research-article Share on Blockchains and the Logic of Accountability: Keynote Address Authors: Maurice Herlihy Brown University and Oracle Labs Brown University and Oracle LabsView Profile , Mark Moir Oracle Labs Oracle LabsView Profile Authors Info & Claims LICS '16: Proceedings of the 31st Annual ACM/IEEE Symposium on Logic in Computer ScienceJuly 2016 Pages 27–30https://doi.org/10.1145/2933575.2934579Published:05 July 2016Publication History 6citation736DownloadsMetricsTotal Citations6Total Downloads736Last 12 Months19Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access
Quantum information and computation provide a fascinating twist on the notion of proofs in computational complexity theory. For instance, one may consider a quantum computational analogue of the complexity class NP, known as QMA, in which a quantum state plays the role of a proof (also called a certificate or witness), and is checked by a polynomial-time quantum computation. For some problems, the fact that a quantum proof state could be a superposition over exponentially many classical states appears to offer computational advantages over classical proof strings. In the interactive proof system setting, one may consider a verifier and one or more provers that exchange and process quantum information rather than classical information during an interaction for a given input string, giving rise to quantum complexity classes such as QIP, QSZK, and QMIP* that represent natural quantum analogues of IP, SZK, and MIP. While quantum interactive proof systems inherit some properties from their classical counterparts, they also possess distinct and uniquely quantum features that lead to an interesting landscape of complexity classes based on variants of this model. In this survey we provide an overview of many of the known results concerning quantum proofs, computational models based on this concept, and properties of the complexity classes they define. In particular, we discuss non-interactive proofs and the complexity class QMA, single-prover quantum interactive proof systems and the complexity class QIP, statistical zero-knowledge quantum interactive proof systems and the complexity class QSZK, and multiprover interactive proof systems and the complexity classes QMIP, QMIP*, and MIP*.
Distributed consensus (aka Byzantine agreement [Pease, Shostak & Lamport, 1980]) is one of the fundamental problems in fault-tolerant distributed computing and cryptographic protocols. It requires correct participants (parties) to reach agreement on initially held values despite the arbitrary behavior of some of them, with the additional requirement (known as Validity) that if all the correct participants start off with the same value, then that must be the decision value. The problem has been studied extensively in both the unconditional setting (where no assumptions are made about the computational power of the adversary) and the cryptographic setting, and efficient (i.e., polynomial-time) solutions exist tolerating the optimal number of misbehaving parties and running in the optimal number of rounds, on networks with pairwise authenticated channels. In many interesting scenarios, however, such as "peer-to-peer" networks, where parties come and go as they please and there are no prior relations among them, such infrastructure (pairwise authenticated channels, public-key infrastructure) is unavailable, thus raising the question whether anything "interesting" can be achieved. In this talk we answer this question in the affirmative, presenting two new probabilistic consensus protocols based on "proofs of work" (POWs, aka "moderately hard functions," "cryptographic puzzles" [Dwork & Naor, 1992]), the technology underlying Bitcoin, the first and most popular decentralized cryptocurrency to date. (In Bitcoin, POWs are implemented using the SHA-256 cryptographic hash function, by finding preimages that produce values in a given smaller domain.) In more detail, we first extract and analyze the core of the Bitcoin protocol, which we term the Bitcoin backbone, and prove two fundamental properties of its "blockchain" approach which we call "common prefix" and "chain quality." The consensus protocols can then be built as applications on top of the backbone protocol, with the Agreement and Validity properties following from common prefix and chain quality, respectively. The first protocol works assuming the adversary's hashing power is bounded by 1/3 of the network's total hashing power. The second consensus protocol is more elaborate, relies on the notion of robust transaction ledgers, which capture the essence of Bitcoin's operation as a cryptocurrency, and works assuming the adversary's hashing power is strictly less than 1/2.
Succinct non-interactive zero-knowledge arguments of knowledge (Zk-SNARKs) are needed in many applications. Unfortunately, all previous zk-SNARKs for interesting languages are either inefficient for the prover, or are non-adaptive and based on a commitment scheme that depends both on the prover's input and on the language, i.e., they are not commit-and-prove (CaP) SNARKs. We propose a proof-friendly extractable commitment scheme, and use it to construct prover-efficient adaptive CaP succinct zk-SNARKs for different languages, that can all reuse committed data. In new zk-SNARKs, the prover computation is dominated by a linear number of cryptographic operations. We use batch-verification to decrease the verifier's computation; importantly, batch-verification can be used also in QAP-based zk-SNARKs.
