There are two qualities that together make UC Berkeley unique among worldwide institutions of higher education.

One is that our several academic departments cover nearly all fields of scholarship, and that nearly every department is at the very top of its field. Very few places have this phenomenal combination of breadth and depth, although, admittedly, there are some.

The other is the diversity of the student body. Not ethnic diversity, because the passage of Proposition 209 made black and (to a lesser extent) Latino students almost disappear from campus. But, at least, UC Berkeley has been an engine of upward social mobility for a lot (and, being a big campus, it is really a lot) of white and Asian Californians from middle and working class families. To be sure, the top East Coast private universities do admit several students who are not from privileged families, and they do provide generous financial aid, but one has to be off-the-charts brilliant to get in based on raw talent alone. The merely very smart students can get in only if they have the kind of expensive resume-padding extracurricular activities that are out of reach for most students. At Berkeley, the merely very smart student has a good chance to get in by simply doing well in high school. And then, tuition is low for everybody who is from California, and the state used to give additional grants (80% of tuition) to everybody with a 3.0 GPA; plus the UC system has its own financial aid program.

Two days ago, the Chancellor announced that because of the cuts expected as a consequence of the state-wide budget crisis, UC Berkeley needs to cut about $100 millions. Next year, we should expect a complete freeze on hiring, layoffs of administrative staff, strong cuts to student aid, increased tuition, and salary cuts of 8%. For 2010-2011, rumors are that the sun will go dark, it will rain blood from the sky, and then the locusts will come and eat us alive. Unfortunately, 2011-2012 will be much worse.

It is unclear how this will affect breadth and depth of research at Berkeley. The idea of closing academic departments seems to be completely off-limits. (It is not even mentioned for the sake of ruling it out.) The hiring freeze, however, will inevitably affect changing areas and new interdisciplinary activities.

I am, however, very pessimistic on how the cuts will affect the diversity of the student body, and the Harvard/Princeton/Yale quality of their education. The tuition increase and reduced financial aid, together with the state cutting its own student grants, will make it harder for many students to come to Berkeley. And for those who come, fewer TAs, larger classes, and overworked administrative staff will make for a much less rewarding experience.

Of course, deep cuts are being made to all state activities, and the Berkeley students won’t have it as badly as the 930,000 children who are going to lose health coverage or the 35,000 AIDS patients who are going to lose access to their life-saving medications. There are also plans to close prisons, cut costs in law enforcement, close firefighter stations, reduce road maintenance work, and so on.

To external observers, it may seem incomprehensible that California, which remains a very rich state, cannot afford to take care of its students, its sick, its roads, its burning homes, and so on. The culprit is Proposition 13, which I see as a reduction ad absurdum showing that direct democracy does not work. Proposition 13 made property taxes work like TCP/IP: they can be reduced arbitrarily when property values go down, but can only go up very slowly when property values go up; in addition, it makes it all but impossible to raise income taxes. To be sure, nobody likes to pay taxes, but the only way to not pay taxes is to not have a state, and, as Somalis can tell you, not having a state is a bad thing. Perhaps, when we’ll have pirates off the coast of California, there will be a movement to overturn Prop 13.

At the STOC 2009 business meeting, Silvio Micali announced a new conference, Innovations in Computer Science (ICS), whose first edition will be in Beijing in January, 2010.

This is a conference that aims to be the venue for the first papers in new areas. This prompted people to ask me afterward if we shouldn’t start a new conference devoted to second papers. I thought this was an appealing ideas, and perhaps the conference could be called Follows-up in Computer Science; a snarky colleague, however, suggested that we already have two such conferences and they are called STOC and FOCS.

ICS has a steering committee entirely composed of past and future Turing Award winners, so surely they know what they are doing. A common complaint I heard, however, was that it isn’t clear exactly what the motivations and the goals of this conference are, what papers are being sought (surely you cannot fill up a 30-paper conference with first papers, each opening up a new area), and so on.

Helpfully, Oded Goldreich, one of the promoters of ICS, has written a statement about the goals ICS, as well as a longer essay on What is wrong with STOC and FOCS. The arguments made in the essay are Oded’s motivations for the new conference.

As I have said before, I agree with the importance of conceptual innovations, and of simplicity, but I disagree with the claim that our current review system undervalues such points. Hence, I think that initiatives such as the “letter on conceptual contributions” and now ICS will not correct an imbalance, but rather will create an imbalance, penalizing the necessary, hard, and unglamorous technical work by which we understand new ideas, exploit and simplify their applications, and create the conditions such that the next new ideas are “in the air” and the right person at the right time can get them, and so on.

LaTeX2WP is a program that converts a LaTeX file into something that is ready to be cut and pasted into the WordPress online editor. It makes it easier to write mathematical posts, to post lecture notes on WordPress, and so on.

