一种构造并发不可延展零知识的新方法  

A New Construction of Concurrent Non-malleable Zero-Knowledge

作　　者：李睿[1] 徐秋亮[1] 

机构地区：[1]山东大学计算机科学与技术学院,济南250101

出　　处：《计算机学报》2012年第4期682-692,共11页Chinese Journal of Computers

基　　金：国家自然科学基金(61173139);山东省自然科学基金重点项目(ZR2011FZ005);教育部博士点基金(20110131110027);山东省自然科学基金(ZR2010FM045)资助~~

摘　　要：构造了一个新的并发不可延展的零知识论证系统,具有更好的鲁棒性.新方案基于Feige-Shamir结构而设计,以具有鲁棒性的不可延展承诺方案以及巧妙设计的证据不可区分性证明为基本组件,来实现并发不可延展性和鲁棒性.此外,对敌手视图的模拟借助了"茫然模拟"的策略.当与其它协议并发组合时,该方案更易于分析和应用.基于单向函数假设,该方案的轮复杂性为超对数.This paper focuses on the robustness of concurrent non-malleable zero-knowledge.Existing concurrent non-malleable zero-knowledge protocols either apply non-black-box simulation techniques,or employ black-box simulation but incorporate a zero-knowledge sub-protocol.Hence when concurrently composed with other protocols,security of these protocols is not preserved or hard to argue.Following the well-known Feige-Shamir style,this paper presents a new construction for concurrent non-malleable zero-knowledge argument system,which is easily composed.This protocol takes the robust non-malleable commitment scheme introduced by Lin and Pass in STOC 2009 and specially designed witness indistinguishable proofs as basic components to achieve non-malleability and robustness.Moreover,this paper applies the ＂oblivious simulation＂ strategy to simulate the view of the adversary,and the proof technique introduced by Lin et al.in Crypto 2010 to analyze the indistinguishability of simulation.Since witness indistinguishability is closed under concurrent composition,the commitment sub-protocol is robust and the simulation is oblivious,when concurrently composed with other protocols,this protocol is easier to work with and analyze.Based on the one-way function assumption,the round complexity of this protocol is super-logarithmic.

关 键 词：零知识 并发不可延展性 鲁棒性 单向函数假设 茫然模拟 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]