What Makes Fiat–Shamir zkSNARKs (Updatable SRS) Simulation Extractable?

• Published in: Security and Cryptography for Networks pp. 735 - 760
• Main Authors: Ganesh, Chaya, Khoshakhlagh, Hamidreza, Kohlweiss, Markulf, Nitulescu, Anca, Zając, Michał
• Format: Book Chapter
• Language: English
• Published: Cham Springer International Publishing 2022
• Series: Lecture Notes in Computer Science
• DOI: 10.1007/978-3-031-14791-3_32
• ISBN: 9783031147906; 3031147901
• ISSN: 0302-9743

We show that three popular universal zero-knowledge SNARKs (Plonk, Sonic, and Marlin) are updatable SRS simulation extractable NIZKs and signatures of knowledge (SoK) out-of-the-box avoiding any compilation overhead. Towards this we generalize results for the Fiat–Shamir (FS) transformation, which turns interactive protocols into signature schemes, non-interactive proof systems, or SoK in the random oracle model (ROM). The security of the transformation relies on rewinding to extract the secret key or the witness, even in the presence of signing queries for signatures and simulation queries for proof systems and SoK, respectively. We build on this line of work and analyze multi-round FS for arguments with a structured reference string (SRS). The combination of ROM and SRS, while redundant in theory, is the model of choice for the most efficient practical systems to date. We also consider the case where the SRS is updatable and define a strong simulation extractability notion that allows for simulated proofs with respect to an SRS to which the adversary can contribute updates. We define three properties (trapdoor-less zero-knowledge, rewinding-based knowledge soundness, and a unique response property) that are sufficient for argument systems based on multi-round FS to be also simulation extractable in this strong sense. We show that Plonk, Sonic, and Marlin satisfy these properties, and conjecture that many other argument systems such as Lunar, Basilisk, and transparent variants of Plonk fall within the reach of our main theorem.