Suyash Bagad
Department of Electrical Engineering, IIT Bombay
As a Part of Dual Degree (B.Tech + M.Tech) Project
Prof. Saravanan Vijayakumaran
Guide
June 29, 2020
Shorter, Privacy-Enhancing
Proof of Reserves
Proof of Reserves
Outline
Log-sized Privacy-Enhancing Proofs of Reserves Protocol
Motivation and main idea
Confidentiality of Amounts in Grin
Presented at Crypto Valley Conference on Blockchain Technology, 2020
Focus on performance trade-offs and implementation
Work accepted at IEEE Security & Privacy on Blockchain, 2020
Graph-based analysis of the Grin Blockchain
Main challenge in design
Adaptability to Edwards and Ristretto curves
MimbleWimble
Monero
Revelio
Cown
\mathcal{C}_{\text{own}}
C=gk⋅ha
C = g^{k} \cdot h^{a}
C∈Cown⟹k is known
C \in \mathcal{C}_{\text{own}} \implies k \text{ is known}
Each output in MimbleWimble is a Pedersen Commitment
For an amount a∈{0,1,…,264−1} and blinding factor k∈Zq
where g,h∈G such that DL relation between them is unknown
Revelio
Canon
\mathcal{C}_{\text{anon}}
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
9
9
10
10
12
12
11
11
13
13
For each Ci∈Canon, publish the tags (I1,…,In)∈Gn where n=∣Canon∣
Publish Cassets=∏i∈[n]Ii, and NIZK proofs σi∈Zq5 ∀i∈[n]
PoK{secret(α,β,γ) ∣ statement(Ci=gα⋅hβ ∧ Ii=gtα⋅hβ)∨(Ii=gtγ)}
PoK\big\{\underbrace{(\alpha,\beta,\gamma)}_{\text{secret}} \ | \ \underbrace{(C_i = g^{\alpha} \cdot h^{\beta} \ \wedge \ I_i = g_t^{\alpha} \cdot h^{\beta}) \vee (I_i = g_t^{\gamma}) }_{\text{statement}} \big\}
where yi=H(kexch,Ci)∈Zq
Ii={ g1ki⋅hai g1yiif Ci∈Cown,if Ci∈/Cown,
I_i =
\begin{cases}
\ g_1^{k_i} \cdot h^{a_i} & \text{if } C_i \in \mathcal{C}_{\text{own}},\\
\ g_1^{y_i} & \text{if } C_i \notin \mathcal{C}_{\text{own}},
\end{cases}
Drawbacks of Revelio
Proof size linear in anonymity set size
(n+1) in G, 5n in Zq
(n+1) \text{ in } \mathbb{G}, \ 5n \text{ in } \mathbb{Z}_q
Can we shrink proofs sizes to O(log2(n))?
Can we link the blockchain state to the proof of reserves?
Privacy of outputs depends on the anonymity set n
RevelioBP!
RevelioBP!
1
1
2
2
3
3
4
4
5
5
6
6
7
7
8
8
9
9
10
10
12
12
11
11
13
13
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
(
(
)
)
e1=
\textbf{e}_1 =
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
(
(
)
)
e2=
\textbf{e}_2 =
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
(
(
)
)
e3=
\textbf{e}_3 =
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
(
(
)
)
e4=
\textbf{e}_4 =
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
(
(
)
)
e5=
\textbf{e}_5 =
k1
k_1
k2
k_2
k3
k_3
k4
k_4
k5
k_5
(
(
)
)
k=
\textbf{k} =
PoK{ (k∈Zqs, E∈Z2s×n) ∣ Cej=gkjhaj ∧ Ij=gtkjhaj ∀j∈[s] }
PoK\left\{ \ (\textbf{k} \in \mathbb{Z}_q^s, \
\textbf{E} \in \mathbb{Z}_2^{s \times n}) \ | \
\textbf{C}^{\textbf{e}_j} = g^{k_j}h^{a_j}
\ \wedge \
\ I_j = g_t^{k_j}h^{a_j}
\ \forall j \in [s]
\ \right\}
Publish tag vector (I1,I2,…,Is), Cassets=∏i∈[n]Ii and NIZK ΠRevBP
More on RevelioBP
PoK{ (k∈Zqs, E∈Z2s×n) ∣ Cej=gkjhaj ∧ Ij=gtkjhaj ∀j∈[s] }
PoK\left\{ \ (\textbf{k} \in \mathbb{Z}_q^s, \
\textbf{E} \in \mathbb{Z}_2^{s \times n}) \ | \
\textbf{C}^{\textbf{e}_j} = g^{k_j}h^{a_j}
\ \wedge \
\ I_j = g_t^{k_j}h^{a_j}
\ \forall j \in [s]
\ \right\}
To build ΠRevBP, we combine the constraints using a scalar u←Zq
∏j∈[s](g−kj⋅gtkj⋅Ceij⋅Ij−1)uj−1=1,
\prod_{j \in [s]} \left(g^{-k_j} \cdot g_t^{k_j} \cdot \textbf{C}^{\textbf{e}_{i_j}} \cdot I_j^{-1}\right)^{u^{j-1}} = 1,
⟹g−⟨us,k⟩⋅gt⟨us,k⟩⋅CusE⋅I−us=1,
\implies g^{- \langle \textbf{u}^s, \textbf{k} \rangle} \cdot
g_t^{\langle \textbf{u}^s, \textbf{k} \rangle} \cdot
\textbf{C}^{ \textbf{u}^s \textbf{E}} \cdot
\textbf{I}^{- \textbf{u}^s} = 1,
