3
$\begingroup$

Special honest verifier zero-knowledge and zero-knowledge property is defined as follows:

Special honest verifier zero-knowledge(SHVZK):There exists a polynomial-time simulator M, which on input x and a random t, outputs an accepting conversation of the form $(m_1,t,m_2)$, with the same probability distribution as conversations between the honest $(P,V)$ on input $x$

Zero-knowledge property(ZK): Let $(P,V)$ be an interactive proof system for some language L . We say that (P,V) is computational zero-knowledge if for every probabilistic polynomial-time interactive machine $V^*$, there exists a probabilistic polynomial-time algorithm $M^*$ such that the output of the interactive machine $V^*$ after it interacts with the interactive machine P on common input x is computationally indistinguishable from the output of machine $M^*$ on input x.

Assume, there exists a interactive-protocol $\pi$ for language $L$ which is three move protocol that satisfies zero-knowledge property

Considering $\pi$, the difference between SHVZK AND ZK is Simulator is constructed for only honest verifier in SVZK, whereas in ZK simulator must constructed for even cheating verifier.

Can we say $\pi$ satifies SHVZK?. My doubt is In SHVZK, simulator produces accepting transcript where as in ZK property there is no condition about acceptance of transcript generated by simulator.

$\endgroup$
1
$\begingroup$

"Can we say $\pi$ satisfies SHVZK?"

Yes you can. As any proof system which satisfies ZK property, also achieves SHVZK.

Regard to "My doubt is In SHVZK, simulator produces accepting transcript where as in ZK property there is no condition about acceptance of transcript generated by simulator."

Note that in the definition of ZK, it is mentioned that "Let $(P,V)$ be an interactive proof system". A proof system should be complete, meaning that a honest prover always convinces honest verifier, which implies that the proof should be acceptable. So, even if in the definition of ZK, clearly is not mentioned that the proof should be acceptable, but similar to the SHVZK proof, a simulated ZK proof should be acceptable by verifier.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.