Zero-Knowledge Proof System Slides by Ouzy Hadad

Zero-Knowledge Proof System Slides by Ouzy Hadad , Yair Gazelle & Gil Ben-Artzi Adapted from Ely Porat course lecture notes.

Background and Motivation t. The purpose of a traditional proof is to convince somebody, but typically the details of a proof give the verifier more info about the assertion. t. A proof is a zero-knowledge if the verifier does not get from it anything that he can not compute by himself.

Background and Motivation (cont. ) t. Whatever can be efficiently obtained by interacting with a prover, could also be computed without interaction, just by assuming that the assertion is true and conducting some efficient computation.

Zero Knowledge (Definition) t Let (P, V) be an interactive proof system for some language L. We say that (P, V), actually P, is zeroknowledge if for every probabilistic polynomial-time verifier V*, there exists a probabilistic polynomialtime machine M* s. t. for every x L holds t Machine M* is called the simulator for the interaction of V* with P.

Perfect Zero Knowledge (Definition) Let (P, V) be an interactive proof system for some language L. We say that (P, V), actually P, is perfect zero-knowledge (PZK) if for every probabilistic polynomial time verifier V*, there exists a probabilistic polynomial-time machine M* s. t. for every x L the distributions {<P, V*>(x)}x L and {M*(x)}x L are identical, i. e. ,

Statistically close distributions (Definition) The distribution ensembles {Ax}x L and {Bx}x L are statistically close or have negligible variation distance if for every polynomial p( • ) there exits integer N such that for every x L with holds:

Statistical zero-knowledge (Definition) Let (P, V) be an interactive proof system for some language L. We say that (P, V), actually P, is statistical zero knowledge (SZK) if for every probabilistic polynomial time verifier V* there exists a probabilistic polynomial-time machine M* s. t. the ensembles {<P, V*>(x)}x L and {M*(x)}x L are statistically close.

Computationally indistinguishable (Definition) Two ensembles {Ax}x L and {Bx}x L are computationally indistinguishable if for every probabilistic polynomial time distinguisher D and for every polynomial p( • ) there exists an integer N such that for every x L with |x| N holds

Computational zero-knowledge (Definition) Let (P, V) be an interactive proof system for some language L. (P, V), actually P, is computational zero knowledge (CZK) if for every probabilistic polynomial-time verifier V* there exists a probabilistic polynomial-time machine M* s. t. the ensembles {<P, V*>(x)}x L and {M*(x)}x L are computationally indistinguishable.

PZK by view t. The pair <P, V> is PZK by view if for every p. p. t V*. . . (probability polynomial time machine) there exist p. p. t M* such that for every x L we have: {view(P, V*)(x)={M*(x)} where view(P, V*)(x) is the view of V* after running <P, V*> on the input x, and M*(x) is the output of M* on the input x.

IP is PZK iff PZK by view Lemma: An interactive proof system is perfect zero-knowledge iff it is perfect zero knowledge by view. Proof: Let M* satisfy: {view<P, V*>(x)}x L {M*(x)}x L for every x L. M* has on its work-tape the final view of V*. Hence, it is able to perform the last step of V* and output the result. And so the modified M*(x) is identical to <P, V*>(x).

Proof of lemma (cont. ) Let M* satisfy: {<P, V*>(x)}x L {M*(x)}x L. For a particular V*, let us consider a verifier V** that behaves exactly like V*, but outputs its whole view (at the end). There is a machine M** s. t.

Graph-Isomorphism t. A pair of two graphs, Where t. Lets be an isomorphism between the input graphs, namely is 1 -1 and onto mapping of the vertex set V 1 to the vertex set V 2 so that

ZK proof for Graph Isomorphism t. Prover’s first step(P 1): Select random permutation over V 1, construct the set , and send to the verifier. t. Verifier’s first step gets H from P. select and send it to P. P is supposed to answer with an isomorphism

ZK proof for Graph Isomorphism(cont. ) )P 2): If =1, then send = to V. Otherwise send = -1 to V. (V 2): If is an isomorphism between G and H then V output 1, otherwise it outputs 0.

