PriVeto: a fully private two‐round veto protocol

IET Information SecurityVolume 13, Issue 4 p. 311-320 Research ArticleFree Access PriVeto: a fully private two-round veto protocol Samiran Bag, Corresponding Author Samiran Bag samiran.bag@warwick.ac.uk orcid.org/0000-0002-3501-0829 Department of Computer Science, University of Warwick, UKSearch for more papers by this authorMuhammad Ajmal Azad, Muhammad Ajmal Azad Department of Computer Science, University of Warwick, UKSearch for more papers by this authorFeng Hao, Feng Hao Department of Computer Science, University of Warwick, UKSearch for more papers by this author Samiran Bag, Corresponding Author Samiran Bag samiran.bag@warwick.ac.uk orcid.org/0000-0002-3501-0829 Department of Computer Science, University of Warwick, UKSearch for more papers by this authorMuhammad Ajmal Azad, Muhammad Ajmal Azad Department of Computer Science, University of Warwick, UKSearch for more papers by this authorFeng Hao, Feng Hao Department of Computer Science, University of Warwick, UKSearch for more papers by this author First published: 01 July 2019 https://doi.org/10.1049/iet-ifs.2018.5115Citations: 3AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract In 2006, Hao and Zieliński presented a two-round veto protocol named anonymous veto network (AV-net), which is exceptionally efficient in terms of the number of rounds, computation and bandwidth usage. However, AV-net has two generic issues: (i) a participant who has submitted a veto can find out whether she is the only one who vetoed; (ii) the last participant who submits her input can pre-compute the Boolean-OR result before submission, and may amend her input based on that knowledge. These two issues generally apply to any multi-round veto protocol where participants commit their input in the last round. In this study, the authors propose a novel solution to address both issues within two rounds, which are the best possible round efficiency for a veto protocol. Their new private veto protocol, called PriVeto, has similar system complexities to AV-net, but it binds participants to their inputs in the very first round, eliminating the possibility of runtime changes to any of the inputs. At the end of the protocol, participants are strictly limited to learning nothing more than the output of the Boolean-OR function and their own inputs. 1 Introduction In 1988, David Chaum first proposed a dining cryptographers (DC) problem [1]. Three cryptographers sit at a table to have dinner together. At the time of payment, they are informed by the waiter that someone, who may either be National Security Agency (NSA) or one of the cryptographers, has already paid for the dinner. The cryptographers respect each other's right in making a private payment but they want to find out if NSA paid. Essentially they want to securely compute a Boolean-OR function with the input ‘1’ representing ‘I paid’ and ‘0’ representing ‘I did not pay’. If the output of the Boolean-OR function is ‘0’, it means that NSA must have paid (since no cryptographer has paid); otherwise, NSA has not paid. To securely find the result, the three cryptographers executed a two-stage protocol called DC network (DC-net), proposed by Chaum [1]. In the first stage, the three cryptographers establish a pairwise shared secret bit between each other, e.g. by tossing a coin secretly behind a menu. In the second stage, each cryptographer announces a bit, which is the XOR of his shared secret bits with the other cryptographers if he did not pay or the opposite value if he paid. After the two stages, everyone, including any third party observers, can calculate the XOR of all announced bits: if the result is ‘0’, it means NSA has paid for the dinner; and otherwise, NSA has not paid. While the original protocol is described for three participants, it can be easily generalised to accommodate any number of participants more than three. The aim of the DC-net protocol is to allow multiple parties to securely compute a Boolean-OR function, but it has a ‘collision’ problem whereby when an even number of participants use ‘1’ in their inputs, the protocol will falsely return ‘0’. This problem is acknowledged in Chaum's paper [1] as one major limitation of DC-net. Chaum proposed to resolve this problem by ‘retransmission’, but details of the retransmission mechanism are not specified in [1]. Follow-up works by other researchers propose to address this problem by setting up ‘traps’ to probabilistically detect the collision and disruption [2-4], but they tend to make the DC-net system much more complex. There are also other limitations of DC-net, such as the requirement