A new version is now available, which fixes a couple of bugs:

• WordPress has trouble if a mathematical expression containing is followed by a mathematical expression containing . This is prevented by converting the inequality symbols to their HTML “character codes.”
• The previous version of LaTeX2WP had trouble with long sentences in square brackets; this is fixed.

In addition, \S for § and \v{C} for Č (as “in Stone–Čech compactification”) now work.

Scribed by Madhur Tulsiani

Summary

In this lecture we begin the construction and analysis of a zero-knowledge protocol for the 3-coloring problem. Via reductions, this extends to a protocol for any problem in NP. We will only be able to establish a weak form of zero knowledge, called “computational zero knowledge” in which the output of the simulator and the interaction in the protocol are computationally indistinguishable (instead of identical). It is considered unlikely that NP-complete problem can have zero-knowledge protocols of the strong type we defined in the previous lectures.

As a first step, we will introduce the notion of a commitment scheme and provide a construction based on any one-way permutation.

1. Commitment Scheme

A commitment scheme is a two-phase protocol between a Sender and a Receiver. The Sender holds a message and, in the first phase, it picks a random key and then “encodes” the message using the key and sends the encoding (a commitment to ) to the Receiver. In the second phase, the Sender sends the key to the Receiver can open the commitment and find out the content of the message .

A commitment scheme should satisfy two security properties:

• Hiding. Receiving a commitment to a message should give no information to the Receiver about ;
• Binding. The Sender cannot “cheat” in the second phase and send a different key that causes the commitment to open to a different message .

It is impossible to satisfy both properties against computationally unbounded adversaries. It is possible, however, to have schemes in which the Hiding property holds against computationally unbounded Receivers and the Binding property holds (under appropriate assumptions on the primitive used in the construction) for bounded-complexity Senders; and it is possible to have schemes in which the Hiding property holds (under assumptions) for bounded-complexity Receivers while the Binding property holds against any Sender. We shall describe a protocol of the second type, based on one-way permutations. The following definition applies to one-round implementations of each phase, although a more general definition could be given in which each phase is allowed to involve multiple interactions.

Definition 1 (Computationally Hiding, Perfectly Binding, Commitment Scheme) A Perfectly Binding and -Hiding Commitment Scheme for messages of length is a pair of algorithms such that

• Correctness. For every message and key ,

  

• -Hiding. For every two messages , the distributions and are -indistinguishable, where is a random key, that is, for every algorithm of complexity ,

  

• Perfectly Binding. For every message and every two keys ,

  

In the following we shall refer to such a scheme as simply a -secure commitment scheme.

Given a one-way permutation and a hard-core predicate , we consider the following construction of a one-bit commitment scheme:

• 
• equals if , and otherwise.

Theorem 2 If is a -secure hard core predicate for , then the above construction is a -secure commitment scheme.

Proof: The binding property of the commitment scheme is easy to argue as the commitment is a permutation of the key and the message. In particular, given , we can find the unique and that generate it as

To prove the hiding property in the contrapositive, we want to take an algorithm which distinguishes the commitments of two messages and convert it to an algorithm which computes the predicate with probability better than . Let be such an algorithm which distinguishes two different messages (one of which must be 0 and the other must be 1). Then, we have that for

Assume without loss of generality that the quantity in the absolute value is positive i.e.

Hence, outputs 1 significantly more often when given the correct value of . As seen in previous lectures, we can convert this into an algorithm that predicts the value of . Algorithm takes as input and generates a random bit as a guess for . It then runs . Since is correct more often on the correct value of , outputs if and outputs otherwise. We can analyze its success probability as below

Thus, predicts with probability and has complexity only more than (for generating the random bit) which contradicts the fact that is -secure.

There is a generic way to turn a one-bit commitment scheme into a commitment scheme for messages of length (just concatenate the commitments of each bit of the message, using independent keys).

Theorem 3 Let be a -secure commitment scheme for messages of length such that is computable in time . Then the following scheme is a -secure commitment scheme for message of length :

• 
• equals if at least one of outputs ; otherwise it equals .

Proof: The commitment to is easily seen to be binding since the commitments to each bit of are binding. The soundness can be proven by a hybrid argument.

Suppose there is an algorithm distinguishing and with probability more than . We then consider “hybrid messages” , where . By a hybrid argument, there is some such that

But since and differ in only one bit, we can get an algorithm that breaks the hiding property of the one bit commitment scheme . , given a commitment , outputs

Hence, has complexity at most and distinguishes from .

There is also a construction based on one-way permutations that is better in terms of key length.

2. A Protocol for 3-Coloring

We assume we have a -secure commitment scheme for messages in the set .

