Skip to main content
Cryptography

Return to Answer

deleted 1 character in body
Source Link
Geoffroy Couteau
Geoffroy Couteau
  • 21.3k
  • 2
  • 50
  • 72

For many concrete HVZK proof systems, we actually. don't have an attack against zero-knowledge when the verifier is dishonest - but we don't have a security proof either!

In particular, in many $\Sigma$-protocols, such as the standard QR argument, this is the case. We only know how to prove HVZK, but we don't have an explicit attack against zero-knowledge.

If you've not done it, I suggest that you run through the security analysis and try to understand why it breaks down when the verifier can be malicious. The issue will not appear when the verifier does something too simple, like always sending zero, but it appears as soon as the verifier picks their challenge based on the first flow (e.g. by hashing the first flow).

Still, the fact that we have not found an explicit attack should not be taken as a strong support for the assumption that the protocol is secure. There are many examples of protocols for which we had no attacks for years, and the protocol sure looked secure (but we had no proof) -- and eventually, an explicit attack was found.

For many concrete HVZK proof systems, we actually. don't have an attack against zero-knowledge when the verifier is dishonest - but we don't have a security proof either!

In particular, in many $\Sigma$-protocols, such as the standard QR argument, this is the case. We only know how to prove HVZK, but we don't have an explicit attack against zero-knowledge.

If you've not done it, I suggest that you run through the security analysis and try to understand why it breaks down when the verifier can be malicious. The issue will not appear when the verifier does something too simple, like always sending zero, but it appears as soon as the verifier picks their challenge based on the first flow (e.g. by hashing the first flow).

Still, the fact that we have not found an explicit attack should not be taken as a strong support for the assumption that the protocol is secure. There are many examples of protocols for which we had no attacks for years, and the protocol sure looked secure (but we had no proof) -- and eventually, an explicit attack was found.

For many concrete HVZK proof systems, we actually don't have an attack against zero-knowledge when the verifier is dishonest - but we don't have a security proof either!

In particular, in many $\Sigma$-protocols, such as the standard QR argument, this is the case. We only know how to prove HVZK, but we don't have an explicit attack against zero-knowledge.

If you've not done it, I suggest that you run through the security analysis and try to understand why it breaks down when the verifier can be malicious. The issue will not appear when the verifier does something too simple, like always sending zero, but it appears as soon as the verifier picks their challenge based on the first flow (e.g. by hashing the first flow).

Still, the fact that we have not found an explicit attack should not be taken as a strong support for the assumption that the protocol is secure. There are many examples of protocols for which we had no attacks for years, and the protocol sure looked secure (but we had no proof) -- and eventually, an explicit attack was found.

Source Link
Geoffroy Couteau
Geoffroy Couteau
  • 21.3k
  • 2
  • 50
  • 72

For many concrete HVZK proof systems, we actually. don't have an attack against zero-knowledge when the verifier is dishonest - but we don't have a security proof either!

In particular, in many $\Sigma$-protocols, such as the standard QR argument, this is the case. We only know how to prove HVZK, but we don't have an explicit attack against zero-knowledge.

If you've not done it, I suggest that you run through the security analysis and try to understand why it breaks down when the verifier can be malicious. The issue will not appear when the verifier does something too simple, like always sending zero, but it appears as soon as the verifier picks their challenge based on the first flow (e.g. by hashing the first flow).

Still, the fact that we have not found an explicit attack should not be taken as a strong support for the assumption that the protocol is secure. There are many examples of protocols for which we had no attacks for years, and the protocol sure looked secure (but we had no proof) -- and eventually, an explicit attack was found.