\documentstyle[12pt,twoside,alltt]{article}

\textwidth=6in
\oddsidemargin=0.25in
\evensidemargin=0.25in
\topmargin=-0.1in
\footskip=0.8in
\parindent=0.0cm
\parskip=0.3cm
\textheight=8.00in
\setcounter{tocdepth} {3}
\setcounter{secnumdepth} {2}
\sloppy

\newenvironment{proof}{\noindent{\bf Proof:}}{\qed\bigskip}
\newenvironment{proof_sketch}{\noindent{\bf Sketch of 
Proof}\hspace*{1em}}{\qed\bigskip}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}{Corollary}
\newtheorem{lemma}{Lemma}
\newtheorem{claim}{Claim}
\newtheorem{fact}{Fact}
\newtheorem{definition}{Definition}
\newtheorem{assumption}{Assumption}
\newtheorem{observation}{Observation}
\newtheorem{example}{Example}
\newcommand{\qed}{\rule{7pt}{7pt}}

\newcommand{\lecture}[4]{
\pagestyle{headings}
\thispagestyle{plain}
\newpage
\noindent
\begin{center}
\framebox{
\vbox{
\hbox to 5.75in { {\bf 6.857 Computer and Network Security
\hfill Fall Term, 1997}  }
\vspace{4mm}
\hbox to 5.75in { {\Large \hfill Lecture #1 : #2 \hfill} }
\vspace{2mm}
\hbox to 5.75in { {\it Lecturer: #3 \hfill Scribe: #4} }
}
}
\end{center}
\markboth{Lecture #1 : #2}{Lecture #1 : #2}
\vspace*{4mm}
}

\begin{document}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Lecture command takes 4 arguments:
%		ordinal number of the lecure
%		date of the lecure
%		lecturer
%		scribe---that is you
%
\lecture{11}{October 9, 1997}{Ron Rivest}{Ching Law} 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% For theorems, lemmas, definitions, remarks, etc. use commands
% \begin{theorem} .... \end{theorem} 
% \begin{definition} ... \end{definition} 
% \begin{proof} ... \end{proof}
% and so on ...
%
% If you want to insert figures in your notes do the following: 
% 1) Prepare your figures using your favourite graphic editor
% 	for example idraw or xfig
% 2) Save your pictures in PostScript form using the following convention
% 	notes-nn-fig-mm.ps where nn is the number of the lecture you 
% 	are scribing and mm is the sequential number of the picture in the 
% 	notes
% 3) Insert the following block in your LaTeX code in the place you 
% 	want to insert the figure BUT LEAVE IT AS A COMMENT (with the %
% 	at the beginning of the line) since it will not work on athena: 
%
% \begin{figure}[h]
% \begin{center}
% \mbox{\psfig{figure=notes-nn-fig-mm.ps}}
% \caption{A very nice picture.}
% \label{fig:mm}
% \end{center}
% \end{figure}
%
% 	of course the picture will not show up when you compile and 
% 	print your notes, but don't worry the TA will take care of it. 
% 4) When you mail the TA the LaTeX code mail him/her the PostScript
%	files for the figures as well 
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes start here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Take-home Midterm: Oct 30.

Topics Covered:
\begin{itemize}
\item Coin-flipping
\item Proof of knowledge:
\begin{itemize}
\item as identification protocol
\item definition
\item of discrete log
\item in zero knowledge
\end{itemize}

\end{itemize}

\section{Coin-flipping}
Alice and Bob wants to decide something on the phone. Can you flip 
coins on the phone? 
\begin{eqnarray*}
\mbox{Alice} & & \mbox{Bob} \\
b\in_{R} \{0,1\} & \stackrel{c=\mbox{\scriptsize commit}(b)}{\longrightarrow} & \\
 & {\stackrel{\quad b'\quad }{\longleftarrow}} & b'\in_{R} \{0,1\} \\
 & \stackrel{b,\ \mbox{\scriptsize open}(c)}{\longrightarrow} & \\
\end{eqnarray*}

Result $=b \oplus b'$. Both Alice and Bob cannot influence the result. 
They can also play other games with similar protocols. 

\section{Proof of Knowledge}
Alice (Prover) knows x such that $y=g^x \pmod p$, ($x,g,p$ are public).
Alice wants to prove that she knows $x$ to Bob (Verifier). For example, in a 
login
system, Bob is the computer and $x$ is the key for identification. 
How to prove knowledge of $x$ without revealing $x$, or any information
about $x$?

