## On the Knowledge Complexity of ... (1996)

### Cached

### Download Links

- [www.renyi.hu]
- [www.cs.technion.ac.il]
- [theory.lcs.mit.edu]
- [ftp.wisdom.weizmann.ac.il]
- DBLP

### Other Repositories/Bibliography

Venue: | In 37th FOCS |

Citations: | 26 - 7 self |

### BibTeX

@INPROCEEDINGS{Petrank96onthe,

author = {Erez Petrank and Gábor Tardos},

title = {On the Knowledge Complexity of ...},

booktitle = {In 37th FOCS},

year = {1996},

pages = {494--503}

}

### Years of Citing Articles

### OpenURL

### Abstract

We show that if a language has an interactive proof of logarithmic statistical knowledge-complexity, then it belongs to the class AM \ co AM. Thus, if the polynomial time hierarchy does not collapse, then NP-complete languages do not have logarithmic knowledge complexity. Prior to this work, there was no indication that would contradict NP languages being proven with even one bit of knowledge. Our result is a common generalization of two previous results: The rst asserts that statistical zero knowledge is contained in AM \ co AM [F-89, AH-91], while the second asserts that the languages recognizable in logarithmic statistical knowledge complexity are in BPP NP [GOP-94]. Next, we consider the relation between the error probability and the knowledge complexity of an interactive proof. Note that reducing the error probability via repetition is not free: it may increase the knowledge complexity. We show that if the negligible error probability (n) is less than 2 3k(n) (where k(n) is the knowledge complexity) then the language proven is in the third level of the polynomial time hierarchy (specically, it is in AM NP . In the standard setting of negligible error probability, there exist PSPACE-complete languages which have sub-linear knowledge complexity. However, if we insist, for example, that the error probability is less than 2 n 2 , then PSPACE-complete languages do not have sub-quadratic knowledge complexity, unless PSPACE= P 3 . In order to prove our main result, we develop an AM protocol for checking that a samplable distribution D has a given entropy h. For any fractions ; , the verier runs in time polynomial in 1= and log(1=) and fails with probability at most to detect an additive error in the entropy. We believe that this ...

### Citations

8550 |
Elements of Information Theory
- Cover, Thomas
- 1991
(Show Context)
Citation Context ...e this increase in computing ability. Thus, knowledge complexity is a fundamental measure of interaction between parties, and it differs from other measures of interaction such as information entropy =-=[25, 9]-=- and communication complexity [26, 22]. The following examples may help to illustrate what we mean. In all these examples we assume that Bob is restricted to probabilistic polynomialtime (in the param... |

1486 | Probability inequalities for sums of bounded random variables - Hoeffding - 1963 |

1173 |
Probabilistic encryption
- Goldwasser, Micali
- 1984
(Show Context)
Citation Context ...esidues mod N with Jacobi Symbol +1. Recall that one fourth of the elements of Z N are in QNR + N and that it is considered infeasible to distinguish elements of QNR + N from quadratic residues mod N =-=[15]-=-. Suppose that Alice uniformly selects a y 2 QNR + N and sends it to Bob. It seems that Bob has gained some knowledge (as we don't know how to uniformly sample QNR + N in polynomial-time when only giv... |

1032 | The Knowledge Complexity of Interactive Proof Systems
- Goldwasser, Micali, et al.
- 1989
(Show Context)
Citation Context ... is that the ensembles are identical. The resulting definition is called perfect zero-knowledge. An example of a language having a perfect zeroknowledge interactive proof is Quadratic Non-Residousity =-=[17]-=-. 2. Slightly more liberal is the requirement that the ensembles are statistically close, namely that their variation distance (Norm-1 difference) is negligible (i.e., smaller than any polynomial frac... |

667 | Universal classes of hash functions - Carter, Wegman - 1979 |

613 | Communication complexity
- Kushilevitz, Nisan
- 1997
(Show Context)
Citation Context ... Thus, knowledge complexity is a fundamental measure of interaction between parties, and it differs from other measures of interaction such as information entropy [27, 9] and communication complexity =-=[28, 24]-=-. The following examples may help to illustrate what we mean. In all these examples we assume that Bob is restricted to probabilistic polynomialtime (in the parameter n), whereas no computation restri... |

515 | How to play any mental game, or a completeness theorem for protocols with honest majority - Goldreich, Micali, et al. - 1987 |

