Albert Albiol, Elvira MaríaBellés-Muñoz, MartaIsabel Márquez, MiguelRodríguez-Núñez, ClaraAlbert Rubio Gimeno2025-05-262025-05-262022Albert E, Bellés-Muñoz M, Isabel M, Rodríguez-Núñez C, Rubio A. Distilling constraints in zero-knowledge protocols. In: Shoham S, Vizel Y, editors. Computer aided verification. Proceedings of the 34th International Conference, CAV; 2022 Aug 7-10; Haifa, Israel. Cham: Springer; c2022. p. 430-43. (Lecture Notes in Computer Science, 13371). DOI: 10.1007/978-3-031-13185-1_219783031131844http://hdl.handle.net/10230/70488Comunicació presentada a la 34th International Conference, celebrada del 7 al 10 d'agost de 2022 a Haifa, Israel.The most widely used Zero-Knowledge (ZK) protocols require provers to prove they know a solution to a computational problem expressed as a Rank-1 Constraint System (R1CS). An R1CS is essentially a system of non-linear arithmetic constraints over a set of signals, whose security level depends on its non-linear part only, as the linear (additive) constraints can be easily solved by an attacker. Distilling the essential constraints from an R1CS by removing the part that does not contribute to its security is important, not only to reduce costs (time and space) of producing the ZK proofs, but also to reveal to cryptographic programmers the real hardness of their proofs. In this paper, we formulate the problem of distilling constraints from an R1CS as the (hard) problem of simplifying constraints in the realm of non-linearity. To the best of our knowledge, it is the first time that constraint-based techniques developed in the context of formal methods are applied to the challenging problem of analysing and optimizing ZK protocols.application/pdfengThis chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made. The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.Seguretat informàticaSistemes de seguretatXifratge (Informàtica)info:eu-repo/semantics/conferenceObjecthttp://dx.doi.org/10.1007/978-3-031-13185-1_21info:eu-repo/semantics/openAccess