Improved lattice‐based mix‐nets for electronic voting

IET Information SecurityVolume 17, Issue 1 p. 18-34 ORIGINAL RESEARCHOpen Access Improved lattice-based mix-nets for electronic voting Valeh Farzaliyev, Valeh Farzaliyev Cybernetica AS, Tartu, Estonia STACC OÜ, Tartu, Estonia Tartu University, Tartu, EstoniaSearch for more papers by this authorJan Willemson, Corresponding Author Jan Willemson jan.willemson@gmail.com orcid.org/0000-0002-6290-2099 Cybernetica AS, Tartu, Estonia STACC OÜ, Tartu, Estonia Correspondence Jan Willemson, Cybernetica AS, Narva mnt 20, Tartu 51009, Estonia. Email: jan.willemson@gmail.comSearch for more papers by this authorJaan Kristjan Kaasik, Jaan Kristjan Kaasik Cybernetica AS, Tartu, Estonia Tartu University, Tartu, EstoniaSearch for more papers by this author Valeh Farzaliyev, Valeh Farzaliyev Cybernetica AS, Tartu, Estonia STACC OÜ, Tartu, Estonia Tartu University, Tartu, EstoniaSearch for more papers by this authorJan Willemson, Corresponding Author Jan Willemson jan.willemson@gmail.com orcid.org/0000-0002-6290-2099 Cybernetica AS, Tartu, Estonia STACC OÜ, Tartu, Estonia Correspondence Jan Willemson, Cybernetica AS, Narva mnt 20, Tartu 51009, Estonia. Email: jan.willemson@gmail.comSearch for more papers by this authorJaan Kristjan Kaasik, Jaan Kristjan Kaasik Cybernetica AS, Tartu, Estonia Tartu University, Tartu, EstoniaSearch for more papers by this author First published: 18 August 2022 https://doi.org/10.1049/ise2.12089AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract Mix-networks were first proposed by Chaum in the late 1970s–early 1980s as a general tool for building anonymous communication systems. Classical mix-net implementations rely on standard public key primitives (e.g., ElGamal encryption) that will become vulnerable when a sufficiently powerful quantum computer will be built. Thus, there is a need to develop quantum-resistant mix-nets. This article focuses on the application case of electronic voting where the number of votes to be mixed may reach hundreds of thousands or even millions. We propose an improved architecture for lattice-based post-quantum mix-nets featuring more efficient zero-knowledge proofs while maintaining established security assumptions. Our current implementation scales up to 100,000 votes, still leaving a lot of room for future optimisation. 1 INTRODUCTION Voting is the main mechanism of public opinion polling utilised, for example, in the context of general elections. Traditionally, voting has happened in a controlled location (polling station) to ease electoral management and reduce potential fraud. However, by the beginning of the 21st century, peoplehave become more mobile than ever before, so taking all the electorate into one place for a short period of time has become increasingly challenging. This challenge has been amplified by the recent COVID-19 outburst that has brought along the need to avoid gathering people in small spaces. Thus, the need for the methods of remote voting has increased significantly. For example, during the 2020 U.S. presidential elections, more than 65 million votes were sent in by post. Even though there seems to be little evidence of direct fraud, the extent of postal voting still caused a lot of controversy and discussion. Indeed, the unreliability of postal services may raise questions about what to do with late votes, voter identification of postal votes is not particularly