509 | Theory and applications of trapdoor functions - Yao - 1982 |

496 |
Graphs and Hypergraphs
- Berge
- 1973
(Show Context)
Citation Context ...pass in the protocol (the communication complexity) is at most log m. It is known that the chromatic index of the graph is either \Delta (the degree of the graph) or \Delta + 1 (Vizing's Theorem, see =-=[Ber]-=-). Thus, the knowledge complexity of this protocol is at most 1 even in the hint sense. (It is possible to simulate the protocol efficiently given which of the options (\Delta or \Delta + 1) applies t... |

383 |
Some complexity questions related to distributive computing
- Yao
- 1979
(Show Context)
Citation Context ... Thus, knowledge complexity is a fundamental measure of interaction between parties, and it differs from other measures of interaction such as information entropy [25, 9] and communication complexity =-=[26, 22]-=-. The following examples may help to illustrate what we mean. In all these examples we assume that Bob is restricted to probabilistic polynomialtime (in the parameter n), whereas no computation restri... |

374 | Proofs that Yield Nothing But Their Validity or All Languages in NP Have Zero-Knowledge Proof Systems - Goldreich, Micali, et al. - 1991 |

304 | Arthur-Merlin games: A randomized proof system, and a hierarchy of complexity classes - Babai, Moran - 1988 |

302 | Algebraic Methods for Interactive Proof Systems - Lund, Fortnow, et al. - 1990 |

299 | Trading group theory for randomness
- Babai
- 1985
(Show Context)
Citation Context ...t is clear that if both prover and verifier act according to the protocol, then completeness is ensured. Claim 6.1 implies the soundness of the protocol. The number of rounds is a constant, and using =-=[5]-=- and [19] we get L 2 AM[2] as desired. 2 Theorem 6.3 Let L be a language that has an interactive proof with knowledge complexity k = O(log(n)) in the Hint sense, then L 2 coAM[2]. Proof: Let us define... |

281 | Random generation of combinatorial structures from a uniform distribution, Theoretical Computer Science 43 - Jerrum, Valiant, et al. - 1986 |

205 |
Riemann’s hypothesis and tests for primality
- Miller
(Show Context)
Citation Context ...s with respect to the oracle measure (cf., Proposition 4.3). An obvious bound with respect to the hint measure is the length of the smallest element in QNR + N (which under ERH has length O(log jN j) =-=[23]-=-), and it is not clear if one can provide a better bound. As per Example 5, Alice sends a single bit which can be easily simulated by one oracle query (or by a good subspace of density 1/2). Thus, the... |

190 | On the composition of zero-knowledge proof systems
- Goldreich, Krawczyk
- 1996
(Show Context)
Citation Context ...parallel) repetitions of the proof system. Things become less robust when zero-knowledge is involved, since the latter is not known to be preserved under parallel repetitions (see negative results in =-=[12]-=-). Still, zero-knowledge (w.r.t. auxiliary-input) is preserved under sequential repetitions (see [14]). However, not all measures of knowledge complexity defined below are preserved under sequential r... |

159 | Proofs that yield nothing but their validity and a method of cryptographic protocol design - Goldreich, Micali, et al. |

145 | A complexity theoretic approach to randomness - Sipser - 1983 |

141 | Foundations of Cryptography (Fragments of a book)", Weizmann Inst - Goldreich - 1995 |

133 |
Rabin functions: Certain parts are as hard as the whole
- CHOR, GOLDREICH, et al.
- 1988
(Show Context)
Citation Context ... 2 (mod N )). Example 5 Let N be as in Example 4. Suppose that Alice agrees to provide Bob with the least significant bit of the square root (mod N) of any quadratic residue mod N of Bob's choice. By =-=[18, 2]-=- such an answer (by Alice) does yield knowledge to Bob and furthermore jN j answers of this form allow Bob to factor N . Thus, although each answer yields little knowledge (as can be argued analogousl... |

117 | Does co-NP have short interactive proofs - Boppana, H˚astad, et al. - 1987 |

112 | Definitions and properties of zero-knowledge proof systems - Goldreich, Oren - 1994 |

87 |
The knowledge complexity of interactive proofs
- Goldwasser, Micali, et al.
- 1989
(Show Context)
Citation Context ... Technion -- Israel Institute of Technology, Haifa 32000, Israel. E-mail: erez@cs.technion.ac.il. 0 1 Introduction One of the many contributions of the seminal paper of Goldwasser, Micali and Rackoff =-=[16]-=- is the introduction of the notion of knowledge complexity. Knowledge complexity is intended to measure the computational advantage gained by interaction. Hence, something that can be obtained without... |