The prover takes in input a 3-coloring graph (we assume that the set of vertices is the set and use the notation ) and a proper 3-coloring of (that is, is such that for every edge we have ). The verifier takes in input . The protocol, in which the prover attempts to convince the verifier that the graph is 3-colorable, proceeds as follows:

• The prover picks a random permutation of the set of colors, and defines the 3-coloring . The prover picks keys for , constructs the commitments and sends to the verifier;
• The verifier picks an edge uniformly at random, and sends to the prover;
• The prover sends back the keys ;
• If and are the same color, or if at least one of them is equal to , then the verifier rejects, otherwise it accepts

Theorem 4 The protocol is complete and it has soundness error at most .

Proof: The protocol is easily seen to be complete, since if the prover sends a valid 3-coloring, the colors on endpoints of every edge will be different.

To prove the soundness, we first note that if any commitment sent by the prover opens to an invalid color, then the protocol will fail with probability at least when querying an edge adjacent to the corresponding vertex (assuming the graph has no isolated vertices – which can be rivially removed). If all commitments open to valid colos, then the commitments define a 3-coloring of the graph. If the graph is not 3-colorable, then there must be at least one edge both of whose end points receive the same color. Then the probability of the verifier rejecting is at least the probability of choosing , which is .

Repeating the protocol times sequentially reduces the soundness error to ; after about repetitions the error is at most about .

3. Simulability

We now describe, for every verifier algorithm , a simulator of the interaction between and the prover algorithm.

The basic simulator is as follows:

Algorithm

• Input: graph
• Pick random coloring .
• Pick random keys
• Define the commitments
• Let be the 2nd-round output of given as input and as first-round message
• If , then output FAIL
• Else output

And the procedure simply repeats until it provides an output different from .

It is easy to see that the output distribution of is always different from the actual distribution of interactions between and : in the former, the first round is almost always a commitment to an invalid 3-coloring, in the latter, the first round is always a valid 3-coloring.

We shall prove, however, that the output of and the actual interaction of and have computationally indistinguishable distributions provided that the running time of is bounded and that the security of is strong enough.

For now, we prove that has efficiency comparable to provided that security of is strong enough.

Theorem 5 Suppose that is -secure and is computable in time and that is a verifier algorithm of complexity .

Then the algorithm as defined above has probability at most of outputting .

The proof of Theorem 5 relies on the following result.

Lemma 6 Fix a graph and a verifier algorithm of complexity .

Define to be the probability that asks the edge at the second round in an interaction in which the input graph is and the first round is a commitment to the coloring .

Suppose that is -secure, and is computable in time .

Then for every two colorings and every edge we have

Proof: If and differ by more than for any edge , then we can define an algorithm which distinguishes the commitments corresponding to from the commitments corresponding to . simply runs the verifier given commitments for colors and outputs 1 if the verifier selects the edge in the second round.

Then, by assumption, -distinguishes the commitments corresponding to from the commitments corresponding to in time . However, by Theorem 3, this means that is not -secure which is a contradiction.

Given the lemma, we can now easily prove the theorem.

Proof: (of Theorem 5) The probability that outputs is given by

Let denote the coloring which assigns the color 1 to every vertex. Then using Lemma 6 we bound the above as

where in the second step we used the fact that for a fraction of all the colorings and the last step used that the probability of selecting some edge given the coloring is 1.

]]> http://lucatrevisan.wordpress.com/2009/05/16/cs276-lecture-27/feed/ 0 luca http://lucatrevisan.wordpress.com/2009/05/14/the-loser-gets-pregnant-first/ http://lucatrevisan.wordpress.com/2009/05/14/the-loser-gets-pregnant-first/#comments Thu, 14 May 2009 20:48:43 +0000 luca http://lucatrevisan.wordpress.com/?p=1402 ]]>

After reading the mouseover text of today’s dinosaur comic:

I couldn’t help looking up the Pseudobiceros hancockanus flatworm, and here is a PBS video of two of them engaged in penis fencing. (direct link)

[At the end of a survey paper on additive combinatorics and computational complexity which is to appear in SIGACT News, I list three major open questions in additive combinatorics which might be amenable to a "computer science proof." They are all extremely well studied questions, by very smart people, for the past several years, so they are all very long shots. I don't recommend anybody to start working on them, but I think it is good that as many people as possible know about these questions, because when the right technique comes along its applicability can be more quickly realized.]

The first question is to improve the Triangle Removal Lemma. I have talked here about what the triangle removal lemma is, how one can prove it from the Szemerédi Regularity Lemma, and how it implies the length-3 case of Szemerédi’s Theorem.

As a short recap, the Triangle Removal Lemma states that if is an -vertex graph with triangles, then there is a set of edges such that the removal of those edges eliminates all the triangles. Equivalently, it says that if a graph has triangles which are all pair-wise edge-disjoint, then there must be triangles overall.

