Zero-Knowledge Proofs Lecture 15 Interactive Proofs Interactive - PowerPoint PPT Presentation

An Example Graph Isomorphism (G 0 ,G 1 ) in L iff there exists an isomorphism σ such that σ (G 0 )=G 1 G* := π (G 1 ) (random π ) IP protocol: send σ ZK protocol?

An Example Graph Isomorphism (G 0 ,G 1 ) in L iff there exists G* an isomorphism σ such that σ (G 0 )=G 1 G* := π (G 1 ) (random π ) IP protocol: send σ ZK protocol?

An Example Graph Isomorphism (G 0 ,G 1 ) in L iff there exists G* an isomorphism σ such that σ (G 0 )=G 1 G* := π (G 1 ) (random π ) IP protocol: send σ random bit b ZK protocol?

An Example Graph Isomorphism (G 0 ,G 1 ) in L iff there exists G* an isomorphism σ such that σ (G 0 )=G 1 G* := π (G 1 ) (random π ) b IP protocol: send σ random bit b ZK protocol?

An Example Graph Isomorphism (G 0 ,G 1 ) in L iff there exists G* an isomorphism σ such that σ (G 0 )=G 1 G* := π (G 1 ) (random π ) b IP protocol: send σ random bit b if b=1, π * := π ZK protocol? if b=0, π * := π o σ

An Example Graph Isomorphism (G 0 ,G 1 ) in L iff there exists G* an isomorphism σ such that σ (G 0 )=G 1 G* := π (G 1 ) (random π ) b IP protocol: send σ random bit b if b=1, π * := π ZK protocol? if b=0, π * := π o σ π *

An Example Graph Isomorphism (G 0 ,G 1 ) in L iff there exists G* an isomorphism σ such that σ (G 0 )=G 1 G* := π (G 1 ) (random π ) b IP protocol: send σ random bit b if b=1, π * := π ZK protocol? if b=0, π * := π o σ G*= π *(G b )? π *

An Example G* G* := π (G 1 ) (random π ) b random bit b if b=1, π * := π if b=0, π * := π o σ G*= π *(G b )? π *

An Example Why is this convincing? G* G* := π (G 1 ) (random π ) b random bit b if b=1, π * := π if b=0, π * := π o σ G*= π *(G b )? π *

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* G* := π (G 1 ) (random π ) b random bit b if b=1, π * := π if b=0, π * := π o σ G*= π *(G b )? π *

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := π (G 1 ) (random π ) b random bit b if b=1, π * := π if b=0, π * := π o σ G*= π *(G b )? π *

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := π (G 1 ) Why ZK? (random π ) b random bit b if b=1, π * := π if b=0, π * := π o σ G*= π *(G b )? π *

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := π (G 1 ) Why ZK? (random π ) b random bit Verifier’s view: random b b and π * s.t. G*= π *(G b ) if b=1, π * := π if b=0, π * := π o σ G*= π *(G b )? π *

An Example Why is this convincing? If prover can answer both b’s for the same G* then G 0 ~G 1 G* Otherwise, testing on a random b will leave prover stuck w.p. 1/2 G* := π (G 1 ) Why ZK? (random π ) b random bit Verifier’s view: random b b and π * s.t. G*= π *(G b ) if b=1, π * := π if b=0, π * := π o σ Which he could have G*= π *(G b )? generated by himself (whether G 0 ~G 1 or not) π *

Zero-Knowledge Proofs

Zero-Knowledge Proofs Interactive Proof

Zero-Knowledge Proofs Interactive Proof Complete and Sound

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property:

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property:

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property:

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! 42

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! 42

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” Ah, got it! 42

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” Ah, got it! 42

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” Ah, got it! 42

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Verifier’s view could have been “simulated” L n i x Ah, got it! 42

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! Verifier’s view could 42 have been “simulated” L n i x Ah, got it! 42

Zero-Knowledge Proofs Interactive Proof Complete and Sound ZK Property: Ah, got it! Verifier’s view could 42 have been “simulated” L For every adversarial n i x Ah, got it! strategy, there exists 42 a simulation strategy

ZK Property (in other pict’ s) x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

ZK Property (in other pict’ s) x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

ZK Property (in other pict’ s) x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

ZK Property (in other pict’ s) Classical definition uses simulation only for corrupt receiver; x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

ZK Property (in other pict’ s) Classical definition uses simulation only for corrupt receiver; and uses only standalone security: Environment gets only a transcript at the end x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

SIM ZK x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

SIM ZK • SIM-ZK would require simulation also when prover is corrupt x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

SIM ZK • SIM-ZK would require simulation also when prover is corrupt • Then simulator is a witness extractor x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

SIM ZK • SIM-ZK would require simulation also when prover is corrupt • Then simulator is a witness extractor • Adding this (in standalone setting) makes it a Proof of Knowledge x,w x F R proto proto i’face x Secure (and correct) if: ∀ ∃ s.t. ∀ output of is distributed Env Env identically in REAL IDEAL REAL and IDEAL

Results

Results IP and ZK defined [GMR’85]

Results IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86]

Results IP and ZK defined [GMR’85] ZK for all NP languages [GMW’86] Assuming one-way functions exist