Construction (diagram) Prover Verifier =Random Permotation H G 1 H If =1, send = R{1, 2} otherwise = -1 Accept iff H = (G )

An example: Common input: two graphs G 1 and G 2. 3 2 4 4 G 1 G 2 5 5 1 2 1 Only P knows . 3

An example (cont. ) V sends = 3 2 G 1 2 5 4 1 5 1 H Only P knows . G 2 =2 to P. 4 5 1 3 2 4 P sends H to V. -1 3 V gets and accepts.

Theorem: Graph isomorphism is in Zero-Knowledge Theorem 1: The construction above is a perfect zero-knowledge interactive proof system (with respect to statistical closeness).

Proof of Theorem 1 Completeness: If G 1 G 2 , V always accepts. First, G’= (G 1). If =1 then = , Hence: (G ) = (G 1) = G’. If =2 then = -1, Hence: (G ) = -1(G 2) = (G 1) = G’. And hence V always accepts when G 1 G 2.

Proof of Theorem 1 (cont. ) Soundness: Let P* be any prover. If it sends to V a graph not isomorphic neither to G 1 nor to G 2, then there is no isomorphism between G and G’. If G’ G 1 then P* can convince V with probability at most 1/2 (V selects {1, 2} uniformly). Hence: when G 1 and G 2 are non-isomorphic: If we will run this several times we will get the desire probability.

Zero Knowledge (Construction of a simulator) t. Let V* be any polynomial-time verifier, and let q( • ) be a polynomial bounding the running time of V*. t M* selects a string r = 011………… 01100

t. M Construction of a Simulator (cont. ) * selects R{1, 2}. t M* selects a random permutation over V. t M* constructs G’’= (G ). 4 2 5 1 G’’ 3 5 1 2 4 3 G 2

t. M Construction of a Simulator (cont. ) * * runs V with the latter’s strings set as Input follows: Random Tape x Tape r G’’ t. Denote w Message Tape as V*‘s output. M* halts with output (x, r, G’’, ).

Proof of Theorem 1 (cont. ) Definition: Let (P, V) be an interactive proof system for L. (P, V) is perfect zero-knowledge by view if for every probabilistic polynomial-time view = all verifier V* there exists a probabilistic the data * s. t. for every polynomial time machine M a machine x L holds: possesses {view<P, V*>(x)}x L {M*(x)}x L where view<P, V*>(x) is the final view of V* after running <P, V*> on input x.

Proof of Theorem 1 (cont. ) Lemma: Then for every string r, graph H and permutation , it holds that: Pr [view<P, V*>(x) = (x, r, H, )] = Pr [M*(x) = (x, r, H, ) | M*(x) ] Proof: Let m* describe M* conditioned on its not being . Define the 2 random variables: 1. v(x, r) - the last 2 elements of view(P, V*)(x) conditioned on the second element equals r. 2. (x, r) - the same with m*(x).

Proof of lemma (cont. ) Let V* (x, r, H) denote the message sent by V* for a fixed r and an incoming message H. We will show that v(x, r) and (x, r) are uniformly distributed over the set: While running the simulator we have H= (G ), and only the pairs satisfying =v*(x, r, H) lead to an output. Hence:

Proof of lemma (cont. ) Consider v(x, r): For each H (which is isomorphic to G 1): Observing that and hence the lemma follows.

Proof of Theorem 1 (cont. ) Corollary: view<P, V*>(x) and M*(x) are statistically close. Proof: A failure is output with probability If the simulator returns steps P 1 -P 2 of the construction |x| times and at least once at step P 2 = , then output (x, r, G’’, ). If in all |x| trials , then output rubbish. Hence, we got a statistical difference of and so the corollary follows.

Zero-Knowledge for NP NP Problem: A language L belongs to NP if and only if there exist a two-input polynomial-time algorithm A and constant C such that: there exist a certificate y with We say that algorithm A verifies language L in polynomial time.