The connection with Szemerédi’s Theorem is that if is an abelian group with elements, and is a subset of with no length-3 arithmetic progressions (i.e., is such that there are no three distinct elements in such that ), then we can construct a graph that has vertices, pair-wise edge-disjoint triangles, and no other triangles. This contradicts the triangle removal lemma if , and so we must have .

This is great, until we start looking at the relationships between the constants hidden by the notation. Quantitatively, the Triangle Removal Lemma states that for every there is a such that if a graph has at least pair-wise edge-disjoint triangles, then it has at least triangles. The only known proof, however, has incredibly small: grows like a tower of exponentials of height polynomial in . The proof uses the Szemerédi Regularity Lemma, and the Regularity Lemma is known to require such very bad dependencies.

63 years ago, Behrend showed that , prime, has a subset that contains no length-3 arithmetic progression and whose size is . (Last year, Elkin gave the first improvement in 62 years to Behrend’s bound, but the improvement is only a multiplicative polylog factor.) Combined with the graph construction mentioned above, this gives a graph with vertices, edge-disjoint triangles, and no other triangle. Thus, the graph has triangles where , but one needs to remove edges to make it triangle-free, where . This shows that, in the Triangle Removal Lemma, must grow super-polynomially in , and be at least .

The question is to shorten the gap between the tower-of-exponential relationship between and coming from the proof via the Szemerédi Regularity Lemma and the mildly super-polynomial lower bound coming from the above argument.

Gowers has constructed graphs showing that the tower-of-exponentials bounds in the Szemerédi Regularity are necessary. One idea on improving the lower bound could be to look at Gowers’s examples and show that with similar techniques one can construct stronger lower bound examples for the Triangle Removal Lemma. Gowers, however, has given a lot of thought to the Triangle Removal Lemma, and it is safe to assume that he knows his own construction well, so I think that this direction is completely hopeless.

In terms of improving the upper bound, one could first consider a direct proof of the Triangle Removal Lemma via iterative partitioning, instead of proving the Regularity Lemma from iterative partitioning and proving the Triangle Removal Lemma by reduction. When one considers the direct proof (which is straightforward), one sees that at every step there are many choices of sets to use to refine the partition. One may hope that, among those choices, one could find one that makes the partition grow polynomially or sub-exponentially instead of exponentially. For example, if one could show that the energy can be increased while only increasing the number of atoms in the partition by a polynomial, in the end we would get a double-exponential relationship between and , which would be quite amazing. (It would recover the bounds of Roth’s original proof for arithmetic progressions of length 3.) Again, people with a lot of experience on iterative partitioning methods have thought about this problem, so this approach is also likely to be hopeless.

So maybe one needs to think of something completely different, and put the problem in a context in which fresh techniques can be applied. Here are some observations I made about two years ago. Unfortunately, they circle back to problems that people have thought about for 40+ years. An equivalent way of stating the Triangle Removal Lemma is to say that there is a function which tends to infinity when tends to zero such that if a graph has triangles then they can all be removed by removing edges. This means, in particular, that if the graph contains exactly triangles, then there is an edge that belongs to at least triangles.

Theorem 1 There is a function such that and such that in any -vertex graph with exactly triangles there is an edge that belongs to at least triangles.

Can we find a different proof of this fact?

Note that Theorem 1 is enough to establish Szemerédi’s Theorem for progressions of length 3: take a graph with edge-disjoing triangles and no other triangle; we need to reach a contradiction if is large enough compared with . Applying Theorem 1, we find that there is an edge that belongs to at least triangles, and this is more than if is large enough, contradicting the assumption that all the triangles in the graph are edge-disjoint.

Now, label each edge (indeed, every pair of vertices) in a graph by the number of triangles it belongs to, and ignore multiplicative constant factors (so we don’t need to worry whether we are counting triangles as ordered 3-tuples or unordered ones and so on). To prove Theorem 1 we need to argue that the labels are “irregularly distributed,” so it is natural to look at their variance. Consider then the average, for a random “edge” (or, rather, for a random pair of vertices, which may or may not be an edge), of the square of the number of triangles it belongs to.

If the graph has exactly triangles, then by Cauchy-Schwarz it is easy to see that the above quantity is at least . If all triangles can be removed by removing edges, then a more careful Cauchy-Schwarz argument shows that the average square label is at least . If one can show that this average square is at least times a term that goes to infinity, then in particular some label must be at least times a term that goes to infinity, which proves Theorem 1. The following statement, then, is “intermediate” between the full Triangle Removal Lemma and Theorem 1, and it might be the right question to think about:

Theorem 2 There is a function such that and such that in any -vertex graph with exactly triangles, if we label each vertex pair by the number of triangles involving and , then

Terry Tao observed that, up to normalization, the average of counts the number of diamonds of the graph, that is, the number of patterns made of four vertices, and looking like two triangles with an edge in common. So Theorem 2 can be stated equivalently as

Theorem 3 There is a function such that and such that any -vertex graph with exactly triangles has at least diamonds.

