Interactive Proofs Lecture 16 What the all-powerful can convince mere mortals of 1 Recap 2 Recap Non-deterministic Computation 2 Recap Non-deterministic Computation Polynomial Hierarchy 2 Recap Non-deterministic Computation Polynomial Hierarchy Non-determinism on steroids! 2 Recap Non-deterministic Computation Polynomial Hierarchy Non-determinism on steroids! Non-uniform computation 2 Recap Non-deterministic Computation Polynomial Hierarchy Non-determinism on steroids! Non-uniform computation Probabilistic Computation 2 Recap Non-deterministic Computation Polynomial Hierarchy Non-determinism on steroids! Non-uniform computation Probabilistic Computation Today: Interactive Proofs 2 Recap Non-deterministic Computation Polynomial Hierarchy Non-determinism on steroids! Non-uniform computation Probabilistic Computation Today: Interactive Proofs Non-determinism and Probabilistic computation on steroids! 2 Interactive Proofs 3 Interactive Proofs Prover wants to convince verifier that x has some property 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L x ∈ L 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L Prove to me! x ∈ L 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L Prove to me! x ∈ L 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L Prove to me! x ∈ L YES! 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L All powerful prover, computationally bounded verifier Prove to me! x ∈ L YES! 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L All powerful prover, computationally bounded verifier Verifier doesn’t trust prover Prove to me! x ∈ L YES! 3 Interactive Proofs Prover wants to convince verifier that x has some property i.e. x is in language L All powerful prover, computationally bounded verifier Verifier doesn’t trust prover Prove to me! Limits the power x ∈ L YES! 3 Interactive Proofs 4 Interactive Proofs Completeness 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier Soundness 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier Soundness If x not in L, honest Verifier won’t accept any purported proof 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier Soundness If x not in L, honest Verifier won’t accept any purported proof 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier Soundness If x not in L, honest Verifier won’t accept any purported proof x ∈ L 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier Soundness If x not in L, honest Verifier won’t accept any purported proof x ∈ L yeah right! 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier Soundness If x not in L, honest Verifier won’t accept any purported proof x ∈ L yeah right! 4 Interactive Proofs Completeness If x in L, honest Prover should convince honest Verifier Soundness If x not in L, honest Verifier won’t accept any purported proof x ∈ L NO! yeah right! 4 An Example 5 An Example Coke in bottle or can 5 An Example Coke in bottle or can Prover claims: coke in bottle and coke in can are different 5 An Example Coke in bottle or can Prover claims: coke in bottle and coke in can are different IP protocol: 5 An Example Coke in bottle or can Prover claims: coke in bottle and coke in can are different IP protocol: 5 An Example Coke in bottle or can Prover claims: coke in bottle and coke in can are different IP protocol: Pour into from can or bottle 5 An Example Coke in bottle or can Prover claims: coke in bottle and coke in can are different IP protocol: Pour into from can or bottle 5 An Example Coke in bottle or can Prover claims: coke in bottle and coke in can are different IP protocol: prover tells whether cup was filled from can or bottle Pour into from can or bottle can/bottle 5 An Example Coke in bottle or can Prover claims: coke in bottle and coke in can are different IP protocol: prover tells whether cup was filled from can or bottle repeat till verifier is convinced Pour into from can or bottle can/bottle 5 An Example 6 An Example Graph non-isomorphism (GNI) 6 An Example Graph non-isomorphism (GNI) Prover claims: G0 not isomorphic to G1 6 An Example Graph non-isomorphism (GNI) Prover claims: G0 not isomorphic to G1 IP protocol: 6 An Example Graph non-isomorphism (GNI) Prover claims: G0 not isomorphic to G1 IP protocol: 6 An Example 1 Graph non-isomorphism0 not (GNI) isomorphic to G Set G* to be Prover claims: G !(G0) or !(G1) (! a random IP protocol: permutation) 6 An Example 1 Graph non-isomorphism0 not (GNI) isomorphic to G Set G* to be Prover claims: G !(G0) or !(G1) (! a random IP protocol: permutation) G* 6 An Example Graph non-isomorphism (GNI) Prover claims: G0 not isomorphic to G1 IP protocol: prover tells whether G* came from G0 or G1 Set G* to be ! (G0) or ! (! a random(G 1) permutation) G* G0/G 1 6 An Example Graph non-isomorphism (GNI) Prover claims: G0 not isomorphic to G1 IP protocol: prover tells whether G* came from G0 or G1 Set G* to be ! repeat till verifier is convinced (G0) or ! (! a random(G 1) permutation) G* G0/G 1 6 Interactive Proofs 7 Interactive Proofs Completeness 7 Interactive Proofs Completeness If x in L, honest Prover will convince honest Verifier 7 Interactive Proofs Completeness If x in L, honest Prover will convince honest Verifier With probability at least 2/3 7 Interactive Proofs Completeness If x in L, honest Prover will convince honest Verifier With probability at least 2/3 Soundness 7 Interactive Proofs Completeness If x in L, honest Prover will convince honest Verifier With probability at least 2/3 Soundness If x not in L, honest Verifier won’t accept any purported proof 7 Interactive Proofs Completeness If x in L, honest Prover will convince honest Verifier With probability at least 2/3 Soundness If x not in L, honest Verifier won’t accept any purported proof Except with probability at most 1/3 7 Deterministic IP? 8 Deterministic IP? Deterministic Verifier IP 8 Deterministic IP? Deterministic Verifier IP Prover can construct the entire transcript, which verifier can verify deterministically 8 Deterministic IP? Deterministic Verifier IP Prover can construct the entire transcript, which verifier can verify deterministically NP certificate 8 Deterministic IP? Deterministic Verifier IP Prover can construct the entire transcript, which verifier can verify deterministically NP certificate Deterministic Verifier IP = NP 8 Deterministic IP? Deterministic Verifier IP Prover can construct the entire transcript, which verifier can verify deterministically NP certificate Deterministic Verifier IP = NP Deterministic Prover IP = IP 8 Deterministic IP? Deterministic Verifier IP Prover can construct the entire transcript, which verifier can verify deterministically NP certificate Deterministic Verifier IP = NP Deterministic Prover IP = IP For each input prover can choose the random tape which maximizes Pr[yes] (probability over honest verifier’s randomness) 8 Public and Private Coins 9 Public and Private Coins Public coins: Prover sees verifier’s coin tosses 9 Public and Private Coins Public coins: Prover sees verifier’s coin tosses Verifier might as well send nothing but the coins to the prover 9 Public and Private Coins Public coins: Prover sees verifier’s coin tosses Verifier might as well send nothing but the coins to the prover Private coins: Verifier does not send everything about the coins 9 Public and Private Coins Public coins: Prover sees verifier’s coin tosses Verifier might as well send nothing but the coins to the prover Private coins: Verifier does not send everything about the coins e.g. GNI protocol: verifier keeps coin tosses hidden; uses it to create challenge 9 Arthur Merlin Proofs 10 Arthur Merlin Proofs Arthur-Merlin proof-systems 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon Public coin proof-system 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon Public coin proof-system Arthur sends no messages nor flips any coins 10 Arthur Merlin Proofs Arthur-Merlin proof-systems Arthur: polynomial time verifier Merlin: unbounded prover Random coins come from a beacon Public coin proof-system Arthur sends