\section{Interactive Protocol}
An interactive protocol is a specification of a back and forth dialougue
between a Prover and a Verifier. At the end of which the Verifier either
``accepts'' or ``rejects''. The Verifier accepts if he is convinced 
that the Prover knows $x$. The interactive protocol has multiple rounds of
`proofs', compared with a single one-way statement in an ordinary proof. 
\begin{description}
\item[Completeness] 
If $P$ knows $x$, then $V$ accepts. 
\item[Soundness]
If $V$ accepts, then $P$ knows $x$. 

\item[Zero-knowledge]
$V$ learns nothing (zero), except that $P$ knows $x$. ($V$ learns nothing 
about $x$.)
(The protocol does not leak any information about $x$.)

\end{description}

{\bf Protocol for proving knowledge of Discrete Logarithm:\\
}
Prover knows $x$ such that $y=g^x \pmod p$.\\
Repeat the following round $t$ times:\\
\begin{eqnarray*}
\mbox{Prover} & & \mbox{Verifier} \\
k\in_{R} Z_{p-1} & \stackrel{s=g^k \bmod p}{\longrightarrow} & \\
& \stackrel{\quad c \quad}{\longleftarrow} & c\in_{R} \{0,1\} \\
& \stackrel{r=k+cx \bmod {(p-1)}}{\longrightarrow} & sy^c\stackrel{?}{=}g^r \\
\end{eqnarray*}
Verifier accpets if the check $sy^c\stackrel{?}{=}g^r$ always succeeds. 

\subsection{Completeness}
If $c=0$, $g^r=g^k=s=sy^{0}=sy^c$.\\
If $c=1$, $g^r=g^{k+x}=g^kg^x=sy^1=sy^c$.

\subsection{Soundness}
If Verifier accepts, then Prover knows $x$.
\begin{definition}
A program $P$ knows $x$ in a given state if it is possible 
to easily extract $x$ by examining $P$'s outputs to several different 
inputs (from a same given starting state).
\end{definition}

In this case, we have:\\
\[
\begin{array}{cl}
\mbox{input $c=0$} & \mbox{output $k$} \\
\mbox{input $c=1$} & \mbox{output $k+x \pmod {p-1}$}
\end{array}\]
Thus $x \pmod {p-1}$ is known by $P$. 
Since $P$ has demonstrated her ability to respond to challenges, she must
be prepared to respond either way. 

Can she cheat?

\begin{eqnarray*}
P\ \mbox{guesses $c=0$}&:&\begin{array}[t]{l}
			      \mbox{pick $k\in_R Z_{p-1}$}\\
				\mbox{output $s=g^k \pmod p$} \\
				r=k \end{array}      \\
P\ \mbox{guesses $c=1$}&: &\begin{array}[t]{l}
			      \mbox{pick $\overbrace{k+x}^r  \in_R Z_{p-1}$}\\
				\mbox{output $s=\frac{g^{k+x}}{g^x}=
                                      \frac{g^{k+x}}{y} \pmod p$} \\
				r=k+x \end{array}    
\end{eqnarray*}

She can only succeed with probability 
$2^{-t}$ by guessing the challenges ($c$). 
Therefore, $P$ must `know' $x$. 



\section{Zero-knowledge}
We will show that the Verifier learns nothing about $x$ (except that $P$ knows 
$x$).
\begin{definition}
A {\em transcript} is a record of all messages, all coin flips and all public 
information seen 
by the Verifier.  It is what the Verifier ``takes home'' when the protocol is 
over. 
\end{definition}

A transcript has a probability distribution depending on the random coin flips 
of $P$ and $V$.
The Verifier gets a sample of transcript according to the probability 
distribution. 
However, we claim that $V$ can sample transcripts with the same probability 
distribution (perfect Zero-knowledge!)
on his own. This implies that $P$ has not given $V$ anything that $V$ cannot 
get on his own, and thus 
$P$ has released zero knowledge about $x$ by engaging in the protocol (she is 
not worse off).

{\bf The Transcripts of the Interactive Protool}
\begin{eqnarray*}
&&\mbox{$s$ is uniform in $Z^*_{p}$}  \\
&&\mbox{$c$ is uniform in $\{0,1\}$}  \\
&&\mbox{$r$ is uniform in $Z_{p-1}$}  
\end{eqnarray*}
Such that $sy^c=g^r$

{\bf Construction of sample transcripts without knowing $x$}
\[
\left[\begin{array}{l}
\mbox{pick $c\in_R \{0,1\}$}\\
\mbox{pick $r\in_R Z_{p-1}$}\\
\mbox{compute $s=\frac{g^r}{y^c} \pmod p$}\\
\mbox{output $(s,c,r)$}\\
\end{array}\right] \mbox{repeat for $t$ rounds}
\]

Since we have an identical distribution here, an honest verifier gains zero 
knowledge.




%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Your notes end here!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\end{document}
