Terry wrote a fascinating post putting this question in the broad context of extremal questions about “local patterns” in graphs. In the comments to that post, Vlado Nikiforov points out the notion of “book with pages” (a pattern consisting of triangles sharing a common edge — a diamond is a “book with 2 pages”) about which Erdös and others considered many questions since the 1960s. (Although I am not sure whether a statement exactly equivalent to Theorem 3 has been formulated before, related conjectures have been around for more than 40 years. Note that Theorem 3 is true; the question is how good a function we can get, and whether we can find a proof that does not go through the Szemerédi Regularity Lemma.)

]]> http://lucatrevisan.wordpress.com/2009/05/13/the-triangle-removal-lemma/feed/ 4 luca http://lucatrevisan.wordpress.com/2009/05/11/cs276-lecture-24/ http://lucatrevisan.wordpress.com/2009/05/11/cs276-lecture-24/#comments Tue, 12 May 2009 02:49:54 +0000 luca http://lucatrevisan.wordpress.com/?p=1389 ]]>

Scribed by Milosh Drezgich

Summary

Today we introduce the notion of zero knowledge proof and design a zero knowledge protocol for the graph isomorphism problem.

1. Intuition

A zero knowledge proof is an interactive protocol between two parties, a prover and a verifier. Both parties have in input a statement that may or may not be true, for example, the description of a graph and the statement that is 3-colorable, or integers and the statement that there is an integer such that . The goal of the prover is to convince the verifier that the statement is true, and, at the same time, make sure that no information other than the truth of the statement is leaked through the protocol.

A related concept, from the computational viewpoint, is that of a zero knowledge proof of knowledge, in which the two parties share an input to an -type problem, and the prover wants to convince the verifier that he, the prover, knows a valid solution for the problem on that input, while again making sure that no information leaks. For example, the common input may be a graph , and the prover may want to prove that he knows a valid -coloring of , or the common input may be and the prover may want to prove that he knows an such that .

If a prover “proves knowledge” of a 3-coloring of a graph , then he also proves the statement that is 3-coloring; in general, a proof of knowledge is also a proof of the statement that the given instance admits a witness. In some cases, however, proving that an NP statement is true, and hence proving existence of a witness, does not imply a proof of knowledge of the witness. Consider, for example, the case in which common input is an integer , and the prover wants to prove that he knows a non-trivial factor . (Here the corresponding \textquotedblleft statement\textquotedblright would be that is composite, but this can easily be checked by the verifier offline, without the need for an interaction.)

Identification schemes are a natural application of zero knowledge. Suppose that a user wants to log in into a server. In a typical Unix setup, the user has a password , and the server keeps a hash of the user’s password. In order to log in, the user sends the password to the server, which is insecure because an eavesdropper can learn and later impersonate the user.

In a secure identification scheme, instead, the user generates a public-key/ secret key pair , the server knows only the public key , and the user “convinces” the server of his identity without revealing the secret key. (In SSH, for example, are the public key/ secret key pair of a signature scheme, and the user signs a message containing a random session identifier in order to “convince” the server.)

If is a one-way function, then a secure identification scheme could work as follows: the user picks a random secret key and lets its public key be . To prove its identity, the user engages in a zero knowledge proof of knowledge with the server, in which the user plays the prover, the server plays the verifier, and the protocol establishes that the user knows an inverse of . Hence, the server would be convinced that only the actual person would be able to log in, and moreover from the point of view of the user he/she will not be giving away any information the server might maliciously utilize after the authentication.

This example is important to keep in mind as every feature in the definition of the protocol has something desirable in the protocol of this model.

The main application of zero knowledge proofs is in the theory of multi party protocols in which multiple parties want to compute a function that satisfies certain security and privacy property. One such example would be a protocol that allow several players to play online poker with no trusted server. By such a protocol, players exchange messages to get the local view of the game and also at the end of the game to be able to know what is the final view of the game. We would like that this protocol stays secure even in the presence of malicious players. One approach to construct such a secure protocol is to first come up with a protocol that is secure against “honest but curious” players. According to this relaxed notion of security, nobody gains extra information provided that everybody follows the protocol. Then one provides a generic transformation from security against “honest but curious” to security against malicious user. This is achieved by each user providing a at each round that in the previous round he/she followed the protocol. This would on one side convince the other players that no one is cheating and on the other side the player presenting the protocol would provide no information about his own cards. This forces apparent malicious players to act honestly, as only they can do is to analyze their own data. At at the same time this is also not a problem for the honest players.

