Average-Case Soundness Clause Samples

Average-Case Soundness. For any non-uniform PPT prover P∗, it holds that Pr [S.Verify(crs, x, π) = 1 | crs ← S.Setup(1κ, 1n), x ← Dno(1n), π ← P∗(crs, x)] ≤ negl(n, κ). SRDS based on multi-signatures. We consider implications of SRDS constructions based on an underlying multi-signature scheme (see Appendix A.3) in the following sense. While rigorously specifying the notion is rather involved, at a high level, such a scheme is one that satisfies three natural properties:

Average-Case Soundness. Recall that each of the values (a1, . . . , an, t) in x ← Dno(1n) are sampled uniformly at random. Let α = φℓ−1({ai}i∈S) and assume that α−1 exists. Since t is a randomly sampled value, so is an+1 = (vkdeg − t) · α−1 for any S ⊆ [n]. We interpret the set of n + 1 verification keys as vki = ai for i ∈ [n +1]; thus, the verification keys {vk1, . . . , vkn+1} are uniformly distributed over R. Since n/ log |R| < 1 and the output of elementary symmetric polynomials is uniformly distributed, then with overwhelming probability (bounded by 2n+1/|R|), there does not exist a subset S′ ⊆ [n + 1] of size s + 1, such that φℓ({ai}i∈S′ ) = vkdeg. Given (m, σms, π), we check if: (1) σms is a valid multi-signature on m with respect to vkdeg and (2) if (σms, π) is a valid SRDS on m. Recall that in a SNARG-compliant multi-signature 22We note that all elements of R = Fk, except for the ones with a 0 in any of its vector coordinates, have an inverse in R. scheme, given a multi-signature σms, a message m, and public parameters ppms, there exists a unique aggregate verification key vkagg with respect to which σms verifies, i.e.,

Average-Case Soundness. Recall that each of the values (a1, . . . , an, t) in x ← Dno(1n) are sampled uniformly at random. Let α = φl−1({ai}i∈S) and assume that α−1 exists. Since t is a randomly sampled value, so is an+1 = (vkdeg − t) · α−1 for any S ⊆ [n]. We interpret the set of n + 1 verification keys as vki = ai for i ∈ [n +1]; thus, the verification keys {vk1, . . . , vkn+1} are uniformly 29We note that all elements of R = Fk, except for the ones with a 0 in any of its vector coordinates, have an inverse in R. ⊆ { } ∈ | | | |