4
$\begingroup$

In ZKP, if a prover P1 possesses a secret number S and generates a proof PRF for the possession of the same with the aim to prove it to a verifier V1.

But, what prevents V1 from misusing the PRF and present itself to others as the one in possession of the secret S (misrepresenting itself as P1)? In fact, since PRF is public, anyone can misuse it. Although I heard the "soundness" keyword but since PRF is public how this activity is prevented?

On similar lines, if V1 has received such PRF from P1, why V1 should not think that P1 might have stolen or copied the PRF from somewhere else?

Please let me know what I am missing here.

$\endgroup$

1 Answer 1

5
$\begingroup$

You are not missing anything: if the proof is non-interactive, then it is transferrable, as you observed. Hence, such a proof cannot authenticate the proof sender as the owner of the secret information.

However, this does not hold anymore if the proof is interactive: the proof of knowledge of the secret depends on an interaction with the verifier, who is sending some challenges. There, simply storing the transcript of a proof interaction does not help you in successfully completing the interaction if you don't know the secret, because the challenges won't be the same with very high probability (this is a high-level intuition, but it can be made formal and proven).

If you really want non-interactivity, then depending on the scenario there can sometimes be workarounds where you use ZK proofs with a stronger "non-rerandomizability" notion (i.e., given a proof, one cannot generate a different proof of the same statement without knowing the witness) if the entity checking the proof can e.g. remember all proofs it has seen and refuse to accept a proof it has already seen once in the past. There, the honest party could still authenticate by re-generating a fresh new proof every time, but outside observers of the network could not reuse a previous authentication credential of the honest user.

$\endgroup$
4
  • 1
    $\begingroup$ Thanks. I thought every IZK can be converted to NIZK using Fiet Shamir transformation. But, in this case, even if converted, they will atleast be different in semantic. It would be great to know other differences. Can you pls point to other differences between IZK and NIZK? $\endgroup$
    – user60588
    Apr 23 at 15:26
  • $\begingroup$ Every interactive public-coin zero-knowledge can indeed be made non-interactive with Fiat-Shamir, but this is a compiler and it does not guarantee that the NIZK you get has the same properties as the original ZK proof. Here are a few other key differences: (1) if the ZK proof has statistical soundness, the NIZK still has only computational soundness; (2) if the ZK proof was only secure against honest verifier, the resulting NIZK becomes nevertheless (trivially) secure against malicious verifiers. $\endgroup$ Apr 23 at 15:45
  • $\begingroup$ For a more detailed discussion regarding the question of your comment, see my answer to a related question. $\endgroup$ Apr 23 at 15:46
  • $\begingroup$ Thanks very much. It was really helpful. $\endgroup$
    – user60588
    Apr 23 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.