strong, and due to voting in an uncontrolled environment, it is hard to guarantee voting privacy and coercion resistance. Such problems motivate a search for alternatives, with remote electronic (Internet) voting being one of the prime candidates. The votes stored on and transmitted via digital media are, contrary to paper votes, not directly perceivable by humans. Thus, the central problem of remote electronic voting is the independent verifiability of all the actions. In this paper, we are going to focus on a particular method of ensuring verifiability of the central voting system, since this is potentially the most critical point of failure. What makes central server-side verification challenging is the need to also maintain the privacy of the votes. There are two main approaches used to implement privacy-preserving verifiable electronic voting systems—homomorphic tallying and mixing the votes before decryption [1]. There are a number of implementations known for both of these approaches, typically relying on some form of homomorphic encryption, for example, the Paillier or the ElGamal scheme [2]. However, the classical asymmetric algorithms used in these implementations are known to become weak due to Shor's algorithm once a sufficiently capable quantum computer will be built [3]. Thus, looking for post-quantum alternatives is a necessity. In recent years, both post-quantum homomorphic tallying [4, 5] and mixing [6-8] have been studied. Mix-networks were first proposed by Chaum in the late 1970s–early 1980s [9] as a general tool for building anonymous communication systems. In this paper, we will concentrate on quantum-resistant mix-nets, aiming at improving their efficiency in terms of the number of votes they are able to shuffle in a given time period. As the most expensive part of a cryptographic mix-net is the generation and verification of zero-knowledge proofs of correct operation, we concentrate on improving these proofs. Technically, we build upon the recently proposed protocol by Costa et al. [9], applying amortisation techniques for linear and product relations described in the LANES framework [10-12] and using a commitment scheme by Baum et al. [13]. As a result, we design a purely lattice-based zero-knowledge proof of a shuffle for a lattice-based mixing scheme that can be scaled up to about 100,000 votes. We instantiate the protocol with specific parameters such that the protocol achieves 128-bit soundness and 180-bit post-quantum encryption security level. Finally, we provide a proof-of-concept implementation of the proposed scheme and benchmark its practical performance. The structure of this paper is as follows. In Section 2, we specify notation and Preliminaries used in the construction of the protocol and its security proof. The protocol itself is presented in Section 3. Implementation and experimental results are presented in Section 4.3. Finally, Section 5 draws some conclusions and sets directions for future work. Details of the proofs can be found in the Appendices. This is an extended version of paper that appeared at the 24th Annual International Conference on Information Security and Cryptology. Compared to the conference version, the zero-knowledge proof of a shuffle protocol has been modified by appending an argument that the extracted permutation vector is indeed a vector of integers. The authors would like to thank members of the academic community for pointing to this shortcoming. Additionally, further analysis revealed that some intermediate terms are committed to twice in the protocol. Removing those redundant commitments resulted in shorter proof size, increasing the protocol efficiency especially for larger number of voters. Also, a number of typos have been fixed and wording has been improved in many places to improve readability of the current journal version of the paper. 