Eli Ben‐Sasson, Alessandro Chiesa, Michael A. Forbes, Ariel Gabizon · 6 authors
We study the problem of constructing proof systems that achieve both soundness and zero knowledge unconditionally (without relying on intractability assumptions). Known techniques for this goal are primarily combinatorial, despite the fact that constructions of interactive proofs (IPs) and probabilistically checkable proofs (PCPs) heavily rely on algebraic techniques to achieve their properties.
Eli Ben‐Sasson, Alessandro Chiesa, Ariel Gabizon, Madars Virza
The seminal result that every language having an interactive proof also has a zero-knowledge interactive proof assumes the existence of one-way functions. Ostrovsky and Wigderson (ISTCS 1993) proved that this assumption is necessary: if one-way functions do not exist, then only languages in BPP have zero-knowledge interactive proofs. Ben-Or et al. (STOC 1988) proved that, nevertheless, every language having a multi-prover interactive proof also has a zero-knowledge multi-prover interactive proof, unconditionally. Their work led to, among many other things, a line of work studying zero knowledge without intractability assumptions. In this line of work, Kilian, Petrank, and Tardos (STOC 1997) defined and constructed zero-knowledge probabilistically checkable proofs (PCPs). While PCPs with quasilinear-size proof length, but without zero knowledge, are known, no such result is known for zero knowledge PCPs. In this work, we show how to construct “2-round” PCPs that are zero knowledge and of length ~ O(K) where K is the number of queries made by a malicious polynomial time verifier. Previous solutions required PCPs of length at leastK 6 to maintain zero knowledge. In this model, which we call duplex PCP (DPCP), the verifier first receives an oracle string from the prover, then replies with a message, and then receives another oracle string from the prover; a malicious verifier can make up toK queries in total to both oracles. Deviating from previous works, our constructions do not invoke the PCP Theorem as a blackbox but instead rely on certain algebraic properties of a specific family of PCPs. We show that if the PCP has a certain linear algebraic structure — which many central constructions can be shown to possess, including [BFLS91,ALMSS98,BS08] — we can add the zero knowledge property at virtually no cost (up to additive lower order terms) while introducing only minor modifications in the algorithms of the prover and verifier. We believe that our linear-algebraic characterization of PCPs may be of independent interest, as it gives a simplified way to view previous well-studied PCP constructions.
Samuel Ranellucci, Alain Tapp, Rasmus Winther Zakarias
Abstract. Even though Zero-knowledge has existed for more than 30 years, few generic constructions for Zero-knowledge exist. In this paper we present a new kind of commitment scheme on which we build a novel and efficient Zero-knowledge protocol for circuit satisfiability. 1
A probabilistically Checkable Proof (PCP) allows a randomized verifier, with oracle access to a purported proof, to probabilistically verify an input statement of the form “x ∈ L” by querying only few bits of the proof. A PCP of proximity (PCPP) has the additional feature of allowing the verifier to query only few bits of the input x, where if the input is accepted then the verifier is guaranteed that (with high probability) the input is close to some x′ ∈ L.
Single-prover interactive proofs can recognize PSPACE; if certain complexity assumptions are made, they can do so in zero-knowledge. Generalizing to multiple non-communicating provers extends this class to NEXP, and at the same time removes the complexity assumption needed for zero-knowledge. \n \nHowever, it was recently discovered that the non-communication condition might be insufficient to guarantee soundness. The provers can form joint randomness through non-local computation without communicating. This could break protocols that rely on the statistical independence of the provers. \n \nIn this work, we analyze multi-prover interactive proofs under the constraint of statistical isolation which prohibits non-local computation. We show that there exists perfect zero-knowledge proofs for NEXP under statistical isolation.
