Sebery J.Cryptography.An introduction to computer security.1989

Common Knowledge: an instance (x; N) of the QR problem (n is the size of the instance).

Description: Given a polynomial t(n) in n. P and V , repeat the following steps t(n) times.

If the condition fails, V stops and rejects. Otherwise, the interaction continues.

Finally, after t(n) rounds, V halts and accepts.

The proof satis es the completeness property as for any yes-instance of QR (or x 2 ZNQ+), V always accepts P 's proof. For any b, the prover can always compute the correct response w. Note that for a no-instance (or x 2 ZNQ ), if P follows the protocol then u is a quadratic residue modulo N but x u is a quadratic nonresidue modulo N. If P cheats than u is a quadratic nonresidue but x u is a quadratic residue. Once P committed herself to u and sent it to V (does not matter if P cheats or not), the probability that V rejects (or accepts) x is 1=2. As the protocol is executed t(n) times, the cheating prover can succeed and convince V to accept a no-instance with the probability at most 2 t(n). The proof system satis es the soundness property.

The next interactive proof system is based on the graph isomorphism (GI) problem. Let V be a set of n elements. Sym(V) denotes the group of permutations over the set V. The composition of two permutations ; 2 Sym(V) is denoted by Æ . Let G0 = (V0; E0) and G1 = (V1; E1) be two graphs where Vi is the set of vertices and Ei is the set of edges (i = 0; 1).

Name: Graph isomorphism (GI) problem

Instance: Given two graphs G0 = (V0; E0) and G1 = (V1; E1) with j V0 j=j V1 j= n.

Question: Is there a permutation : V0 ! V1 such that an edge (u; v) 2 E0 if and only if ( (u); (v)) 2 E1?

412 12 ZERO KNOWLEDGE PROOF SYSTEMS

An interactive proof system for GI is presented below [209]. The interaction takes t(n) rounds. At each round, the prover selects a random permutation 2R Sym(V0), computes an isomorphic copy of G0, i.e. h = (G0) and forwards h to the veri er. V selects at random a bit b and communicates it to P . P responds by sending if b = 0 or Æ , otherwise. The permutation establishes the isomorphism between G0 and G1 or G0 = (G1) and exists for yes-instance only. V checks whether the provided permutation forces the isomorphism between h and Gb. If the check is satis ed, V continues. Otherwise, V stops and rejects.

GI interactive proof { GI$

and G1 or G0 = (G1) ( always exists for any yes-instance).

5. V checks whether the provided permutation establishes the isomorphism between h and Gb. V halts and rejects the instance whenever the check fails. Otherwise, the interaction continues.

If all t(n) rounds have been successful, V stops and accepts.

Assume that both P and V share a yes-instance. No matter how V have chosen the bit b, P always can arbitrarily select either or Æ as both graphs G0 and G1 are isomorphic to h. So the proof satis es the completeness property. What happens when P and V share a no-instance and the prover wants to cheat? P has to choose a random h that can be isomorphic to either G0 (h G0) or G1 (h G1). Once h has been sent to V , P is committed to either h G0 or h G1 (but not to both). V randomly selects b and asks P to show the appropriate permutation. There is the probability of 1=2 that P will

be caught. As the interaction takes t(n) rounds, the probability that V stops in an accept state is 2 t(n). So the soundness of the proof holds.

The class IP (interactive polynomial time) contains all decision problems for which exists interactive proof systems. Clearly, NP IP.

12.2 Perfect Zero Knowledge Proofs

Informally, an interactive proof system is zero knowledge if during interaction the veri er gains no information from the prover. In particular, having a transcript of an interaction with P , V is not able to play later a role of the prover to somebody else.

To make our discussion more formal we need some de nitions. A view is a transcript that contains all messages exchanged between the prover and ver- i er. Assume that during the ith round, P sends a random commitment Ai, V responds by sending a random challenge bit Bi and P forwards her proof Ci. The triple (Ai; Bi; Ci) are random variables. The view is a sequence of all messages (A1; B1; C1; : : : ; At(n); Bt(n); Ct(n)) exchanged by P and V during interaction. For an honest V all Bi are uniform and independent random variables (i = 1; : : : :t(n)). Note that the view is de ned for a yes-instance only. All noinstances are not of interest to us as the prover does not know the truth (or secret). She may merely pretend to know it but she will be caught with a high probability.

