Why was the simulator/extractor specifically given the power to rewind "time" instead of a different super power?

Was it defined in the first ZKP paper that the simulator and extractor would have this power as a "standard" and then everyone went with it or was there more thought put into it when giving it this super power?

I just want to understand how someone came to the conclusions(their though process) that rewinding "time" was the power that should be given instead of something else as this super power is very useful for a lot of ZKP proofs....so at the very least I think it was NOT a arbitrary choice to have this super power.

  • 1
    $\begingroup$ This isn't an answer but a note on the nature of the super-power. Although rewinding time appears “magical” a different perspective. Provers, verifiers, extractors, and simulators are “programs”. So rewinding time is really taking a snapshot of their state in a given point and resuming execution. A process similar to context-switching. Rewinding access is then a powerful tool to argue that some things are computable, which in turn provides the desired security guarantees. $\endgroup$ Commented Feb 29 at 22:39
  • $\begingroup$ The "rewinding of time" is a thought experiment primarily so that the prover is assured they are not leaking information - see crypto.stackexchange.com/questions/101979/… $\endgroup$
    – knaccc
    Commented Mar 1 at 14:06
  • $\begingroup$ Can you discern between the real world and a simulated one? This question may evoke thoughts of the renowned Matrix movie. If so, then it is conceivable to exist within a simulated world. In this realm, the act of rewinding is akin to setting a breakpoint in a line of code. When the program reaches this breakpoint, it halts, allowing for the re-execution of said code by stepping back to the preceding line to get the value again. $\endgroup$
    – X.H. Yue
    Commented Mar 31 at 13:56

1 Answer 1


Not sure, but my educated guess is that's because interactive protocols (from which ZKPs appear if you had zero-knowledgeness to completeness and soundness properties) rely deeply on order of messages exchanged between Prover and Verifier. So the ability to exchange that order seems a "natural" way to act out of protocol rules.

But I also think that from a general/"philosophical" point of view that's not mandatory, to avoid a simulator break soundness or an extractor to break zero-knowledgeness it's enough the simulator/extractor cannot be a valid party in the protocol, so is't enough they play out of rules whichever way they want.. but again, playing with time order seems so convenient ;)

my2cents :)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.