IP for NP t. Lets L language belong to NP, and x L , P should prove V that he know the solution for x. (P 1): P guess the solution y for the problem x. (V 1) V verify in polynomial time that A(x, y)=1. t. We will give ZK interactive proof system for NP complete problem (G 3 C), which

G 3 C t. Common Input: A graph t. P can paint the graph in 3 colors. t. P must keep the coloring a secret. 1 2 3 4 5

G 3 C is in Zero-Knowledge Construction (ZK IP for G 3 C): t. P chooses a random color permutation. t. He 1 2 puts all the nodes inside envelopes. t. And sends them to the verifier. 1 2 3 3 5 4

G 3 C is in ZK (cont. ) t. Verifier receives a 3 colored graph, but colors are hidden. t. He chooses an edge at random. t. And asks the prover to open the 2 envelopes. 1 1 2 3 3 4 4 5 5

G 3 C is in ZK (cont. ) t. Prover opens the envelopes, revealing the colors. accepts if the t. Verifier 1 1 2 3 3 4 colors are different. 5

Formally, t. G = (V, E) is 3 -colorable if there exists a mapping for every. t. Let be a 3 -coloring of G, and let be a permutation over {1, 2, 3} chosen randomly. t. Define a random 3 -coloring. t. Put each (v) in a box with v marked on it. t. Send all the boxes to the verifier.

Formally, (cont. ) t. Verifier selects an edge at random asking to inspect the colors. t. Prover sends the keys to boxes u and v. t. Verifier uses the keys to open the boxes. t. If he finds 2 different colors from {1, 2, 3} - Accept. t. Otherwise - Reject.

G 3 C (diagram) 1 (1( 2 (2( n (n( P V P Keyu , keyv V

The construction is in ZK: t Completeness: If G is 3 -colorable and both P and V follow the rules, V will accept. t Soundness: Suppose G is not 3 -colorable and P* tries to cheat. Then at least one edge (u, v) will be colored badly: (u) = (v). V will pick a bad edge with probability which can be increased to by repeating the protocol sufficiently many times.

Zero Knowledge (Construction of a simulator) t. Let V* be any polynomial-time verifier, and let q( • ) be a polynomial bounding the running time of V*. t M* selects a string

Construction of a Simulator (cont. ) selects e’=(u’, v’) R E. t. M* sends to V* boxes filled with garbage, except for the boxes of u’ and v’, colored as follows: t M* c C R {1, 2, 3} w w d u’ v’ d R {1, 2, 3}{c} If V* picks (u’, v’), M* sends V* their keys and the simulation is completed. Otherwise, the simulation fails.

Analysis of the Simulation For every G G 3 C, the distribution of m*(<G>) = M*(<G>) | (M*(<G>) ) is identical to <P, V*>(<G>). Since V* can’t tell e’ from other edges by looking at the boxes, he picks e’ with probability 1/|E|, which can be increased to a constant by repeating M* sufficiently many times. So if the boxes are perfectly sealed, G 3 C PZK.

ZK for Finding square modulo n t. Input: x 2 modulo n. toutput: x modulo n. t. The prover need to prove that he know the output.

ZK for Finding square modulo n (cont. ) )P 1): P find two large prime number p, q, where n=p·q. He also choose randomly r [n, n 4]. P send n, x 2 mod n and r 2 mod n to V. (V 1): V has two possibilities (a) Ask r. check the value of r 2 mod n. (b) Ask for x ·r. check the value of x 2 r 2 mod n

Analysis of the Protocol - square modulo n Soundness: If P does not know x, then in probability of 50% V will catch him, if we will run this several times we will get the V will reject in probability larger then 2/3. Completeness: If P know x, V always accept.

Analysis of the Protocol - square modulo n (cont. ) t. This protocol is computational ZK. t. The Protocol give the value x 2 mod n but the verifier can't calculate x from it. t. If the verifier ask option 1 from the prover, he get no additional info. t. If the verifier ask option 2 from the prover, he get xr which is random.