of pairwise shared keys between participants, which lead to a system complexity for n participants. To address the limitations of DC-net, Hao and Zieliński [5] proposed an alternative solution called anonymous veto network (AV-net). In some sense, AV-net can be seen as a translation of DC-net from a non-cryptographic setting to a cryptographic one. The construction of AV-net echoes a similar idea in DC-net by combining shared secrets in a particular way to achieve a cancellation effect. The major difference between the two is that DC-net only involves sending Boolean values, while AV-net is built on public-key cryptography, and it utilises established cryptographic primitives (e.g. zero-knowledge proofs) to enforce every participant to honestly follow the protocol specification. AV-net only requires two rounds of broadcast, which is the best possible round efficiency for a veto protocol. It is also exceptionally efficient in terms of the computation and the bandwidth usage. The system complexity is , as opposed to in DC-net. Among the veto protocols proposed in the literature [6-8], AV-net is the most efficient in each of the following aspects: the number of rounds, computation, bandwidth, and system complexity. However, the AV-net protocol has two generic issues. First, a participant who has submitted ‘1’ as the input can find the Boolean-OR of other participants’ inputs. In other words, if a participant vetoes, she can find out if she is the only one who has vetoed or not. Second, the last participant who submitted her input can pre-compute the result of the Boolean-OR function, and hence may amend her input accordingly. The latter problem can be alleviated by introducing an intermediate round in which all participants first commit to their inputs, thus eliminating the scope of any runtime change to the value of the input in the subsequent round. However, this remedy increases the round complexity of the protocol to three rounds. In this study, we address these issues by proposing a new private veto protocol called ‘PriVeto’. The same as AV-net, the proposed protocol has only two rounds. It binds participants to their inputs in the very first round in a way that no participant will be able to find the Boolean-OR of all the inputs until the second round ends. The ciphertext generated by a participant in the second round depends upon the ciphertexts generated by other participants in the first round. By then all the ciphertexts coming from the first round of the protocol have already been committed (e.g. published on a public bulletin board), which eliminates the possibility of amendment by any participant. Our protocol strictly limits each participant to learn nothing more than the output of the Boolean-OR function and their own private inputs. The privacy of each individual input is guaranteed even under the extreme case that all other participants collude against a single victim (i.e. a full-collusion attack). By contract, in AV-net, in the extreme scenario of full collusion, the privacy of the individual input can no longer be guaranteed. The rest of the paper is organised as follows. Section 2 discusses approaches that have been proposed for securely computing the Boolean-OR function. Section 3 describes our proposed approach for anonymous veto. Section 4 presents the security proofs of the proposed protocol. Section 5 presents the system complexity of the protocol. Finally, Section 6 concludes the paper. 2 Related work 2.1 Multiparty computation The DC-net problem can be seen as a secure multi-party computation (MPC) problem for computing a Boolean-OR function while preserving the privacy of each individual input. A general MPC problem is to compute a function , on secret inputs provided by n participants, respectively. At the end of the protocol, each participant would learn the output of the function f over all the secret inputs, but they do not learn anything more than the output and their own inputs. The first general protocol for the secure two-party computation was proposed by Yao [9]. The Fairplay [10] system presents an implementation of Yao's protocol. This system generates the circuits by representing the computed functions of each participating party as high-level languages (secure function definition language (SFDL) and secure hardware definition language (SHDL)). A number of methods have been proposed [11-14] to generalise Yao's two-party computation method to MPC. The MPC protocols of Goldreich et al. [14] and Assaf et al. [11] are based on Boolean circuits that represent the function. In theory, the general MPC solutions can work with an arbitrary polynomial-time