2. The Graph Non-Isomorphism Protocol

We say that two graphs and are isomorphic if there is a bijective relabeling of the vertices such that the relabeling of is the same graph as , that is, if

We call the graph that as an edge for every edge of .

The graph isomorphism problem is, given two graphs, to check if they are isomorphic.

It is believed that this problem is not -complete however algorithm that would run faster than is not known.

Here we describe an interactive protocol in which a prover can \textquotedblleft convince\textquotedblright a verifier that two given graphs are not isomorphic, and in which the verifier only makes questions for which he already knows an answer, so that, intuitively, he gains no new knowledge from the interaction. (We will give a precise definition later, but we will not prove anything formal about this protocol, which is presented only for intuition.) For the prover, unfortunately, we only know how to provide an exponential time implementation. However the verifier algorithm, is very efficient.

• Common input: two graphs , ; the prover wants to convince the verifier that they are not isomorphic

• The verifier picks a random and a permutation and sends to the prover
• The prover finds the bit such that and are isomorphic sends to the verifier

• The verifier checks that , and, if so, accepts

Theorem 1 Let be the prover algorithm and be the verifier algorithm in the above protocol. Then

1. If are not isomorphic, then the interaction ends with the verifier accepting with probability 1

2. If are isomorphic, then for every alternative prover strategy , of arbitrary complexity, the interaction ends with the verifier accepting with probability

The first part of the theorem is true as for every permutation is not isomorphic to and similarly for every permutation is not isomorphic to , therefore if and are not isomorphic no relabeling of can make it isomorphic to Since the prover runs in exponential time he can always find out which graph the verifier has started from and therefore the prover always gives the right answer.

The second part of the theorem is true as there exist permutation such that Then if verifier picks a random permutation then the distribution we obtain by and the distribution are exactly the same as both are just random relabelling of, say, This fact is analogous to the fact that if we add a random element from the group to some other group element we get again the random element of the group. Therefore here the answer of the prover is independent on and the prover succeeds with probability half. This probability of can be reduced to by repeating the protocol times. It is important to notice that this protocol is since the verifier already knows the answer so he learns nothing at the end of interaction. The reason why the verifier is convinced is because the prover would need to do something that is information theoretically impossible if the graphs are isomorphic. Therefore, it is not the answers themselves that convince the prover but the fact that prover can give those answers without knowing the isomorphism.

3. The Graph Isomorphism Protocol

Suppose now that the prover wants to prove that two given graphs are isomorphic, and that he, in fact, knows an isomorphism. We shall present a protocol for this problem in which both the prover and the verifier are efficient.

• Verifier’s input: two graphs , ;

• Prover’s input: and permutation such that ; the prover wants to convince the verifier that the graphs are isomorphic
• The prover picks a random permutation and sends the graph
• The verifier picks at random and sends to the prover
• The prover sends back if , and otherwise

• The verifier checks that the permutation received at the previous round is such that , and accepts if so

Theorem 2 Let be the prover algorithm and be the verifier algorithm in the above protocol. Then

1. If are isomorphic, then the interaction ends with the verifier accepting with probability 1

2. If are not isomorphic, then for every alternative prover strategy , of arbitrary complexity, the interaction ends with the verifier accepting with probability

The first part is clear from the construction.

What happens if and are not isomorphic and the prover is not following the protocol and is trying to cheat a verifier? Since in the first round the prover sends a graph , and and are not isomorphic, then can not be isomorphic to both and . So in second round with probability at least half the verifier is going to pick that is not isomorphic to . When this happens there is nothing that the prover can send in the third round to make the verifier accept, since the verifier accepts only if what prover sends in the third round is the isomorphism between and . Hence the prover will fail with probability a half at each round and if we do the same protocol for several rounds the prover will be able to cheat only with exponentially small probability.

Definition 3 A protocol defined by two algorithms and is an interactive proof with efficient prover, for a decision problem if:

• (Completeness) for every input for which the correct answer is YES, there is a witness such that interaction ends with accepting with probability one.

• (Soundness) for every input for which answer is NO, for algorithm of arbitrary complexity interaction ends with rejecting with probability at least half (or at least if protocol repeated times)

So the graph isomorphism protocol described above is an interactive proof with efficient prover for the graph isomorphism protocol.

We now formalize what we mean by the verifier gaining zero knowledge by participating in the protocol. The interaction is ZK if the verifier could simulate the whole interaction by himself without talking to the prover.

Definition 4 (Honest Verifier Perfect Zero Knowledge) A protocol is Honest Verifier Perfect Zero Knowledge with simulation complexity for a decision problem if there is an algorithm that has complexity at most , such that for which the answer is YES, samples the distribution of interactions for every valid .

