥ⁿ + 1⟩, con 𝑝 primo y 𝑛 una potencia de 2, es la operación más utilizada al trabajar con retículos ideales, estudiamos de forma exhaustiva cuáles son las condiciones suficientes y necesarias para aplicar (una versión generalizada de) la Transformada Rápida de Fourier (FFT, por sus siglas en inglés) para obtener algoritmos de multiplicación eficientes en anillos cociente ℤₘ[𝑥]/⟨𝑥ⁿ − 𝑎⟩, (considerando cualquier 𝑚 positiva y generalizando el cociente), de interés por sí mismo. Creemos que este análisis teórico es fundamental para determinar cuándo puede diseñarse un algoritmo eficiente de multiplicación si la FFT no está definida para el anillo considerado. Es el caso de los anillos que utilizamos en el compromiso y las pruebas descritas anteriormente, donde solo es posible calcular una FFT parcial.

Sujit Sangram Sahoo, Vijay Kumar Chaurasiya

No abstract is available for this record.

Yiyang Xu, Dahong Qian

In cryptography, Zero-knowledge proof (ZKP) is a protocol that enables a party to demonstrate the accuracy of a given statement without revealing any additional information beyond the validity of the statement itself. This protocol ensures both the confidentiality and integrity of the computation, and has therefore become widely utilized in various industries for privacy-preserving, including online age verification and electronic voting. The most computationally demanding component of most Zero Knowledge Proof systems is the Multi-Scalar Multiplication (MSM) module. To address this issue and achieve low power and cost efficient MSM for different applications, a novel heterogeneous MSM architecture, ZodiacMSM, is developed. The architecture utilizes the Pippenger algorithm and a multi-chip design with memory access partitioning, which enables scalable performance for polynomials of various sizes in different ZKP applications. The performance of this architecture increases almost linearly with the number of nodes. ZodiacMSM supports multiple elliptic curves through reconfigurable fully-pipelined point-addition to achieve lower latency and minimize scheduler effort. When evaluated in 28nm, ZodiacMSM is able to achieve 2.3x speedup on MSM with single node and 32x speedup on 16 nodes compared to previous peer-reviewed state-of-the-art ASIC results [8].

Annisa Dini Handayani, Sa'aadah Sajjana Carita, Nia Yulianti

Zero-knowledge proof is a tool in cryptography that ensures the privacy of the users. In general, zero-knowledge (ZK) proves that a user (called the prover) knows one secret value to another (called the verifier) without revealing the secret value itself. This proof is used, for instance, in password verification or authentication process. The concept of ZK has been implemented in various fileds, including secure multi-party computation and blockchain technology. ZK proof could use pairing as the interactive function, through which the prover and verifier play their roles. ZK proof usually protects one secret, meaning the prover only certifies their knowledge of one single secret value. In this paper, we proposed a zero-knowledge scheme using a bilinear map which could help a user prove their knowledge related to multiple secret values to others. We also show that this scheme satisfies completeness and soundness properties, implying the proposed scheme is a proof of knowledge.

Stephan Cilliers, Amit Kumar Mishra

In this paper, we present the exploration of algorithms for the hardware acceleration of multi-scalar multiplication (MSM) on field programmable gate arrays (FPGAs). We have aggregated Verilog and System Verilog implementations of popular algorithms for each component in the MSM processing stack, including large integer multiplication, modular reduction, and elliptic curve point addition, doubling, and scalar multiplication. Additionally, we have compared these algorithms in the context of MSM and evaluated their performance. Our results highlight the efficiency of application specific hardware over general purpose processors for computationally intensive operations. Our contribution provides a valuable resource for those interested in using hardware acceleration to improve the efficiency of zero knowledge proof systems.

