Presented by: Suparita Parakarn Kinzang Wangdi Research Report Presentation Computer Network Security

Introduction Properties of Zero-Knowledge Proofs Classic Example of Zero-Knowledge Fiat-Shamir protocol Interactive Proof What Attacker can do? Secrecy of Zero Knowledge Conclusion

Shafi Goldwasser, Silvio Micali, Charles Rackoff put forward the basic idea of Zero Knowledge Proof in 1985 Zero Knowledge protocol is an instance of interactive proof protocol Zero Knowledge Protocol overcomes major concerns of password based authentication Verifier knows some information about one who proves (prover) Zero Knowledge protocol is to enable the prover convince the verifier that the prover knows secret without revealing the secret itself.

Protocols are mostly based on probabilistic Proof hold good with high probability of success Not necessarily absolute Verifier may accept or reject the proof after exchanging multiples messages The probability of errors can be reduced with increasing the number of challenges and responses

Zero Knowledge protocols derived their properties from interactive proof protocols Completeness The protocol is consider complete, if it succeeds with a very high probability for an honest verifier and honest prover Soundness If the fact is false, the verifier rejects the proof

Alice wants to prove to Bob that she knows how to open the secret door between R and S. Bob goes to P Alice goes to R or S Bob goes to Q and tells Alice to come from one side or the other of the cave If Alice knows the secret, she can appear from the correct side of the cave every time Bob repeats as many times until he believe Alice knows to open the secret door Note that Bob doesn’t know which path she has gone down Bob’s Cave

Suppose Alice doesn’t know the secret word, then she would be able to come back by the named path if Bob were to name the same path that she entered by Since Bob will name the path at random, he will have 50% chances of getting the right path If they repeats this tricks many times, her chances of returning from Bob’s named path becomes very small But if Alice reliably appears from the Bob’s named path, he can conclude that she is likely to know the secret word to open the magic door. From Bob’s Cave indicates that a zero knowledge proof is possible in principle Can we achieve the same effect without the cave?

Zero knowledge transfer Verifier does not learn any thing about prover’s secret S Verifier cannot impersonate prover to a third person Prover cannot cheat the verifier with several iterations of the protocol Efficiency Computational efficiency is due to its interactive proofs nature Costly computation related to encryption are avoided Degradation The security of protocol itself does not get degraded with continuous use as no information about the secret is made known

If public keys are used for authentication both the parties should know public key If one party does not know others public key, then they should send certificate. In the certificate, owner’s identity is revealed Zero Knowledge Proof allow authentication with secrecy of identity In Fiat-Shamir protocol, both party knows public value v, but there is nothing in v that identifies both the party

Watermark verification It is very important to show the presence of watermark in the image without actually revealing it This prevents any malicious user from removing the watermark and reselling multiple copies of duplicate watermark NGSCB Next Generation Secure Computing Base (NGSCB) is Microsoft’s proposed secure computing environment to use zero knowledge proofing techniques to verify authenticity of services and code

Special case of interactive proofs Zero knowledge proofs offer a way to prove knowledge to someone without transferring any additional knowledge to that person