1

Take for example "Hamiltonian cycle for a large graph". The proof works by starting with a graph G that contains a hamiltonian cycle, then constructing an isomorphic graph H, and then either showing the mapping between the graphs G and H or releaving the cycle in H.

It is said that we prove that that we know a hamiltonian cycle in G without revealing it.

But this assumes the verifier does not have unlimited computational power. If he had it, he could ask to reveal the cycle in H, and use his unlimited computational power to work out the isomorphism. I understand that if the verifier had unlimited power, he could find the cycle in G directly. But that's not my point. What I find strange is that we are relying on "hard problems" in the proof itself.

Are there ZKP protocols that do not rely on hard problems? Hard problems are only hard according to the state of the art. It is not proven that NP is not P, therefore, in my mind, this sounds like security through obscurity in some sense.

TNB
  • 11
  • 1

2 Answers2

1

One of the most basic assumptions in cryptography is the existence of hard problems, even on a very conceptual level. For example, to establish a secure communication channel, you want your cipher to impose problems on eavesdroppers which they cannot solve.

The problem is that the existence of hard problems generally has (severe) impact to questions in complexity theory. The most attractive problems for cryptography are those in $\mathsf{NP}$, in particular because, assuming $\mathsf{NP}$ has intractable problems, these have nice asymmetrical properties: Although you can verify a solution efficiently, it is infeasible to find one. However, establishing intractable problems in $\mathsf{NP}$ necessarily entails proving $\mathsf{P} \neq \mathsf{NP}$.

Furthermore, some cryptographic primitives imply the existence of hard problems even without basing on the hardness of a particular problem. For example, the existence of one-way functions, which are essentially the most basic cryptographic primitive, implies $\mathsf{P} \neq \mathsf{NP}$. We also know one-way functions exist if and only if PRNGs exist, so it is clear one-way functions are not an isolated case (whose existence is hard to establish). Also, asymmetric cryptography implies the existence of either of these primitives. (Read more on Impagliazzo's five worlds if you are interested in these issues.)

Modern cryptography is highly dependent on complexity theory for its assumptions. Since that is the case anyway, it only seems natural to embrace the conjectures of complexity theory too.

dkaeae
  • 4,997
  • 1
  • 15
  • 31
0

The zero-knowledge protocol you describe in your computation is an example of computational zero-knowledge. A more stringent requirement is statistical zero-knowledge, and the corresponding class of languages is $\mathsf{SZK}$. The classical example is graph non-isomorphism, see for example slides of Eli Biham. In fact, this protocol is perfect zero-knowledge ($\mathsf{PZK}$).

For more on statistical zero-knowledge, see for example Sahai and Vadhan, A complete problem for statistical zero knowledge.

Yuval Filmus
  • 276,994
  • 27
  • 311
  • 503