1

I have seen proofs of this particular problem in a few articles/papers (which lead to a ZKP 2 nuclear warheads are similar), but I find a problem in the proof with the marbles - surely the proof doesn't work because the experiment cannot be repeated.

Proof outline:

  1. The prover claims a pair of cups each contain $n$ marbles and for some $N$, $1 \leq n \leq N$.
  2. The prover prepares a pair of buckets and claims each contain $N-n$ marbles.
  3. The prover pours each cup of marbles into a different bucket, but the verifier chooses which cup goes into which bucket.
  4. The verifier confirms each bucket now contains $N$ marbles.
  5. This can be repeated an arbritrary number of times until the verifier is satisfied.

Is there a way this proof can be rectified? (I'm assuming the marbles aren't necessarily identical so weighing won't work)

http://cvt.engin.umich.edu/wp-content/uploads/sites/173/2014/10/Glaser-Nature-Article.pdf https://www.latimes.com/science/sciencenow/la-sci-sn-verification-nuclear-disarmament-20140625-story.html

Shuri2060
  • 111
  • 3

1 Answers1

1

Add $m - 2$ more pairs of cups. The prover claims that the first $m$ cups (including the two original ones) contain $n$ marbles, and the second $m$ cups contain $N-n$ marbles. You choose a matching between the two $m$-tuples, the prover pours the cups, and you check that they all contain $N$ marbles.

If the two original cups contained the same amount of marbles, then the prover will always win. Otherwise, suppose that the first $m$ cups contain $k$ different amounts of marbles, with $c_1,\ldots,c_k$ copies each (so $c_1 + \cdots + c_k = m$). For the prover to have any chance of winning, we need the second $m$ cups to be partitioned similarly. Out of the $m!$ many partitions that the verifier chooses, the number of ones for which the proof goes through is $c_1! \cdots c_k!$, hence the success probability is $$ \frac{c_1! \cdots c_k!}{m!}. $$ Let us now notice that if $a \geq b \geq 2$ then $$ (a+1)! (b-1)! = \frac{a+1}{b} a! b! > a! b!. $$ Therefore the quantity $c_1! \cdot c_k!$ is maximized, subject to $c_1,\ldots,c_k \geq 1$ and $c_1 + \cdots + c_k = m$, when $c_1 = m-k+1$ and $c_2 = \cdots = c_k = 1$, that is, $$ \frac{c_1! \cdots c_k!}{m!} \leq \frac{(m-k+1)!}{m!} \leq \frac{(m-1)!}{m!} = \frac{1}{m}, $$ since $k \geq 2$ (recall the prover is trying to cheat now!).

While this is less efficient than standard zero-knowledge proofs (in which the error probability decreases exponentially in the amount of work), this does show that you can get the error as small as you want.

Yuval Filmus
  • 276,994
  • 27
  • 311
  • 503