diff --git a/sigma-or-notes.pdf b/sigma-or-notes.pdf new file mode 100644 index 0000000..e3a8705 Binary files /dev/null and b/sigma-or-notes.pdf differ diff --git a/sigma-or-notes.tex b/sigma-or-notes.tex new file mode 100644 index 0000000..6e7be31 --- /dev/null +++ b/sigma-or-notes.tex @@ -0,0 +1,155 @@ +\documentclass{article} +\usepackage[utf8]{inputenc} +\usepackage{amsfonts} +\usepackage{amsthm} % theorems structure +\usepackage{enumerate} +\usepackage{hyperref} % links +\usepackage{tikz} % diagrams +\usepackage{pgf-umlsd} % diagrams +\usepackage{amsmath} % arrows + +\theoremstyle{definition} +\newtheorem{example}{Example}[section] + +\title{Sigma protocol and OR proofs - notes} +\author{arnaucube} +\date{March 2022} + +\begin{document} + +\maketitle + +\begin{abstract} + This document contains the notes taken during the \emph{Cryptography Seminars} given by \href{https://github.com/rbkhmrcr}{Rebekah Mercer}. +\end{abstract} + +\tableofcontents + +\section{Sigma protocol} + +\subsection{The protocol} +Let $q$ be a prime, $q$ a prime divisor in $p-1$, and $g$ and element of order $q$ in $\mathbb{Z}_p^a$. Then we have $G = \langle g \rangle$. +\\ +We assume that computationally for a given $A$ it's hard to find $a \in \mathbb{F}$ such that $A = g^a$. +\\ +Alice wants to prove that knows the \emph{witness} $w \in \mathbb{F}$, such that the \emph{statement} $X = g^w$, without revealing $w$. + +\begin{enumerate}[1.] + \item Alice generates a random $a \xleftarrow{r} \mathbb{F}$, and computes $A=g^a$. And sends $A$ to Bob. + \item Bob generates a challenge $c \xleftarrow{r} \mathbb{F}$, and sends it to Alice. + \item Alice computes $z=a + c \cdot w$, and sends it to Bob. + \item Bob verifies it by checking that $g^z == X^c \cdot A$. +\end{enumerate} + +We can unfold Bob's verification and see that: +$$g^z == X^c \cdot A$$ +$$g^{a+cw} == g^{wc} g^a$$ +$$g^{a+cw} == g^{wc+a}$$ + +\begin{center} +\begin{sequencediagram} + \newinst[1]{a}{Alice} + \newinst[3]{b}{Bob} + \mess[0]{a}{$A$}{b} + \mess[2]{b}{$c$}{a} + \mess[2]{a}{$z$}{b} + \mess[0]{b}{$ok$}{a} +\end{sequencediagram} +\end{center} + +Properties: +\begin{enumerate}[i.] + \item \emph{correctness/completness}: if Alice know the witness for the statement, then they can create a valid proof. + \item \emph{soundness}: if someone does not have knowledge of the witness, can not form a valid proof (verifier will always reject). + \item \emph{zero knowledge}: nobody gains knowledge of anything new with the proof. prior knowledge + proof = prior knowledge +\end{enumerate} + +\subsection{Non interactive protocol} +With the \emph{Fiat-Shamir Heuristic}, we model a hash function as a random oracle, thus we can replace Bob's role by a hash function in order to obtain the challenge $c \in \mathbb{F}$. +\\ +So, we replace the step 2 from the described protocol by $c = H(X || A)$ (where $H$ is a known hash function). + +\subsection{What could go wrong (Simulator)} +If the verifier (Bob) sends $c \in \mathbb{F}$, prior to the prover committed to $A$, the prover could create a proof about a public key which they don't know $w$. +\begin{enumerate}[1.] + \item Bob sends $c \xleftarrow{r} \mathbb{F}$ to Alice + \item Alice generates $z \xleftarrow{r} \mathbb{F}$ + \item Alice then computes $A = g^z X^{-c}$, and sends $z, A$ to Bob + \item Bob would check that $g^z == X^c A$ and it would pass the verification, as $g^z== X^c \cdot A \Rightarrow g^z==X^c \cdot g^z X^{-c} \Rightarrow g^z == g^z$. +\end{enumerate} + +As we've seen, it's really important the order of the steps, so Alice must commit to $A$ before knowing $c$.