2 PRELIMINARIES 2.1 Notation For a prime q, let Z q ${\mathbb{Z}}_{q}$ be the ring of integers modulo q, with its elements considered in the interval − q − 1 2 , q − 1 2 $\left[-\frac{q-1}{2},\frac{q-1}{2}\right]$ , and let Z n × ${\mathbb{Z}}_{n}^{\times }$ denote the group of invertible elements modulo n. ⌊x⌉ represents the closest integer to x in Z q ${\mathbb{Z}}_{q}$ . Vectors over Z q ${\mathbb{Z}}_{q}$ are denoted as v → ∈ Z q m $\overrightarrow{\mathrm{v}}\in {\mathbb{Z}}_{q}^{m}$ and matrices over Z q ${\mathbb{Z}}_{q}$ are denoted by regular capital letters (e.g. A) unless explicitly stated otherwise. Letting d be a power of two, we consider the rings R = Z [ X ] / ( X d + 1 ) $\mathcal{R}=\mathbb{Z}[X]/({X}^{d}+1)$ and R q = Z q [ X ] / ( X d + 1 ) ${\mathcal{R}}_{q}={\mathbb{Z}}_{q}[X]/({X}^{d}+1)$ . Elements of these rings are written in bold lower-case letters (e.g. p), and vectors with elements from these rings will naturally be denoted as b → $\overrightarrow{\boldsymbol{b}}$ . Matrices over R $\mathcal{R}$ or R q ${\mathcal{R}}_{q}$ are bold upper-case letters, for example, B. By default, all vectors and their concatenations are column vectors. More precisely, an element a ∈ R q $\boldsymbol{a}\in {\mathcal{R}}_{q}$ can be written as column vector V a = | a 0 , a 1 , … , a d − 1 | T ${\mathcal{V}}_{\boldsymbol{a}}=\vert {a}_{0},{a}_{1},\text{\ldots },{a}_{d-1}{\vert }^{T}$ where a = ∑ i = 0 d − 1 a i X i $\boldsymbol{a}={\sum }_{i=0}^{d-1}{a}_{i}{X}^{i}$ and a i ∈ Z q ${a}_{i}\in {\mathbb{Z}}_{q}$ . Especially for ring R q ${\mathcal{R}}_{q}$ , the same element can be represented as a matrix in Z q ${\mathbb{Z}}_{q}$ when it is a multiplicand: M a = a 0 − a d − 1 − a d − 2 ⋯ − a 1 a 1 a 0 − a d − 1 ⋯ − a 2 ⋮ ⋱ ⋱ ⋱ ⋮ a d − 1 a d − 2 a d − 3 ⋯ a 0 . ${\mathcal{M}}_{\boldsymbol{a}}=\left\vert \begin{array}{ccccc}\hfill {a}_{0}\hfill & \hfill -{a}_{d-1}\hfill & \hfill -{a}_{d-2}\hfill & \hfill \cdots \hfill & \hfill -{a}_{1}\hfill \\ \hfill {a}_{1}\hfill & \hfill {a}_{0}\hfill & \hfill -{a}_{d-1}\hfill & \hfill \cdots \hfill & \hfill -{a}_{2}\hfill \\ \hfill {\vdots}\hfill & \hfill \ddots \hfill & \hfill \ddots \hfill & \hfill \ddots \hfill & \hfill {\vdots}\hfill \\ \hfill {a}_{d-1}\hfill & \hfill {a}_{d-2}\hfill & \hfill {a}_{d-3}\hfill & \hfill \cdots \hfill & \hfill {a}_{0}\hfill \end{array}\right\vert .$ l2 and l∞ norms are defined as usual: ‖ a ‖ ∞ = max i | a i | and ‖ a ‖ 2 = | a 0 | 2 + ⋯ + | a d − 1 | 2 . $\Vert \boldsymbol{a}{\Vert }_{\infty }=\underset{i}{\mathrm{max}\,}\vert {a}_{i}\vert \,\text{and}\,\Vert \boldsymbol{a}{\Vert }_{2}=\sqrt{\vert {a}_{0}{\vert }^{2}+\cdots +\vert {a}_{d-1}{\vert }^{2}}.$ These norms can naturally be extended to vectors over R q ${\mathcal{R}}_{q}$ . For w → = w 1 , … , w k ∈ R q k $\overrightarrow{\boldsymbol{w}}=\left\{{\boldsymbol{w}}_{1},\text{\ldots },{\boldsymbol{w}}_{k}\right\}\in {\mathcal{R}}_{q}^{k}$ , we have ‖ w → ‖ ∞ = max i ‖ w i ‖ and ‖ w → ‖ 2 = ‖ w 1 ‖ 2 2 + ⋯ + ‖ w k ‖ 2 2 . $\Vert \overrightarrow{\boldsymbol{w}}{\Vert }_{\infty }=\underset{i}{\mathrm{max}\,}\Vert {\boldsymbol{w}}_{i}\Vert \,\text{and}\,\Vert \overrightarrow{\boldsymbol{w}}{\Vert }_{2}=\sqrt{\Vert {\boldsymbol{w}}_{1}{\Vert }_{2}^{2}+\cdots +\Vert {\boldsymbol{w}}_{k}{\Vert }_{2}^{2}}.