560 likes | 580 Views
Great Theoretical Ideas In Computer Science. Information Magic: Zero-Knowledge. Lecture 27. 15-251. n=pq. I know the factors of n. Prove it!. Odette. Bonzo. p,q. pq=n, yes you proved it. Odette. Bonzo. p,q. pq=n, yes you proved it. Bonzo knows: The factors of n
E N D
Great Theoretical Ideas In Computer Science InformationMagic: Zero-Knowledge Lecture 27 15-251
n=pq I know the factors of n. Prove it! Odette Bonzo
p,q pq=n, yes you proved it. Odette Bonzo
p,q pq=n, yes you proved it. • Bonzo knows: • The factors of n • Odette knows the factors of n Odette Bonzo
GOAL: After conversation, Bonzo should know that Odette knows the factors of n, but Bonzo should not have learned anything else. Odette Bonzo
How can Odette prove that she knows the factors of n while revealing ZERO KNOWLEDGE about anything else? Odette Bonzo
There is a zero-knowledge proof of knowledge of the factors of n. • To understand the import and subtlety of what this means, let’s assume we can do this and solve one of the most significant security problems of our time: IDENTITY THEFT
My credit card number is 32543-22243-2232 Thanks. He He He Odette Merchant
Public Notice • Odette is the only one who knows the factors of the number n.
Zero Knowledge Proof that Odette knows the factors of n. Odette Merchant
The merchant can’t turn around and prove to someone else that he is Odette. He does not know the factors of n. Merchant
RECALL:Quadratic Residues Mod n=pq • A quadratic residue x mod n is a square mod n. It has 4 roots r1, -r1, r2, -r2. • A pair of roots is called primitive if one is not the negative of the other. • Knowing 2 primitive roots, allows you to quickly calculate the factors of n. Knowing the factors of n, allows you to quickly calculate all square roots mod n.
RECALL:An efficient way to calculate a square root of random number mod n can be transformed to an efficient way to factor n. • Let A be an algorithm to give one root of a random input x. • Pick r at random. Let x=r2. r1 = A(x). • With 50% chance (r,r1) are primitive and you can factor n. Repeat until n is factored.
RECALL:Being able to quickly find a root of random number is equivalent to being able to factor n. • Let A be an algorithm to give one root of a random input x. • Pick r at random. Let x=r2. r1 = A(x). • With 50% chance (r,r1) are primitive and you can factor n. Repeat until n is factored.
Pick r at random. X=r2. x A root of x Crude Attempt
Pick r at random. X=r2. Pick a random bit b. X Y b If b=0: root of Y If b=1: root of XY Catch a crook with probability 1/2
a2 =Y and b2 = XY • Sqrt(X) = a-1 b • (a-1b)2 = a-2 b2 = Y-1 XY = X
Pick r at random. X=r2. Pick a random bit b. X Y b If b=0: root of Y If b=1: root of XY Catch a crook with probability 1/2
Pick r at random. X=r2. Pick a random bit b. REPEAT K INDEPDENT TIMES. X Y b If b=0: root of Y If b=1: root of XY Catch a crook with prob 1-1/2k
Pick r at random. X=r2. Pick a random bit b. How can we be sure this is zero-knowledge? X Y b If b=0: root of Y If b=1: root of XY
Can Bonzo simulate the distribution of conversations by himself? Random square X Random square Y Random bit b If b=0: root of Y If b=1: root of XY
Pick a random bit b. Pick random r. If b=0, set Y=r2; X to random square. If b=1, set X= r2Y-1; Y to random square X Y b If b=0: root of Y If b=1: root of XY r
Bonzo can perfectly simulate the probability distribution on conversations with Odette. • HENCE those conversations contain no knowledge that Bonzo could not generate himself.
How Do You Flip A Coin Over The Telephone? • Alice and Bob want to make a difficult decision…..
ENVELOPE Or SAFE:Bit Commitment • Imagine that you had an envelope that: • Only you can open • But you could not change its contents once it was sealed • Put a bit in it to COMMIT to the bit, and reveal when it suits you.
ENVELOPE:Bit Commitment • Quadratic Residue Method to Commit to b • Let n-pq, where p and q are secret. Let r be random in Zn*. Let m be a non-residue mod n. • E(r,b) = r2 mb mod n • TO OPEN: Reveal r and b
Coin Flipping Over Phone • Alice picks random bit b • She sends ENVELOPE(b) • Bob announces his random bit c • Alice reveals b • SELECTED BIT = b XOR c
Romantic Information Game • I need 2 romantic guys….. • ….who have to fall in love with one of the girls in class…..
Prover knows a way to 3-color gadget. We will call this the secret coloring
3! = 6 ways to permute the color names • Notice that the secret coloring of gadget, there are 6 colorings that can be obtained by permuting the 3 color names.
Prover randomly chooses of one the 6 coloring obtainable form the secret coloring.
Prover randomly chooses of one the 6 coloring obtainable form the secret coloring. Each node will have an associated envelope. The prover places the coloring in the corresponding envelopes.
Verifier: Picks an edge at random and asks to open envelopes at both ends of the edge.
Verifier: Picks an edge at random and asks to open envelopes at both ends of the edge.
Verifier: Picks an edge at random and asks to open envelopes at both ends of the edge.
REPEAT USING AN INDEPENDENT, RANDOM CHOICE OF THE 6 PERMUTATIONS OF COLOR NAMES
Prover randomly chooses of one the 6 coloring obtainable form the secret coloring.
Prover randomly chooses of one the 6 coloring obtainable form the secret coloring. Each node will have an associated envelope. The prover places the coloring in the corresponding envelopes.
Verifier: Picks an edge at random and asks to open envelopes at both ends of the edge.
Verifier: Picks an edge at random and asks to open envelopes at both ends of the edge.
REPEAT USING AN INDEPENDENT, RANDOM CHOICE OF THE 6 PERMUTATIONS OF COLOR NAMES
Prover randomly chooses of one the 6 coloring obtainable form the secret coloring.
Prover randomly chooses of one the 6 coloring obtainable form the secret coloring. Each node will have an associated envelope. The prover places the coloring in the corresponding envelopes.
Verifier: Picks an edge at random and asks to open envelopes at both ends of the edge.
Verifier: Picks an edge at random and asks to open envelopes at both ends of the edge.