computable function assuming that the majority of the players are honest [13]. However, general MPC techniques are rather inefficient for computing specific functions such as Boolean-OR [15]. Furthermore, they typically require pairwise secrete authenticated channels between players in addition to a public authenticated channel. The establishment of pairwise secure channels is complex to realise in practice [5]. For these reasons, researchers normally propose specific MPC solutions to efficiently solve specific problems, e.g. e-voting [16], secure network statistics aggregation [17-20], secure function computation [21], secure auctions [22] etc. 2.2 Review of AV-net There have already been a number of protocols proposed to perform secure MPC on a Boolean-OR function [1, 5-8]. Among these solutions, AV-net, due to Hao and Zieliński in 2006 [5], is known to be the most efficient in terms of the number of rounds, computation and bandwidth. AV-net does not require any pairwise secret and authenticated channels. It only assumes an authenticated public channel, which is typically implemented by a public bulletin board [7], where participants publish data with a digital signature to prove authenticity. Let G denote a finite cyclic group of prime order p in which the decision Diffie–Hellman (DDH) problem is intractable. Let g be a generator in G. Assume there are n participants. The protocol proceeds in two rounds. (All computations are modular and we omit the modulus for simplicity.) Round 1: Every participant chooses a random secret and publishes and a zero-knowledge proof (Schnorr signature [23]) for proving the knowledge of . When this round finishes, each participant computes We can also represent the above as , where . Round 2: Every participant publishes , where is either for the input ‘1’ or a random value for the input ‘0’, together with a zero-knowledge proof (Schnorr signature [23]) to prove the knowledge of . After Round 2, every participant computes . If no one vetoes, we have ; otherwise we have . Note that when no one vetoes, all the random factors vanish because [5]. Although AV-net is exceptionally efficient, it has two generic issues. The first issue, as highlighted in the original AV-net paper [5], is that a participant who has sent the veto message (‘1’) in the second round will be able to find out if she is the only one who vetoed at the end of the second round. To learn this, she just needs to substitute her input in Round 2 with ‘0’ and re-calculate the Boolean-OR function. Note that she can do this non-interactively without the cooperation from other participants. Thus she can learn the Boolean-OR of all other inputs, which is equivalent to knowing if she is the only one who has submitted a veto. As only the vetoer can learn this extra-bit information, we call this the vetoer's advantage. The second issue is that the participant who sends data at last in Round 2 can pre-compute the Boolean-OR, thus knowing the outcome before others, and she might alter her input based on that knowledge. We call this the last player's advantage. It seems inevitable that the participant who sends data at last will learn the result before others, but the run-time change of the input should be prevented. These two issues are generally applicable to other veto protocols [6-8] where participants send the input in the last round. The last player's advantage can be alleviated by requiring all participants to commit their input first, so they cannot change it later; however that will require an additional round of sending commitments. 3 PriVeto scheme In this section, we present a novel solution to address both issues in AV-net without increasing the number of rounds. Our new protocol is called PriVeto. For any integer , we define to be the set . 3.1 Setup Let there be n participants identified as . Let , , denote the unique identities of the participants. Each participant has a secret input bit . The n participants want to securely compute the value of . Our protocol uses a finite multiplicative group G of p elements, p being a prime number. The DDH problem is assumed to be intractable in G. Let g and be two random generators of G, whose discrete logarithm relationship is unknown. Let be two secure one-way hash functions. Hence, the setup function takes as input the security parameter and generates the following system parameters: We assume there is an authenticated public channel, which can be realised by a public bulletin board as in [5-8]. The bulletin board is readable to all, and writable only to authenticated participants with a digital signature to prove the data authenticity. 