More efficient amortization of exact zero-knowledge proofs for LWE

J Bootle, V Lyubashevsky, NK Nguyen… - European Symposium on …, 2021 - Springer
European Symposium on Research in Computer Security, 2021Springer
We propose a practical zero-knowledge proof system for proving knowledge of short
solutions s, es, e to linear relations A s+ e= u\pmod q A s+ e= u (mod q) which gives the most
efficient solution for two naturally-occurring classes of problems. The first is when AA is very
“tall”, which corresponds to a large number of LWE instances that use the same secret s s. In
this case, we show that the proof size is independent of the height of the matrix (and thus the
length of the error vector ee) and rather only linearly depends on the length of s s. The …
Abstract
We propose a practical zero-knowledge proof system for proving knowledge of short solutions to linear relations which gives the most efficient solution for two naturally-occurring classes of problems. The first is when is very “tall”, which corresponds to a large number of LWE instances that use the same secret . In this case, we show that the proof size is independent of the height of the matrix (and thus the length of the error vector ) and rather only linearly depends on the length of . The second case is when is of the form , which corresponds to proving many LWE instances (with different secrets) that use the same samples . The length of this second proof is square root in the length of , which corresponds to a square root of the length of all the secrets. Our constructions combine recent advances in “purely” lattice-based zero-knowledge proofs with the Reed-Solomon proximity testing ideas present in some generic zero-knowledge proof systems – with the main difference that the latter are applied directly to lattice instances without going through intermediate problems.
Springer
Showing the best result for this search. See all results