Zero Knowledge Proofs Suppose Alice has some secret information, and she wants to prove to Bob (to his satisfaction) that she has this secret without revealing ANYTHING to Bob about that secret. What would this be good for? * Possibly some system of identity * Convincing skeptical investors one has something valuable without risking it getting into the hands of a competitor Not quite right example: Alice attempts to prove to Bob that she has the private key corresponding to a public one. 1. Bob sends some message to Alice. 2. Alice encrypts it (signs it) with the private key and sends it to Bob. 3. Bob verifies the signature with the public key. Try again: * Bob has some information he didn't have before, and couldn't get easily - namely what the signature on his message is. 1. Bob encrypts some random message with the public key and sends it to Alice 2. Alice decrypts it and sends it back to Bob. * A bit closer, though Alice didn't really prove she has the key, just that she knew Bob's message - maybe she was looking over his shoulder. Inexact but classic cave analogy: There is a cave with a loop and an entrance and a magic password door (D) in the loop |---------| | | -------A D | | |---------| Alice wants to prove she has the password. 1. Alice goes into the cave and down either the right or left branch 2. Bob goes into the cave and stands a A 3. Bob tells Alice to come out either the right or left branch 4. They repeat this a number of times 5. If Alice ever fails to come out of the correct passage, Bob concludes she does not have the password. Otherwise, after sufficient trials he concludes she (probably) does. * Not the only way Alice can convince Bob in this case (he just has to see her go down the left passage and come out the right) * Interesting property is that no-one watching a videotape made by Bob would be convinced that Alice knew the password - Bob and Alice could have scripted the whole thing. * This is not the case if Bob watches Alice go down the left passage and come out the right. * Such "simulability" to an outside non-participant, is the basis of one formal definition of "zero knowledge" (if an observer seeing everything that Bob sees cannot even tell whether or not Alice has the password, then clearly no (provable) knowledge of the password can be leaking out) * Of course Bob's "proof" is probabilisitic in nature - Alice could have guessed right each time. But there is a formal statistical aspect to this knowledge that is lacking in probabilities of the sort "It seems unlikely that Alice and Bob would collude and script the whole thing"... Classic graph isomorphism example Bob and Alice both have access to two graphs G1 and G2, that by cursory examination (node counts, edge counts, degree counts) could be isomorphic. Alice claims she has an isomorphism, and she wants to convince Bob that she has one without helping him construct one. She does this as follows: 1. Alice randomly permutes the nodes of G1 to produce a graph H that is isomorphic to G1. Since she generated the permutation, she knows the isomorphism. If she knows an isomorphism between G1 and G2, she can also easily obtain an isomorphism between G2 and H 2. Alice shows H to Bob. 3. Bob asks Alice to either a) show him that H is isomorphic to G1 or b) show him that H is isomorphic to G2 (but not both) 4. Alice can comply in either case without revealing anything about the isomorphism from G1 to G2, since Bob can generate as many random permuations as he want on his own. 5. After sufficient (random) challenges, Bob is convinced that Alice does indeed have an isomorphism from G1 to G2 * Note that this has the same "simulation" property as the cave example - Bob and Alice could simulate the whole thing without either of them actually having an isomorphism from G1 to G2, (and without such an isomorphism even existing) Hamiltonian path example? Alice claims she has a Hamiltonian path in graph G. She convinces Bob of this as follows 1. Alice constructs a random permutation H of G and shows it to Bob. 2. Bob challenges her to either a) show him a Hamiltonian path in H or b) show him that H is isomorphic to G * This one is a bit unclear. It is not known that graph isomorphism is NP hard, so it seems possible that having a Hamiltonian path in an isomophic graph could represent transferred information. * There IS a sound zero knowledge proof for Hamiltonian path (and anything in NP, and in fact, in PSPACE) * This general "cut and choose" approach is common to many zero knowledge proofs: Alice converts one hard problem into another in a manner that is known to be as hard as the original problem to invert, and Bob challenges here either to prove the equivalence, or illustrate the secret in the transformed problem. Parallel Proofs * Alice could precompute all N! random permutations of the graph in advance, and Bob could submit his vector of challenges all at once. There is no requirement of sequentiality, or even for Bob to see the graphs H before he makes his challenges. They just need to be irrevocable so that Alice can not make then with knowledge of Bobs challenges. * There is a version of this that is not simulable, if Bob bases his vector on a one-way hash of Alices list of permutations. Non-interactive zero knowledge proofs Extending the previous observation, we could try the following: 1. Alice precomputes isomorphisms to G1 and G2 for n random permutations H1 - Hn of G1. 2. She commits these isomorphisms individually. 3. Alice then computes a one-way hash of the concatenation of all the commitment strings, and interprets the first n bits as challenges. 4. Alice supplies the key for the selected half of the commitments, and opens them for display. 5. Anyone who is interested then verifies that the steps were performed correctly. * Essentially, the hash function is standing in for Bob, selecting random challenges for Alice. * This is truly a bit startling. A completely examineable "proof" that Alice has access to a well defined, finite object, that contains no information about the identiy of that object. * n needs to be fairly large; otherwise Alice could just keep trying fake solutions (only one of the isomorphisms is there) until she finds one that generates challenges to the "correct" half. * We need to believe that the function is truely one-way, so that Alice canot engineer a "script" ---------------------------------------------------------------------------- Quantum cryptography Quantum mechanics provides some very slippery physical mechanisms that allow some interesting applications. * Quantum computation. In theory quantum mechanisms can perform some sorts of computation for which no efficient standard algorithms are known. Specifically, factoring * Practicality of these schemes is very murky. * Some other quantum effects are more easily usable * Specifically, the indivisible nature of quantum observations can be used in secure communication.