3.2 Protocol The PriVeto protocol works in two rounds as below: Round 1: Each participant chooses and publishes on the bulletin board . also computes and , where is a non-interactive zero-knowledge (NIZK) proof [23] to prove the knowledge of , and is a NIZK proof [24] to prove the knowledge of , i.e. and Every participant posts these two NIZK proofs on the bulletin board. also posts an intermediate ballot computed as follows: Here, , where . Hence, both and can be computed by anyone after fetching all the three inputs (i.e. ) from the bulletin board. The participant also computes NIZK proof of the fact that is either or . This is an OR proof of two statements with the first statement being and the second statement being (see the Appendix for a detailed construction of this NIZK proof). We express as follows: Each participant posts and on the bulletin board. Round 2: Each participant copies the intermediate ballot for all from the bulletin board. Then she computes Each participant computes a final ballot as follows: Here . also computes a NIZK proof of well-formedness of . This NIZK proof proves that is indeed equal to , given the value of , and . Essentially, this is an equality proof that (see the Appendix for more details on the construction of this NIZK proof). posts and on the bulletin board. Once, every participant has posted the ballot in the second round anyone can compute . Let us assume . It is easy to see that It can be proved that . Readers are referred to [5] for a proof of the above fact. Now, . If , then . Let us assume that for some . As such, . Here Note that is independent of A and is random. Hence, is a random element in G (and is not 1 with overwhelming probability). Thus we get This way everyone can find T, the Boolean-OR of all n input bits by computing . 4 Analysis 4.1 Completeness of the scheme We show that our two-round PriVeto protocol is correct, i.e. it correctly computes the Boolean-OR of all input bits. It is worth noticing that when , for all , then . Now, we need to show that if there exists at least one , such that , then will be random. For this purpose, let us assume for some . Hence, . Our algorithm will output if and only if . So, for the scheme to be correct, we need to show that with overwhelming probability. We know that . Therefore, . If , then . So i.e. Here, . Since, is a secure hash function i.e. Hence, . Hence, we get Thus, the scheme is correct. 4.2 Security assumptions Assumption 1.Given and a challenge , where , it is hard to find whether or . This assumption is known as the DDH assumption. Assumption 2.Given and a challenge , where , it is hard to find whether or . Lemma 1.Assumption 1 implies Assumption 2. Proof.We shall show that if there exists an adversary against Assumption 2, then the same can be used to construct another adversary against Assumption 1. The adversary works as follows:It receives as input and a challenge . It sends to . Note that if , then the tuple will be of the form . Else the tuple will be , where . Now, if can distinguish between them, will be able to identify . □ Assumption 3.: Given and a challenge , it is hard to find whether or . Lemma 2.Assumption 2 implies Assumption 3. Proof.We show that if there exist an adversary against Assumption 3, it could be used to construct another adversary against Assumption 2. receives as input and a challenge . It chooses random and computes and . Then sends and to . If can identify the correct value of , then so can . □ Assumption 4.: Given and a challenge , it is hard to find whether or . Lemma 3.Assumption 3 implies Assumption 4. Proof.According to Assumption 3 □ 4.3 Security analysis of the PriVeto scheme 4.3.1 Security model Now, we show that our scheme is secure against a probabilistic polynomial time (PPT) adversary who can compromise all but one participant. If the scheme can protect the privacy of the sole uncompromised participant under a full collusion scenario, then the scheme could be called secure. We show that if the DDH assumption holds in the group G, the scheme will be secure. In order to prove our security claim, we choose the following security model. In this model, there are two entities: the challenger and the adversary who together enact the full collusion scenario. The setup function generates the public parameters . The challenger creates one participant with a random id . The adversary creates participants with ids in the set . The adversary controls these colluding participants. The challenger chooses random , and generates (or simulates) the NIZK proofs and . The challenger sends to the adversary. The challenger replies to all queries to the hash