A behavior of a cheating veri er V can signi cantly deviate. First the random variables Bi may not be statistically independent. Moreover, the veri er can use some transcripts from previous interactions hoping that they can help him extract some information from P . So the view should also include the past interactions h (history). For an instance x 2 Q and an arbitrary veri er V , the view is

V iewP;V (x; h) = (x; h; A1; B1; C1; : : : ; At(n); Bt(n); Ct(n)):

Random variables Bi are calculated by a cheating V using a polynomial time probabilistic function F so Bi = F(x; h; A1; B1; C1 : : : ; Ai 1; Bi 1; Ci 1; Ai). The view is a probabilistic ensemble with a well de ned set of possible values and associated probabilities (Section 5.2).

A transcript simulator SV (x; h) is an expected polynomial time probabilistic algorithm that uses all the information accessible to V (i.e. previous

414 12 ZERO KNOWLEDGE PROOF SYSTEMS

transcripts h and the function F ) and generates a transcript for an instance x 2 Q without interaction with the prover P. Note that the simulator can be seen as an ensemble generator.

An interactive proof system is perfect zero knowledge if there is a transcript simulator SV (x; h) such that its ensemble is identical to the view ensemble. In other words, the knowledge extracted from P by V could be obtained without interaction with P . Instead, V cold run the corresponding transcript simulator. More formal de nition can be formulated as follows.

De nition 34. An interactive proof system for a decision problem Q is perfect zero knowledge if the ensemble V iewP;V (x; h) is identical to the ensemble generated by an expected polynomial time probabilistic simulator SV (x; h) for any yes-instance of Q and any h.

Now we can go back to the rst interactive proof system QR$.

Theorem 45. (Goldwasser, Micali, Racko [211]) QR$ is perfect zero knowledge.

Proof. Let (x; N) be a yes-instance of QR. The ith round involves the following random variables: Ui, a quadratic residue generated by P; Bi, a bit generated by V ; and Wi, a proof of P . So the view for an arbitrary veri er V is

V iewP;V (x; N; h) = (x; N; h; U1; B1; W1; : : : ; Ut(n); Bt(n); Wt(n)):

For simplicity, we denote Vi = (U1; B1; W1; : : : ; Ui; Bi; Wi). Note that if V is honest, all Bi are independent and uniform random variables over f0; 1g. However, if V cheats, he uses some polynomial time probabilistic algorithm F that generates bi+1 = F (x; N; h; vi; ui+1 ), where Vi = vi. Now we can use the algorithm F to construct a simulator SV (x; N; h) as follows.

Transcript simulator SV (x; N; h) for QR$

Input: (x; N), a yes-instance of QR; h, past transcripts; vi, transcript of the current interaction (i rounds).

Description: Repeat the following steps for i + 1 t(n). 1. Select bi+1 2R f0; 1g.

2. Choose wi+1 2R ZN .

3. If bi+1 = 0, then ui+1 wi2+1 mod N else ui+1 wi2+1 x 1 mod N.

4.If bi+1 = F(x; N; h; vi; ui+1), then return (ui+1; bi+1; wi+1)

else go to (1).

Some comments about the simulator. Instead of selecting rst a quadratic residue ui+1, the simulator chooses wi+1 and bi+1 at random and computes ui+1. Having ui+1, the simulator can recompute bi+1 using the function F where ui+1 is a part of an input. There is the probability of 1=2 that a randomly selected bi+1 will match the correct value indicated by F(x; N; h; vi; ui+1). On the average, the simulator will need two rounds per a single output (ui+1; bi+1; wi+1). So the simulator runs in an expected polynomial time. Note also that for an honest veri er, the function F simpli es to a single toss of an unbiased coin.