CO-NP ZK t t t In order to prove the above it’s enough to show that CO-NP complete problem is in IP We will show that CO-SAT belongs to IP. Than we can show that CO-SAT belongs to ZK. Reminder: CO-SAT means that there are no truth assignment for an equation. We can treat it as a specific case of proving that for an equation there are exactly K truth assignments (In this case , K=0)

CO-SAT IP t Lemma 1. (x 1, x 2, x 3, …, Xn) has exactly Kn truth assignments k 0, k 1 : Kn=k 0+k 1 2. (0, x 2, x 3, …Xn) = 0(x 2, x 3, …Xn) has exactly k 0 truth assignments 3. (1, x 2, x 3, …Xn) = 1(x 2, x 3, …Xn) has exactly k 1 truth assignments t Informal explanation t t By setting a variable in the original equations we create a new equation with a special relation to the original one. Each new equation must have a specific number of assignments which can be pre-calculate.

CO-SAT IP t t t We can now construct a solution based upon the previous lemma Prover will send verifier k 0, k 1 for (n) Verifier will check that for (n-1) , condition 1 of lemma is true ( Kn=k 0+k 1) Verifier will create randomly a new equation (n+1), by assigning 1 or 0 to the first variable of n If we assign 1 , the number of solutions should be K 0 , otherwise k 0 Verifier will send to prover the new equation

CO-SAT IP Now prover will send the new k 0 n, k 1 n for the new (n+1) t Verifier remember previous k 1 and can check if k 1=k 0 n+k 1 n , so the prover cannot cheat him t Each stage we reduced one variable from equation by assign a value to it t Now let’s prove completeness & soundness t

CO-SAT IP t Completeness t t If prover does not cheat , each new equation will have the appropriate relation to the previous one and verifier will be convinced Soundness t t If prover cheat i. e. send k 0 as a false one, the new equation should be based upon assignment of 0 to first element in order to see it (remember that we check only one of k 0/k 1 – it’s deepened on the assignment). We have a probability of ½ to do this , and we should always peek the right assignment down the road. Total probability (in the worst case) is (½)^n Huston, we have a problem ! ( no soundness )

CO-SAT IP, Solution 2 We will expand the range variables of to a field (F) such that |F| > (2)^n t Each variable can get now not just 0 or 1 but a value from the field t We will construct a new equation `: t F 0 , T positive integer t^ * , + t (p)` p , (~p)` 1 -p` t (p^q)` p` q` , (p q)` ~(~(~p ^ ~q))’ t

CO-SAT IP, Solution 2 t We got now ` that is a polynomial of (x 1, …, Xn) over field F. Prover should now prove that t Note that t 1. Number of root for [p 1(0)+p 1(1)]= p 0( ). 2. Polynomials have the same number of roots for [p 1( )-p 2( )] = 0

CO-SAT IP, Solution 2 t t Prover will send the polynom [P 1], and the number of roots (K) for this polynom Verifier will check that K=p 1(0)+p 1(1), choose a random value F and send it to prover Prover will now construct a new polynom P 2 = P 1( ), calculate the number of roots for the new one and send it to verfier This process continue until all variable has been assign (2 n iterations)

CO-SAT IP, Solution 2 Completeness is clear. t Soundness t t t In order to lie , the prover should send the verifier a false polynom. This polynom should have the same roots as the correct one. Since we have a field of elements , The probability for this is n/|F|. The probability not found this is (1 -n/|F|) > 2/3 We proved that CO-NP is in IP

CO-NP ZK t. It’s enough to show that CO-SAT is in ZK t. The problem in the previous solution is that the verifier can see each stage the solution of the previous. t. He can use it to get some other information from prover

CO-SAT ZK t. The prover can now send the polynom in an envelops , just like in G 3 C t. The verifier should now check that the prover has not mislead him t. We have got now a new problem : How can we open the envelops without gaining any information from the prover

CO-SAT ZK t. The problem of opening an envelops is in NP , since the oracle can guess the keys and we can verify in a polynomial time that indeed we have the appropriate keys t. Since NP ZK , we can now make a reduction and solve the above problem t. CO-SAT ZK CO-NP ZK !