We then use Inner Product Argument of the form
PoK{(a,b)∈ZqN ∣ P=ucgahb∧c=⟨a,b⟩ }
PoK \left\{
(\textbf{a}, \textbf{b}) \in \mathbb{Z}_q^N \ | \
P = u^{c}\textbf{g}^{\textbf{a}} \textbf{h}^{\textbf{b}} \wedge c = \langle \textbf{a}, \textbf{b} \rangle \
\right\}
s+2log2(sn+n+s+3) in G, 5 in Zq
s + 2 \text{log}_2(sn+n+s+3) \text{ in } \mathbb{G}, \
5 \text{ in } \mathbb{Z}_q
| RevelioBP proof size | Revelio proof size |
(n+1) in G, 5n in Zq
(n+1) \text{ in } \mathbb{G}, \ 5n \text{ in } \mathbb{Z}_q
Performance Trade-offs
| RevelioBP | Revelio | |
|---|---|---|
| Proof size | ||
| Scalability | ||
| Blockchain state | ||
| Output privacy | ||
| Inflation resistance | ||
| Own set size | ||
| Running times |
O(n)
\mathcal{O}(n)
O(s+log2(sn))
\mathcal{O}(s+\text{log}_2(sn))
O(sn)
\mathcal{O}(sn)
O(n)
\mathcal{O}(n)
For UTXO set size n=1.6×105 and s=102
5KB
5\text{KB}
32MB
32\text{MB}
(164,68)min
(164,68)\\[-3pt]
\text{min}
(34,34)min
(34,34)\\[-3pt]
\text{min}
Proof Sizes
We implemented RevelioBP in Rust over G=secp256k1 elliptic curve
n ⟶
n \ \longrightarrow
s ⟶
s \ \longrightarrow
s=20
s=20
n=1000
n=1000
Proof size in KB⟶
\text{Proof size in KB} \longrightarrow
Note: All plots are in log-log scale.
RevelioBP proofs are ≥10X shorter that that of Revelio
Running Times
RevelioBP proof generation is ≈2X slower that of Revelio
n ⟶
n \ \longrightarrow
s ⟶
s \ \longrightarrow
s=20
s=20
n=1000
n=1000
Running time in mins⟶
\text{Running time in mins} \longrightarrow
Note: All plots are in log-log scale.
RevelioBP ver. is ≈3X faster than its gen. due to multi-exponentiation
MProve+
Key challenge: Unlinking key-images & one-time addresses in MProve
Πt1={(P1,I1,α1,β1), (P2,I2,α2,β2), … , (Pn,In,αn,βn),}
\Pi_{t_1} =
\left\{
(P_1, I_1,\alpha_1, \beta_1),
\
(P_2, I_2,\alpha_2, \beta_2),
\ \ldots \ ,
\
(P_n, I_n,\alpha_n, \beta_n),
\right\}
Txt2={R,I2}
\textsf{Tx}_{t_2} = \{\mathcal{R}, I_{2}\}
Use an approach similar to RevelioBP
PoK{(x,k∈Zqs, E∈Z2s×n) Pej=gxj, Cej=gkjhaj, Ij=gtkjhaj ∀j∈[s] }
PoK\left\{ (\textbf{x}, \textbf{k} \in \mathbb{Z}_q^s, \
\textbf{E} \in \mathbb{Z}_2^{s \times n}) \ \bigg| \
\textbf{P}^{\textbf{e}_j} = g^{x_j},
\
\textbf{C}^{\textbf{e}_j} = g^{k_j}h^{a_j},
\
\ I_j = g_t^{k_j}h^{a_j}
\ \forall j \in [s]
\ \right\}
An MProve+ proof looks like
Πt1+={P,C∈Gn, I∈Gs, ΠNIZK}
\Pi^{+}_{t_1} =
\{
\textbf{P},
\textbf{C}\in \mathbb{G}^n, \
\textbf{I} \in \mathbb{G}^s, \
\Pi_{\textsf{\tiny NIZK}}
\}
Implementation Challenges
Implemented MProve+ and MProve in Rust over ed25519, ristretto
Small subgroup attack possible in ed25519
Implementation Challenges
Implemented MProve+ and MProve in Rust over ed25519, ristretto
Small subgroup attack possible in ed25519. For a prime q
Ristretto constructs a prime order group from an Edwards curve
MProve+ over ristretto allows generalisation for other Edwards curves
∣Ged∣=8q, ∣Gris∣=q
|\mathbb{G}_{\textsf{ed}}| = 8q,
\
|\mathbb{G}_{\textsf{ris}}| = q
We show conversion of Ristretto points to Edwards
Wrote an Elligator support over ed25519 to generate random curve points
Running Times for Gris
n ⟶
n \ \longrightarrow
s ⟶
s \ \longrightarrow
Running time in mins⟶
\text{Running time in mins} \longrightarrow
Note: All plots are in log-log scale.
s=100
s=100
n=5000
n=5000
n≈2000
n \approx 2000
Thank
Happy to answer any questions!
you!
Suyash Bagad Department of Electrical Engineering, IIT Bombay As a Part of Dual Degree (B.Tech + M.Tech) Project Prof. Saravanan Vijayakumaran Guide June 29, 2020 Shorter, Privacy-Enhancing Proof of Reserves Proof of Reserves
Aztec-Suyash-Round#2
By Suyash Bagad
Aztec-Suyash-Round#2
Short Presentation of thesis project for Aztec Protocol.
- 114