Therefore the simulator does not know the witness but it is able to replicate the interaction between the prover and the verifier. One consequence of this is, the protocol is able to simulate all possible interactions regardless of what particular witness the prover is using. Hence the protocol does the same regardless of witness. This witness indistinguishability property is useful on its own.

Now consider an application in which the user is the prover and the server is the verifier. For this application of it is not sufficient that honest does not learn anything following the protocol but also that if the verifier is not honest and does not follow the protocol he will still not be able learn anything from the prover.

Therefore the full definition of zero knowledge is the following.

Definition 5 (Perfect Zero Knowledge) A prover algorithm is (general) Perfect Zero Knowledge with simulation overhead for a decision problem if

• for every algorithm of complexity at most there is a simulator algorithm of complexity at most

• such that for every for which the answer is YES, and every valid witness , samples .

(In an asymptotic setting, we would want to be polynomial in . Typically, we have .)

So from the prover’s viewpoint the protocol is always safe, since even if the verifier does not follow the protocol he would be able to gain only the information that he (the verifier) would gain otherwise anyway, by running the simulator himself.

The zero knowledge property is purely the property of the prover algorithm since it is quantified of over all witnesses, all inputs, and all verifier algorithms. Symmetrically the soundness property was the property of the verifier algorithm since the verifier would get convinced with high probability only if the property is really true, regardless whether the prover is malicious or not.

In the next class we will establish the fact that the prover algorithm in the graph isomorphism protocol described above is (general) perfect zero knowledge.

]]> http://lucatrevisan.wordpress.com/2009/05/11/cs276-lecture-24/feed/ 0 luca http://lucatrevisan.wordpress.com/2009/05/06/cs276-lecture-28/ http://lucatrevisan.wordpress.com/2009/05/06/cs276-lecture-28/#comments Thu, 07 May 2009 00:54:44 +0000 luca http://lucatrevisan.wordpress.com/?p=1380 ]]>

Summary

Today we define the notion of computational zero knowledge and show that the simulator we described in the last lecture establishes the computational zero knowledge property of the 3-coloring protocol.

1. The Protocol and the Simulator

Recall that we use a commitment scheme for messages in , and that the common input to the prover and the verifier is a graph , where . The prover, in addition, is given a valid 3-coloring of .

The protocol is defined as follows:

• The prover picks a random permutation of the set of colors, and defines the 3-coloring . The prover picks keys for , constructs the commitments and sends to the verifier;
• The verifier picks an edge uniformly at random, and sends to the prover;
• The prover sends back the keys ;
• If and are the same color, or if at least one of them is equal to , then the verifier rejects, otherwise it accepts

For every verifier algorithm , we defined a simulator algorithm which repeats the following procedure until the output is different from :

Algorithm

• Input: graph
• Pick random coloring .
• Pick random keys
• Define the commitments
• Let be the 2nd-round output of given as input and as first-round message
• If , then output FAIL
• Else output

We want to show that this simulator construction establishes the computational zero knowledge property of the protocol, assuming that is secure. We give the definition of computational zero knowledge below.

Definition 1 (Computational Zero Knowledge) We say that a protocol for 3-coloring is computational zero knowledge with simulator overhead if for every verifier algorithm of complexity there is a simulator of complexity on average such that for every algorithm of complexity , every graph and every valid 3-coloring we have

Theorem 2 Suppose that is -secure and that is computable in time .

Then the protocol defined above is computational zero knowledge with simulator overhead at most .

2. Proving that the Simulation is Indistinguishable

In this section we prove Theorem 2.

Suppose that the Theorem is false. Then there is a graph , a 3-coloring , a verifier algorithm of complexity , and a distinguishing algorithm also of complexity such that

Let be the event that the edge is selected in the second round; then

So there must exist an edge such that

(We have omitted references to , which are fixed for the rest of this section.)

Now we show that there is an algorithm of complexity that is able to distinguish between the following two distributions over commitments to colors:

• Distribution (1) commitments to the colors ;
• Distribution (2) commitments to random colors

Algorithm :

• Input: 3n commitments where and ;
• Pick a random permutation
• Pick random keys ,
• Construct the sequence of commitments by setting:
  • 
  • 
  • for every ,
• If the 2nd round output of given and is different from output 0
• Else output

First, we claim that

This follows by observing that on input Distribution (1) behaves exactly like the prover given the coloring , and that accepts if and only if the event happens and accepts the resulting transcript.

Next, we claim that

To prove this second claim, we introduce, for a coloring , the quantity , defined as the probability that the following probabilistic process outputs 1:

• Pick random keys
• Define commitments
• Let be the 2nd round output of given the input graph and first round message
• Output 1 iff , , and

  

Then we have

Because , on input Distribution 2, first prepares commitments to a coloring chosen uniformly at random among all colorings such that and then outputs 1 if and only if, given such commitments as first message, replies with and the resulting transcript is accepted by .

