Zero-Knowledge Proof Systems

Abstract

In this chapter we discuss zero-knowledge proof systems. Loosely speaking, such proof systems have the remarkable property of being convincing and yielding nothing (beyond the validity of the assertion). The main result presented is a method to generate zero-knowledge proof systems for every language in NP. This method can be implemented using any bit commitment scheme, which in turn can be implemented using any pseudorandom generator. In addition, we discuss more reened aspects of the concept of zero-knowledge and their aaect on the applicability of this concept. 6.1 Zero-Knowledge Proofs: Motivation An archetypical \cryptographic" problem consists of providing mutually distrustful parties with a means of \exchanging" (predetermined) \pieces of information". The setting consists of several parties, each wishing to obtain some predetermined partial information concerning the secrets of the other parties. Yet each party wishes to reveal as little information as possible about its own secret. To clarify the issue, let us consider a speciic example. Suppose that all users in a system keep backups of their entire le system, encrypted using their public-key encryption, in a publicly accessible storage media. Suppose that at some point, one user, called Alice, wishes to reveal to another user, called Bob, the cleartext of one of her rles (which appears in one of her backups). A trivial \solution" is for Alice just to send the (cleartext))le to Bob. The problem with this \solution" is that Bob has no way of verifying that Alice really sent him a le from her public backup, rather than just sending him an arbitrary yle. Alice can simply prove that she sends the correct tle by revealing to Bob her private encryption key. However, doing so, will reveal to Bob the contents of all her les, which is certainly something that Alice does 143