Interactive Proofs Nabil Mustafa Computational Complexity 1 / 144 1 V runs in time polynomial in jxj 2 x 2 L =) 9P s.t. V (x) = 1 after k-rounds with P 3 x 2= L =) 8PV (x) = 0 after k-rounds with P Note: each message sent is one round Messages have to be of length polynomial in jxj dIP dIP is the set of languages with a k(n)-round interactive proof system, where k(n) is a polynomial in n. Deterministic Interactive Proof System Deterministic Proof Systems A language L has a k-round deterministic interactive proof system if there exists a TM V such that on input x, 2 / 144 2 x 2 L =) 9P s.t. V (x) = 1 after k-rounds with P 3 x 2= L =) 8PV (x) = 0 after k-rounds with P Note: each message sent is one round Messages have to be of length polynomial in jxj dIP dIP is the set of languages with a k(n)-round interactive proof system, where k(n) is a polynomial in n. Deterministic Interactive Proof System Deterministic Proof Systems A language L has a k-round deterministic interactive proof system if there exists a TM V such that on input x, 1 V runs in time polynomial in jxj 3 / 144 3 x 2= L =) 8PV (x) = 0 after k-rounds with P Note: each message sent is one round Messages have to be of length polynomial in jxj dIP dIP is the set of languages with a k(n)-round interactive proof system, where k(n) is a polynomial in n. Deterministic Interactive Proof System Deterministic Proof Systems A language L has a k-round deterministic interactive proof system if there exists a TM V such that on input x, 1 V runs in time polynomial in jxj 2 x 2 L =) 9P s.t. V (x) = 1 after k-rounds with P 4 / 144 Note: each message sent is one round Messages have to be of length polynomial in jxj dIP dIP is the set of languages with a k(n)-round interactive proof system, where k(n) is a polynomial in n. Deterministic Interactive Proof System Deterministic Proof Systems A language L has a k-round deterministic interactive proof system if there exists a TM V such that on input x, 1 V runs in time polynomial in jxj 2 x 2 L =) 9P s.t. V (x) = 1 after k-rounds with P 3 x 2= L =) 8PV (x) = 0 after k-rounds with P 5 / 144 Messages have to be of length polynomial in jxj dIP dIP is the set of languages with a k(n)-round interactive proof system, where k(n) is a polynomial in n. Deterministic Interactive Proof System Deterministic Proof Systems A language L has a k-round deterministic interactive proof system if there exists a TM V such that on input x, 1 V runs in time polynomial in jxj 2 x 2 L =) 9P s.t. V (x) = 1 after k-rounds with P 3 x 2= L =) 8PV (x) = 0 after k-rounds with P Note: each message sent is one round 6 / 144 dIP dIP is the set of languages with a k(n)-round interactive proof system, where k(n) is a polynomial in n. Deterministic Interactive Proof System Deterministic Proof Systems A language L has a k-round deterministic interactive proof system if there exists a TM V such that on input x, 1 V runs in time polynomial in jxj 2 x 2 L =) 9P s.t. V (x) = 1 after k-rounds with P 3 x 2= L =) 8PV (x) = 0 after k-rounds with P Note: each message sent is one round Messages have to be of length polynomial in jxj 7 / 144 Deterministic Interactive Proof System Deterministic Proof Systems A language L has a k-round deterministic interactive proof system if there exists a TM V such that on input x, 1 V runs in time polynomial in jxj 2 x 2 L =) 9P s.t. V (x) = 1 after k-rounds with P 3 x 2= L =) 8PV (x) = 0 after k-rounds with P Note: each message sent is one round Messages have to be of length polynomial in jxj dIP dIP is the set of languages with a k(n)-round interactive proof system, where k(n) is a polynomial in n. 8 / 144 I Mainly because the prover knows the verifier algorithm I So prover just ‘simulates’ the messages all at once Now we consider when the verifier is probabilistic Defining IP Let k : N ! N be some function. A language L is in IP [k] if there is a k(jxj)-time probabilistic TM V such that: x 2 L =) 9P Pr [ V accepts x, V (x) = 1 ] ≥ 2=3 x 2= L =) 8P Pr [ V accepts x, V (x) = 1 ] ≤ 1=3 Definition [ IP = IP [nc ] c The Class IP Interactivity doesn’t seem to give more power 9 / 144 I So prover just ‘simulates’ the messages all at once Now we consider when the verifier is probabilistic Defining IP Let k : N ! N be some function. A language L is in IP [k] if there is a k(jxj)-time probabilistic TM V such that: x 2 L =) 9P Pr [ V accepts x, V (x) = 1 ] ≥ 2=3 x 2= L =) 8P Pr [ V accepts x, V (x) = 1 ] ≤ 1=3 Definition [ IP = IP [nc ] c The Class IP Interactivity doesn’t seem to give more power I Mainly because the prover knows the verifier algorithm 10 / 144 Now we consider when the verifier is probabilistic Defining IP Let k : N ! N be some function. A