$ Polynomials and vectors with short norms will simply be referred to as short. 2.2 Splitting rings In this work, we set q − 1 ≡ 2l mod 4l, so that Xd + 1 splits into l irreducible polynomials of degree d/l, that is, X d + 1 = ∏ i ∈ Z 2 l × X d / l − ζ i mod q = ∏ i = 1 l φ i mod q , ${X}^{d}+1=\prod\limits _{i\in {\mathbb{Z}}_{2l}^{\times }}\left({X}^{d/l}-{\zeta }^{i}\right)\,\mathrm{mod}\,\,q=\prod\limits _{i=1}^{l}{\boldsymbol{\varphi }}_{\boldsymbol{i}}\,\mathrm{mod}\,\,q,$ where ζ is primitive 2lth root of unity in Z q ${\mathbb{Z}}_{q}$ and φi = Xd/l − ζ2i−1. Thus, the ring R q ${\mathcal{R}}_{q}$ is isomorphic to the product of the corresponding residue fields: R q ≅ Z q [ X ] / φ 1 × ⋯ × Z q [ X ] / φ l . ${\mathcal{R}}_{q}\cong {\mathbb{Z}}_{q}[X]/\left({\boldsymbol{\varphi }}_{1}\right)\times \cdots \times {\mathbb{Z}}_{q}[X]/\left({\boldsymbol{\varphi }}_{l}\right).$ We call a ring fully splitting when l = d. The Number Theoretic Transform (NTT) of a polynomial p ∈ R q $\boldsymbol{p}\in {\mathcal{R}}_{q}$ is defined as N T T ( p ) = [ p ˆ 0 ⋮ p ˆ l − 1 ] where p ˆ i − 1 = p mod φ i . $\mathbf{N}\mathbf{T}\mathbf{T}(\boldsymbol{p})=[\begin{array}{c}\hfill {\widehat{\boldsymbol{p}}}_{0}\hfill \\ \hfill {\vdots}\hfill \\ \hfill {\widehat{\boldsymbol{p}}}_{l-1}\hfill \end{array}]\,\text{where}\,{\widehat{\boldsymbol{p}}}_{i-1}=\boldsymbol{p}\,\mathrm{mod}\,\,{\boldsymbol{\varphi }}_{i}.$ By Chinese Remainder Theorem, there exists a unique inverse transformation—Inverse NTT—such that INTT(NTT(p)) = p. Also, NTT allows the computing of the product of two polynomials faster and saves time in other operations. a b = I N T T ( N T T ( a ) ◦ N T T ( b ) ) N T T ( a + b ) = N T T ( a ) + N T T ( b ) $\begin{array}{rl}\hfill \boldsymbol{a}\boldsymbol{b}& =\mathbf{I}\mathbf{N}\mathbf{T}\mathbf{T}(\mathbf{N}\mathbf{T}\mathbf{T}(\boldsymbol{a}){\circ}\mathbf{N}\mathbf{T}\mathbf{T}(\boldsymbol{b}))\hfill \\ \hfill \mathbf{N}\mathbf{T}\mathbf{T}(\boldsymbol{a}+\boldsymbol{b})& =\mathbf{N}\mathbf{T}\mathbf{T}(\boldsymbol{a})+\mathbf{N}\mathbf{T}\mathbf{T}(\boldsymbol{b})\hfill \end{array}$ Here ◦ is the component-wise multiplication operation. 2.3 Ring-LWE encryption, module SIS/LWE In our constructions, we will rely on hardness of Ring Learning With Errors (Ring-LWE, RLWE) [14] and Module Learning With Errors (Module-LWE, MLWE) or Module Short Integer Solution (Module-SIS, MSIS) [15, 16] problems. Definition 1.[RLWEχ] In the decisional Ring-LWE problem with an error distribution χ over R $\mathcal{R}$ , the probabilistic polynomial time (PPT) adversary A $\mathcal{A}$ is asked to distinguish ( a , b ) ← $ R q × R q $(\boldsymbol{a},\boldsymbol{b})\stackrel{\$}{{\leftarrow}}{\mathcal{R}}_{q}\times {\mathcal{R}}_{q}$ from (a, a ⋅ s + e) for a ← $ R q $\boldsymbol{a}\stackrel{\$}{{\leftarrow}}{\mathcal{R}}_{q}$ and s, e ← χ. The corresponding search-RLWE problem asks to find s from several (a, b) RLWE samples. Ring-LWE assumption is that search-RLWE and/or decisional-RLWE problem is hard for any probabilistic polynomial time adversaries. We implement the encryption scheme described in ref. [14]. Let χ1 be error distribution over R $\mathcal{R}$ where each coefficient is sampled from { −1, 0, 1}. KeyGen: Given a uniformly sampled in R q ${\mathcal{R}}_{q}$ , a secret s ← χ1 and an error e ← χ1, the public key is defined as pk = (pk.a, pk.b) = (a, a⋅s + e) and private key as s. Encryption: To encrypt a message z ∈ R 2 $\boldsymbol{z}\in {\mathcal{R}}_{2}$ , sample new randomness r and error terms e1, e2 from error distribution χ1 are used. Then the ciphertext is a pair of polynomials (u, v) such that u = p k . a ⋅ r + e 1 , v = p k . b ⋅ r + e 2 + ⌊ q 2 ⌉ z . $\begin{array}{rl}\hfill \boldsymbol{u}& =pk.\boldsymbol{a}\cdot \boldsymbol{r}+{\boldsymbol{e}}_{1},\hfill \\ \hfill \boldsymbol{v}& =pk.\boldsymbol{b}\cdot \boldsymbol{r}+{\boldsymbol{e}}_{2}+\lfloor \frac{q}{2}\rceil \boldsymbol{z}.\hfill \end{array}$ Decryption: Given ciphertext (u, v), compute v − u ⋅ s = r ⋅ e − e 1 ⋅ s + e 2 + ⌊ q 2 ⌉ z . $\boldsymbol{v}-\boldsymbol{u}\cdot \boldsymbol{s}=\left(\boldsymbol{r}\cdot \boldsymbol{e}-{\boldsymbol{e}}_{1}\cdot \boldsymbol{s}+{\boldsymbol{e}}_{2}\right)+\lfloor \frac{q}{2}\rceil \boldsymbol{z}.$ If each coefficient of the resulting polynomial is close to 0, set the respective coefficient of the decrypted message to 0. Otherwise, set the decrypted message as 1. The RLWE encryption scheme defined as above is semantically secure under R L W E χ 1 ${\mathsf{R}\mathsf{L}\mathsf{W}\mathsf{E}}_{{\chi }_{1}}$ assumption. To see this, just observe that the ciphertext consists of two RLWE samples, which by the R L W E χ 1 ${\mathsf{R}\mathsf{L}\mathsf{W}\mathsf{E}}_{{\chi }_{1}}$ assumption are indistinguishable from uniformly random elements. Thus, unless one can solve the decisional-RLWE problem, all ciphertexts look uniform and no information can be extracted about the plaintext. Definition 2.[MLWEn,m,χ] In the Module-LWE problem with parameters n, m > 0 and an error distribution χ over R $\mathcal{R}$ , the PPT adversary A $\mathcal{A}$ is asked to distinguish ( A , t → ) ← $ R q m × n × R q m $(\boldsymbol{A},\overrightarrow{\boldsymbol{t}})\stackrel{\$}{{\leftarrow}}{\mathcal{R}}_{q}^{m\times n}\times {\mathcal{R}}_{q}^{m}$ from ( A , A s → + e → ) $(\boldsymbol{A},\boldsymbol{A}\overrightarrow{\boldsymbol{s}}+\overrightarrow{\boldsymbol{e}})$ for A ← $ R q m × n $\boldsymbol{A}\stackrel{\$}{{\leftarrow}}{\mathcal{R}}_{q}^{m\times n}$ , a secret vector s → ← χ n $\overrightarrow{\boldsymbol{s}}{\leftarrow}{\chi }^{n}$ and an error vector e → ← χ m $\overrightarrow{\boldsymbol{e}}{\leftarrow}{\chi }^{m}$ . Definition 3.[MSISm,n,β] The goal in the Module-SIS problem with parameters n, m > 0 and 0 < β < q is to find x → ∈ R q m $\overrightarrow{\boldsymbol{x}}\in {\mathcal{R}}_{q}^{m}$ for a given matrix A ← $ R q n × m $\boldsymbol{A}\stackrel{\$}{{\leftarrow}}{\mathcal{R}}_{q}^{n\times m}$ such that A x → = 0 → mod q $\boldsymbol{A}\overrightarrow{\boldsymbol{x}}=\overrightarrow{\mathbf{0}}\,\mathrm{mod}\,\,q$ and 0 < ‖ x → ‖ ∞ < β $0< \Vert \overrightarrow{\boldsymbol{x}}{\Vert }_{\infty }< \beta $ . In practical security estimations, the parameter m in Definitions 2 and 3 does not play a crucial role, therefore we simply omit it and use the notations M L W E n , χ ${\mathsf{M}\mathsf{L}\mathsf{W}\mathsf{E}}_{n,\chi }$ and M S I S n , β ${\mathsf{M}\mathsf{S}\mathsf{I}\mathsf{S}}_{n,\beta }$ . Furthermore, we let the parameters μ and λ denote the module ranks for M S I S $\mathsf{M}\mathsf{S}\mathsf{I}\mathsf{S}$ and M L W E $\mathsf{M}\mathsf{L}\mathsf{W}\mathsf{E}$ respectively. 