Transcript 10A-interactive-proofs.pptx

Interactive Proofs
(variation of)
Slides by
Ariel Procaccia
Graph isomorphism
𝜋 respects both edges and
non-edges across 𝐺and 𝐺 ′
Two graphs 𝐺 = (𝑉, 𝐸) and 𝐺 ′ = 𝑉 ′ , 𝐸 ′ are isomorphic
(𝐺~𝐺 ′ ) if there exists a bijection 𝜋: 𝑉 → 𝑉 ′ such that:
𝑢, 𝑣 ∈ 𝐸 ⟺ 𝜋 𝑢 , 𝜋 𝑣 ∈ 𝐸 ′
Question. Are these two graphs isomorphic?
1
7
2
3
4
5
6
8
1
2
3
4
5
6
7
8
Answer. Yes, via the bijection shown by the colors.
Graph isomorphism
GRAPH ISOMORPHISM: Given two graphs
𝐺 = (𝑉, 𝐸) and 𝐺 ′ = 𝑉 ′ , 𝐸 ′ check that
they are isomorphic.
Question. Is this problem in P? In NP?
Answer. Not known to be in P. But in NP:
 certificate: Any bijection from 𝑉 to 𝑉 ′ .
 verifier: The algorithm which checks
that the given bijection respects every
edge and non-edge across 𝐺 and 𝐺 ′ .
Question. Is it NP-complete?
Answer. Nobody knows.
Graph non-isomorphism
So, it is easy to convince someone that two
graphs are isomorphic. But what about the
opposite? Is it also easy to convince that
two graphs are not isomorphic?
In other (formal) words:
GRAPH NON-ISOMORPHISM: Given graphs
𝐺0 , 𝐺1 check that they are not isomorphic.
Question. Is this problem also in NP?
Answer. Nobody knows.
Graph non-isomorphism
GRAPH NON-ISOMORPHISM: Given graphs
𝐺0 , 𝐺1 check that they are not isomorphic.
So, if I happen to know that two graphs are
not isomorphic, then there is no known
efficient non-interactive
way to
convince you that this is indeed the case.
But we do know of an interactive one!
(Remark. 𝐺0 ~𝐺1 & 𝐺1 ~𝐺 ⟹ 𝐺0 ~𝐺.)
Our protagonists
Arthur = Verifier
weak; does not know; to be convinced
Merlin = Prover
strong; knows; can convince
IP for GRAPH NON-ISOMORPHISM
Verifier chooses 𝑏 ∈ {0,1} and
permutation 𝜋 at random, and
sends 𝜋(𝐺𝑏 ) to Prover .
Prover sends a bit 𝑏′.
If 𝑏 = 𝑏′ verifier accepts,
otherwise verifier rejects.
IP for GRAPH NON-ISOMORPHISM
1
𝐺0 :
3
2
4
𝜋(𝐺0 ):
0
1
2
3
4
If the graphs are
non-isomorphic:
𝐺0 :
𝐺1 :
always correct
Accept!
IP for GRAPH NON-ISOMORPHISM
1
𝐺0 :
3
2
4
𝜋(𝐺0 ):
1
2
3
4
0/1
correct w.p. 1/2
Accept/Reject!
Prover lucky.
Verifier fooled.
Verifier lucky.
Prover caught.
If the graphs are
isomorphic:
𝐺0 :
𝐺1 :
IP for GRAPH NON-ISOMORPHISM
1. Verifier chooses 𝑏 ∈ {0,1} and permutation 𝜋 at random;
sends 𝜋(𝐺𝑏 ) to Prover .
2. Prover sends a bit 𝑏′.
3. If 𝑏 = 𝑏′ then Verifier accepts, otherwise it rejects.
Vote. With what probability does the Prover
make the Verifier accept, if 𝐺0 , 𝐺1 are respectively
(i) non-isomorphic and (ii) isomorphic?




