LecturerMoniNaor.pptVIP

Lecturer: Moni Naor Foundations of CryptographyLecture 13: Zero-Knowledge Variants and Applications Recap of last week’s lecture String Commitment Definition Construction from pseudo-random generators Coin Flipping Zero-knowledge Interactive Proofs Interactive Proofs and the cryptographic setting Definition of zero-knowledge proofs Construction of a zk proof system for Hamiltonicity Question: zero-knowledge protocol for subset sum Give a direct protocol (i.e. not through a reduction to hamiltoncity) for the subset sum problem Subset sum problem: given n numbers 0 ≤ a1, a2 ,…, an 2m Target sum T Is there a subset S? {1,...,n} such that ∑ i ?S ai,=T mod 2m The world so far Pseudo-random generators Signature Schemes UOWHFs One-way functions String Commitment Zero-Knowledge for all of NP Pseudo-random Permutations Pseudo-random Functions Shared-key Encryption (CPA) and Authentication Trapdoor permutations Public-key Encryption (CPA) Factoring is hard (BG Permutations) P ? NP What’s next More of zero-knowledge: Black-box simulation Proofs of knowledge Public-key Identification Perfect and Statistical Zero-knowledge Authentication via encryption Malleability Zero Knowledge Each (cheating) verifier V* induces a distribution on transcripts on interaction with P Zero-Knowledge Requirement: for all verifiers V* there exists a simulator S such that: simulator S is a pptm (does not get witness W) for all X?L the distributions on transcripts that V* ’ induces and that S produces are computationally indistinguishable. Role of simulator similar to alternative adversary A’ in semantic security Black-box Zero-Knowledge Order of quantifier: for for all verifiers V* there exists a simulator S Black-box simulation: there exists a simulator S that is good for all verifiers V* S interacts with V* as an oracle: SV* Can see V*’s reaction to various messages but not its internal state Almost all known zero-knowledge protocols are black-box Protocol Hamiltonicity Common input g