Tao Lu, Chengkun Wei, Ruijing Yu, Chaochao Chen · 8 authors

Zero-knowledge proof is a critical cryptographic primitive. Its most practical type, called zero-knowledge Succinct Non-interactive ARgument of Knowledge (zkSNARK), has been deployed in various privacy-preserving applications such as cryptocurrencies and verifiable machine learning. Unfortunately, zkSNARK like Groth16 has a high overhead on its proof generation step, which consists of several time-consuming operations, including large-scale matrix-vector multiplication (MUL), number-theoretic transform (NTT), and multi-scalar multiplication (MSM). Therefore, this paper presents cuZK, an efficient GPU implementation of zkSNARK with the following three techniques to achieve high performance. First, we propose a new parallel MSM algorithm. This MSM algorithm achieves nearly perfect linear speedup over the Pippenger algorithm, a well-known serial MSM algorithm. Second, we parallelize the MUL operation. Along with our self-designed MSM scheme and well-studied NTT scheme, cuZK achieves the parallelization of all operations in the proof generation step. Third, cuZK reduces the latency overhead caused by CPU-GPU data transfer by 1) reducing redundant data transfer and 2) overlapping data transfer and device computation. The evaluation results show that our MSM module provides over 2.08x (up to 2.94x) speedup versus the state-of-the-art GPU implementation. cuZK achieves over 2.65x (up to 4.86x) speedup on standard benchmarks and 2.18× speedup on a GPU-accelerated cryptocurrency application, Filecoin.

Handong Cui, Kwan Yin Chan, Tsz Hon Yuen, Xin Kang · 5 authors

Abstract In most threshold Elliptic Curve Digital Signature Algorithm (ECDSA) signatures using additively homomorphic encryption, the zero-knowledge (ZK) proofs related to the ciphertext or the message space are the bottleneck in terms of bandwidth as well as computation time. In this paper, we propose a compact ZK proof for relations related to the Castagnos–Laguillaumie (CL) encryption, which is 33% shorter and 29% faster than the existing work in PKC 2021. We also give new ZK proofs for relations related to homomorphic operations over the CL ciphertext. These new ZK proofs are useful to construct a bandwidth-efficient universal composable-secure threshold ECDSA without compromising the proactive security and the non-interactivity. In particular, we lowered the communication and computation cost of the key refresh algorithm in the Paillier-based counterpart from $O(n^3)$ to $O(n^2)$. Considering a 5-signer setting, the bandwidth is better than the Paillier-based counterpart for up to 99, 95 and 35% for key generation, key refreshment and pre-signing, respectively.

Peng Jiang, Fuchun Guo, Willy Susilo, Chao Lin · 8 authors

Ethereum leverages ECDSA as the digital signature scheme to validate transactions. From the provable security standpoint, ECDSA built on an 80-bit security Elliptic Curve group can achieve at most 50-bit concrete security, rather than 80-bit security, due to its reduction loss for$2^{30}$signature queries in security analysis. The state-of-the-art ECDSA scheme comes with no de facto formal security guarantee. Although there have been many signatures with higher concrete security, their structures are quite different from ECDSA and a total replacement of the signature field in Ethereum will incur high deployment cost. In this work, we present EthereumX without compromising the signature structure in Ethereum while achieves better security. The security gain is built on top of a new technique named randomness preprocessing module (RPM), which can securely pre-generate and verify randomness with the help of Ethereum. Calling RPM allows to pre-select randomness, which will be used for the subsequent signature, and to verify the randomness, assuring that it is previously generated. We give an instantiation with formal security guarantee and prove that it can be improved to 80-bit concrete security under the same discrete logarithm assumption as ECDSA. From this instantiated scheme, we implement EthereumX via a deployment into a locally simulated network. Experiment results show that EthereumX costs 5 seconds for a block generation which is equal to Ethereum, and generates/verifies at least$17017/10623$transactions per second that is practical enough in application, even if they are slightly slower than Ethereum which generates/verifies at least$17908/11257$transactions per second. We also mention that RMP can be applied to other DL-based signatures for the security improvement.