\\ +This 'fake' proof generation is often called the \emph{simulator} and used for further constructions. + +\section{OR proof} + +\emph{OR proofs} allows the prover to prove that they know the witness $w$ of one of the two known \emph{public keys} $X_0, X_1 \in \mathbb{F}$, without revealing which one. It uses the construction seen in the \emph{sigma protocols} together with the idea of the \emph{simulator}. + +A similar construction is used for $n$ statements in the \emph{ring signatures} scheme (used for example in \emph{Monero}). In our case, we will work with $n=2$. + +\subsection{The protocol} +\subsubsection{Simulator} +We can assume that the simulator is a box that for given the inputs $(g, X)$, it will output $(A_s, c_s, z_s)$, such that verification succeeds ($g^{z_s}==X^{c_s} \cdot A_s$). + +\begin{center} +\begin{tikzpicture} +\node [draw, + minimum width=2cm, + minimum height=1.2cm, + right=1cm + ] (simulator) {simulator}; +\draw[-stealth] ++(-1,0) -- (simulator.west) + node[midway,above]{$g, X$}; +\draw[-stealth] (simulator.east) -- ++(+2,0) + node[midway,above]{$A_s, c_s, z_s$}; +\end{tikzpicture} +\end{center} + +Internally, the simulator computes +$$z_s \xleftarrow{r} \mathbb{F},~c_s \xleftarrow{r} \mathbb{F},~A_s = g^{z_s} \cdot X^{c_s}$$ + +\subsection{Flow} +For two known \emph{public keys} $X_0, X_1 \in G$, Alice knows $w_b \in \mathbb{F}$, for $b \in \{0, 1\}$, such that $g^{w_b} = X_0$ or $g^{w_b} = X_1$. As we don't know if Alice controls $0$ or $1$, from now on, we will use $b$ and $1-b$. +\\ +So, Alice knows $w_b \in \mathbb{F}$ such that $X_b = g^{w_b}$, and does not know $w_{1-b}$ for $X_{1-b}=g^{w_{1-b}}$. + +\begin{enumerate} + \item First of all, as in the \emph{Sigma protocol}, Alice generates a random \emph{commitment} $a_b \xleftarrow{r} \mathbb{F}$, and computes $A_b = g^{a_b}$. + \item Then, Alice will run the \emph{simulator} for $1-b$. + \begin{list}{} + \item Sets a random $c_{1-b} \xleftarrow{r} \mathbb{F}$, and runs the simulator with inputs\\$(c_{1-b}, X_{1-b})$, and outputs $(A_{1-b}, c_{1-b}, z_{1-b})$. + \item Remember that internally the \emph{simulator} will set random\\ + $z_{1-b}, c_{1-b} \xleftarrow{r} \mathbb{F}$, and compute an $A_{1-b}$ such that\\ + $A_{1-b} = g^{z_{1-b}} \cdot X_{1-b}^{c_{1-b}}$. + \end{list} + \item Now, Alice sends $A_b, A_{1-b}$ to Bob + \item And Bob sends back the \emph{challenge} $s \xleftarrow{r} \mathbb{F}$. + \item Alice then splits the challenge $s$ into $c_b, c_{1-b}$, by $s = c_{1-b} \oplus c_b$. So Alice can compute $c_b = s \oplus c_{1-b}$. + \item Then Alice computes $z_b = a_b \cdot w_b + c_b$. And sends to Bob $(c_b, c_{1-b}, z_b, z_{1-b})$. + \item Bob can perform the verification by checking that: + \begin{enumerate}[i.] + \item $s == c_b \oplus c_{1-b}$ + \item $g_{z_{1-b}} == A_{1-b} \cdot X_{1-b}^{-c_{1-b}}$ + \item $g_{z_b} == A_b \cdot X_b^{-c_b}$ + \end{enumerate} +\end{enumerate} + + + +\begin{center} +\begin{sequencediagram} + \newinst[1]{a}{Alice} + \newinst[3]{b}{Bob} + \mess[1]{a}{$A_b, A_{1-b}$}{b} + \mess[1]{b}{$s$}{a} + \mess[1]{a}{$c_b, c_{1-b}, z_b, z_{1-b}$}{b} +\end{sequencediagram} +\end{center} + +\section{Resources} +\begin{enumerate} + \item \href{https://cs.au.dk/~ivan/Sigma.pdf}{https://cs.au.dk/~ivan/Sigma.pdf} + \item \emph{Cryptography Made Simple}, Nigel Smart. Section 21.3. +\end{enumerate} + +\end{document}