Non-Interactive Zero-knowledge Compact Multi-Party Range Proofs Sample Clauses

Non-Interactive Zero-knowledge Compact Multi-Party Range Proofs. ‌ Zero-knowledge range proofs prove that a hidden value in a commitment is in the accepted range without revealing the value, ex: v is in [0, 264]. We define a generic compact, multi- party range proof scheme suitable for CT. Let RP is a compact range proof scheme with the following functions, • RP.Set(λ) : pp // generates public parameters for λ • RP.Prv(pp, Cv,Σ k, v, k, n) : π // Co-provers collaboratively compute a compact range proof for the commitment Cv,Σ k when each co-prover i has unshared ki. • RP.Ver(pp, C, π) : True/False // bulk verification for |π| number of range proofs when |C| = |π|. We define the completeness, soundness, zero-knowledge, non-malleability, and security against honest-but-curious combiners of range proofs below. Definition 7 (Completeness). For any p.p.t. adversary A for any λ, RP is complete if, p hRP.Ver(pp, C, RP.Prv(pp, C, v, r, n))|r ←−$ Zn, v ←−$ Vpp , C ← CM.Cmt(pp, v, Σr)i . The zero-knowledge property indicates that the verifier learns nothing besides the statement being proven. Here, we consider an honest verifier who chooses his/her challenge parameters at random and independently from the prover’s messages, which is called the public coin argument. Definition 8 (Honest Verifier Zero-Knowledge). RP is public coin Honest Verifier Zero- RP,A Knowledge for R if there exists a p.p.t. simulator STR such that, AdvZK = ϵ(λ) when AdvZK RP,A,N is, RP.Ver(pp, C, π) pp ← RP.Set(λ), r ←−$ Zn, v ← A′(pp), v ∈ Vpp A(pp, C, π) = 1 C ← CM.Cmt(pp, v, Σr), π ← RP.Prv(pp, C, v, r) Pr  p  − Pr hRP.Ver(pp, C, π) ∧ A(pp, C, π) = 1|pp ← RP.Set(λ), (π, C) ← ST R(pp)i Here, A(tr) = b denotes whether A accepts the transcript or not, and v ← A′(pp), v ∈ Vpp indicates that the adversary gets to choose the distribution of the (valid) witness. Without knowing the witness or its distribution, the simulator produces a distribution of proof transcripts (pp, C) that should be indistinguishable from a honestly generated proof. If the verifier can not make that distinction, he or she will have learned nothing about the witness. The soundness of a proof system requires that it be infeasible (for arguments) or impossible (for proofs) to create a proof of a false statement. This is shown by exhibiting an extractor algorithm χ, which either extracts a valid witness (or, for arguments, breaks a hardness assumption) by interacting with the prover. The computational knowledge soundness property defines that no p.p.t. adversary can create a valid proo...