Advances in Cryptology - CRYPTO '87

Zero-knowledge interactive proofsystems are a new technique which can be used as a cryptographic tool for designing provably secure protocols. Goldwasser, Micali, and Rackoff originally suggested this technique for controlling the knowledge released in an interactive proof of membership in a language, and for classification of languages [19]. In this approach, knowledge is defined in terms of complexity to convey knowledge if it gives a computational advantage to the receiver, theory, and a message is said for example by giving him the result of an intractable computation. The formal model of interacting machines is described in [19, 15, 171. A proof-system (for a language L) is an interactive protocol by which one user, the prover, attempts to convince another user, the verifier, that a given input x is in L. We assume that the verifier is a probabilistic machine which is limited to expected polynomial-time computation, while the prover is an unlimited probabilistic machine. (In cryptographic applications the prover has some trapdoor information, or knows the cleartext of a publicly known ciphertext) A correct proof-system must have the following properties: If XE L, the prover will convince the verifier to accept the pmf with very high probability. If XP L no prover, no matter what program it follows, is able to convince the verifier to accept the proof, except with vanishingly small probability.