2.4 Challenge space Elements of the ring R q ${\mathcal{R}}_{q}$ are not always invertible. In fact, Lyubashevsky et al. proved a relation between the probability of invertibility in this ring and the number of residue fields it splits into [17, Corollary 1.2]. Their claim is that generally short non-zero polynomials are invertible. In lattice-based zero-knowledge proofs, the verifier often samples from a challenge set such that the difference between any two elements in that set is invertible. However, constructing such a set and uniformly sampling from it is not a trivial task. Therefore, Lyubashevsky et al. proposed another method where they relaxed the invertibility requirement. They defined the challenge space as the set of ternary polynomials C = { − 1 , 0 , 1 } d ⊂ R $\mathcal{C}={\left\{-1,0,1\right\}}^{d}\subset \mathcal{R}$ . Coefficients of a challenge c ∈ C $\boldsymbol{c}\in \mathcal{C}$ are identically and independently distributed where 0 has probability 1/2 and ± 1 both have probability 1/4. In ref. [10, Lemma 3.3], it is shown that if c ← C $\boldsymbol{c}{\leftarrow}\mathcal{C}$ , the distribution of coefficients of c mod (Xd/l − ζ) is almost uniform and the maximum probability of coefficients over Z q ${\mathbb{Z}}_{q}$ is bounded. Denote this bound with p. For example, in ref. [10] it is estimated that p = 2−31.44 for l = d = 128, q ≈ 232. An element c in splitting ring R q ${\mathcal{R}}_{q}$ is non-invertible when c mod φi = 0 for any i = 1, …, l. Then the difference between† any two challenges c ¯ = c − c ′ $\bar{\boldsymbol{c}}=\boldsymbol{c}-{\boldsymbol{c}}^{\prime }$ is non-invertible with probability at most pd/l. Therefore, Lyubashevsky et al. proposed another method where they relaxed the invertiblity requirement. They defined the challenge space as the set of ternary polynomials C = { − 1 , 0 , 1 } d ⊂ R $\mathcal{C}={\left\{-1,0,1\right\}}^{d}\subset \mathcal{R}$ . Coefficients of a challenge c ∈ C $\boldsymbol{c}\in \mathcal{C}$ are identically and independently distributed where 0 has probability 1/2 and ± 1 both have probability 1/4. In ref. [10, Lemma 3.3], it is shown that if c ← C $\boldsymbol{c}{\leftarrow}\mathcal{C}$ , the distribution of coefficients of c mod (Xd/l − ζ) is almost uniform and the maximum probability of coefficients over Z q ${\mathbb{Z}}_{q}$ is bounded. Denote this bound with p. For example, in ref. [10] it is estimated that p = 2−31.44 for l = d = 128, q ≈ 232. An element c in splitting ring R q ${\mathcal{R}}_{q}$ is non-invertible when c mod φi = 0 for any i = 1, …, l. Then the difference between any two challenges c ¯ = c − c ′ $\bar{\boldsymbol{c}}=\boldsymbol{c}-{\boldsymbol{c}}^{\prime }$ is non-invertible with probability at most pd/l. 2.5 Error distribution and rejection sampling Security of RLWE and MLWE problems depends on the error distribution. The original security proofs [14, 15] assumed the errors from discrete spherical Gaussian distribution. However, in literature we can find different choices such as centred binomial distribution [18, 19] or uniform distribution in a small interval [20]. We use the former for sampling randomness in MLWE and the latter for randomness and error terms in RLWE. Rejection sampling. It is a common practice to hide secret commitment randomness r → ∈ R q κ $\overrightarrow{\boldsymbol{r}}\in {\mathcal{R}}_{q}^{\kappa }$ in