Guiwen Luo, Guang Gong

The operation of computing$n$scalar multiplications in an elliptic curve group and then adding them together is called n-scalar multiplication.$n$-scalar multiplication is the essential operation for proof generation and verification in pairing-based trusted setup zero-knowledge succinct non-interactive argument of knowledge protocols, which enable the privacy-preserving features in blockchain applications. This paper proposed a method to compute$n$-scalar multiplication taking advantage of$3n$precomputed points. When instantiating over BLS12-381 curve, for$n=2^{c}\ (10\leq c\leq 22)$, which covers the majority of our purported applications, the proposed method showed 2.59% ∼ 12.26% theoretical speed improvement and demonstrated 1.63% ∼ 11.54% experimental improvement against Pippenger's bucket method.

Suthee Ruangwises

In this paper, we propose a physical protocol to verify the first nonzero term of a sequence using a deck of cards. The protocol lets a prover show the value of the first nonzero term of a given sequence to a verifier without revealing which term it is. Our protocol uses $Θ(1)$ shuffles, which is asymptotically lower than that of an existing protocol of Fukusawa and Manabe which uses $Θ(n)$ shuffles, where $n$ is the length of the sequence. We also apply our protocol to construct zero-knowledge proof protocols for three well-known logic puzzles: ABC End View, Goishi Hiroi, and Toichika. These protocols enables a prover to physically show that he/she know solutions of the puzzles without revealing them.

Dong Fang, Guifang Huang, Mengfan Wang, Lei Hu

Abstract Bootle et al. in CRYPTO 2019 proposed a zero knowledge proof for an $\mathrm{ISIS}_{m,n,q,\beta }$ instance $A\vec{s} = \vec{u} \bmod q$ with $\|\vec{s}\|_{\infty }\leq \beta $ (BLS scheme). It was implemented by transforming the instance into the form $A^{\prime }\vec{s}^{\prime } =\vec{u}\bmod q$, where the coefficients of $\vec{s}^{\prime}$ are in $\{0,1,2\}$, and proved the latter in an exact way. With the concrete parameters $m=1024,n=2048,\beta =1,q\approx 2^{32}$, their proof is of length 384.03KB. In this paper, we decrease the proof size of BLS scheme by two techniques. The first one takes effect on some special parameters. For these parameters, using the binary basic set instead of the ternary one results in a shorter proof. The second one deals with the repetition of the lower half in BLS scheme. Observing that what the lower half proves is of form $\mathbf{B}\vec{\mathbf{r}}=\vec{\mathbf{t}}$ with a short vector $\vec{\mathbf{r}}$ of polynomials, a variant of parallel repetition can be used to shorten the proof size. Combining these two techniques together, the proof size of the above-mentioned instance can be reduced to 220.01KB, only 57.3$\%$ of BLS scheme.

Mohammed Mujeer Ulla, Deepak S. Sakkari

Very recent attacks like ladder leak demonstrated feasibility to recover private key with side channel attacks using just one bit of secret nonce. ECDSA nonce bias can be exploited in many ways. Some attacks on ECDSA involve complicated Fourier analysis and lattice mathematics. In this paper will enable cryptographers to identify efficient ways in which ECDSA can be cracked on curves NIST256p, SECP256k1, NIST521p and weak nonce, kind of attacks that can crack ECDSA and how to protect yourself. Initially we begin with ECDSA signature to sign a message using private key and validate the generated signature using the shared public key. Then we use a nonce or a random value to randomize the generated signature. Every time we sign, a new verifiable random nonce value is created and way in which the intruder can discover the private key if the signer leaks any one of the nonce value. Then we use Lenstra–Lenstra–Lovasz (LLL) method as a black box, we will try to attack signatures generated from bad nonce or bad random number generator (RAG) on NIST256p, SECP256k1 curves. The analysis is performed by considering all the three curves for implementation of Elliptic Curve Digital Signature Algorithm (ECDSA).The comparative analysis for each of the selected curves in terms of computational time is done with leak of nonce and with Lenstra–Lenstra–Lovasz method to crack ECDSA. The average computational costs to break ECDSA with curves NIST256p, NIST521p and SECP256k1 are 0.016, 0.34, 0.46 respectively which is almost to zero depicts the strength of algorithm. The average computational costs to break ECDSA with curves SECP256K1 and NIST256p using LLL are 2.9 and 3.4 respectively.