1

I just encountered the term "zero-knowledge" and wanted to know more about it.

I understood that there is a zero knowledge protocol between two parties to determine whether $x$ is greater than, equal to, or smaller than $y$, given that one side knows $x$ and the other knows $y$, but I couldn't find anything about it.

I searched in google, but couldn't find an answer (maybe I'm just bad at searching).

Hopefully you guys can give me a simple answer.

SEJPM
  • 45,967
  • 7
  • 99
  • 205
Naftali Waxman
  • 43
  • 4

1 Answers1

2

If you just encountered the term, I would suggest that you get used first to the intuition of how it can be achieved. ZK using graph isomorphism is great as an introductory example (although impractical for more cases).

That said, what you are looking for is known as [Yao's] Millionaire's Problem. The description of the problem talks about two millionaires who want to find out who is the richest of them without disclosing their actual wealth.

I believe that, for your problem, it is not zero knowledge what you're looking for. Look instead for multiparty computation, but beware: this is a huge research area. In MPC, you want multiple entities to interact, but you know that some of them can cheat in very different ways. The literature is strongly associated with e-voting. You will meet there with Zero Knowledge, but also with homomorphic encryption, commitments and other concepts. You'll be specially interested in oblivious transfer: Bob knows a function $F$. You, Alice, want to get the value of $F(n)$ without telling Bob the value of $n$.

There are different ways to approach the problem, each with a set of trade-offs. You can start at the Wikipedia page about the problem and come back later if (when) you have more questions. It all depends on the capabilities of your adversary. After all, you could just ask the two millionaire's independently in separate rooms and tell them who is the richest without disclosing their values, without using any crypto!

Sergio A. Figueroa
  • 1,798
  • 12
  • 19
  • I actually was in a lecture in university about it (the course called 'safe calculation') and my professor mentioned that problem as motivation (I didn't remember the name)

    I will look it up in wikipedia, but I will also like to know if there is a simple solution taking into account that both sides are honest, without a third party factor.

     – Naftali Waxman Mar 13 '16 at 15:49
  • Can't Edit (5 mins) - not sure if 'safe calculation' is the right translate to english, and also forgot to say Thank You :) – Naftali Waxman Mar 13 '16 at 15:56
  • 2
    Note: ZKPs are a special subclass of MPC. – SEJPM Mar 13 '16 at 16:00
  • In order to keep the answers generic and useful for other people, usually in StackExchange it is advised to thank in the form of upvotes than explicitely. About your question, I'd say that in the "honest-but-curious" model (i.e. the parts follow the protocol, but will be willing to get as much information as they can derive), the single concept that you can remove from the equation is, precisely, ZKPs. Look also for CPIR, in that direction. But, in general, the answer remains: there are several non trivial directions to follow with different tradeoffs. – Sergio A. Figueroa Mar 13 '16 at 16:06