another vector z → $\overrightarrow{\boldsymbol{z}}$ without leaking any information about r → $\overrightarrow{\boldsymbol{r}}$ . For this purpose, we use uniform rejection sampling technique from ref. [19]. In the protocol, the prover samples a 'masking' vector y → $\overrightarrow{\boldsymbol{y}}$ using uniform distribution in [−δ + 1, δ]. Upon receiving the challenge c ← $ C $\boldsymbol{c}\stackrel{\$}{{\leftarrow}}\mathcal{C}$ by the verifier, the prover responds with z → = y → + c r → $\overrightarrow{\boldsymbol{z}}=\overrightarrow{\boldsymbol{y}}+\boldsymbol{c}\overrightarrow{\boldsymbol{r}}$ . The dependency of z → $\overrightarrow{\boldsymbol{z}}$ on r → $\overrightarrow{\boldsymbol{r}}$ is removed if ‖ z → ‖ ∞ < δ − β $\Vert \overrightarrow{\boldsymbol{z}}{\Vert }_{\infty }< \delta -\beta $ where ‖ c r → ‖ ∞ ≤ β $\Vert \boldsymbol{c}\overrightarrow{\boldsymbol{r}}{\Vert }_{\infty }\le \beta $ . Otherwise, the prover rejects the masked vector and aborts the protocol to start over again. The expected number of repetitions M required by rejection sampling can be estimated by 1 / M = 2 ( δ − β ) − 1 2 δ − 1 κ d ≈ e − κ d β / δ . $1/M={\left(\frac{2(\delta -\beta )-1}{2\delta -1}\right)}^{\kappa d}\approx {e}^{-\kappa d\beta /\delta }.$ For more details see ref. [19]. The parameter δ is typically chosen so that the expected value of M is small (say, 2 or 3). 2.6 Commitment scheme In this work, we will be using a variant of BDLOP commitment scheme [13]. Let, B 0 ∈ R q μ × ( μ + λ + 1 ) ${\boldsymbol{B}}_{0}\in {\mathcal{R}}_{q}^{\mu \times (\mu +\lambda +1)}$ , b → 1 ∈ R q μ + λ + 1 ${\overrightarrow{\boldsymbol{b}}}_{1}\in {\mathcal{R}}_{q}^{\mu +\lambda +1}$ and r → ← χ 2 ( μ + λ + 1 ) d $\overrightarrow{\boldsymbol{r}}{\leftarrow}{\chi }_{2}^{(\mu +\lambda +1)d}$ . The commitment of a single message m ∈ R q $\boldsymbol{m}\in {\mathcal{R}}_{q}$ is a pair ( t → 0 , t 1 ) $({\overrightarrow{\boldsymbol{t}}}_{0},{\boldsymbol{t}}_{1})$ where t → 0 = B 0 r → , t 1 = 〈 b → 1 , r → 〉 + m . $\begin{array}{l}{\overrightarrow{\boldsymbol{t}}}_{0}={\boldsymbol{B}}_{0}\overrightarrow{\boldsymbol{r}},\hfill \\ \hfill {\boldsymbol{t}}_{1}=\langle {\overrightarrow{\boldsymbol{b}}}_{1},\overrightarrow{\boldsymbol{r}}\rangle +\boldsymbol{m}.\hfill \end{array}$ It is easy to see that the commitment scheme is binding and hiding due to M S I S μ ${\mathsf{M}\mathsf{S}\mathsf{I}\mathsf{S}}_{\mu }$ and M L W E λ ${\mathsf{M}\mathsf{L}\mathsf{W}\mathsf{E}}_{\lambda }$ assumptions respectively. Definition 4.A weak opening for the commitment t → = t → 0 ‖ t 1 $\overrightarrow{\boldsymbol{t}}={\overrightarrow{\boldsymbol{t}}}_{0}\Vert {\boldsymbol{t}}_{1}$ consists of l polynomials c ¯ i ∈ R q ${\bar{\boldsymbol{c}}}_{i}\in {\mathcal{R}}_{q}$ , randomness vector r → ⋆ ${\overrightarrow{\boldsymbol{r}}}^{\star }$ over R q ${\mathcal{R}}_{q}$ and a message m ⋆ ∈ R q ${\boldsymbol{m}}^{\star }\in {\mathcal{R}}_{q}$ such that ‖ c ¯ i ‖ 1 ≤ 2 d and c ¯ i mod φ i ≠ 0 for all 1 ≤ i ≤ l , ‖ c ¯ i r → ⋆ ‖ ∞ ≤ 2 β for all 1 ≤ i ≤ l , B 0 r → ⋆ = t → 0 , 〈 b → 1 , r → ⋆ 〉 + m ⋆ = t 1 . $\begin{array}{c}\hfill \Vert {\bar{\mathbf{c}}}_{i}{\Vert }_{1}\le 2d\,\text{and}\,{\bar{\boldsymbol{c}}}_{i}\,\mathrm{mod}\,\,{\boldsymbol{\varphi }}_{i}\ne 0\,\text{for}\,\text{all}\,1\le i\le l,\hfill \\ \hfill \Vert {\bar{\mathbf{c}}}_{i}{\overrightarrow{\boldsymbol{r}}}^{\star }{\Vert }_{\infty }\le 2\beta \,\text{for}\,\text{all}\,1\le i\le l,\hfill \\ \hfill {\boldsymbol{B}}_{0}{\overrightarrow{\boldsymbol{r}}}^{\star }={\overrightarrow{\boldsymbol{t}}}_{0},\hfill \\ \hfill \langle {\overrightarrow{\boldsymbol{b}}}_{1},{\overrightarrow{\boldsymbol{r}}}^{\star }\rangle +{\boldsymbol{m}}^{\star }={\boldsymbol{t}}_{1}.