# Why Zero-Knowledge protocols are used for NP problems if IP is the class of interactive proof systems where they come from?

As stated in the title, I'm studying ZKPs and I see they are just interactive proof systems that respect the zero-knowledge property. Now, if that's true, why aren't they used for IP problems, the complexity class of interactive proof systems that was originally introduced for them? I mean, isn't the proof mechanism interactive in ZKPs between Prover and Verifier? Then why are we talking about NP problems, which are the opposite of interactive?

• As far as I known 1) proving ZKP for a specific NP-complete problem as G3C, you have proved it for every NP-complete problem (and I don't know if something similar exist in the wider sense of IP) 2) In cryptography NP problems are of great interest because, in layman terms, for a verifier they are difficult to calculate but easy to verify. 3) From a general point of view, in cryptography interactiveness is not so desirable because it forces the parties to be online at the same time: as far as I know often the flavours of ZKP are NI ones obtained introducing further models (e.g. ROM or CRS) Oct 21, 2021 at 6:21
• Actually, there is an easy reduction from ZK for NP to ZK for all of IP (well, not so easy because it builds on the proof IP = PSPACE, but easy given this proof). I agree with all other points, though. Oct 21, 2021 at 7:42

The reason is that essentially, the class of languages in $$\mathcal IP$$ that are not in $$\mathcal NP$$ cannot be proven with an efficient prover. Since we are typically interested in the cryptographic context with efficient provers, the study of ZK typically focuses on $$\mathcal NP$$. (Note that when studying complexity and often in foundations of cryptography, we are certainly interested in inefficient provers.)
In order to see why outside of $$\mathcal NP$$ the prover cannot be efficient, note that any interactive proof with an efficient prover (given a witness) can be emulated by a machine who receives the witness and runs the proof locally, testing if the result is accept or reject. This is exactly the class of languages $$\mathcal MA$$. Under standard derandomization assumptions, $$\mathcal MA = NP$$. Thus, under these assumptions, any language that is not in $$\mathcal NP$$ can only be run with an inefficient prover (even giving it some witness). As such, it is of less interest when constructing protocols and the like.