Now we prove that the view ensemble

V iewP;V (x; N; h) = (x; N; h; U1; B1; W1; : : : ; Ut(n); Bt(n); Wt(n)) is identical to the simulator ensemble

SV (x; N; h) = (x; N; h; U10; B10 ; W10; : : : ; Ut0(n); Bt0(n); Wt0(n)):

The proof proceed by induction on i. The case when i = 0 is trivial as both ensembles are constant. In the inductive step, we assume that the ensemble

V iewP;V (x; N; h) = (x; N; h; U1; B1; W1; : : : ; Ui 1; Bi 1; Wi 1) is identical to

SV (x; N; h) = (x; N; h; U10; B10 ; W10; : : : ; Ui0 1; Bi0 1; Wi0 1):

The next part of the view transcript consists of the triple (Ui; Bi; Wi). The variable Ui is independent. Bi depends on Ui, Vi 1 and h. Wi depends on both previous variables so

P (Ui = u; Bi = b; Wi = w) =

P (Ui = u) P(Bi = bjVi 1 = v; Ui = u; h) P (Wi = wjUi = u; Bi = b):

416 12 ZERO KNOWLEDGE PROOF SYSTEMS

The ith part of the simulator transcript is (Ui0; Bi0; Wi0). Considering the order the variables are generated, we can write that the probability

The random variable Ui0 has the same probability distribution as Ui. Consequently, Bi0 has the identical probability distribution to Bi. So, both the view and simulator probability distributions for i rounds are identical and the corresponding ensembles are the same. Finally, we conclude that QR$ is perfect zero knowledge. tu

Consider our second interactive proof system GI$ for graph isomorphism.

Theorem 46. (Goldreich, Micali, Wigderson [209]) GI$ is perfect zero knowledge.

Proof. The proof proceeds in a similar manner to the previous one. The core of the proof is the construction of an expected polynomial time simulator that generates an ensemble identical to the view ensemble. An honest veri er is V while a veri er who deviates arbitrarily from the protocol is denoted by V .

Let (G0; G1) be a yes-instance of GI. The view of interaction between P and V is an ensemble

V iewP;V (G0; G1; h) = (G0; G1; h; H1; B1; 1; : : : ; Ht(n); Bt(n); t(n));

where (Hi; Bi; i) are random variables used in the ith round of the protocol. Hi represents an isomorphic copy of G0, Bi is a binary random variable generated by V , and i is a random permutation sent by P. Again h indicates the additional information accessible to V from previous interactions with the prover P. Note that instead of a random selection of his bit, a cheating V may use a polynomial time probabilistic algorithm F to generate his bits. Having F , the veri er V can design a simulator SV (G1; G2; h) that works as follows.

Transcript simulator { SV (G0; G1; h) for GI$

Input: (G0; G1), a yes-instance of QR; h, past transcripts; vi, transcript of the current interaction ( rst i rounds).

+1) t(n).

1.Choose bi+1 2R f0; 1g.

2.Select 2R Sym(V1) and compute hi+1 = (Gbi+1 ).

3.If bi+1 = F(G1; G2; h; vi; hi+1), then

return (hi+1; bi+1; i+1)

else go to (1).Description: Repeat the following steps for (i

Note that all computations can be done in polynomial time except that bi+1 generated at the step (1) may not match the value calculated in the step (3). The probability that they match in a single round is 1=2. On the average it is necessary to run two rounds of the simulator to produce a single output. So the simulator runs in expected polynomial time.

Now we prove that the view ensemble V iewP;V (G0; G1; h) is identical to the ensemble SV (G0; G1; h). The proof proceeds by induction on the number of rounds i. When i = 0, both the simulator and the view consist of constants so their probability distributions are identical. Now we assume that both probability distributions are identical for (i 1) rounds, i.e.

P (V iewP;V (Vi 1) = vi 1) = P(SV = vi 1):

Consider a triple of random variables (Hi; Bi; i), which is the transcript of the ith round of the protocol. The probability that

P (Hi = h; Bi = b; i = ) =

P ( i = ) P (Bi = bj i = ) P(Hi = hj i = ; Bi = b):

As the permutation is selected at random so P( i = ) = n1! . The random variable Bi = F (h; Vi; Hi) so we can assume that P (Bi = b) = pb.