\hfill \end{array}$ The BDLOP commitment scheme is proven to be binding also with respect to the weak opening in ref. [10, Lemma 4.3]. 2.7 Generalised Schwartz-Zippel lemma The generalised Schwartz-Zippel lemma is stated as follows [9, Appendix A]. Lemma 1.Let p ∈ R[x1, x2, …, xn] be a non-zero polynomial of total degree d ≥ 0 over a commutative ring R. Let S be a finite subset of R such that none of the differences between two elements of S is a divisor of 0 and let r1, r2, …, rn be selected at random independently and uniformly from S. Then Pr[p(r1, r2, …, rn) = 0] ≤ d/|S|. In general, it is not trivial to construct the set S. A polynomial in R q ${\mathcal{R}}_{q}$ is a zero divisor when at least one of its NTT coefficients is zero. Thus, the difference between two elements is not a divisor of zero when they do not have a common NTT coefficient. There can be at most q pairwise different modulo degree 1 prime ideals for fully splitting rings. This strictly reduces soundness. However, for partially splitting rings, this number increases to qd/l. For any random polynomial, one can find qd/l − 1 other polynomials which do not have common NTT coefficients and construct the set S. We fix this set to be S = f ∈ R q ∣ deg f < d / l $\mathcal{S}=\left\{\boldsymbol{f}\in {\mathcal{R}}_{q}\,\vert \,\text{deg}\,\boldsymbol{f}< d/l\right\}$ . 2.8 Mix-node security Costa et al. [9] proposed a stronger security definition for a mix-node. Assume that MixVotes is a generic mixing algorithm such that, given input ciphertexts and a permutation vector, produces shuffled and re-encrypted ciphertexts. Moreover, let z i A ${z}^{\left({i}_{\mathcal{A}}\right)}$ and z π j A ${z}^{\pi \left({j}_{\mathcal{A}}\right)}$ be the message before and after running the algorithm. Definition 5.Let J be a uniform random variable taking values in [1, …, N]. A mix-node given by algorithm MixVotes is said to be secure if the advantage of any PPT adversary A $\mathcal{A}$ over random guess is negligible in the security parameter. That is, ∀c, ∃κ0 s.t if κ > κ0: A d v A sec = Pr z i A = z π j A − Pr z i A = z π ( J ) < 1 κ c . ${\boldsymbol{A}\boldsymbol{d}\boldsymbol{v}}_{\mathcal{A}}^{\mathrm{sec}\,}=\left\vert \mathrm{Pr}\left[{z}^{\left({i}_{\mathcal{A}}\right)}={z}^{\pi \left({j}_{\mathcal{A}}\right)}\right]-\mathrm{Pr}\left[{z}^{\left({i}_{\mathcal{A}}\right)}={z}^{\pi (J)}\right]\right\vert < \frac{1}{{\kappa }^{c}}.$ 3 IMPROVED MIX-NODE Our proof of shuffle protocol is based on Costa et al.'s work [9]. Assume that there are N RLWE ciphertexts (ui, vi) encrypted with public key (pk.a, pk.b) to be shuffled. A mixing node will generate secret random zero encryption ciphertexts (ui,0, vi,0) and permutation π, and output u i ′ , v i ′ $\left({\boldsymbol{u}}_{i}^{\prime },{\boldsymbol{v}}_{i}^{\prime }\right)$ such that u i , 0 , v i , 0 = pk . a ⋅ r E , i + e u , i , pk . b ⋅ r E , i + e v , i + 0 u i ′ , v i ′ = u π ( i ) + u i , 0 , v π ( i ) + v i , 0 $\begin{array}{rl}\hfill \left({\boldsymbol{u}}_{i,0},{\boldsymbol{v}}_{i,0}\right)& =\left(\mathit{\text{pk}}.\boldsymbol{a}\cdot {\boldsymbol{r}}_{E,i}+{\boldsymbol{e}}_{u,i},\mathit