This is a purely hypothetical example but is provable ignorance useful in cryptography?
For example, let's say I have a trapdoor collision resistant function. I know the trapdoor and therefore some $x_0 \neq x_1$ such that $f(x_0) = f(x_1)$. This is however, hard to find. If someone proves they know $x_0$, I can conclude that they do not know $x_1$.
Is there any context where more complicated versions of such problems is useful?
In general, you cannot prove lack of knowledge, because even if you did know something you shouldn't, you can always pretend that you don't know it and carry out the proof as if you didn't know it.
For your specific example, consider how the prover would know $x_0$. Did you tell them what it is? If so, that proves nothing, since they would then know $x_0$ even if they had also learned $x_1$ from somewhere else.
Conversely, if your function $f$ is collision resistant without the trapdoor, but is not injective (i.e. potential collisions do exist), then it must also be preimage resistant. Thus, finding $x_0$ from $y = f(x_0)$ is (at least) as hard as finding $x_1$. Thus, paradoxically, the prover exhibiting $x_0$ would in fact be evidence that they can find preimages for $f$, and thus can probably find $x_1$ as well.
You can't prove unconditional lack of knowledge, but you can create proven, shared lack of knowledge of a number by all parties that contribute.
Suppose there are two parties. They each generate a 256-bit random number (call them $r_1$ and $r_2$), and publish and sign $H(r_1)$ and $H(r_2)$ as their choices. Both parties then sign $H(r_1)||H(r_2)$ as an agreement that they both agree to $H(r_1||r_2)$ as "the number" that they both do not know.
Now a number exists that two parties have agreed on that they both have no knowledge on (to a 256-bit security level), yet if the parties decide to reveal the number (by revealing $r_1, r_2$) it can be confirmed that this was indeed the number they agreed upon.
The above scheme can be used for example for trustless (in the sense that the random number truly was random) gambling.
|| to mean...? I would think XOR would do it, but that's not the symbol for it. Also it's notable that neither of the inputs has to be random, or rather, neither party can prevent the other from ensuring the outcome is truly random.
– Wildcard
Nov 30 '18 at 21:00
|| is concatenation. And yes, I'm stating random but that's for that party's own good, as long as one party uses random data the result is random. XOR would do as well.
– orlp
Nov 30 '18 at 21:22
If you want to be sure that no one knows X, then one thing you can do is incentivize people to reveal the fact that they know X. You could offer a monetary bounty to anyone who can demonstrate that they know X. If no one takes the bounty, then you know that either no one knows X, they value the secrecy of that knowledge at higher than your bounty, they just don't yet know about your bounty, they don't trust you to pay up, or they value their privacy more than the bounty and don't believe they can claim the bounty anonymously.
Cryptocurrency systems provide a few ways for people to offer bounties in a way that solves the trust and anonymity issues, and can even allow third parties to contribute directly to the bounty too without them needing to trust the bounty-offerer.
In 2013, Peter Todd created several bitcoin addresses that were configured to automatically allow anyone to withdraw the stored bitcoin if they publicly demonstrated a hash collision in one of several algorithms. Many people pitched in and contributed bitcoin into the bounty wallets. No one, including Peter Todd, could withdraw the money back from the wallet unless they demonstrated a hash collision. The bounty for a SHA-1 collision (worth about $3000 at the time) was claimed in 2017 using the SHA-1 collision published by Google. The other bounties (for SHA-256 and RIPEMD160) are still unclaimed, implying that no one yet knows of any collisions for them.
One strategy to detect intrusion into a computer system is to place an unencrypted cryptocurrency wallet file containing a valuable amount of cryptocurrency on the computer, and then watch the addresses controlled by the wallet to see if the cryptocurrency is ever taken. If a virus or attacker ever hacks into the computer, then they may find the wallet file and steal the cryptocurrency from it. An attacker may realize that taking the cryptocurrency will expose the fact that the system has been hacked, but if the cryptocurrency is worth more than the system is worth to the attacker, then they have little reason to not take it. (This article about the now-defunct service Bitcoin Vigil explains the strategy a bit more.)
If you computed x0 and x1 yourself out of nothing, and never leaked any information anyone could use to derive x1, then it would be true that nobody but you who knows x0 would also know x1, but it would be equally true that nobody who doesn't know x0 would also know x1. Both statements would be true because you're the only person in the universe who knows x1. Further, if information about x1 did leak out in ways you don't know about, the fact that somebody acquires x0 would almost never imply anything about their knowledge of x1.
There is one possible situation where proof of knowledge might prove ignorance of something else: in cases where it is externally possible to prove that someone has only had the opportunity to receive a certain amount of information since a piece of information was created (e.g. an amount significantly less than the combined size of x0 and x1), demonstrated possession of a sufficient quantity of information that didn't prior that time window (e.g. x0) could prove that the communications channel wasn't used to convey certain other information (e.g. x1). Such a proof would not require any relationship between x0 and x1, however. If x0 and x1 had been entirely separate and unrelated random bit strings the same situation would apply.
non-hearsay, eye-witness testimony of the side of a coin after a coin flip. Conversation between interviewer I and witness W, where the only "knowledge" that can permissibly enter the court record is direct eyewitness testimony:
I: did you witness the coin toss?
W: Yes.
I: Did you view the coin once it had landed?
W: Yes.
I: Can you describe the picture on the coin?
W: It was a a picture of an eagle?
I: What was depicted on the obverse side of the coin?
OBJECTION, the answer would be speculation. The witness has already dis-qualified his ability answer.
