Zero knowledge interactive proofs of knowledge (a digest)

• Authors: Martin Tompa
• Venue: TARK '88 Proceedings of the 2nd conference on Theoretical aspects of reasoning about knowledge
• Year: 1988

Suppose an associate handed you a 500 digit number N, and informed you, "I know the prime factorization of N." What would convince you of the truth of your associate's statement? If your associate could be persuaded to reveal the factorization to you, a few simple tests would convince you of the statement's truth. Unfortunately the associate responds to this request by saying, "The factorization is a secret. In fact, I would like to convince you that I know the factorization of N without divulging any other useful information." How can you hope to be convinced that your associate is not deceiving you? Needless to say, a primality testing algorithm quickly reveals N to be composite, but your favorite factorization algorithms make no progress whatever. These seemingly irreconcilable positions (the associate's unwillingness to reveal any knowledge, your unwillingness to accept your associate's statement without proof) are reconcilable through a protocol known as a "zero knowledge interactive proof", introduced by Goldwasser, Micali, and Rackoff [15] in 1985. Informally, an interactive proof is a pair of protocols executed by two parties, called the "prover" and the "verifier", whereby the prover attempts to convince the verifier of the validity of some proposition II. The prover, even by deviating from its protocol, should not be able to convince the verifier of the truth of II if, in fact, II is false. An interactive proof is "zero knowledge" if the verifier, even by deviating from its protocol, cannot gain any information from the prover (other than the validity of II) that it could not have derived efficiently itself. More specifically, for any verifier that outputs after interacting with the prover, there is an algorithm that, without benefit of interacting with the prover, produces outputs from a distribution indistinguishable from that of the verifier. The interested reader can find careful definitions of these notions in [20]. The particular problem of knowledge of factorization will be left on the hook until the last section. The intervening sections contain some interesting historical digressions.