Interactive Proofs Lecture 16 What the all-powerful can convince - PowerPoint PPT Presentation

Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier 10

Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover 10

Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon 10

Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon Public coin proof-system 10

Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon Public coin proof-system Arthur sends no messages nor flips any coins 10

MA and AM 11

MA and AM Class of languages with two message Arthur-Merlin protocols 11

MA and AM Class of languages with two message Arthur-Merlin protocols AM (or AM[2]): One message from beacon, followed by one message from Merlin 11

MA and AM Class of languages with two message Arthur-Merlin protocols AM (or AM[2]): One message from beacon, followed by one message from Merlin MA (or MA[2]): One message from Merlin followed by one message from beacon 11

MA and AM Class of languages with two message Arthur-Merlin protocols AM (or AM[2]): One message from beacon, followed by one message from Merlin MA (or MA[2]): One message from Merlin followed by one message from beacon Contain NP and BPP 11

Multiple-message proofs 12

Multiple-message proofs AM[k], MA[k], IP[k]: k(n) messages 12

Multiple-message proofs AM[k], MA[k], IP[k]: k(n) messages Turns out IP[k] ⊆ AM[k+2]! 12

Multiple-message proofs AM[k], MA[k], IP[k]: k(n) messages Turns out IP[k] ⊆ AM[k+2]! Turns out IP[const] = AM[const] = AM[2]! 12

Multiple-message proofs AM[k], MA[k], IP[k]: k(n) messages Turns out IP[k] ⊆ AM[k+2]! Turns out IP[const] = AM[const] = AM[2]! Called AM 12

Multiple-message proofs AM[k], MA[k], IP[k]: k(n) messages Turns out IP[k] ⊆ AM[k+2]! Turns out IP[const] = AM[const] = AM[2]! Called AM Turns out IP[poly] = AM[poly] = PSPACE! 12

Multiple-message proofs AM[k], MA[k], IP[k]: k(n) messages Turns out IP[k] ⊆ AM[k+2]! Turns out IP[const] = AM[const] = AM[2]! Called AM Turns out IP[poly] = AM[poly] = PSPACE! Called IP (= PSPACE) 12

Multiple-message proofs AM[k], MA[k], IP[k]: k(n) messages Turns out IP[k] ⊆ AM[k+2]! Turns out IP[const] = AM[const] = AM[2]! Called AM Turns out IP[poly] = AM[poly] = PSPACE! Called IP (= PSPACE) Later. 12

How can private coins be avoided? 13

How can private coins be avoided? Example: GNI 13

How can private coins be avoided? Example: GNI Recall GNI protocol used private coins 13

How can private coins be avoided? Example: GNI Recall GNI protocol used private coins An alternate view of GNI 13

How can private coins be avoided? Example: GNI Recall GNI protocol used private coins An alternate view of GNI Each of G 0 and G 1 has n! isomorphic graphs 13

Interactive Proofs Lecture 16 What the all-powerful can convince - PowerPoint PPT Presentation

Interactive Proofs Lecture 16 What the all-powerful can convince mere mortals of 1 Recap 2 Recap Non-deterministic Computation 2 Recap Non-deterministic Computation Polynomial Hierarchy 2 Recap Non-deterministic Computation

Interactive Proofs Lecture 18 AM 1 Interactive Proofs 2 Interactive Proofs IP[k] 2

Foundation of Cryptography (0368-4162-01), Lecture 5 Interactive Proofs and Zero Knowledge

Interactive Proof System We have seen interactive proofs, in various disguised forms, in the

Zero-Knowledge Proofs Lecture 15 Interactive Proofs Interactive Proofs Interactive Proofs

Zero-Knowledge Proofs 1 Zero-Knowledge Proofs Lecture 15 1 Interactive Proofs 2 Interactive

(Interactive) Proofs Proofs from 900 BCE until 1800s Pythagorass Theorem: Proof: Looks legit.

Real Interactive Proofs for VPSPACE Klaus Meer Brandenburgische Technische Universit at,

Towards Human Interactive Proofs in the Text-Domain Richard Bergmair University of Derby in

Models for Probabilistic Programs with an Adversary Robert Rand, Steve Zdancewic University of

Quantum zero-knowledge from Locally Simulatable Proofs Alex Bredariol Grilo joint work with Anne

On Hypersequents and Labelled Sequents Translating Labelled Sequent Proofs to Hypersequent Proofs

Non-Interactive Plaintext (In-)Equality Proofs and Group Signatures with Verifiable Controllable

Lin inear Multi-Prover In Interactive Proofs Dan Boneh, Yuval Ishai, Amit Sahai, and David J. Wu

Interactive Proofs Lecture 17 IP = PSPACE 1 So far 2 So far IP 2 So far IP AM, MA 2 So

MoSeL: A General, Extensible Modal Framework for Interactive Proofs in Separation Logic Robbert

MoSeL: A General, Extensible Modal Framework for Interactive Proofs in Separation Logic Robbert

Parallelizing an Interactive Theorem Prover Functional Programming and Proofs with ACL2 David L.

Trusting Trusting the Cloud with the Cloud with Practical Interact Practical Interactive ive

MoSeL: A General, Extensible Modal Framework for Interactive Proofs in Separation Logic Robbert

Proofs, Continued Today Proofs : A style guide Proofs should be easy to

for Linear Algebra Christopher Hickey Graham Cormode University of Warwick Our Model

Welcome to PROOFS! PROOFS: Security Proofs for Embedded Systems Introduction to the fifth

Interactive Proofs in Higher-Order Concurrent Separation Logic Robbert Krebbers 1 Amin Timany 2

Lecture 2 : Interactive Proofs in EasyCrypt July 16th, 2013 The Ambient Logic EasyCrypt ambient