Zero Knowledge r Two parties:  All powerful prover P  Polynomially bounded verifier V r P wants to prove a statement to V with the following properties:  Completeness – honest verifier convinced by honest prover  Correctness – dishonest prover can’t convince verifier of false statement (except with negligible probability)  Zero knowledge – verifier doesn’t learn anything besides the correctness of the statement 1

Proving Zero Knowledge r By simulation  Every cheating verifier has a simulator that outputs Perfect zero knowledge - the same distribution as the verifier’s view in the protocol Computational zero knowledge – indistinguishable distribution from the verifier’s view in the protocol r Bad example – challenge-response password protocol r Example – proving knowledge of discrete log 2

Commitment r Two player protocol r Alice commits to a value b  Binding - Alice can’t change the value after the commitment  Concealing – Bob can’t discover b  Alice can reveal b at some point r Example – f(x) one-way permutation, B(x) hardcore for f(x)  Commitment – (f(x),b  B(x))  Revealing - x 3

Commitment (cont.) r Naor’s scheme – using the indistinguishability property of a PRG G.  Commitment Bob sends random string r of length G(x). Alice chooses random x and sends G(x)  br  Revealing – Alice sends x r Claim – if Bob can find b before Alice reveals it, then Bob can distinguish G(x) from random string r Claim – Alice has low probability of success in cheating (finding y such that G(y)=r  G(x) 4

Zero Knowledge for GI r GI – Graph homomorphism r Two graphs G 1, G 2 are homomorphic if there is a re-labeling of the nodes of G that gives the nodes of H r Hard problem  No known polynomial algorithm  Not known if it is NP-hard r Prover commits to m graphs H 1,…,H m r Verifier sends m choices a 1,…,a m, a i  {1,2} r Prover reveals homomorphism between H i and G a i for every i. 5

SRP r Client authenticated by short password r Motivated by ZK, although not the same r Server and client agree on p, g and hash function h r Server sends random salt r Client sends g a mod p r Server computes x=h(password, salt), B=g b +g x mod p. Server sends B. r Client computes g x mod p, both sides compute u=h(B) r Client computes shared=(B-g x ) a+ux mod p r Server computes shared=(g a g xu ) b mod p 6

Special attacks to conclude r Fault attack – induce some fault in operation of target and hope for good results r Examples  Original hardware jailbreak of iPhone  Power spike during access control run  RSA-CRT computation – error in computation on p, but not on q r Side channel attacks - overview r Power analysis  Simple power analysis of exponentiation 7