Zero-knowledge for set membership is a building block at the core of several privacy-aware applications, such as anonymous payments, credentials and whitelists. We propose a new efficient construction for the batching variant of the problem, where a user intends to show knowledge of several elements (a batch) in a set without any leakage on the elements. Our construction is transparent—it does not requires a trusted setup—and based on Curve Trees by Campanelli, Hall-Andersen and Kamp (USENIX 2023). Our first technical contribution consists in techniques to amortize Curve Trees costs in the batching setting for which we crucially exploit its algebraic properties. Even for small batches we obtain ≈2× speedups for proving, ≈3× speedups for verification and ≈60% reduction in proof size. Our second contribution is a modifications of a key technical requirement in Curve Trees (related to so called “permissible points”) which arguably simplifies its design and obtains a stronger security property. In particular, our construction is secure even for the case where the commitment to the set is provided by the adversary (in contrast to the honest one required by the original Curve Trees).
Side-channel attacks are a significant concern for the implementation of cryptographic algorithms. Data-oblivious programming is a discipline that helps mitigate side-channel attacks by preventing data leakage over side channels. However, due to various optimizations in modern compilers, data-obliviousness cannot be guaranteed in high-level languages. This work investigates to which extent compiler optimizations violate data-obliviousness. To this end, we present data-oblivious compiler checker (DOCC), an automated binary testing pipeline for detecting data-obliviousness violations under different compiler configurations. We show that DOCC is applicable across 6 widely used compilers. Additionally, DOCC can retrofit existing analysis tools with advanced leakage models, such as data-dependent instruction execution times and data-obliviousness under speculation. We evaluate DOCC on 5 major cryptographic libraries and the recently proposed NIST lightweight cryptography primitives. We reveal data-obliviousness violations in 93 out of the 127 tested algorithms and 1845 out of the 12917 test cases across different cryptographic libraries, building blocks, and programming languages. We demonstrate that the choice of compiler and optimizations heavily influences the resulting binary’s properties.
We translate the expand-and-extract framework by Fitzi, Liu-Zhang, and Loss (PODC 21) to the asynchronous setting. While they use it to obtain a synchronous BA with 2^-λ error probability in λ +1 rounds, we achieve asynchronous BA in λ +3 rounds. At the heart of their solution is a proxcensus primitive, which is used to reach graded agreement with 2^r+1 grades in r rounds by reducing proxcensus with 2s-1 grades to proxcensus with s grades in one round. The expand-and-extract paradigm relies on proxcensus to expand binary inputs to 2^λ +1 grades in λ rounds before extracting a binary output by partitioning the grades using a λ bit common coin. However, this proxcensus protocol does not translate to the asynchronous setting without lowering the corruption threshold or using more rounds in each recursive step. Instead, we define validated proxcensus and show that it can be instantiated in asynchrony with the same recursive structure and round complexity as synchronous proxcensus. The main technique is to attach justifiers to all messages which forces the adversary to choose between only sending useful messages or being ignored.
A federated Byzantine agreement (FBA) system is a permissionless system in which each participant declares unilateral agreement requirements that collectively determine a set of quorums. The resulting quorums can be used in a consensus algorithm (such as the Stellar Consensus Protocol) to build a permissionless blockchain system without resorting to proof-of-work or proof-of-stake. Like most permissionless systems, FBA systems must rely on a secure peer-to-peer overlay network for communication between network nodes, yet this topic has received little attention in the FBA setting. In this paper, we address the problem of connecting the nodes in an FBA system to each other in order to construct an overlay topology that securely and efficiently supports gossip protocols, a popular class of protocols for disseminating data across blockchain overlays. We present Constellation, an algorithm that computes an overlay topology whose fault tolerance matches that of the FBA quorum system. Constellation minimizes node degree, which reduces redundant traffic in gossip protocols, and it ensures a maximum diameter of 2, which is crucial for achieving low-latency consensus.
Blind signatures, introduced by Chaum (Crypto’82), are a fundamental cryptographic primitive with various applications such as e-voting, e-cash, anonymous credentials, and more. Although blind signatures inherently require interaction between both parties, Hanzlik (Eurocrypt’23) introduced the notion of non-interactive blind signatures ( ), which allow signatures on random messages to be issued blindly without interaction. While Hanzlik’s constructions are provably secure in the random oracle model, instantiating a provably secure in the plain model remains an open problem. In this paper, we introduce a non-interactive blind signature scheme in the plain model based on complexity leveraging. The key to our construction is the use of the non-uniform reductions employed by Garg et al. (Crypto’11), which enables us to instantiate a provably secure without relying on a trusted setup. Furthermore, we investigate whether our construction can avoid the use of complexity leveraging by applying the idea proposed by Kalai and Khurana (Crypto’19), wherein complexity leveraging can be replaced with classical and quantum assumptions. We introduce a weaker blindness notion called non-adaptive blindness and show that this property allows our construction to avoid using complexity leveraging. Of independent interest, we provide separation results demonstrating the existence of a construction that satisfies nonce blindness but not recipient blindness, and vice versa. This result implies that any construction should be proven to satisfy both nonce blindness and recipient blindness.