oracles and H made by the adversary. The adversary outputs . Since, and are proofs of knowledge of , and , the adversary has to invoke the prover algorithm with these two witnesses () in order to generate and . The challenger can get to learn these values when the prover algorithm is called by the adversary, and can match them with the values of and sent to the challenger by the adversary. If any of the NIZK proofs returned by the adversary is not properly generated, the challenger aborts, and the adversary fails. The adversary also returns a set of inputs , which represent the inputs of the colluding participants. It can be observed that if all the inputs of the colluding participants are 0, the output of our protocol (Boolean-OR of all inputs) will be equal to the input of the honest participant controlled by the challenger. Thus, in this model, we add a condition to make it mandatory for at least one colluding participant to have a 1-bit as input. Note that the adversary may choose the inputs of other colluding participants as she wishes. Thus, there is no upper bound to the value of . So, . Since, , there must be at least one , satisfying . We assume that it is . If there is no such , such that , then the challenger aborts and the adversary fails. Else, the challenger computes and , which are the intermediate ballots corresponding to the two cases and , respectively. Then the challenger randomly selects a bit , and sets the intermediate ballot . The challenger computes the final ballot , and generates (or simulates) the NIZK proofs of well-formednesses of the intermediate and the final ballot, and sends the intermediate and final ballot along with the NIZK proofs to the adversary. The adversary wins if she can distinguish between the two cases: and . 4.3.2 Security experiments Fig. 1 shows the security experiment . This security experiment characterises the full-collusion scenario, where the adversary has colluded with participants with the intention to learn the private input of the sole honest participant for some . represents the intermediate ballots of each of the compromised participant. is the intermediate ballot of the honest participant . is the final ballot of . The adversary's job is to identify e. We define the advantage of the adversary as below Fig. 1Open in figure viewerPowerPoint Description of the security experiment In Fig. 2, we present . This is the security game that emulates an attack against the DDH assumption. The adversary receives as input a challenge , where and . and are two NIZK proofs that prove that the prover knows the values of and , respectively. The NIZK proofs do not provide any useful information other than what they are intended to prove. The DDH adversary has to find e. Since the NIZK proof systems used in the experiment are secure, we may define the advantage of the adversary as follows: Fig. 2Open in figure viewerPowerPoint Description of the security experiment From the discussion in Section 4.2, we can say that if the DDH assumption holds in G, then We now present a series of games below. Game 1: This game is the experiment of Fig. 1. Game 2: This game is the same as the experiment of Fig. 3. The advantage of the adversary is defined as follows: Fig. 3Open in figure viewerPowerPoint Description of the security experiment The difference between Game 1 and Game 2 is that in Game 2, we substitute the two hash functions viz. and by two random functions and , respectively. The difference between the advantages of the adversaries in games 1 and 2 is negligible if the two hash functions are secure, i.e. if and are secure Game 3: This game is the same as the experiment of Fig. 4. The advantage of the adversary is defined as follows: Fig. 4Open in figure viewerPowerPoint Description of the security experiment The difference between game 3 and game 2 is that in game 3, the query-format to the second oracle H is of the form as opposed to its format game 2 in which the query input is of the form . Note that when the adversary of game 2 makes a query of the form , she has to know the values of and , as otherwise computing and would amount to breaking the security of the non-interactive zero knowledge proof system used to compute or which are proofs of knowledge [23, 24]. Hence, the difference between the distinguishing advantages of an adversary in games 2 and 3 is negligible, i.e. From the above discussion, we can infer that i.e. 4.3.3 Security proof Now, we shall show that our PriVeto protocol is secure against full collusion. For this purpose, we first state and prove the following theorem. Theorem 1.. Proof.We show that if there exists an adversary