last byte DOI:10.1145/2461256.2461281 Leah Hoffmann Q&A Cracking the Code Turing Award recipients Shafi Goldwasser and Silvio Micali talk about proofs, probability, and poker. THOUGH THEIR ROUTES to computer science differed, ACM A.M. Turing Award recipients Shafi Goldwasser and Silvio Micali have forged a com- mon path in the field since they met in graduate school. Goldwasser was born in Israel and got hooked on programming in college at Carnegie Mellon University. Micali was born in Italy and discovered his interest in the field at the University of Rome through courses in lambda cal- culus and logic. Now both at MIT (Gold- wasser holds a joint appointment at the Weizmann Institute of Science in Israel), the two have revolutionized cryptography by working through fun- damental questions and forging a link with computational complexity. Since their groundbreaking 1983 paper on probabilistic encryption, their work has transformed the scope of cryptog- raphy from encrypting private mes- sages to strengthening data security, facilitating financial transactions, and supporting cloud computing. What drew you both to the field? SILVIO: I started in physics and switched to mathematics. Then, to- ward the very end, I took two courses in discrete mathematics. So I switched to theoretical computer science and went to Berkeley, and that’s where I I drove up with a friend to see Berkeley cited and an exciting bunch. met Shafi. on a very sunny day. It was beautiful— SILVIO: By contrast, when I landed at SHAFI: I went to college at Carnegie green hills, bright blue skies—so off I Berkeley, it was raining, and I discov- Mellon in applied mathematics. At the went to Berkeley. At first, I was taking ered that I couldn’t speak English. I time, they didn’t have an undergradu- general courses, but then I ran into a knew there was a shuttle to campus, but ate degree in computer science, but group of theory students, one of whom I had to ask six people before they could there was a way to minor in computer was Silvio, and they sort of took me grasp what I wanted. But things light- science. When I graduated, I went to into their midst. The subject matter ened up once we formed this band of California for an internship at Rand as was appealing, but it was also a social brothers. This aspect Shafi mentioned I was interested in AI, and one weekend thing—the theory students were an ex- about sociability, [CONTINUED ON P. 118] VICKMARK BRYCE BY PHOTOGRAPH 120 COMMUNICATIONS OF THE ACM | JUNE 2013 | VOL. 56 | NO. 6 last byte [CONTINUED FROM P. 120] it’s very rel- information leaks.” evant, because at the end of the day we This often happens in mathemat- constructed a theory of interaction, so “This often happens ics—you start with something con- whatever attracted us to this interactive in mathematics— crete and you generalize, and in the thing was going to grow into a profes- end you get this beautiful theorem. sional interest, as well. you start with But you don’t start by saying, “Let’s something concrete think of a scheme that satisfies this You ended up having a common advi- security definition.” sor, Manuel Blum. and generalize, SILVIO: I agree that motivating exam- SHAFI: The turning point was a course and in the end ples are a big propeller for science. But by Blum on computational number we chose a very difficult problem that theory. At the end of the course, Blum you get this is a mixture of not only encryption, but asked this question about tossing a coin beautiful theorem.” also how you deal the cards after you over the telephone. And somehow the encrypt them and how you make sure idea that the combination of random- that the cards are getting a random ness, interaction and complexity of shuffle. We were fearless, but we were number theory problems could be used also lucky. to emulate simultaneity in communi- SHAFI: In a sense, what people re- cation—to make it seem like flipping a member is probabilistic encryption. coin on one end of the telephone and re- We were working on the problem of But there were also all these sub-contri- vealing it on the other hand happened how to play poker so that all partial in- butions that made their way into later at the same time rather than in succes- formation is hidden. I’m not really a larger bodies of work on protocols and sion—seemed unbelievably profound card player; it was all very abstract. We randomness. and exciting to me. And I think it’s true had this idea of using quadratic resid- about theoretical computer science in uosity, a hard problem from number One of the most powerful contribu- general… you use mathematics to solve theory, to code cards. So say the card tions was the notion of indistinguish- real-world problems, but you’re not re- is a seven of spades; we can think of its ability. ally bound by the rules and conventions name as a binary string and represent SILVIO: Computational indistinguish- of classical mathematics. each bit of this string as either a qua- ability roughly means that if you have dratic residue or Q-non-residue chosen limited computational power, being K The coin toss problem sounds simi- at random. We proved that all partial human, you cannot even distinguish R CKMA I lar to the game of mental poker that information about the cards was hid- between two things although they are V led to your 1983 paper on probabilistic den by this representation. It was al- very, very different from one another. In YCE R B encryption. most an afterthought to say, “Wait a the context of encryption, this implies BY S H SHAFI: P Mental poker had been posed minute, there’s a new public encryp- that if you are not the intended recipi- A before, but in that protocol, partial in- tion scheme here where you can prove ent of an encrypted message, not only R HOTOG formation could leak about the cards. very strong security property; no partial can you not figure out the message P 118 COMMUNIcatIONS OF THE acm | JUNE 2013 | VOL. 56 | NO. 6 last byte in its entirety, but you don’t have any why. To accomplish this, you interact inkling about its contents. with me in a way such that if I knew the SHAFI: Nor can you figure out rela- “Proofs are the most theorem were true, I could construct a tionships between different messages. frustrating things. virtual interaction with you that would be indistinguishable to me from the Indistinguishability also played a role They’re not fun true interaction. in your later work on zero knowledge to write and they’re SHAFI: It’s called the simulation par- interaction proofs and zero knowledge adigm. It was already in the probabilis- computations, where the notion of be- not fun to read. tic encryption paper as a proof method, ing unable to distinguish one reality They slow you down. but here it actually becomes part of the from another is the key to analyzing se- definition. If you think about this in- cure protocols. So we transformed terview, the fact that you are talking to SILVIO: Well, first of all, leaving zero them into a game.” us convinces you of the fact that we are knowledge aside for a moment, what real. But beyond that, you could proba- we created is a new kind of proof. Proofs bly have surmised what we’ve said from are the most frustrating things. They’re all the papers we have written. not fun to write and they’re not fun to read. They slow you down. So we trans- So a zero knowledge conversation is a formed them into a game. Say I claim a conversation that could have been sim- certain theorem to be true. Then I con- the theorem to somebody else. Sec- ulated so well that it would be indistin- vince you that the following game has ond, there is this probability of error. guishable from a real conversation. the following special property: if the We played 20 times, but maybe with a SHAFI: That’s right. If you can’t dis- theorem is true, I can win all the time. chance of one in a million, you would tinguish between a true interactive If the theorem is false, you win at least have not caught me if the theorem were proof and a simulated proof, you can half of the time. Now we play, and I win. false. But if we play 30 times, the chance conclude that the true interactive We play again, and I win again. Assume is one in a billion. And if we play 300 proof gave you nothing you couldn’t I win 20 times in a row. Then suddenly times, the chance is one in the number have obtained yourself, besides know- this very esoteric, long, tedious process of every elementary particle in the uni- ing that your questions were actually of verifying becomes, if not fun, at least verse. So all of a sudden this probabil- answered by a real prover. So, the fact quick and interactive. ity is so miniscule that, for all practical that in a true interactive proof the real This is a transformation in two sens- purposes, it can be equated to zero. prover answers your questions con- es. First, since the proof is interactive, vinces you that a proof is correct but what convinces you is that you really How did that lead to zero knowledge? gives nothing else.