Automata, Languages and Programming
Volume 443 of the series Lecture Notes in Computer Science pp 268282
On the composition of zeroknowledge proof systems
 Oded GoldreichAffiliated withComputer Science Dept., Technion
 , Hugo KrawczykAffiliated withComputer Science Dept., Technion
Abstract
A basic question concerning zeroknowledge proof systems is whether their (sequential and/or parallel) composition is zeroknowledge too. This question is not only of natural theoretical interest, but is also of great practical importance as it concerns the use of zeroknowledge proofs as subroutines in cryptographic protocols.
We prove that the original formulation of zeroknowledge as appearing in the pioneering work of Goldwasser, Micali and Rackoff is not closed under sequential composition. This fact was conjectured by many researchers leading to the introduction of stronger formulations of zeroknowledge (e.g. blackbox simulation). We also prove that the parallel composition of zeroknowledge protocols does not necessarily result in a new zeroknowledge protocol: we present two protocols, both being zeroknowledge in a strong sense yet their parallel composition is not zeroknowledge (not even in a weak sense).
We present a lower bound on the round complexity of zeroknowledge proofs. We prove that only BPP languages have 3round interactive proofs which are blackbox simulation zeroknowledge. Moreover, we show that languages having constantround ArthurMerlin proofs that are blackbox simulation zeroknowledge are in BPP. These results have significant implications to the parallelization of zeroknowledge proofs. In particular it follows that the "parallel versions" of the original interactive proofs systems for quadratic residuosity, graph isomorphism and any language in NP, are not blackbox simulation zeroknowledge, unless the corresponding languages are in BPP. This resolves an open problem arising from the early works on zeroknowledge. Other consequences are a proof of optimality for the round complexity of various known zeroknowledge protocols, and a structure theorem for the hierarchy of ArthurMerlin zeroknowledge languages.
 Title
 On the composition of zeroknowledge proof systems
 Book Title
 Automata, Languages and Programming
 Book Subtitle
 17th International Colloquium Warwick University, England, July 16–20, 1990 Proceedings
 Pages
 pp 268282
 Copyright
 1990
 DOI
 10.1007/BFb0032038
 Print ISBN
 9783540528265
 Online ISBN
 9783540471592
 Series Title
 Lecture Notes in Computer Science
 Series Volume
 443
 Series ISSN
 03029743
 Publisher
 Springer Berlin Heidelberg
 Copyright Holder
 SpringerVerlag
 Additional Links
 Topics
 Industry Sectors
 eBook Packages
 Editors
 Authors

 Oded Goldreich ^{(1)}
 Hugo Krawczyk ^{(1)}
 Author Affiliations

 1. Computer Science Dept., Technion, Haifa, Israel
Continue reading...
To view the rest of this content please follow the download PDF link above.