against the POBC experiment, then it could be used to construct the DDHV adversary . receives as input and . and are the two NIZK proofs that prove that the values of a and z are known to the prover. now simulates with the help of . answers ’s queries to the oracles and . Let Q be the maximum number of queries makes to the oracle . Obviously, .Step 1: computes . selects randomly such that holds at least for one value of . implicitly sets and . Then sends to . outputs the values of and . It should be noted that . During this process, may also make queries to both the oracles and . These queries are answered by as follows: If the query is to the oracle and the query input can be parsed as , for some , then sample a random and return it. Register in the log . If the query is to the oracle and input can be parsed as , and return m. Else if the query is to the oracle return a random element from . All queries to the oracle can be answered by as follows: If the query is to the oracle , and the input can be parsed as for some , (where has already been queried by ) and if there exists a such that no query of the form has ever been made, then return a random . Register on the log . Else, if the query is to the oracle , and the input can be parsed as for some , (where has already been queried by ) and for all , the log contains at least one entry of the form , then for all select an entry from each log and compute Here and Sample a random . Return , where Enter on the log . Else return a random element from . Step 2: Now, outputs the index and for all , where . Now, if there exists such that , aborts.Step 3: Else computes the intermediate ballot for all by invoking its internal oracle with inputs . If for all , satisfying there is an entry in such that has been queried, then if abort.Step 4: Else if for all , satisfying , there is an entry in , and there exists at least one , satisfying and has not yet been queried, then let Choose a random . For all , choose random and set . Let and . Set Return .Step 5: Else if there exists such that has not been queried, let Select . For all , choose random and set . Now, if compute and if , compute Also, let Compute as Set .Step 6: If has not already aborted, the following relation holds: i.e. Here, . sets Here, .Now, invoke again with all these parameters. It will return a bit b. If then outputs , else outputs . Alternatively, if aborts, return a random bit.Let us calculate the success probability of . Let Thus If does not abort during the game, then it returns whatever returns, hence If aborts in the game, returns a random bit. Therefore, . So, . From this we get . Thus, we can write Let A denote the event that does not abort in step 2 and B denote the event that does not abort in step 3. Hence, . So, . In step 2, aborts only if for any . Since, ’s are chosen randomly by with the condition that for at least one , the probability .Now, let us calculate the probability that does not abort in step 3, given does not abort in step 2. This happens only if for all , satisfying , there is an entry in such that and We try to find the probability that queries for all , and holds. The event happens when there exists such that in step 1, replies to the query with , for all and for the query it returns , where Here and The probability , where is the number of entries of the form in log when was queried.Now, .Thus Now, . Since, the maximum number of oracle queries made by the adversary is Q, . So, . Hence i.e. Since, , and n is constant Thus, the theorem holds. □ Note that, since, , we have We have shown in Section 4.3.2 that if the DDH assumption holds in the algebraic group G, then holds. Therefore, our two-round PriVeto protocol will be secure against full collusion, if the DDH assumption holds in G. 5 Efficiency analysis In this section, we analyse the computation and communication efficiency of our scheme. Since, exponentiation is the costliest operation, we measure the computation cost in terms of the number of exponentiations done by an entity. In Round 1, each participant needs to do just three exponentiation operations to compute and the intermediate ballot. The NIZK proofs and need one exponentiation each. The NIZK proof requires six exponentiations, making the total exponentiations needed by a single participant in Round 1 equal to 11. In Round 2, the computation of the final ballot would require two exponentiations and the associated NIZK proof would require two exponentiations. Thus, in Round 2, each participant needs to perform four exponentiations. Hence, the total number of exponentiations that a participant is required to perform during the entire