Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I've just realized I find it hard to distinguish between these two terms (proof of knowledge, and zero-knowledge proof), specially where only the latter seems to be used in many cryptographic protocols.

Zero-knowledge proofs are usually defined as those methods by which the prover manages to prove to the verifier that a given statement is true, without revealing any additional information apart from the fact that the statement is true. For example, let's say I want to prove knowledge of the plaintext of some ciphertext I've generated, so that everyone can check that the plaintext is of a certain form (a value within a certain range, for instance). It seems clear to me that in this case I'd be interested in using a zero-knowledge proof, because I don't want anyone else learning what my plaintext was, or which random value I used to encrypt it (I'm assuming I used a public key encryption scheme).

On the other hand, proofs of knowledge seem to be just defined as those proofs in which the prover convinces a verifier that he/she knows something (without stating any constraint about what the verifier can or cannot learn from his interaction with the prover). From the definitions, these two terms seem to be pretty different. However, I find it hard to see in which context one would be interested in using just proofs of knowledge, instead of zero-knowledge proofs.

share|improve this question
    
Zero-knowledge proofs are usually interactive. It can be easier to use proof of knowledge in non interactive setting. –  user4982 Sep 27 '13 at 18:51
add comment

1 Answer 1

up vote 5 down vote accepted

Formally, this is all very complicated, but informally:

An interactive proof is a conversation between a prover and a verifier that ends with the verifier either accepting or rejecting.

The interactive proof can be zero knowledge, in which case a cheating verifier does not learn anything new by talking to the honest prover.

The interactive proof can be a proof of knowledge, where a cheating prover cannot convince an honest verifier to accept unless he (essentially) knows some secret.

The interactive proof can of course be both zero knowledge and a proof of knowledge.

share|improve this answer
    
Thanks for your answer, @K.G, but do you know of any example, context or situation in which proofs of knowledge are used, without being zero-knowledge proofs? Because it seems to me that whenever one wants to prove something, it's better to always do it in a zero-knowledge way. Is it right, or there are actually cases in which we might prefer proofs of knowledge and not zero-knowledge proofs? –  LRM Sep 30 '13 at 13:44
2  
There's witness-indistinguishable proofs. But you are right, usually you want some variant of zero knowledge, since if you don't care about keeping the private input secret, you can just reveal the input. Still, the notions of zero knowledge and proof of knowledge are two different notions. –  K.G. Sep 30 '13 at 13:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.