On the (Im)Possibility of Arthur-Merlin Witness Hiding Protocols

  • Iftach Haitner
  • Alon Rosen
  • Ronen Shaltiel
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5444)


The concept of witness-hiding suggested by Feige and Shamir is a natural relaxation of zero-knowledge. In this paper we identify languages and distributions for which many known constant-round public-coin protocols with negligible soundness cannot be shown to be witness-hiding using black-box techniques. One particular consequence of our results is that parallel repetition of either 3-Colorability or Hamiltonicity cannot be shown to be witness hiding with respect to some probability distribution over the inputs assuming that:

  • the distribution assigns positive probability only to instances with exactly one witness.

  • Polynomial size circuits cannot find a witness with noticeable probability on a random input chosen according to the distribution.

  • The proof of security relies on a black-box reduction that is independent of the choice of the commitment scheme used in the protocol.

These impossibility results conceptually match results of Feige and Shamir that use such black-box reductions to show that parallel repetition of 3-Colorability or Hamiltonicity is witness-hiding for distributions with “two independent witnesses”.

We also consider black-box reductions for parallel repetition of 3-Colorability or Hamiltonicity that depend on a specific implementation of the commitment scheme. While we cannot rule out such reductions completely, we show that “natural reductions” cannot bypass the limitations above.

Our proofs use techniques developed by Goldreich and Krawczyk for the case of zero knowledge. The setup of witness-hiding, however, presents new technical and conceptual difficulties that do not arise in the zero-knowledge setting. The high level idea is that if a black-box reduction establishes the witness-hiding property for a protocol, and the protocol also happens to be a proof of knowledge, then this latter property can be actually used “against the reduction” to find witnesses unconditionally.


Zero-Knowledge Witness-Hiding Arthur Merlin protocols Black-box reductions 


  1. 1.
    Akavia, A., Goldreich, O., Goldwasser, S., Moshkovitz, D.: On basing one-way functions on np-hardness. In: Proceedings of the 38th Annual ACM Symposium on Theory of Computing (STOC), pp. 701–710 (2006)Google Scholar
  2. 2.
    Babai, L., Moran, S.: Arthur-merlin games: A randomized proof system, and a hierarchy of complexity classes. J. Comput. Syst. Sci. 36(2), 254–276 (1988)MathSciNetCrossRefzbMATHGoogle Scholar
  3. 3.
    Barak, B.: How to go beyond the black-box simulation barrier. In: Proceedings of the 42nd Annual Symposium on Foundations of Computer Science (FOCS), pp. 106–115 (2001)Google Scholar
  4. 4.
    Barak, B., Lindell, Y., Vadhan, S.: Lower bounds for non-black-box zero knowledge. Journal of Computer and System Sciences 72(2), 321–391 (2006)MathSciNetCrossRefzbMATHGoogle Scholar
  5. 5.
    Blum, M.: How to prove a theorem so no one else can claim it. In: Proceedings of the International Congress of Mathematicians, pp. 1444–1451 (1987)Google Scholar
  6. 6.
    Bogdanov, A., Trevisan, L.: On worst-case to average-case reductions for np problems. SIAM Journal on Computing 36(4), 1119–1159 (2006)MathSciNetCrossRefzbMATHGoogle Scholar
  7. 7.
    Dwork, C., Naor, M.: Zaps and their applications. SIAM Journal on Computing 36(6), 1513–1543 (2007)MathSciNetCrossRefzbMATHGoogle Scholar
  8. 8.
    Feige, U., Lapidot, D., Shamir, A.: Multiple noninteractive zero knowledge proofs under general assumptions. SIAM Journal on Computing 29(1), 1–28 (1999)MathSciNetCrossRefzbMATHGoogle Scholar
  9. 9.
    Feige, U., Shamir, A.: Witness indistinguishable and witness hiding protocols. In: Proceedings of the 22nd Annual ACM Symposium on Theory of Computing (STOC), pp. 416–426. ACM, New York (1990)Google Scholar
  10. 10.
    Feigenbaum, J., Fortnow, L.: Random-self-reducibility of complete sets. SIAM Journal on Computing 22(5), 994–1005 (1993)MathSciNetCrossRefzbMATHGoogle Scholar
  11. 11.
    Goldreich, O.: Foundations of Cryptography: Basic Tools. Cambridge University Press, Cambridge (2001)CrossRefzbMATHGoogle Scholar
  12. 12.
    Goldreich, O., Krawczyk, H.: On the composition of zero-knowledge proof systems. SIAM J. Comput. 25(1), 169–192 (1996); Preliminary version in ICALP 1990MathSciNetCrossRefzbMATHGoogle Scholar
  13. 13.
    Goldreich, O., Micali, S., Wigderson, A.: Proofs that yield nothing but their validity and a methodology of cryptographic protocol design (extended abstract). In: FOCS, pp. 174–187. IEEE, Los Alamitos (1986)Google Scholar
  14. 14.
    Goldreich, O., Oren, Y.: Definitions and properties of zero-knowledge proof systems. Journal of Cryptology 7(1), 1–32 (1994)MathSciNetCrossRefzbMATHGoogle Scholar
  15. 15.
    Goldwasser, S., Micali, S., Rackoff, C.: The knowledge complexity of interactive proof systems. SIAM J. Comput. 18(1), 186–208 (1989); Preliminary version in STOC 1985MathSciNetCrossRefzbMATHGoogle Scholar
  16. 16.
    Kilian, J., Petrank, E.: An efficient noninteractive zero-knowledge proof system for np with general assumptions. J. Cryptology 11(1), 1–27 (1998)MathSciNetCrossRefzbMATHGoogle Scholar
  17. 17.
    Pass, R.: Parallel repetition of zero-knowledge proofs and the possibility of basing cryptography on np-hardness. In: IEEE Conference on Computational Complexity, pp. 96–110 (2006)Google Scholar
  18. 18.
    Reingold, O., Trevisan, L., Vadhan, S.P.: Notions of reducibility between cryptographic primitives. In: Naor, M. (ed.) TCC 2004. LNCS, vol. 2951, pp. 1–20. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  19. 19.
    Santis, A.D., Persiano, G.: Zero-knowledge proofs of knowledge without interaction. In: Proceedings of the 33rd Annual Symposium on Foundations of Computer Science (FOCS), pp. 427–436 (1992)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Iftach Haitner
    • 1
  • Alon Rosen
    • 2
  • Ronen Shaltiel
    • 3
  1. 1.Microsoft ResearchNew England Campus
  2. 2.Herzliya Interdisciplinary CenterHerzliyaIsrael
  3. 3.University of HaifaIsrael

Personalised recommendations