418 12 ZERO KNOWLEDGE PROOF SYSTEMS

nomial time probabilistic algorithm F so the random variable Bi+1 has the same probability distribution as for the view. So the probability distributions of the view and the simulator are identical and consequently, GI$ is perfect zero knowledge. tu

The complement of GI is the graph non-isomorphism problem. The problem is stated below.

Name: Graph nonisomorphism (GNI) problem

Instance: Given two graphs G0 = (V0; E0) and G1 = (V1; E1) with j V0 j=j V1 j= n.

Question: Are the two graphs nonisomorphic? (so there is no permutation : V0 ! V1 such that an edge (u; v) 2 E0 if and only if ( (u); (v)) 2 E1).

An interactive proof system for GNI is more complex than for its relative GI and each round takes ve transmissions. The main idea is to allow the veri er to construct pairs of graphs in every round. Each pair contains an isomorphic copy of G0 and G1 in an random order. The powerful prover can tell apart those copies for every yes-instance (because G0 and G1 are not isomorphic) while for any no-instance, P can only guess the order.

GNI interactive proof { GNI$

Common Knowledge: an instance of GNI, i.e. two graphs G0 = (V0;E0) and G1 = (V1;E1). The parameter n is the number of vertices in V0 and V1. Denote V = V0 = V1.

Description: Given a polynomial t(n) in n. P and V repeat the following steps t(n) times.

1. V chooses b 2R f0; 1g, a permutation 2R Sym(V) and computes h = (Gb). The graph h is called a question. Further V prepares n2 pairs of graphs such that each pair contains an isomorphic copy of G0 and G1 in a random order. So for j = 1; : : : ; n2, V chooses aj 2R f0; 1g and two permutations j;0; j;1 2R Sym(V) and computes Tj;0 = j;0(Gaj ) and

Tj;1 = j;1(Gaj+1 mod 2). So

V! P : h; (T1;0; T1;1); : : : ; (Tn2;0; Tn2;1):

2.P chooses uniformly at random a subset I f1; : : : ; n2g and

5. V checks whether b = . If the condition is not satis ed, V stops and rejects. Otherwise, the interaction continues.

After passing through t(n) rounds without rejection, V halts and accepts.

It is easy to verify that the interactive proof satis es both the completeness and soundness properties. It is also perfect zero knowledge (for details consult [209]).

Consider the complementary problem to the quadratic residue problem. This is the quadratic nonresidue problem and is de ned as follows.

Name: Quadratic nonresidue (QNR) problem

Instance: Given a composite integer N. The integer x 2 ZNQ. Question: Does x belong to ZNQ (or is x a quadratic nonresidue)?

An interactive proof system for QNR is given below. At each round, the veri er forwards to the prover two types of elements: quadratic residues r2 mod N and products r2x mod N. If (x; N) is a yes-instance, the prover can easily tell apart the type of an element. If (x; N) is a no-instance (i.e. x is a quadratic residue), the prover cannot distinguish elements as they belong to the same class of quadratic residues.

QNR interactive proof { QNR$

Common Knowledge: an instance (x; N) of the QNR problem (n is the size of the instance).

420 12 ZERO KNOWLEDGE PROOF SYSTEMS

Description: Given a polynomial t(n) in n. P and V repeat the following steps

Otherwise, the interaction continues.

After passing through t(n) rounds without rejection, V halts and accepts.

Both completeness and soundness of the interactive proof can be asserted by a careful examination of the protocol. An interesting feature of the proof system is that it satis es a weaker zero knowledge property called the statistical zero knowledge. Consider two probabilistic ensembles: a view (transcript of interaction between the prover P and arbitrary veri er V ) and a simulator SV that is used by V to generate transcripts without interaction with P. Perfect zero knowledge requires the equality of two ensembles, i.e. V iewP;V (x; N; h) = SV (x; N; h) for any yes-instance of the problem QNR. Statistical zero knowledge is weaker as we request that limn!1 V iewP;V (x; N; h) = limn!1 SV (x; N; h) for any yes-instance of the problem QNR, where n is the size of instance (x; N). Details of the proof can be found in [211].

12.3 Computational Zero Knowledge Proofs

Perfect or statistical zero knowledge may still seem to be too restrictive for our polynomially bounded veri er V . An interactive proof is computational zero