In cryptography, a proof of knowledge is an interactive proof in which the prover succeeds in 'convincing' a verifier that the prover knows something. What it means for a machine to 'know something' is defined in terms of computation. A machine 'knows something', if this something can be computed, given the machine as an input. As the program of the prover does not necessarily spit out the knowledge itself (as is the case for zero-knowledge proofs), a machine with a different program, called the knowledge extractor is introduced to capture this idea. We are mostly interested in what can be proven by polynomial time bounded machines. In this case, the set of knowledge elements is limited to a set of witnesses of some language in NP.

.

with the following two properties:

1. Completeness, i.e. given the interaction between the prover P and the verifier V, the probability that the verifier is convinced is 1.

2. Validity in convincing the verifier. This property guarantees that no prover that doesn't know the witness can succeed in convincing the verifier.

Details on the definition

This is a more rigorous definition of Validity:

did not come to a conclusion.

is used to express what is meant by the knowledge of a Turing machine.

This definition of the validity property is a combination of the validity and strong validity properties., it can be seen as being stronger than the soundness of ordinary interactive proofs.

Relation to general interactive proofs

In order to define a specific proof of knowledge, one need not only define the language, but also the witnesses the verifier should know. In some cases proving membership in a language may be easy, while computing a specific witness may be hard. This is best explained using an example:

be a cyclic group in which solving the discrete logarithm holds corresponds to solving the discrete logarithm problem.

Protocols

Schnorr protocol

One of the simplest and frequently used proofs of knowledge, the proof of knowledge of a discrete logarithm, is due to Schnorr. The protocol is defined for a cyclic group.

, the prover interacts with the verifier as follows:

1. is also called commitment.

2. The verifier replies with a challenge chosen at random.

3. , the prover sends the third and last message (the response reduced modulo the order of the group.

.

We can see this is a valid proof of knowledge because it has an extractor that works as follows:

1. .

2. .

3. .

4. .

.

This protocol happens to be zero-knowledge, though that property is not required for a proof of knowledge.

Sigma protocols

Protocols which have the above three-move structure (commitment, challenge and response) are called sigma protocols. The naming originates from Sig, referring to the zig-zag symbolizing the three moves of the protocol, and MA, an abbreviation of "Merlin-Arthur". are equal or fulfill some other linear relation. For a and b. Equality corresponds to the special case where a=1 and b= can be trivially this is equivalent to proving knowledge of an x.

This is the intuition behind the following notation, which is commonly used to express what exactly is proven by a proof of knowledge.

states that the prover knows an x that fulfills the relation above.

Applications

Proofs of knowledge are useful tool for the construction of identification protocols, and in their non-interactive variant, signature schemes. Such schemes are:

• Schnorr signature

They are also used in the construction of group signature and anonymous digital credential systems.

See also

• Cryptographic protocol

• Zero-knowledge proof

• Interactive proof system

• Topics in cryptography

• Zero-knowledge password proof

• Soundness (interactive proof)

References