1. Fine-Tuning Groth-Sahai Proofs Alex Escala Scytl Secure Electronic Voting Jens Groth University College London

2. Non-interactive zero-knowledge proofs Completeness: Prover can prove true statements Soundness: Prover cannot prove false statements Zero-knowledge: Proofs does not reveal anything else 2  Statement Common reference string

3. NIZK proofs Circuit SATPratical pairing- based statements Inefficient Efficient Statistical sampling techniques Groth-Ostrovsky- Sahai 2012 (2006) Groth 2006 Groth-Sahai 2012 (2008) 1 GB 1 KB Statement: Here is a ciphertext and a document. The ciphertext contains a digital signature on the document. 3 Further reduction of size More efficient computation

4. Prime order bilinear groups 4

5. SXDH bilinear groups 5

6. 6

7. Linear algebra notation 7

8. Groth-Sahai proofs 8

9. Commit-and-prove system [Kil90,CLOS02,Fuc11] 9

10. Type-based commit-and-prove system 10

11. 11

12. 12

13. 13

14. Type-based commitments 14

15. The base type 15

16. Commitments 16

17. Proofs 17

18. Soundness 18

19. Zero-knowledge simulation for commitments 19

20. Zero-knowledge simulation for proofs 20

21. Prover-chosen common reference string Faster computation at the cost of sending a separate CRS and proving it is correct –Good trade-off when many proofs to the same verifiers 21 Common reference string I will use this CRS

22. Conclusion 22 Save a couple of group elements in each proof by using ElGamal encryption We can handle base elements directly Prover can reduce computation by using own key Size: Reduced from 16 to 6 group elements ~63% Computation: Reduced ~40%