Skip to content

Commit 96c7829

Browse files
kurtpan666kurtpan666
committed
0921
1 parent 149e0cd commit 96c7829

3 files changed

Lines changed: 90 additions & 5 deletions

File tree

‎myst.yml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,17 +11,21 @@ project:
1111
github: ZKPunk-Org/reduction
1212
# To autogenerate a Table of Contents, run "uv run jupyter book init --write-toc"
1313

14+
1415

1516
toc:
1617
# Auto-generated by `myst init --write-toc`
1718
- file: README.md
1819
- title: Wiki
1920
children:
2021
- file: wiki/index.ipynb
22+
- title: Assumptions
23+
children:
24+
- file: wiki/assumptions/DDH.ipynb
2125
- title: Primitives
2226
children:
23-
- file: wiki/primitives/dhke.ipynb
24-
- file: wiki/primitives/ke.ipynb
27+
- file: wiki/primitives/DHKE.ipynb
28+
- file: wiki/primitives/KE.ipynb
2529

2630
site:
2731
template: book-theme

‎wiki/assumptions/DDH.ipynb‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"cells": [
3+
{
4+
"cell_type": "markdown",
5+
"id": "cf2c5dd5",
6+
"metadata": {},
7+
"source": [
8+
":::{tip}\n",
9+
"The Diffie-Hellman problems. The so-called Diffie-Hellman problems are related, but not known to be equivalent, to the problem of computing discrete logarithms. There are two important variants: the computational DiffieHellman (CDH) problem and the decisional Diffie-Hellman (DDH) problem.\n",
10+
"\n",
11+
"Fix a cyclic group $\\mathbb{G}$ and a generator $g \\in \\mathbb{G}$. Given elements $h_1, h_2 \\in \\mathbb{G}$, define $\\mathrm{DH}_g\\left(h_1, h_2\\right) \\stackrel{\\text { def }}{=} g^{\\log _g h_1 \\cdot \\log _g h_2}$. That is, if $h_1=g^{x_1}$ and $h_2=g^{x_2}$ then\n",
12+
"\n",
13+
"$$\n",
14+
"\\mathrm{DH}_g\\left(h_1, h_2\\right)=g^{x_1 \\cdot x_2}=h_1^{x_2}=h_2^{x_1} .\n",
15+
"$$\n",
16+
"\n",
17+
"The $C D H$ problem is to compute $\\mathrm{DH}_g\\left(h_1, h_2\\right)$ for uniform $h_1$ and $h_2$. Hardness of this problem can be formalized by the natural experiment; we leave the details as an exercise.\n",
18+
"\n",
19+
"If the discrete-logarithm problem relative to some $\\mathcal{G}$ is easy, then the CDH problem is, too: given $h_1$ and $h_2$, first compute $x_1:=\\log _g h_1$ and then output the answer $h_2^{x_1}$. In contrast, it is not clear (in general) whether hardness of the discrete-logarithm problem implies that the CDH problem is hard as well.\n",
20+
"\n",
21+
"The $D D H$ problem, roughly speaking, is to distinguish $\\mathrm{DH}_g\\left(h_1, h_2\\right)$ from a uniform group element when $h_1, h_2$ are uniform. That is, given uniform $h_1, h_2$ and a third group element $h^{\\prime}$, the problem is to decide whether $h^{\\prime}= \\mathrm{DH}_g\\left(h_1, h_2\\right)$ or whether $h^{\\prime}$ was chosen uniformly from $\\mathbb{G}$. Formally:\n",
22+
":::"
23+
]
24+
},
25+
{
26+
"cell_type": "markdown",
27+
"id": "14abcea7",
28+
"metadata": {},
29+
"source": [
30+
":::{tip} DDH Assumption\n",
31+
":label: ddh\n",
32+
"We say the DDH problem is hard relative to $\\mathcal{G}$ if for all probabilistic polynomial-time algorithms $\\mathcal{A}$ there is a negligible function negl such that\n",
33+
"\n",
34+
"$$\n",
35+
"\\left|\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^z\\right)=1\\right]-\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^{x y}\\right)=1\\right]\\right| \\leq \\operatorname{negl}(n),\n",
36+
"$$\n",
37+
"\n",
38+
"where in each case the probabilities are taken over the experiment in which $\\mathcal{G}\\left(1^n\\right)$ outputs ( $\\mathbb{G}, q, g$ ), and then uniform $x, y, z \\in \\mathbb{Z}_q$ are chosen. (Note that when $z$ is uniform in $\\mathbb{Z}_q$, then $g^z$ is uniformly distributed in $\\mathbb{G}$.)\n",
39+
":::"
40+
]
41+
}
42+
],
43+
"metadata": {
44+
"language_info": {
45+
"name": "python"
46+
}
47+
},
48+
"nbformat": 4,
49+
"nbformat_minor": 5
50+
}