Jannik Dreier, Guillaume Dumas, Hugo Jonker, Pascal Lafourcade
An electronic auction protocol will only be used by those who trust that it operates correctly. Therefore, e-auction protocols must be verifiable: seller, buyer and losing bidders must all be able to determine that the result was correct. We pose that the importance of verifiability for e-auctions necessitates a formal analysis. Consequently, in the first part of the talk, we identify notions of verifiability for each stakeholder. We formalize these and then use the developed framework to study the verifiability of several examples. We provide an analysis of the protocol by Sako in the applied pi-calculus with help of ProVerif, finding it to be correct. Additionally we identify issues with the protocols due to Curtis et al. and Brandt. In the second part, we will analyze the protocol by Brandt in more detail. We show first that this protocol – when using malleable interactive zero-knowledge proofs – is vulnerable to attacks by dishonest bidders. Such bidders can manipulate the publicly available data in a way that allows the seller to deduce all participants’ bids. Additionally we discuss attacks on non-repudiation, fairness and the privacy of individual bidders exploiting authentication problems.
The notion of Multi-Agent System (MAS) environment, as remarked by recent literature, has gained a key role, becoming a mediating entity, functioning as enabler but possibly also as a manager and constrainer of agent actions, perceptions, and interactions 1 while addressing the requirements of openness and scalability. According to such a perspective, the environment is not a merely passive source of agent perceptions and target of agent actions which is, actually, the dominant perspective in agency, but a first-class abstraction that can be suitably designed to encapsulate some fundamental functionalities and services, such as coordination and organization, besides agent mobility, communications, security, etc [2]. Then, the environment dimension appears to intersect with all the dimensions that should be addressed to define an agreement between autonomous agents, that is, all the different Agreement Technologies giving support to the building, development and management of agreements in decentralized and open systems between autonomous agents. Those dimensions are the ones related to the development of technologies dealing with: Semantics, Norms, Organizations, Argumentation & Negotiation, and Trust.
Multi-agent system (MAS) is a common way of exploiting the potential power of agent by combining many agents in one system. Each agent in a multivalent system has incomplete information and is in capable of solving entire problem on its own. Multi-agent system offers modularity. If a problem domain is particularly complex, large and contain uncertainty, then the one way to address, it to develop a number of functional specific and modular agent that are specialized at solving various problems individually. It also consists of heterogeneous agents implemented by different tool and techniques. MAS can be defining as loosely coupled network of problem solvers that interact to solve problems that are beyond the individual capabilities or knowledge of each problem solver. These problem solvers, often ailed agent are autonomous and can be heterogeneous in nature. MAS is followed by characteristics, Future application, What to be change, problem solving agent, tools and techniques used, various architecture, multi agent applications and finally future Direction and conclusion. Various Characteristics are limited viewpoint, effectively, decentralized; computation is asynchronous, use of genetic algorithms. It has some drawbacks which must be change to make MAS more effective. In the session of problem solving of MAS, the agent performance measure contains many factors to improve it like formulation of problems, task allocation, organizations. In planning of multivalent this paper cover self-interested multivalent interactions, modeling of other agents, managing communication, effective allocation of limited resources to multiple agents with managing resources. Using of tool, to make the agent more efficient in task that are often used. The architecture o MAS followed by three layers, explore, wander, avoid obstacles respectively. Further different and task decomposition can yield various architecture like BDI (Belief Desire Intension), RETSINA. Various applications of multi agent system exist today, to solve the real-life problems, new systems are being developed two distinct categories and also many others like process control, telecommunication, air traffic control, transportation systems, commercial management, electronic commerce, entertainment applications, medical applications. The future aspect of MAS to solve problems that are too large, to allow interconnection and interoperation of multiple existing legacy systems etc.
Shlomi Dolev, Panagiota N. Panagopoulou, Mikaël Rabie, Elad M. Schiller · 5 authors
Players in a game are assumed to be totally rational and absolutely smart. However, in reality all players may act in non-rational ways and may fail to understand and find their best actions. In particular, participants in social interactions, such as lotteries and auctions, cannot be expected to always find by themselves the "best-reply" to any situation. Indeed, agents may consult with others about the possible outcome of their actions. It is then up to the counselee to assure the rationality of the consultant's advice. We present a distributed computer system infrastructure, named rationality authority, that allows safe consultation among (possibly biased) parties. The parties' advices are adapted only after verifying their feasibility and optimality by standard formal proof checkers. The rationality authority design considers computational constraints, as well as privacy and security issues, such as verification methods that do not reveal private preferences. Some of the techniques resembles zero-knowledge proofs. A non-cooperative game is presented by the game inventor along with its (possibly intractable) equilibrium. The game inventor advises playing by this equilibrium and offers a checkable proof for the equilibrium feasibility and optimality. Standard verification procedures, provided by trusted (according to their reputation) verification procedures, are used to verify the proof. Thus, the proposed rationality authority infrastructure facilitates the applications of game theory in several important real-life scenarios by the use of computing systems.
