Batching, Aggregation, and Zero-Knowledge Proofs in Bilinear Accumulators
Batching, Aggregation, and Zero-Knowledge Proofs in Bilinear Accumulators
复制标题
DOI：
10.1145/3548606.3560676
复制
发表时间：
2022-11
期刊：
影响因子：
--
通讯作者：
Shravan Srinivasan;Ioanna Karantaidou;Foteini Baldimtsi;Charalampos Papamanthou
中科院分区：
文献类型：
--
作者：
Shravan Srinivasan;Ioanna Karantaidou;Foteini Baldimtsi;Charalampos Papamanthou
累加器是一种加密原语，它允许证明者简洁地提交一组值，同时能够提供（非）成员资格的证明。批量证明是一种累加器证明，可用于同时证明多个值的（非）成员资格。在这项工作中，我们提出了一个零知识批量证明与常数证明大小和常数验证双线性对（BP）设置。我们的方案比RSA设置中最先进的基于SNARK的零知识批量证明快16倍到42倍。此外，我们提出的协议，允许证明聚合多个个人的非成员资格证明，在BP设置，到一个单一的批量证明的恒定大小。我们的聚合结构满足一个强可靠性的定义-一个累加器的值可以任意选择。我们评估我们的技术，并系统地比较它们与基于RSA的替代品。我们的评估结果展示了几种情况下，BP神经网络显然是更可取的，可以作为一个指导方针时，选择这两种类型的神经网络。
An accumulator is a cryptographic primitive that allows a prover to succinctly commit to a set of values while being able to provide proofs of (non-)membership. A batch proof is an accumulator proof that can be used to prove (non-)membership of multiple values simultaneously. In this work, we present a zero-knowledge batch proof with constant proof size and constant verification in the Bilinear Pairings (BP) setting. Our scheme is 16x to 42x faster than state-of-the-art SNARK-based zero-knowledge batch proofs in the RSA setting. Additionally, we propose protocols that allow a prover to aggregate multiple individual non-membership proofs, in the BP setting, into a single batch proof of constant size. Our construction for aggregation satisfies a strong soundness definition - one where the accumulator value can be chosen arbitrarily. We evaluate our techniques and systematically compare them with RSA-based alternatives. Our evaluation results showcase several scenarios for which BP accumulators are clearly preferable and can serve as a guideline when choosing between the two types of accumulators.