Reading Why Zk-SNARKs are Argument of Knowledge if a Knowledge Extractor exists? I feel confused by OP first statement:
From what I know, proving the existance of a Knowledge Extractor implies perfect soundness.
Answer focuses on soundness not necessarily being perfect, but it seems implicitly confirming the soundness implication by the extractor.
First of all let me state that when I read "soundness" I think to the property of IPs stating that no Prover strategy can convince the Verifier of a symbol not belonging to the Language with more than negligible probability... which seems a quite different "object" than an extractor "spilling out" the witness, so it's difficult for me to get an at least naive idea of that supposed implication.
However I was beginning to believe it, because of sources I found, e.g.:
- on page 44 of Geoffroy Couteau's PhD thesis (https://geoffroycouteau.github.io/assets/pdf/thesis.pdf) regarding ZKPoK:
[...] the soundness property is replaced by a knowledge-extraction property [...]
- on blog post ZKPs An Illustrated Primer by Matthew Green (https://blog.cryptographyengineering.com/2017/01/21/zero-knowledge-proofs-an-illustrated-primer-part-2/) in section "Proving Soundness":
When it comes to demonstrating the soundness of a proof of knowledge, we have a really nice formal approach. Just as with the Simulator we discussed above, we need to demonstrate the existence of a special algorithm. This algorithm is called a knowledge extractor, and it does exactly what it claims to. A knowledge extractor (or just ‘Extractor’ for short) is a special type of Verifier that interacts with a Prover, and — if the Prover succeeds in completing the proof — the Extractor should be able to extract the Prover’s original secret. And this answers our question above. To prove soundness for a proof of knowledge, we must show that an Extractor exists for every possible Prover.
HOWEVER in paragraph 4.5 "What about soundness?" of On Defining Proofs of Knowledge where Bellare and Goldreich deal with their formulation of PoK versus previous ones (https://www.wisdom.weizmann.ac.il/~oded/PS/pok.ps) I have found these words:
We note that our definition makes no requirement for the case $x$ not in $L_R$. In particular, soundness (i.e., a bound on the prover's ability to lead the verifier to accept $x$ not in $L_R$) is not required. Consequently, a knowledge verifier for $R$ does not necessarily define an interactive proof of membership in $L_R$. This is in contrast to previous definitions; they had the "validity" condition imply the soundness condition, so that the latter always held. We feel that our "decoupling" of soundness from validity is justified both conceptually and in the light of certain applications.
By the way, it's the same point of view of famous Golderich's "Foundation of Cryptography", section 4.7.
So again I'm dubious about: Knowledge Extractor $=>$ Soundness
Coud someone state the implication proof explicitly or at least give me any hints about it?
Or maybe existence of Knowledge Extractor in some way by itself avoids the Verifier to be convinced of a "witness" not really known by the Prover, so it could be considered a sort of "soundness property" even if of different nature with respect to usual ones? (this point of view seems confirmed by Geoffroy Couteau in the originally cited question/answer exchange when he writes:
Yes, there are several dimensions in the flavor of soundness: whether you have "membership soundness" or "knowledge soundness" is one (I usually say 'knowledge extractability" in my paper to distinguish from the usual soundness)
however if that's the case I would have expected him to correct that "implies" by OP)
Sorry for having been wordy, I hope to have described my doubts in an understandable way.