I came across the notion of Common Reference String (CRS) model while reading this paper on a protocol for UC Oblivious Transfer: https://eprint.iacr.org/2007/348.pdf

I did some research and it seems to me that the CRS model is just some way to model hash functions: What are alternatives to the random oracle model for modelling hash functions?

My questions are:

  1. What is exactly the CRS model?

  2. What are the main differences, comparing to the Random Oracle Model (ROM)?

  3. What are the advantages and disadvantages of using the CRS model instead of using the ROM?

Thank you in advance


1 Answer 1

  1. The CRS has nothing to do with modeling hash functions. Rather, it is a model where there is a public string that was generated in a trusted manner, and all parties have access to the string. It has two flavors: a common random string (where it is just a uniformly distributed string) and a general common reference string (which may have an arbitrary distribution).

  2. The main difference between the ROM and CRS model is that proofs in the ROM are heuristic, since the actual protocol instantiation uses a hash function that is blatantly NOT a random oracle. In contrast, proofs in the CRS model have a standard reduction-based proof of security, and so are not heuristic.

  3. The main advantage of the CRS model over the random oracle model is that security is standard, and doesn't rely on a heuristic belief system that the real protocol that uses a standard hash function is secure. The main disadvantage is that you need to somehow generate this CRS, and this isn't trivial if there's no trust. Zcash uses a CRS and ran a large MPC protocol between many parties to generate the CRS. As long as you believe that not all the participants colluded, then you can trust the system from that point on. This is a good example of where a CRS can be deployed in reality.

  • $\begingroup$ As a special case, imagine a setup where the secret key is shared among parties as $sk=\sum_i sk_i$, the public-key is $pk=g^{sk}$ (in a discrete-logarithm secure group $G$). Finally $pk$ is published while $sk_i$ is given only to party $i$ ( I mean the setup returns $pk$ and $sk_i$ for party $i$). Is this a CRS setup? For me $pk$ is the string that is generated in a trusted way and everybody has access to it. But then what about $sk_i$ they are just for one party. $\endgroup$
    – A.Solei
    Commented Sep 24, 2020 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.