1 and 1/𝑛!
1 and 1/2
1/2 and 1/𝑛!
1/2 and 1/2
Interactive proofs
Definition. An interactive proof system for a problem 𝐿 is
a protocol between a computationally unbounded Prover 𝑃
and a probabilistic polynomial-time Verifier 𝑉 which meets
the following two specifications:
 Completeness: For every YES-instance 𝑥:
Pr 𝑉 ↔ 𝑃 𝑥 = accept = 1
 Soundness: For every NO-instance 𝑥 and any 𝑃′:
Pr 𝑉 ↔ 𝑃′ 𝑥 = accept ≤ 1/2
Being fooled with probability
½ is still pretty bad!
What can we do about it?
includes potentially
dishonest Provers.
Theorem. GRAPH NON-ISOMORPHISM has an i.p. system.
IP
Definition. We call 𝐈𝐏 the class of all problems which have
an interactive proof system.
Corollary. GRAPH NON-ISOMORPHISM ∈ 𝐈𝐏.
Vote. What is the known relation between 𝐍𝐏 and 𝐈𝐏?

𝐍𝐏 ⊆ 𝐈𝐏

𝐈𝐏 ⊆ 𝐍𝐏

𝐈𝐏 = 𝐍𝐏

They are incomparable.
Corollary. GRAPH ISOMORPHISM ∈ 𝐈𝐏, as well.
Zero-knowledge proofs
In the i.p. for GRAPH ISOMORPHISM, the Prover obviously
reveals the bijection to the Verifier. Can that be avoided?
Namely:
Question. Is there an interactive protocol by which the
Prover can convince the Verifier that a bijection exists
without revealing such a bijection to him?
Such a protocol is called a zero-knowledge proof.
Why do we need ZKPs?
Merlin, prove that you are who
you say you are!
Accept!
* Just for fun
ZKP for GRAPH ISOMORPHISM
Prover chooses 𝑏 ∈ {0,1} and permutation 𝜋 at
random, and sends 𝐻 = 𝜋(𝐺𝑏 ) to Verifier.
Verifier sends a random bit 𝑏′ to Prover.
Prover picks a permutation 𝜋′ and sends it
to Verifier.
Verifier accepts iff 𝐻 = 𝜋 ′ 𝐺𝑏′ .
ZKP for GRAPH ISOMORPHISM
1. Prover chooses 𝑏 ∈ {0,1} and permutation 𝜋 at random,
and sends 𝐻 = 𝜋(𝐺𝑏 ) to Verifier.
2. Verifier sends a random bit 𝑏′ to Prover.
3. Prover picks a permutation 𝜋′ and sends it to Verifier.
4. Verifier accepts iff 𝐻 = 𝜋 ′ 𝐺𝑏′ .
Claim 1. This is an indeed an interactive proof protocol:
 It is complete (why?)
 It is sound (why?)
Claim 2. The verifier learns nothing about the solution!
* Just for fun
Zero-knowledge proofs
Definition (informal).
An interactive proof system is zero-knowledge if:
for any probabilistic polynomial-time Verifier 𝑉′
there is a probabilistic polynomial-time Simulator 𝑆𝑉 ′
which, given any YES-instance 𝑥, produces the same
distribution of interaction transcripts as the one produces
when 𝑉′ talks to the honest Prover 𝑃!
By talking to the honest Prover 𝑃
about 𝑥, a dishonest Verifier 𝑉′ can
only see information that it can
produce by talking to itself anyway!
ZKP for OPEN SESAME
Peggy knows the magic words that open a door in a cave.
