# zero knowledge proof for complete new user authentication

Consider an environment, an user A who is completely new to the environment is entering. An user B who is member of the environment need to verify A as genuine not liar.

No information about user A is known to B.

Is it possible using the zero knowledge proof.

• If there's no information about A known how would you distinguish A from C or D or E? – SEJPM Nov 12 '17 at 16:36
• Or, another way to put it 'verify A as genuine not liar'; liar about what? – poncho Nov 12 '17 at 17:37
• it is that he/she is A not B – Venkatesan S. Venkatesan Nov 13 '17 at 7:14
• How do you define "being A" without any external information? Besides, B will easily convince himself that the new player is not B... – Geoffroy Couteau Nov 13 '17 at 9:41
• Solution is need to detect that. Is it possible with zero knowledge – Venkatesan S. Venkatesan Nov 13 '17 at 11:14

No, you can not.

You assume:

• $B$ does not know anything about $A$.
• You need to know if $A$ is actually called Alice.

Well, that does not work. There is no possible proof that $A$ is actually called Alice. That is unless you verify some other credentials, e.g. an ID card. But trust can not be generated out of nothing. That is simply impossible.

For example, if there is no way to verify a persons name, then no one in the world can decide if he is actually talking to the real Alice or to Eve who is just calling herself Alice.

The question has nothing to do with zero knowledge - that is just impossible in general.

You can generate a random keys pair for each user, and store the public key of each user somewhere on the net (blockchain, Usenet, ZeroDB, a website...)

Then, each of your users could share a link to their public key for their friends. Friends could then verify signature of challenge to be sure it's the real friend and not a liar.

• The question states, the user is "completely new to the environment", so even if there are friends who could verify the person, they are not part of the environment (and thus not trustworthy either). And some random key on the web does not prove it is actually Alice and not Eve calling herself Alice. – tylo Nov 17 '17 at 15:03
• Well, it's not the random key that prove it, it's the public key of the user stored somewhere on the net. For example, this could be a hash ID in the public twitter user's profile, where this hash refer to a public key. So when A come in the environment and claim to be "Alice", a user B can retrieve the public key of "Alice" and verify the signature of user A to detect if it's a liar or not, without having any information on A inside the environment. – lakano Nov 17 '17 at 15:17
• What if there is not already an Alice? Do you just trust every new user who's name is not already known? Say I am the first to claim to be Alice but I am really Eve and that is accepted, not along comes the real Alice—oops. – zaph Nov 17 '17 at 15:41
• @zaph If Alice doesn't exists, so the question to known if it's a liar doesn't exists, because he can't impersonate someone that doesn't exists. – lakano Nov 17 '17 at 15:49
• @zaph When the evil Alice register but can't have any proof, the system could add a flag « unverifed » to inform other users. When the real Alice sign-up, she can add a proof (eg: Twitter hash on his profile), the system can now warn every contacts of evil Alice was a liar, and replace it with the real Alice. – lakano Nov 17 '17 at 16:08