Lecture 12 questions

Lecture 12 questions

AvivB 27 Jan 2020 22:19

Hi,
I have some question regarding Lecture 12:

1. Page 1, Adaptive Zero Knowledge: Can you please give a description of the distribution behind the Real and the Ideal worlds? maybe in an ensemble notation?
2. Page 3, Within the Decrypt of the CCA scheme: Don't we need to append to SK' the CRS? Because it has to verify that the NIZK is correct, and the verifier of the NIZK needs the CRS.
3. Page 3, Claim 2.2: What does it mean a "sequence of hybrid games" - How does the distribution of game look like? And why does it imply that we can replace one game with another?
4.Page 3, Game1: It seems that we assumed NIZK, but we are using the two simulators which are part of the Adaptive NIZK ZK.
Do we assume NIZK and transform it into an adaptive NIZK (although the proof for it will come later on the lecture) as stated that can be done?
(The same question goes for Definition 2.3 which also assumed NIZK but used the adaptive ZK).
5. Page 4, Game4: In line 2, do we intentionally moved back to decrypting with sk0, If so - why is that?
6. A General question: In most of the NIZK ZK definitions we used an ensemble notation, but we didn't mention the security parameter n.
Does it have some meaning? or n is that obvious that it is omitted? (If n shouldn't be there - on what parameter is the bounding negligible function?)

Thanks, and sorry for the long questions.

Re: Lecture 12 questions

nbitansky 28 Jan 2020 20:42

1. It's the output bit of $D$ in each of the two games. (Equivalently, you can say it is the view of $D$ in these games, including its input, randomness, and all oracle answers.)

2. Yes, thanks for noting!

3. It's basically a hybrid argument. We considered several games, and showed that the probability that the attacker wins doesn't change much between each two consecutive games. The first game was the real game, and the last game was one where we could easily argue that the attacker wins with probability 1/2. Thus we deduce that it wins the original game with probability at most 1/2 plus neg.

4. The CCA construction relies on adaptive NIZK (which was the whole point). We defined it, showed how it's useful, and then talked about obtaining it. Definition 2.3 follows the syntax of adaptive NIZK (crs is simulated separately etc).

5. Copy-paste type. Thanks!

6. We just identified the security parameter $n$ with the input length $|x|$, which is just for notational convenience (you could have a more general definition where inputs could be bounded by some polynomial in $n$).

Last edited on 28 Jan 2020 21:04 by nbitansky Show more