How to prove so to Victor, without revealing the words?
1. Peggy chooses passage 𝑏 ∈ {𝐴, 𝐵} and enters via 𝑏.
2. Victor picks a random passage 𝑏′ ∈ 𝐴, 𝐵 and shouts it to
Peggy.
3. Peggy exits via 𝑏′. Victor accepts if she indeed does so.
Claim 1. This is an indeed an interactive proof protocol:
 It is complete (why?)
 It is sound (why?)
* Just for fun
Claim 2. Victor learns nothing about the magic word!
Comparison
Prover chooses 𝑏 ∈ {0,1} and permutation 𝜋 at
random, and sends 𝐻 = 𝜋(𝐺𝑏 ) to Verifier.
Verifier sends a random bit 𝑏′ to Prover.
Prover picks a permutation 𝜋′ and sends it
to Verifier.
Verifier accepts iff 𝐻 = 𝜋 ′ 𝐺𝑏′ .
*Not in the exam
ZKP for 3-COLORING*
Let us design a zero-knowledge proof
system for 3-COLORING.
We will assume the cryptographic
construction of bit commitment:
 Prover can put bits in envelopes
and send them to Verifier.
 Verifier can open an envelope
only if the Prover tells him how.
* Just for fun
*Not in the exam
ZKP for 3-COLORING*
Prover selects random permutation 𝜋 of 𝑅, 𝐺, 𝐵 ,
commits to all 𝜋 𝛾 𝑣 for 𝑣 ∈ 𝑉 and sends them
to Verifier.
Verifier selects random 𝑢, 𝑣 ∈ 𝐸 and sends
it to Prover.
Prover reveals 𝑎 = 𝜋 𝛾 𝑢
and 𝑏 = 𝜋(𝛾 𝑣 ).
Verifier accepts iff 𝑎 ≠ 𝑏
*Not in the exam
ZKP for 3-COLORING*
If the graph is
3-colorable:
𝑎
𝑐
𝑑
𝑏
𝑐
𝑒
𝑐
𝑑
Accept!
* Just for fun
𝛾(𝐺)
𝑑
*Not in the exam
ZKP for 3-COLORING*
If the graph is
not 3-colorable:
𝑎
𝑐
𝑐
𝑑
𝑑
/
/
𝑒
𝑏
𝑎
error caught
w.p. ≥ 1/|𝐸|
𝑒
𝑎
Accept/Reject!
* Just Prover
for lucky.
fun
Verifier fooled.
Verifier lucky.
Prover caught.
𝑐
𝑒
𝛾(𝐺)
𝑑
*Not in the exam
ZKP for 3-COLORING*
1. Prover selects random permutation 𝜋 of 𝑅, 𝐺, 𝐵 ,
commits to all 𝜋 𝛾 𝑣 for 𝑣 ∈ 𝑉 and sends them to Verifier.
2. Verifier selects and sends random 𝑢, 𝑣 ∈ 𝐸.
3. Prover reveals 𝑎 = 𝜋 𝛾 𝑢 and 𝑏 = 𝜋(𝛾 𝑣 ).
4. Verifier accepts iff 𝑎 ≠ 𝑏.
Vote. If 𝐺 is not 3-colorable, what is the worst-case
probability that the Prover will convince the Verifier?
 1
 1
 1
 1
1
−
2
1
−
𝑛!
1
−
3!
1
−
|𝐸|
*Not in the exam
ZKP for 3-COLORING*
1. Prover selects random permutation 𝜋 of 𝑅, 𝐺, 𝐵 ,
commits to all 𝜋 𝛾 𝑣 for 𝑣 ∈ 𝑉 and sends them to Verifier.
2. Verifier selects and sends random 𝑢, 𝑣 ∈ 𝐸.
3. Prover reveals 𝑎 = 𝜋 𝛾 𝑢 and 𝑏 = 𝜋(𝛾 𝑣 ).
4. Verifier accepts iff 𝑎 ≠ 𝑏.
To get soundness, we must repeat the protocol.
Why zero-knowledge: Prover just reveals a pair of distinct
random colors!
* Just for fun
What you need to know
Definitions
 Interactive proof system
 The class IP
 Zero-Knowledge proofs
Algorithms
 Interactive proof system for
GRAPH NON-ISOMORPHISM
 Zero-Knowledge proof for
GRAPH ISOMORPHISM