On the (Im)Possibility of Arthur-Merlin Witness Hiding Protocols
- Iftach HaitnerAffiliated withMicrosoft Research
- , Alon RosenAffiliated withHerzliya Interdisciplinary Center
- , Ronen ShaltielAffiliated withUniversity of Haifa
The concept of witness-hiding suggested by Feige and Shamir is a natural relaxation of zero-knowledge. In this paper we identify languages and distributions for which many known constant-round public-coin protocols with negligible soundness cannot be shown to be witness-hiding using black-box techniques. One particular consequence of our results is that parallel repetition of either 3-Colorability or Hamiltonicity cannot be shown to be witness hiding with respect to some probability distribution over the inputs assuming that:
the distribution assigns positive probability only to instances with exactly one witness.
Polynomial size circuits cannot find a witness with noticeable probability on a random input chosen according to the distribution.
The proof of security relies on a black-box reduction that is independent of the choice of the commitment scheme used in the protocol.
These impossibility results conceptually match results of Feige and Shamir that use such black-box reductions to show that parallel repetition of 3-Colorability or Hamiltonicity is witness-hiding for distributions with “two independent witnesses”.
We also consider black-box reductions for parallel repetition of 3-Colorability or Hamiltonicity that depend on a specific implementation of the commitment scheme. While we cannot rule out such reductions completely, we show that “natural reductions” cannot bypass the limitations above.
Our proofs use techniques developed by Goldreich and Krawczyk for the case of zero knowledge. The setup of witness-hiding, however, presents new technical and conceptual difficulties that do not arise in the zero-knowledge setting. The high level idea is that if a black-box reduction establishes the witness-hiding property for a protocol, and the protocol also happens to be a proof of knowledge, then this latter property can be actually used “against the reduction” to find witnesses unconditionally.
KeywordsZero-Knowledge Witness-Hiding Arthur Merlin protocols Black-box reductions
- On the (Im)Possibility of Arthur-Merlin Witness Hiding Protocols
- Book Title
- Theory of Cryptography
- Book Subtitle
- 6th Theory of Cryptography Conference, TCC 2009, San Francisco, CA, USA, March 15-17, 2009. Proceedings
- pp 220-237
- Print ISBN
- Online ISBN
- Series Title
- Lecture Notes in Computer Science
- Series Volume
- Series ISSN
- Springer Berlin Heidelberg
- Copyright Holder
- Springer-Verlag Berlin Heidelberg
- Additional Links
- Arthur Merlin protocols
- Black-box reductions
- Industry Sectors
- eBook Packages
- Omer Reingold (16)
- Editor Affiliations
- 16. Faculty of Mathematics and Computer Science, The Weizmann Institute of Science
- Author Affiliations
- 17. Microsoft Research, New England Campus,
- 18. Herzliya Interdisciplinary Center, Herzliya, Israel
- 19. University of Haifa,
To view the rest of this content please follow the download PDF link above.