We also have

To see why Equation (5) is true, consider that the probability that outputs a particular transcript is exactly times the probability that outputs that transcript. Also, the probability that outputs a transcript which involves at the second round and which is accepted by conditioned on being the coloring selected at the beginning is if is a coloring such that , and it is zero otherwise. Finally, selects the initial coloring uniformly at random among all possible coloring.

From our security assumption on and from Lemma 6 in Lecture 27 we have

and so the claim we made in Equation (3) follows from Equation (4), Equation (5), Equation (6) and the fact that if are quantities such that , , and (so that ), then

(We use the above inequality with , , and .)

Having proved that Equation (3) holds, we get

where is an algorithm of complexity at most . Now by a proof similar to that of Theorem 3 in Lecture 27, we have that is not secure.

]]> http://lucatrevisan.wordpress.com/2009/05/06/cs276-lecture-28/feed/ 0 luca http://lucatrevisan.wordpress.com/2009/05/06/cs276-lecture-22/ http://lucatrevisan.wordpress.com/2009/05/06/cs276-lecture-22/#comments Thu, 07 May 2009 00:03:10 +0000 luca http://lucatrevisan.wordpress.com/?p=1374 ]]>

Summary

In the last lecture we described a very complex signature scheme based on one-time signatures and pseudorandom functions. Unfortunately there is no known simple and efficient signature scheme which is existentially unforgeable under a chosen message attack under general assumptions.

Today we shall see a very simple scheme based on RSA which is secure in the random oracle model. In this model, all parties have oracle access to a random function . In implementations, this random function is replaced by a cryptographic hash function. Unfortunately, the proof of security we shall see today breaks down when the random oracle is replaced by hash function, but at least the security in the random oracle model gives some heuristic confidence in the design soundness of the construction.

1. The Hash-and-Sign Scheme

Our starting point is the “textbook RSA” signature scheme, in which a message is signed as and an alleged signature for a message is verified by checking that .

We discussed various ways in which this scheme is insecure, including the fact that

1. It is easy to generate random message/ signature pairs by first picking a random and then setting ;
2. If is the signature of message and is the signature of , then is the signature of .

Suppose now that all parties have access to a good cryptographic hash function, which we will model as a completely random function , mapping every possible message to an random integer , and define a signature scheme as follows:

• Key generation: as in RSA
• Signature: the signature of a message with secret key is
• Verification: given an alleged signature , a message , and a public key , check that .

That is, we use the textbook RSA method to sign .

Now it is not clear any more how to employ the previously mentioned attacks. If we first select a random , for example, then to find a message of which is a signature we need to compute and then find a message such that . This, however, requires exponential time if is a random functions. Similarly, if we have two messages and know their signatures , the number is a signature for any document such that . Finding such an is, however, again very hard.

2. Analysis

We provide a formal analysis of the signature scheme defined in the previous section, in the random oracle model.

Theorem 1 Suppose that , as defined in the previous section, is not existentially unforgeable under a chosen message attack in the random oracle model.

Then RSA, with the key size used in the construction, is not a -secure family of trapdoor permutations, where is the time taken by RSA computation with the selected key size.

Proof: We will prove that, if is an algorithm of complexity at most that breaks existential unforgeability under chosen message attack with probability , then there is an algorithm that breaks RSA (finds given mod ) with probability and complexity .

Without the loss of generality we assume that:

• never makes the same random oracle query twice.
• queries before it requests a signature on a message .
• If outputs then it had previously queried

We construct an algorithm which on input where mod , finds .

Algorithm is defined as:

• Pick randomly.
• Initialise datastructure that stores triples, initially empty.
• Simulate :
  • When makes its th random oracle query
    • If , answer the oracle query with .
    • Otherwise, randomly pick , compute mod , store mod in the datastructure and answer the oracle query with mod
  • When requests
    • If abort.
    • If look for mod in the datastructure and answer the oracle query with .

      (Note that we had made the assumption that queries before it requests a signature on a message .)

• After finishes, it outputs . If and mod , then output as the required output .

For each random oracle query, we are doing a RSA exponentiation operation of complexity . So the complexity of would be at most complexity of multiplied by i.e. .

The index chosen by in the first step represents a guess as to which oracle query of will correspond to the eventual forgery output by . When the guess is correct, view of as part of is distributed identically to the view of alone. When guesses correctly and outputs a forgery, then solves the given instance of RSA problem (because mod and thus is of ). Since guesses correctly with probability and outputs a forgery with probability . So, Probability with which breaks RSA , which is what we intended to prove.