Honest-Verifier Statistical Zero-Knowledge Equals General Statistical Zero-Knowledge

1. Honest-Verifier Statistical Zero-Knowledge EqualsGeneral Statistical Zero-Knowledge Oded Goldreich (Weizmann) Amit Sahai (MIT) Salil Vadhan (MIT)

2. Zero-Knowledge (ZK) • Zero-Knowledge means Verifier can simulate interaction. • Two types of Verifiers: • Honest - follows the protocol • General- employs any strategy We give a transformation: Proof ZK for Honest Verifier Proof ZK for General Verifiers

3. Motivation Why would one want to show HVZK = General ZK? • Easier to prove statements about the honest-verifier model, e.g. HVSZK • Methodology: • Design an HVZK proof • Transform into General ZK proof

4. Zero-Knowledge Proof v1 When assertion is true, Verifier can simulate her view of the interaction on her own. p1 v2 pk accept/reject Formally, a proof system is Statistical ZK iffor every Verifier, there is probabilistic poly-time simulator such that, when the assertion is true, its output distribution is statistically close to Verifier’s view of the interaction with Prover. Computational ZK : require simulator distribution to be computationally indistinguishable rather than statistically close.

5. Our Results • For Public-Coin Proof Systems, for both Statistical ZK and Computational ZK: • Show how to transform proof ZK • against Honest Verifier into proof • ZK against Any Verifier. • No computational assumptions • ZK condition holds even for computationally unbounded Verifiers • For the case of Statistical ZK,since Okamoto shows Public-Coins suffice, we have HVSZK = General SZK.

6. Random Coins Response Public Coin Proofs Arthur Merlin Random Coins Response Accept/Reject A Dishonest Arthur might not choose his messages at random.

7. Previous Work • For Computational Zero-Knowledge, if one-way functions exist, CZK = HVCZK = IP = PSPACE [GMW91, Ben-Or+88] • For Statistical Zero-Knowledge, • Private Coin=Public Coin [Oka96] • If one-way functions exist, SZK = HVSZK [BMO90, OVY93, Oka96] • Unconditionally, for constant round Public-Coin Proofs, Honest-Verifier = General Verifier [Dam94, DGW94]

8. Techniques • Main Ingredients: • A (Public-Coin) Random Selection Protocol, which will replace Arthur’smessages. • A new Hashing Lemma about 2-universal hash functions, generalizing the Leftover Hash Lemma, used to prove Simulability.

9. Random Selection Random Selection The Transformation Original Protocol a1 b1 ar Arthur br Merlin Transformed Protocol a1 b1 Arthur Merlin ar br

10. a1 b1 ar br The Simulator Use the Honest-Verifier Simulator togenerate transcript: For each Arthur message ai, simulatethe Random Selection protocol to produce ai.Use Merlin responses bi given in thetranscript.

11. Desired Properties ofRandom Selection (RS) • Dishonest Merlin: OK for Soundness by parallel repetitionof Original Proof System. • Dishonest Arthur: • Outcome a still almost uniform. • For each a, can simulate RS to produce a. • Conditioned on a fixed a, the simulator distribution is statistically close to distribution of actual RS transcripts that produce a.

12. Random Selection [DGW] Arthur selects partition of message spaceinto cells of size poly(n). Merlin Arthur Merlin selects a cell Arthur chooses a from the cell • Dishonest Merlin can cause at most 1/poly(n) statistical deviation. • For Dishonest Arthur: can simulate for only a 1/poly(n) fraction of a’s. • Yields result only for constant round. • We fix this. Accept/Reject

13. Our Solution [DGW] RS protocol Set S of 2na’s Arthur Merlin Merlin selects a from S • Use [DGW] protocol to select randomly among sets of 2na’s. • Any 1/poly(n) fraction of such sets will cover the space of a’s almost uniformly. Accept/Reject

14. Hash Functions • We use hash functions to describe setsof a’s. We will use h-1(0) to be our set of a’s. • H is a 2-universal family of hash functions. • For almost all h’s, h-1(0) is of size 2n. Accept/Reject

15. New Random Selection Arthur selects partition of H into cells of size poly(n) (using high-moment hash) Arthur Merlin Merlin selects a cell Arthur chooses h from the cell Merlin selects afrom h-1(0) Accept/Reject

16. Properties ofRandom Selection (RS) • Dishonest Merlin: Still OK for Soundness. • Dishonest Arthur: • Outcome a almost uniform. • For almost every a, • can simulate RS to produce a. • conditioned on a, the simulator distribution is statistically close to distribution of actual RS transcripts that produce a.

17. Simulation ofRandom Selection (RS) • Assume random tape of Arthur is already fixed; Arthur is deterministic. • Simulator, on input a: • Obtains Arthur’s partition p. • Chooses cell y randomly among cells containing some h such that h(a)=0: • If Arthur picks h such that h(a)=0,output (p,y,h,a). Otherwise repeat. Why does this work?

18. New Hashing Lemma (Hence the simulation is polynomial time) Moreover, the statistical difference between the following two distributions is at most 2-W(n) : (Hence the simulation is statistically close.)

19. Test This is the beginning of the end, he said. There is no hope. What’s the use in going on? We’re all dead anyway… The door opened. Hello there, my friend. Hello there, my friend. Hello there, my friend.

21. v1 p1 vk pk vk+1 Simulator Verifier Definitions Black-Box Simulator: Random Tape Simulator Verifier Computational Zero-Knowledge: Require Simulator Distribution to be only Computationally Indistinguishable rather than statistically close.