language L is in IP [k] if there is a k(jxj)-time probabilistic TM V such that: x 2 L =) 9P Pr [ V accepts x, V (x) = 1 ] ≥ 2=3 x 2= L =) 8P Pr [ V accepts x, V (x) = 1 ] ≤ 1=3 Definition [ IP = IP [nc ] c The Class IP Interactivity doesn’t seem to give more power I Mainly because the prover knows the verifier algorithm I So prover just ‘simulates’ the messages all at once 11 / 144 Defining IP Let k : N ! N be some function. A language L is in IP [k] if there is a k(jxj)-time probabilistic TM V such that: x 2 L =) 9P Pr [ V accepts x, V (x) = 1 ] ≥ 2=3 x 2= L =) 8P Pr [ V accepts x, V (x) = 1 ] ≤ 1=3 Definition [ IP = IP [nc ] c The Class IP Interactivity doesn’t seem to give more power I Mainly because the prover knows the verifier algorithm I So prover just ‘simulates’ the messages all at once Now we consider when the verifier is probabilistic 12 / 144 Definition [ IP = IP [nc ] c The Class IP Interactivity doesn’t seem to give more power I Mainly because the prover knows the verifier algorithm I So prover just ‘simulates’ the messages all at once Now we consider when the verifier is probabilistic Defining IP Let k : N ! N be some function. A language L is in IP [k] if there is a k(jxj)-time probabilistic TM V such that: x 2 L =) 9P Pr [ V accepts x, V (x) = 1 ] ≥ 2=3 x 2= L =) 8P Pr [ V accepts x, V (x) = 1 ] ≤ 1=3 13 / 144 The Class IP Interactivity doesn’t seem to give more power I Mainly because the prover knows the verifier algorithm I So prover just ‘simulates’ the messages all at once Now we consider when the verifier is probabilistic Defining IP Let k : N ! N be some function. A language L is in IP [k] if there is a k(jxj)-time probabilistic TM V such that: x 2 L =) 9P Pr [ V accepts x, V (x) = 1 ] ≥ 2=3 x 2= L =) 8P Pr [ V accepts x, V (x) = 1 ] ≤ 1=3 Definition [ IP = IP [nc ] c 14 / 144 Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn Have to accept φ iff φ is not satisfiable We give a n-round interactive proof as follows: Proof steps: I Reduce the problem to polynomial identity testing over f0; 1g I Think of the polynomial over a larger domain I Present a Verifier protocol for proving this identity 3SAT Claim 3SAT 2 IP 15 / 144 Have to accept φ iff φ is not satisfiable We give a n-round interactive proof as follows: Proof steps: I Reduce the problem to polynomial identity testing over f0; 1g I Think of the polynomial over a larger domain I Present a Verifier protocol for proving this identity 3SAT Claim 3SAT 2 IP Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn 16 / 144 We give a n-round interactive proof as follows: Proof steps: I Reduce the problem to polynomial identity testing over f0; 1g I Think of the polynomial over a larger domain I Present a Verifier protocol for proving this identity 3SAT Claim 3SAT 2 IP Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn Have to accept φ iff φ is not satisfiable 17 / 144 Proof steps: I Reduce the problem to polynomial identity testing over f0; 1g I Think of the polynomial over a larger domain I Present a Verifier protocol for proving this identity 3SAT Claim 3SAT 2 IP Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn Have to accept φ iff φ is not satisfiable We give a n-round interactive proof as follows: 18 / 144 I Reduce the problem to polynomial identity testing over f0; 1g I Think of the polynomial over a larger domain I Present a Verifier protocol for proving this identity 3SAT Claim 3SAT 2 IP Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn Have to accept φ iff φ is not satisfiable We give a n-round interactive proof as follows: Proof steps: 19 / 144 I Think of the polynomial over a larger domain I Present a Verifier protocol for proving this identity 3SAT Claim 3SAT 2 IP Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn Have to accept φ iff φ is not satisfiable We give a n-round interactive proof as follows: Proof steps: I Reduce the problem to polynomial identity testing over f0; 1g 20 / 144 I Present a Verifier protocol for proving this identity 3SAT Claim 3SAT 2 IP Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn Have to accept φ iff φ is not satisfiable We give a n-round interactive proof as follows: Proof steps: I Reduce the problem to polynomial identity testing over f0; 1g I Think of the polynomial over a larger domain 21 / 144 3SAT Claim 3SAT 2 IP Given φ = C1 _ ::: _ Cm in n variables x1;:::; xn Have to accept φ iff φ is not satisfiable We give a n-round interactive proof as follows: Proof steps: I Reduce the problem to polynomial identity testing over f0; 1g I Think of the polynomial over a larger domain I Present a Verifier protocol for proving this identity 22 / 144 Prover: φ(x1;:::; xn) has k satisfying assignments.