On Message Proof Systems with Known Space Verifiers

• Authors: Yonatan Aumann;Uriel Feige
• Venue: CRYPTO '93 Proceedings of the 13th Annual International Cryptology Conference on Advances in Cryptology
• Year: 1993

We construct a proof system for any NP statement, in which the proof is a single message sent from the prover to the verifier. No other interaction is required, neither before nor after this single message is sent. In the "envelope" model, the prover sends a sequence of envelopes to the verifier, where each envelope contains one bit of the prover's proof. It suffices for the verifier to open a constant number of envelopes in order to verify the correctness of the proof (in a probabilistic sense). Even if the verifier opens polynomially many envelopes, the proof remains perfectly zero knowledge.We transform this proof system to the "known-space verifier" model of De-Santis et al. [7]. In this model it suffices for the verifier to have space Smin in order to verify proof, and the proof should remain statistically zero knowledge with respect to verifiers that use space at most Smax. We resolve an open question of [7], showing that arbitrary ratios Smax/Smin are achievable. However, we question the extent to which these proof systems (that of [7] and ours) are really zero knowledge. We do show that our proof system is witness indistinguishable, and hence has applications in cryptographic scenarios such as identification schemes.