Imad Fakhri Taha Alshaikhli, Rusydi Hasan Makarin, Siti Khairunnisa Mohd Bakri, Nur Dalilah More Yusoff · 5 authors
Much of the current innovation in advanced materials is occurring at the nanoscale, specifically in manufactured nanomaterials (MNs). MNs display unique attributes and behaviors, and may be biologically and physically unique, making them valuable across a wide range of applications. However, as the number, diversity and complexity of MNs coming to market continue to grow, assessing their health and environmental risks with traditional animal testing approaches is too time- and cost-intensive to be practical, and is undesirable for ethical reasons. New approaches are needed that meet current requirements for regulatory risk assessment while reducing reliance on animal testing and enabling safer-by-design product development strategies to be implemented. The adverse outcome pathway (AOP) framework presents a sound model for the advancement of MN decision making. Yet, there are currently gaps in technical and policy aspects of AOPs that hinder the adoption and use for MN risk assessment and regulatory decision making. This review outlines the current status and next steps for the development and use of the AOP framework in decision making regarding the safety of MNs. Opportunities and challenges are identified concerning the advancement and adoption of AOPs as part of an integrated approach to testing and assessing (IATA) MNs, as are specific actions proposed to advance the development, use and acceptance of the AOP framework and associated testing strategies for MN risk assessment and decision making. The intention of this review is to reflect the views of a diversity of stakeholders including experts, researchers, policymakers, regulators, risk assessors and industry representatives on the current status, needs and requirements to facilitate the future use of AOPs in MN risk assessment. It incorporates the views and feedback of experts that participated in two workshops hosted as part of an Organization for Economic Cooperation and Development (OECD) Working Party on Manufactured Nanomaterials (WPMN) project titled, "Advancing AOP Development for Nanomaterial Risk Assessment and Categorization", as well as input from several EU-funded nanosafety research consortia.
We prove new results regarding the complexity of various complexity classes under randomized oracle reductions. We first prove that BPPPSZK⊆ AM ∩ coAM, where PSZK is the class of promise problems having statistical zero knowledge proofs. This strengthens the previously known facts that PSZK is closed under NC1truth-table reductions (Sahai and Vadhan, J. ACM '03) and that PPSZK⊆ AM ∩ coAM (Vadhan, personal communication). Our proof relies on showing that a certain class of real-valued functions that we call ℝ-TUAM can be approximated using an AM protocol. Then we investigate the power of randomized oracle reductions with relation to the notion of instance checking (Blum and Kannan, J. ACM '95). We observe that a theorem of Beigel implies that if any problem in TFNP such as Nash equilibrium is NP-hard under randomized oracle reductions, then SAT is checkable. We also observe that Beigel's theorem can be extended to an average-case setting by relating checking to the notion of program testing (Blum et al., JCSS '93). From this, we derive that if one-way functions can be based on NP-hardness via a randomized oracle reduction, then SAT is checkable. By showing that NP has a non-uniform tester, we also show that worst-case to average-case randomized oracle reduction for any relation (or language) R E NP implies that R has a nonuniform instance checker. These results hold even for adaptive randomized oracle reductions.
José Bacelar Almeida, Endre Bangerter, Manuel Barbosa, Stephan Krenn · 6 authors
Abstract. Zero-knowledge proofs of knowledge (ZK-PoK) are important building blocks for numerous cryptographic applications. Although ZK-PoK have very useful properties, their real world deployment is typically hindered by their significant complexity compared to other (noninteractive) crypto primitives. Moreover, their design and implementation is time-consuming and error-prone. We contribute to overcoming these challenges as follows: We present a comprehensive specification language and a certifying compiler for ZK-PoK protocols based on Σ-protocols and composition techniques known in literature. The compiler allows the fully automatic translation of an abstract description of a proof goal into an executable implementation. Moreover, the compiler overcomes various restrictions of previous approaches, e.g., it supports the important class of exponentiation homomorphisms with hidden-order co-domain, needed for privacy-preserving applications such as idemix. Finally, our compiler is certifying, in the sense that it automatically produces a formal proof of security (soundness) of the compiled protocol (currently covering special homomorphisms) using the Isabelle/HOL theorem prover.