Zero-Knowledge Proofs 1 Zero-Knowledge Proofs Lecture 15 1 - PowerPoint PPT Presentation

An Example Why is this convincing? G* G* := ! (G 1 ) (random ! ) b random bit b if b=1, ! * := ! if b=0, ! * := ! o σ G*= ! *(G b )? ! * 12

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* G* := ! (G 1 ) (random ! ) b random bit b if b=1, ! * := ! if b=0, ! * := ! o σ G*= ! *(G b )? ! * 12

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := ! (G 1 ) (random ! ) b random bit b if b=1, ! * := ! if b=0, ! * := ! o σ G*= ! *(G b )? ! * 12

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := ! (G 1 ) Why ZK? (random ! ) b random bit b if b=1, ! * := ! if b=0, ! * := ! o σ G*= ! *(G b )? ! * 12

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := ! (G 1 ) Why ZK? (random ! ) b random bit Verifier’s view: random b b and ! * s.t. G*= ! *(G b ) if b=1, ! * := ! if b=0, ! * := ! o σ G*= ! *(G b )? ! * 12

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := ! (G 1 ) Why ZK? (random ! ) b random bit Verifier’s view: random b b and ! * s.t. G*= ! *(G b ) if b=1, ! * := ! if b=0, ! * := ! o σ Which he could have G*= ! *(G b )? generated by himself (whether G 0 ~G 1 or not) ! * 12

Zero-Knowledge Proofs 13

Zero-Knowledge Proofs Interactive Proof 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! 42 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! 42 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” Ah, got it! 42 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” Ah, got it! 42 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” Ah, got it! 42 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” L n i x Ah, got it! 42 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! Verifier’s view could 42 have been “simulated” L n i x Ah, got it! 42 13

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! Verifier’s view could 42 have been “simulated” L For every adversarial n i x Ah, got it! strategy, there exists 42 a simulation strategy 13

ZK Property (in other pict’ s) x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 14

ZK Property (in other pict’ s) x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 14

ZK Property (in other pict’ s) x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 14

ZK Property (in other pict’ s) Classical definition uses simulation only for corrupt receiver; x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 14

ZK Property (in other pict’ s) Classical definition uses simulation only for corrupt receiver; and uses only standalone security: Environment gets only a transcript at the end x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 14

SIM ZK x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 15

SIM ZK • SIM-ZK would require simulation also when prover is corrupt x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 15

SIM ZK • SIM-ZK would require simulation also when prover is corrupt • Then simulator is a witness extractor x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 15

SIM ZK • SIM-ZK would require simulation also when prover is corrupt • Then simulator is a witness extractor • Adding this (in standalone) makes it a Proof of Knowledge x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL 15

Results 16

Results IP and ZK defined [GMR’85] 16

Results IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] 16

Results IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist 16

Results IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist ZK for all of IP [BGGHKMR’88] 16

Results IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist ZK for all of IP [BGGHKMR’88] Everything that can be proven can be proven in zero-knowledge! (Assuming OWF) 16