On Concurrent and Resettable Zero-Knowledge Proofs for NP

TL;DR

This paper introduces a concurrent zero-knowledge proof system for NP that remains secure in asynchronous environments, with near-optimal round complexity, and extends it to resettable zero-knowledge protocols.

Contribution

It presents the first concurrent zero-knowledge proof system for all NP languages that maintains security in asynchronous settings and achieves near-optimal round complexity.

Findings

Supports all NP languages in concurrent zero-knowledge

Achieves $ ilde{O}( ext{log}^2 k)$ rounds, close to the theoretical lower bound

Extends to resettable zero-knowledge with similar round complexity

Abstract

A proof is concurrent zero-knowledge if it remains zero-knowledge when many copies of the proof are run in an asynchronous environment, such as the Internet. It is known that zero-knowledge is not necessarily preserved in such an environment. Designing concurrent zero-knowledge proofs is a fundamental issue in the study of zero-knowledge since known zero-knowledge protocols cannot be run in a realistic modern computing environment. In this paper we present a concurrent zero-knowledge proof systems for all languages in NP. Currently, the proof system we present is the only known proof system that retains the zero-knowledge property when copies of the proof are allowed to run in an asynchronous environment. Our proof system has $\tilde{O}(\log^2 k)$ rounds (for a security parameter $k$), which is almost optimal, as it is shown by Canetti Kilian Petrank and Rosen that black-box concurrent zero-knowledge requires $\tilde{\Omega}(\log k)$ rounds. Canetti, Goldreich, Goldwasser and Micali introduced the notion of {\em resettable} zero-knowledge, and modified an earlier version of our proof system to obtain the first resettable zero-knowledge proof system. This protocol requires $k^{\theta(1)}$ rounds. We note that their technique also applies to our current proof system, yielding a resettable zero-knowledge proof for NP with $\tilde{O}(\log^2 k)$ rounds.