How to Use SNARKs in Universally Composable Protocols

The past several years have seen tremendous advances in practical, general-purpose, non-interactive proof systems called SNARKs. These building blocks are efficient and convenient, with multiple publicly available implementations, including tools to compile high-level code (e.g., written in C) to arithmetic circuits, the native representation used by SNARK construc-tions. However, while we would like to use these primitives in UC-secure protocols—which are provably-secure even when composed with other arbitrary concurrently-executing protocols— the SNARK definition is not directly compatible with this framework, due to its use of non black-box knowledge extraction. We show several constructions to transform SNARKs into UC-secure NIZKs, along with benchmarks and an end-to-end application example showing that the added overhead is tolerable. Our constructions rely on embedding cryptographic algorithms into the SNARK proof sys-tem. Ordinarily, cryptographic constructions are chosen and tuned for implementation on CPUs or in hardware, not as arithmetic circuits. We therefore also explore SNARK-friendly cryptog-raphy, describing several protocol parameterizations, implementations, and performance com-parisons for encryption, commitments, and other tasks. This is also of independent interest for use in other SNARK-based applications.