‎wiki/primitives/dhke.ipynb‎

Lines changed: 34 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
"metadata": {},
2323
"source": [
2424
":::{attention}\n",
25-
"If the decisional Diffie-Hellman problem is hard relative to $\\mathcal{G}$, then [the Diffie-Hellman key-exchange protocol $\\Pi$](#dhke) is [secure in the presence of an eavesdropper](#ke-eav) (with respect to [the modified experiment $\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\mathrm{eav}}$](#ke-exp) ).\n",
25+
"If [the decisional Diffie-Hellman problem](#ddh) is hard relative to $\\mathcal{G}$, then [the Diffie-Hellman key-exchange protocol $\\Pi$](#dhke) is [secure in the presence of an eavesdropper](#ke-eav) (with respect to [the modified experiment $\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\mathrm{eav}}$](#ke-exp) ).\n",
2626
":::"
2727
]
2828
},
@@ -31,14 +31,45 @@
3131
"id": "693f633f",
3232
"metadata": {},
3333
"source": [
34-
"PROOF Let $\\mathcal{A}$ be a PPT adversary. Since $\\operatorname{Pr}[b=0]=\\operatorname{Pr}[b=1]=1 / 2$, we have\n",
34+
":::{danger} PROOF \n",
35+
":class: dropdown\n",
36+
"\n",
37+
"Let $\\mathcal{A}$ be a PPT adversary. Since $\\operatorname{Pr}[b=0]=\\operatorname{Pr}[b=1]=1 / 2$, we have\n",
3538
"\n",
3639
"$$\n",
3740
"\\begin{aligned}\n",
3841
"\\operatorname{Pr} & {\\left[\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\text {eav }}(n)=1\\right] } \\\\\n",
3942
"& =\\frac{1}{2} \\cdot \\operatorname{Pr}\\left[\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\text {eav }}(n)=1 \\mid b=0\\right]+\\frac{1}{2} \\cdot \\operatorname{Pr}\\left[\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\text {eav }}(n)=1 \\mid b=1\\right]\n",
4043
"\\end{aligned}\n",
41-
"$$"
44+
"$$\n",
45+
"\n",
46+
"In experiment $\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\text {eav }}(n)$ the adversary $\\mathcal{A}$ receives $\\left(\\mathbb{G}, q, g, h_A, h_B, \\hat{k}\\right)$, where $\\left(\\mathbb{G}, q, g, h_A, h_B\\right)$ represents the transcript of the protocol execution, and $\\hat{k}$ is either the actual key computed by the parties (if $b=0$ ) or a uniform group element (if $b=1$ ). Distinguishing between these two cases is exactly equivalent to solving the decisional Diffie-Hellman problem. That is\n",
47+
"\n",
48+
"$$\n",
49+
"\\begin{aligned}\n",
50+
"& \\operatorname{Pr}\\left[\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\text {eav }}(n)=1\\right] \\\\\n",
51+
"& =\\frac{1}{2} \\cdot \\operatorname{Pr}\\left[\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\text {eav }}(n)=1 \\mid b=0\\right]+\\frac{1}{2} \\cdot \\operatorname{Pr}\\left[\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\text {eav }}(n)=1 \\mid b=1\\right] \\\\\n",
52+
"& =\\frac{1}{2} \\cdot \\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^{x y}\\right)=0\\right]+\\frac{1}{2} \\cdot \\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^z\\right)=1\\right] \\\\\n",
53+
"& =\\frac{1}{2} \\cdot\\left(1-\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^{x y}\\right)=1\\right]\\right)+\\frac{1}{2} \\cdot \\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^z\\right)=1\\right] \\\\\n",
54+
"& =\\frac{1}{2}+\\frac{1}{2} \\cdot\\left(\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^z\\right)=1\\right]-\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^{x y}\\right)=1\\right]\\right) \\\\\n",
55+
"& \\leq \\frac{1}{2}+\\frac{1}{2} \\cdot\\left|\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^z\\right)=1\\right]-\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^{x y}\\right)=1\\right]\\right|\n",
56+
"\\end{aligned}\n",
57+
"$$\n",
58+
"\n",
59+
"where the probabilities are all taken over ( $\\mathbb{G}, q, g$ ) output by $\\mathcal{G}\\left(1^n\\right)$, and uniform choice of $x, y, z \\in \\mathbb{Z}_q$. (Note that since $g$ is a generator, $g^z$ is a uniform element of $\\mathbb{G}$ when $z$ is uniformly distributed in $\\mathbb{Z}_q$.) If the decisional DiffieHellman assumption is hard relative to $\\mathcal{G}$, that exactly means that there is a negligible function negl for which\n",
60+
"\n",
61+
"$$\n",
62+
"\\left|\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^z\\right)=1\\right]-\\operatorname{Pr}\\left[\\mathcal{A}\\left(\\mathbb{G}, q, g, g^x, g^y, g^{x y}\\right)=1\\right]\\right| \\leq \\operatorname{negl}(n)\n",
63+
"$$\n",
64+
"\n",
65+
"We conclude that\n",
66+
"\n",
67+
"$$\n",
68+
"\\operatorname{Pr}\\left[\\widehat{\\mathrm{KE}}_{\\mathcal{A}, \\Pi}^{\\mathrm{eav}}(n)=1\\right] \\leq \\frac{1}{2}+\\frac{1}{2} \\cdot \\operatorname{negl}(n),\n",
69+
"$$\n",
70+
"\n",
71+
"completing the proof.\n",
72+
":::"
4273
]
4374
}
4475
],

0 commit comments

Comments
 (0)