Lecture 15 Zero-Knowledge Techniques

1. Lecture 15 Zero-Knowledge Techniques

2. Peggy: “I know the password to the Federal Reserve System computer, the ingredients in McDonald’s secret sauce, and the contents of Volume 4 of Knuth.” Victor: “No, you don’t.” Peggy: “Yes, I do.” Victor: “Do not!” Peggy: “Do too!” Victor: “Prove it!” Peggy: “All right. I’ll tell you.” She whispers in Victor’s ear. Victor: “That’s interesting. Now I know it, too. I’m going to tell The Washington Post.”

3. A few years ago, it was reported that some thieves set up a fake automatic teller machine at a shopping mall. When a person inserted a bank card and typed in an identification number, the machine recorded the information but responded with the message that it could not accept the card. The thieves then made counterfeit bank cards and went to legitimate teller machines and withdrew cash, using the identification numbers they had obtained.

4. How can this be avoided? There are several situations where someone reveals a secret identification number or password in order to complete a transaction. Anyone who obtains this secret number, plus some (almost public) identification information (for example, the information on a bank card), can masquerade as this person. What is needed is a way to use the secret number without giving any information that can be reused by an eavesdropper. This is where zero-knowledge techniques come in.

5. Outline • Overview of Zero-Knowledge Concepts • Fiat-Shamir Identification Protocol • Feige-Fiat-Shamir Identification Protocol • GQ Identification Protocol • Schnorr Identification Protocol

6. 1 Overview of Zero-Knowledge Concepts 1.1 Idea

7. 1.1 Idea (Continued) Peggy knows the secret of the cave. She wants to prove her knowledge to Victor, but she doesn’t want to reveal the magic words. Here’s how she convinces him: (1) Victor stands at point A. (2) Peggy walks all the way into the cave, either to point C or point D. (3) After Peggy has disappeared into the cave, Victor walks to point B.

8. 1.1 Idea (Continued) (4) Victor shouts to Peggy, asking her either to: (4.1) come out of the left passage or (4.2) come out of the right passage. (5) Peggy complies, using the magic words to open the secret door if she has to. (6) Peggy and Victor repeat steps (1) through (5) n times.

9. 1.1 Idea (Continued) Comment. The technique used in this protocol is called cut and choose, because of its similarity to the classic protocol for dividing anything fairly: (1) Peggy cuts the thing in half. (2) Victor chooses one of the halves for himself. (3) Peggy takes the remaining half. It is in Peggy’s best interest to divide fairly in step (1), because Victor will choose whichever half he wants in step (2).

10. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols The ZK protocols to be discussed are instances of interactive proof systems, wherein a prover and verifier exchange multiple. The prover’s objective is to convince the verifier the truth of an assertion, e.g., claimed knowledge of a secret. The verifier either accepts or rejects the proof. The traditional mathematical notion of a proof, however, is altered to an interactive game wherein proofs are probabilistic rather than absolute; a proof in this context need be correct only with bounded probability. For this reason, an interactive proof is sometimes called a proof by protocol.

11. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) Interactive proofs used for identification may be formulated as proofs of knowledge. A possesses some secret s, and attempts to convince B it has knowledge of s by correctly responding to queries (involving publicly known inputs and agreed upon functions) which require knowledge of s to answer. Note that proving knowledge of s differs from proving that such s exists. An interactive proof is said to be a proof of knowledge if it has both the properties of completeness and soundness.

12. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) Definition 1 (completeness property) An interactive proof (protocol) is complete if, given an honest prover and an honest verifier, the protocol succeeds with overwhelming probability (i.e., the verifier accepts the prover’s claim). Comment. Completeness is viewed as the customary requirement that a protocol functions properly given honest participants.The definition of overwhelming depends on the application, but generally implies that the probability of failure is not of practical significance.

13. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) Definition 2 (soundness property) An interactive proof (protocol) is sound if there exists an expected polynomial-time algorithm M with the following property: if a dishonest prover (impersonating A) can with non-negligible probability successfully execute the protocol with B, then M can be used to extract from this prover knowledge (essentially equivalent to A’s secret) which with overwhelming probability allows successful subsequent protocol executions.

14. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) Since any party capable of impersonating A must know the equivalent of A’s secret knowledge (Mcan be used to extract it from this party in polynomial time), soundness guarantees that the protocol does indeed provide a proof of knowledge – knowledge equivalent to that being queried is required to succeed. Soundness thus prevents a dishonest prover from convincing an honest verifier.

15. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) Definition 3 (zero-knowledge property) A protocol which is a proof of knowledge has the zero-knowledge property if it is simulatable in the following sense: there exists an expected polynomial-time algorithm (simulator) which can produce, upon input of the assertion(s) to be proven but without interacting with the real prover, transcripts indistinguishable from those resulting from interaction with the real prover.

16. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) Comment. (1) The zero-knowledge property implies that a prover executing the protocol (even when interacting with a malicious verifier) does not release any information (about its secret knowledge, other than that the particular assertion itself is true) not otherwise computable in polynomial time from public information alone. Thus, participation does not increase the chances of subsequent impersonation.

17. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) (2) Consider an observer C who witnesses a zero-knowledge interactive proof (ZKIP) involving a prover A convincing a verifier B (B C) of some knowledge A has. The “proof” to B does not provide any guarantees to C. (Indeed, A and B might have a prior agreement, conspiring against C, on the challenges to be issued.) Similarly, a recorded ZKIP conveys no guarantees upon playback. This is fundamental to the idea of the zero-knowledge property and the condition that proofs be simulatable by a verifier alone.

18. 1.2 Interactive Proof Systems and Zero-Knowledge Protocols (Continued) (3) The zero-knowledge property (Definition 3) does not guarantee that a protocol is secure (i.e., that the probability of it being easily defeated is negligible). Similarly, the soundness property (Definition 2) does not guarantee that a protocol is secure. Neither property has much value unless the underlying problem faced by an adversary is computationally hard.

19. 1.3 General Structure of Zero-Knowledge Protocols

20. 1.3 General Structure of Zero-Knowledge Protocols (Continued)

21. 1.4 Zero-Knowledge VS. Asymmetric Protocols (1) No degradation with usage: protocols proven to have the ZK property do not suffer degradation of security with repeated use, and resist chosen-text attacks. This is perhaps the most appealing practical feature of ZK techniques. (2) Encryption avoided: many ZK techniques avoid use of explicit encryption algorithms. (3) Efficiency: while some ZK-based techniques are extremely efficient, protocols which formally have the zero-knowledge property typically have higher communications and/or computational overheads than PK protocols which do not. The computational efficiency of the more practical ZK-based schemes arises from their nature as interactive proofs, rather than their zero-knowledge aspect.

22. 1.4 Zero-Knowledge VS. Asymmetric Protocols (Continued) (4) Unproven assumptions: many ZK protocols ("proofs of knowledge") themselves rely on the same unproven assumptions as PK techniques (e.g., the intractability of factoring). (5) ZK-based vs. ZK: although supported by prudent underlying principles, many techniques based on zero-knowledge concepts fall short of formally being zero-knowledge and/or formally sound in practice, due to parameter selection for reasons of efficiency, or for other technical reasons. In fact, many such concepts are asymptotic, and do not apply directly to practical protocols.

23. 2 Fiat-Shamir Identification Protocol

24. 2 Fiat-Shamir Identification Protocol (Continued)

25. A B 2 Fiat-Shamir Identification Protocol (Continued)

26. 2 Fiat-Shamir Identification Protocol (Continued)

27. 2 Fiat-Shamir Identification Protocol (Continued)

28. 3 Feige-Fiat-Shamir Identification Protocol

29. 3 Feige-Fiat-Shamir Identification Protocol (Continued)

30. A B 3 Feige-Fiat-Shamir Identification Protocol (Continued)

31. 3 Feige-Fiat-Shamir Identification Protocol (Continued)

32. 3 Feige-Fiat-Shamir Identification Protocol (Continued)

33. 3 Feige-Fiat-Shamir Identification Protocol (Continued)

34. 3 Feige-Fiat-Shamir Identification Protocol (Continued)

35. 3 Feige-Fiat-Shamir Identification Protocol (Continued)

36. 3 Feige-Fiat-Shamir Identification Protocol (Continued)

37. 4 GQ Identification Protocol

38. 4 GQ Identification Protocol (Continued)

39. 4 GQ Identification Protocol (Continued)

40. A B 4 GQ Identification Protocol (Continued)

41. 4 GQ Identification Protocol (Continued)

42. 4 GQ Identification Protocol (Continued)

43. 4 GQ Identification Protocol (Continued)

44. 5 Schnorr Identification Protocol

45. 5 Schnorr Identification Protocol (Continued)

46. 5 Schnorr Identification Protocol (Continued)

47. 5 Schnorr Identification Protocol (Continued)

48. A B 5 Schnorr Identification Protocol (Continued)

49. 5 Schnorr Identification Protocol (Continued)

50. 5 Schnorr Identification Protocol (Continued)