protocol is 15. On the other hand, a verifier who wants to check all the NIZK proofs would need to perform exponentiations. Table 1 shows a break-down of the computation overhead on a participant and a verifier. Table 1. Number of exponentiations in computational load Entity Round I Round II Public parameters Intermediate ballot NIZKP Public parameters Final ballot NIZKP Total participant — verifier — — — — Here, n is the total number of participants. NIZKP, NIZK proof. Now, we calculate the communication overhead of the protocol. Each participant needs to post and in Round 1. The participant also needs to post the two NIZK proofs and of size 6 in total. Thus, in Round 1, each participant needs to transfer nine items. In Round 2, each participant needs to post only the final ballot and the NIZK proof . The participant also needs to download all arguments uploaded by all other participants in Round 1. Together, they add up to . The size of all NIZK proofs of all the n participants is 18. Table 2 shows a break-down of the communication overhead on a participant and a verifier. Table 2. Number of group elements in the usage of communication bandwidth Entity Round I Round II Public parameters Intermediate ballot NIZKP Downloaded parameters Final ballot NIZKP Total participant 2 1 14 1 4 verifier 2n n 14n — n 4n 22n Here, n is the total number of participants. 6 Conclusion In this study, we have proposed a novel two-round veto protocol that addresses the two major limitations of the original AV-net protocol. Our scheme achieves the best possible round efficiency for a veto protocol. In addition to that it has the same asymptotic system complexities as the AV-net protocol. We have proved that our scheme is secure against full collusion in a random oracle model, assuming that the DDH problem is intractable in the algebraic group used in the scheme. 7 Acknowledgment This work is supported by the ERC starting grant no. 306994. 9 Appendix 9.1 NIZK proofs Here, we discuss the construction of the non-interactive proofs used in our two-round anonymous veto protocol. We shall use Fiat–Shamir heuristic [25] for converting standard interactive zero knowledge proofs into non-interactive ones. Such a conversion requires a secure cryptographic hash function; hence our proof is constructed in a random oracle model. We tie every NIZK proof argument to the identity of the prover by making it mandatory to include the identity of the prover into the set of parameters that are fed as input to the hash function in order to generate the random challenge. This would effectively eliminate replay attacks [5]. The constructions of these kinds of NIZK proofs can be found in [23, 24, 26]. . This NIZK proof proves the fact that given g and , the prover knows the value of . The construction of this NIZK proof can be found in [23] and is described in the following. The prover selects and generates a commitment . Let the random challenge be ch. The prover generates a response . The verification equation is as follows: The above NIZK proof requires one exponentiation for computation and two exponentiations for verification. The arguments include a commitment, a challenge and a response, making the total size equal to 3. : This NIZK proof proves the fact that given and , the prover knows the value of . The construction of the NIZK proof is the same as the one above : This NIZK proof proves that given , either or . The construction of this NIZK proof can be found in [24, 26] and is described as follows. Let us assume that . The prover selects random and computes four commitments and Let, the grand challenge of the NIZK proof be Ch. The prover computes . Also, the prover generates a response . The verification equations are as follows: Now, we show how a similar NIZK proof can be generated when . This time the prover selects random and computes these four commitments and Let, the grand challenge be ch. The prover computes . Also, the prover generates a response . The verification equations are as above. This NIZK proof requires six exponentiations for computation and eight exponentiations for verification. The arguments consist of four commitments, two challenges and two responses; hence the size of the proof is 8. : This NIZK proof proves that given , . The construction of the proof is as below. The prover selects random and generates two commitments Let the random challenge be ch. The prover generates a response . The verification is given by This NIZK proof requires two exponentiations for computation and five exponentiations for verifications. The size of the proof is 4. 