International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Malicious Security in Collaborative zkSNARKs: More than Meets the Eye

Authors:
Sanjam Garg , UC Berkeley
Aarushi Goel , Purdue University
Abhishek Jain , Johns Hopkins University and NTT Research
Bhaskar Roberts , UC Berkeley
Sruthi Sekar , IIT Bombay
Download:
Search ePrint
Search Google
Conference: CRYPTO 2025
Abstract: Collaborative zkSNARKs (Ozdemir and Boneh, USENIX'22) are a multiparty variant of zkSNARKs where multiple provers, each holding a private witness, jointly compute a zkSNARK for their combined witness. A sequence of works has proposed efficient constructions of collaborative zkSNARKs. All of them follow a common design template to emulate a zkSNARK prover in the distributed setting: (i) First, using a generic MPC, the parties jointly compute secret shares of an "extended" prover witness. (ii) Next, given these shares, the parties jointly compute a zkSNARK proof. The latter step involves designing custom semi-honest MPC protocols that avoid non-black-box use of cryptography. To achieve malicious security, prior works adopt state-of-the-art compilers from the MPC literature to transform semi-honest MPC into malicious-secure MPC. In this work, we revisit this design template. - Pitfalls: We demonstrate two pitfalls in the template, which can lead to loss of input privacy. We show that it is possible to compute collaborative proofs on invalid extended witnesses, which in turn can leak the witnesses of honest provers. We also show that using existing malicious security compilers as-is for proof computation is insecure in general. Finally, we discuss mitigation strategies. -Malicious Security for Free: Surprisingly, we show that in the honest-majority setting, given (honestly generated) shares of the extended witness, a semi-honest MPC suffices for collaborative proof generation of several widely used zkSNARKs, even in the presence of a malicious adversary. In other words, we can avoid the overheads of malicious security compilers, enabling faster proof generation. To the best of our knowledge, this presents the first examples of non-trivial computations for which semi-honest MPC protocols achieve malicious security.
BibTeX
@inproceedings{crypto-2025-35681,
  title={Malicious Security in Collaborative zkSNARKs: More than Meets the Eye},
  publisher={Springer-Verlag},
  author={Sanjam Garg and Aarushi Goel and Abhishek Jain and Bhaskar Roberts and Sruthi Sekar},
  year=2025
}