Zero-Knowledge

Reference Bruce, Applied Cryptography

1

16/10/2013

Outlines
Zero-knowledge Proof Basic Zero-knowledge Protocol Graph Isomorphism Parallel Zero-knowledge Proofs Noninteractive Zero-knowledge Proofs
16/10/2013

Zero-knowledge Proof

16/10/2013

Zero-Knowledge Proof
It is a protocol. Zero-knowledge protocol proves to someone that somene else know a secret.
16/10/2013

Basic Zero-knowledge Protocol

16/10/2013

Basic Zero-knowledge Protocol (1)

Jean-Jecques Quisquater and Louis Guillou explain zero-knowledge with a cave. There is a secret door between C and D. Only Someone who knows the magic words can open the secret door between C and D
16/10/2013

Basic Zero-knowledge Protocol (2)

Peggy knows the secret and she wanna prove to Victor that she knows. She doesnt wanna share the secret words to Victor. The protocol that shows Peggys provement: 1. Victor stands at A. 2. Peggy walks all the way into the cave, either to C and D. 3. After Peggy has disappeared into the cave, Victor walks to B. 4. Victor shouts to Peggy, asking her either to: come out of the left passage or come out of the right passage. 5. Peggy complies, using the secret words to open the secret door if she has to. 6. Peggy and Victor repeat steps (1) through (5) n times.
16/10/2013

Basic Zero-knowledge Protocol (3)

Assume Victor records everything he sees. He records Peggy disappering into the cave, when he shouts out where he wants Peggy to come out from, and Peggy coming out. He records all n trials. If he showed this recording to Carol, would she believe that Peggy knew the secret words to open the door? No.
impossible for Victor to convince a third party of the proofs validity it proves that the protocol is zero-knowledge 8
16/10/2013

Basic Zero-knowledge Protocol (4)

Cut and choose technique is used in basic zero-knowledge protocol because of its similarity to the classic protocol for dividing anything fairly. Peggy cut the thing in half. Victor chooses one of the halves for himself. Peggy takes the remaining half. The cut and choose protocol works because there is no way Peggy can repeatedly guess which side Victor will ask her to come out of. If Peggy doesnt know the secret, she has a 50% chance of guessing which side Victor will ask in each round of the protocol.
16/10/2013

Basic Zero-knowledge Protocol (5)

The chance of her fooling him in n roounds is 1 in 2n. If there is 16 rounds, Peggy has a 1 in 65536 chance of fooling Victor. Victor can assume that if all n rounds of Peggys proof are valid, she must know the secret words to open the door.
16/10/2013

She has 50% chance of fooling him in one round. The chance of her fooling him in two rounds is 25%.

10

Basic Zero-knowledge Protocol (6)

Assume that the secret words is the solution of hard problem.
1. Peggy uses her information and a random number to tansform the hard problem into another hard problem that is isomorphic to the original problem. She then uses her information and the random number to solve this new instance of the hard problem. 2. Peggy commits to the solution of the new instance, using a bitcommitment scheme. 3. Peggy reveals to Victor the new instance. Victor cannot use this new problem to get any information about the original instance or its solution. 4. Victor asks Peggy either to:
a. prove to him that the old and new instances are isomorphic b. open the solution she commited to in step (2) and prove that it is a solution to the new instance
16/10/2013

5. Peggy complies. 6. Peggy and Victor repeat steps(1) through (5) n times.

11

Basic Zero-knowledge Protocol (7)

16/10/2013

Not all hard problems can be used for zero-knowledge proofs, but a lot of them can.

12

Graph Isomorphism

13

16/10/2013

Example
Are they the isomorphic?
16/10/2013

14

15

16/10/2013

Graph Isomorphism (1)

If two graphs are identical except for the name of the points, they are called isomorphic. Peggy knows the isomorphsm between the two graphs G1 and G2. 1. Peggy randomly permutes G1 to produce another graph H that is isomorphic to G1. 2. Peggy sends H to Victor. 3. Victor asks Peggy either to: a. prove that H and G1 are isomorphic or b. prove that H and G2 are isomorphic. 4. Peggy complies she either: a. prove that H and G1 are isomorphic without proving that H and G2 are isomorphic or b. prove that H and G2 are isomorphic without proving that H and G1 are isomorphic. 5. Peggy and Victor repeat steps (1) through (4) n times.
16/10/2013

16

Graph Isomorphism (2)

Peggy can create a graph that is either isomorphic to G1 or G2. Peggy has only a 50% chance of guessing which proof Victor will ask her to perform in step (3).
16/10/2013

This protocol dosent give Victor any useful information to aid in figuring out an isomorphism between G1 and G2. Because Peggy generates a new graph H for each round of the protocol.

17

Parallel Zero-knowledge Proofs

18

16/10/2013

Parallel Zero-knowledge Proof

It is development of the basic zero-knowledge protocol.
1. Peggy uses her information and n random numbers to transform the hard problem into n different isomorphic problems. She then uses her information and the random numbers to solve the n new hard problems. 2. Peggy commits to the solution of the n new hard problems. 3. Peggy reveals to Victor the n new hard problems. Victor cannot use these new problems to get any information about the original prblems or its solutions. 4. For each of the n new hard problems, Victor asks Peggy either to:
a. prove to him that old and new pproblems are isomorphic or b. open the solution she committed to in step (2) and prove that it is a solution to the new problem.
16/10/2013

5. Peggy complies for each of the new hard problems.

19

Noninteractive Zeroknowledge Proofs

20

16/10/2013

Noninteractive Zeroknowledge Proof (1)

16/10/2013

In basic zero-knowledge protocol, Victor cannot convince Carol or anyone else about Peggys knowledge. So, noninteractive zero-knowledge protocol is needed. These protocols dont require any interacion. Peggy could publish them and thereby prove to anyone who takes the time to check that the proof is valid.

The basic protocol and the parallel zero-knowledge proof are the same, but a one-way hash funcion takes the place of Victor.

21

Noninteractive Zeroknowledge Proof (2)

1. Peggy uses her information and n random numbers to transform the hard problem into n different isomorphic problems. She then uses her information and the random numbers to solve the n new hard problems. 2. Peggy commits to the solution of the n new hard problems. 3. Peggy uses all of these commitment together as a single input to a one-hash function. (after all, the commitments are nothing more than bit strings). She then saves the first n bits of the output of this one-way hash function. 4. Peggy takes the n bits generated in step (3). For each ith new hard problem in turn, she takes the ith bit of those n bits and: a. if it is a 0, she proves that the old and new problems are isomorphic or b. if it is 1, she opens the solution she committed to in step (2) and prove that it is a solution to the new problem 5. Peggy publish all the commitments from step (2) as well as the solutions in step (4). 6. Victor and Carol or whoever else is interested, verifies that steps (1) through (5) were executed properly.
16/10/2013

22

Noninteractive Zeroknowledge Proof (3)

Peggy can publish some data that contains no information about her secret, but can be used to convince anyone of the secrets existence. This protocol can also be used for digital signature scheme. In a noninteractive protocol, there must be many more iterations of the challenge/reply sequence. Peggy can pick different problems, hence different commitment vectors, till the hash function produces something she likes. In an interactive protocol, Peggy has a 1 in 210 (1 in 1024) chance of cheating for 10 rounds. But in a noninteracive protocol, that is not enough.
16/10/2013

23

EXERCISE
Explain briefly about: 1. Brute force attack 2. Avalance effect 3. Statistical Attack
16/10/2013

24

HAPPY LEARNING!

25

16/10/2013