8 References 1Chaum, D.: ‘The dining cryptographers problem: unconditional sender and recipient untraceability’, J. Cryptol., 1988, 1, (1), pp. 65– 75 2Bos, J., Boer, B.D.: ‘ Detection of disrupters in the dc protocol’, in J.-J. Quisquater, J. Vandewalle (Eds): ‘ Advances in cryptology – EUROCRYPT'89’ ( Springer, Berlin, Heidelberg, 1990), pp. 320– 327 3Golle, P., Juels, A.: ‘ Dining cryptographers revisited’, in C. Cachin, J.L. Camenisch (Eds): ‘ Advances in cryptology – EUROCRYPT 2004’ ( Springer, Berlin, Heidelberg, 2004), pp. 456– 473 4Waidner, M., Pfitzmann, B.: ‘The dining cryptographers in the disco: unconditional sender and recipient untraceability with computationally secure serviceability’. Proc. Workshop on the Theory and Application of Cryptographic Techniques on Advances in Cryptology, EUROCRYPT'89, New York, NY, USA, 1990, p. 690 5Hao, F., Zieliński, P.: ‘A 2-round anonymous veto protocol’. Int. Workshop on Security Protocols, Cambridge, UK, 2006, pp. 202– 211 6Brandt, F.: ‘Efficient cryptographic protocol design based on distributed El Gamal encryption’. Int. Conf. on Information Security and Cryptology, Seoul, 2005, pp. 32– 47 7Groth, J.: ‘Efficient maximal privacy in boardroom voting and anonymous broadcast’. Int. Conf. on Financial Cryptography, Key West, Florida, 2004, pp. 90– 104 8Kiayias, A., Yung, M.: ‘Non-interactive zero-sharing with applications to private distributed decision making’. Int. Conf. on Financial Cryptography, Guadeloupe, French West Indies, 2003, pp. 303– 320 9Yao, A.C.C.: ‘How to generate and exchange secrets’. 27th Annual Symp. Foundations of Computer Science (SFCS 1986), Toronto, ON, October 1986, pp. 162– 167 10Malkhi, D., Nisan, N., Pinkas, B. et al: ‘Fairplay – a secure two-party computation system’. Proc. 13th Conf. on USENIX Security Symp. – Volume 13, SSYM'04, Berkeley, CA, USA, 2004, pp. 20– 20 11Assaf, B.-D., Nisan, N., Pinkas, B.: ‘Fairplaymp: a system for secure multi-party computation’. Proc. 15th ACM Conf. on Computer and Communications Security, CCS'08, New York, NY, USA, 2008, pp. 257– 266 12Bogetoft, P., Christensen, D.L., Damgård, I. et al: ‘ Secure multiparty computation goes live’, in R. Dingledine, P. Golle (Eds): ‘ Financial cryptography and data security’ ( Springer, Berlin, Heidelberg, 2009), pp. 325– 343 13Chaum, D., Crépeau, C., Damgård, I.: ‘ Multiparty unconditionally secure protocols (abstract)’, in C. Pomerance (Ed.): ‘ Advances in cryptology – CRYPTO'87’ ( Springer, Berlin, Heidelberg, 1988), pp. 462– 462 14Goldreich, O., Micali, S., Wigderson, A.: ‘How to play any mental game’. Proc. Nineteenth Annual ACM Symp. on Theory of Computing, STOC'87, New York, NY, USA, 1987, pp. 218– 229 15Hao, F., Zieliński, P.: ‘ The power of anonymous veto in public discussion’, in ‘ Transactions on computational science IV’ ( Springer, 2009), pp. 41– 52 16Hao, F., Ryan, P.Y.A., Zielinski, P.: ‘Anonymous voting by two-round public discussion’, IET Inf. Sec., 2010, 4, (2), pp. 62– 67 17Ajmal Azad, M., Bag, S., Tabassum, S. et al: ‘Privy: privacy preserving collaboration across multiple service providers to combat telecoms spam’, IEEE Trans. Emerg. Top. Comput., 2017, PP, (99), pp. 1–1 18Bag, S., Azad, M.A., Hao, F.: ‘A privacy-aware decentralized and personalized reputation system’, Comput. Secur., 2018, 77, pp. 514– 530 19Burkhart, M., Strasser, M., Many, D. et al: ‘Sepia: privacy-preserving aggregation of multi-domain network events and statistics’. Proc. 19th USENIX Conf. on Security, USENIX Security'10, Berkeley, CA, USA, 2010, pp. 15– 15 20Goryczka, S., Xiong, L., Fung, B.C.M.: ‘m -Privacy for collaborative data publishing’, IEEE Trans. Knowl. Data Eng., 2014, 26, (10), pp. 2520– 2533 21Corrigan-Gibbs, H., Boneh, D.: ‘Prio: private, robust, and scalable computation of aggregate statistics’. Proc. Networked Systems Design and Implementation (NSDI), Boston, MA, 2017, pp. 259– 282 22Naor, M., Pinkas, B., Sumner, R.: ‘Privacy preserving auctions and mechanism design’. Proc. 1st ACM Conf. on Electronic Commerce, EC'99, New York, NY, USA, 1999, pp. 129– 139 23Schnorr, C.-P.: ‘Efficient signature generation by smart cards’, J. Cryptol., 1991, 4, (3), pp. 161– 174 24Chaum, D., Pedersen, T.: ‘Transferred cash grows in size’. EUROCRYPT'92 (LNCS), Balatonfüred, Hungary, 1993, 658, pp. 390– 407 25Fiat, A., Shamir, A.: ‘How to prove yourself: practical solutions to identification and signature problems’. Advances in Cryptology – CRYPTO'86, Santa Barbara, CA, 1986, pp. 186– 194 26Brands, S.A.: ‘ Rethinking public key infrastructures and digital certificates: building in privacy’ ( MIT Press, 2000) Citing Literature Volume13, Issue4July 2019Pages 311-320 FiguresReferencesRelatedInformation