86 | The complexity of perfect zero-knowledge
- Fortnow
- 1987
(Show Context)
Citation Context ...on difference (Norm-1 difference) is negligible (i.e., smaller than any polynomial fraction). The resulting definition is called statistical (or almost perfect) zero-knowledge. The results of Fortnow =-=[F] and Aiell-=-o and Hastad [AH] on the "complexity of zero-knowledge" refer to this definition. 3. Most liberal is the requirement that the distributions are indistinguishable by all probabilistic polynom... |

67 |
A mathematical theory of communication," Bell Sys
- Shannon
- 1948
(Show Context)
Citation Context ...e this increase in computing ability. Thus, knowledge complexity is a fundamental measure of interaction between parties, and it differs from other measures of interaction such as information entropy =-=[25, 9]-=- and communication complexity [26, 22]. The following examples may help to illustrate what we mean. In all these examples we assume that Bob is restricted to probabilistic polynomialtime (in the param... |

42 | The complexity of approximate counting - Stockmeyer - 1983 |

41 |
Direct minimum-knowledge computations
- Yung, Impagliazzo
- 1988
(Show Context)
Citation Context ...ng the existence of secure bit commitment scheme (i.e., the existence of one-way functions), all languages having interactive proofs have interactive proofs of computational knowledge-complexity zero =-=[8, 21]-=-. 3.2 Analyzing the examples of the introduction Alice's behavior in Examples 1 and 2 is zero-knowledge and thus of knowledge-complexity zero under all our definitions. In general, it is easy to see t... |

40 | The (true) complexity of statistical zero knowledge - Bellare, Micali, et al. - 1990 |

38 | On Relationships Between Statistical Zero-Knowledge Proofs - Okamoto - 2000 |

35 |
Everything Provable is Provable in Zero-Knowledge
- Ben-Or, Gutfreund
- 1988
(Show Context)
Citation Context ...ng the existence of secure bit commitment scheme (i.e., the existence of one-way functions), all languages having interactive proofs have interactive proofs of computational knowledge-complexity zero =-=[8, 23]-=-. 3.2 Analyzing the examples of the introduction Alice's behavior in Examples 1 and 2 is zero-knowledge and thus of knowledge-complexity zero under all our definitions. In general, it is easy to see t... |

30 | A fast and Simple Randomized Algorithm for the Maximal Independent Set Problem - Alon, Babai, et al. - 1986 |

30 | Comparing Entropies in Statistical Zero-Knowledge with Applications to the Structure of SZK - Goldreich, Vadhan - 1999 |

26 |
Why and How to Establish a Private Code on a Public Network
- Goldwasser, Micali, et al.
- 1982
(Show Context)
Citation Context ... 2 (mod N )). Example 5 Let N be as in Example 4. Suppose that Alice agrees to provide Bob with the least significant bit of the square root (mod N) of any quadratic residue mod N of Bob's choice. By =-=[18, 2]-=- such an answer (by Alice) does yield knowledge to Bob and furthermore jN j answers of this form allow Bob to factor N . Thus, although each answer yields little knowledge (as can be argued analogousl... |

18 |
Perfect zero-knowledge languages can be recognized in two rounds
- Aiello, H˚astad
- 1987
(Show Context)
Citation Context ...omial fraction in the length of the common input). The resulting definition is called statistical (or almost perfect) zero-knowledge. For example, the results of Fortnow [10] and of Aiello and Hastad =-=[4] on the &q-=-uot;complexity of zero-knowledge" refer to this definition. 3. Most liberal is the requirement that the ensembles are indistinguishable by all probabilistic polynomial time tests. The resulting d... |

18 | Making Zero-Knowledge Provers Efficient
- Bellare, Petrank
- 1992
(Show Context)
Citation Context ...position 4.3) to be the most interesting one. 1.5 Subsequent works Following the conference publication of this paper, subsequent work has been done in two directions. The first direction, pursued in =-=[7]-=-, [13] and [24], focuses on the oracle (or, equivalently fraction) measure of knowledge complexity and is aimed at relating the knowledge complexity of languages to their computational complexity. The... |

9 | On the knowledge complexity of NP
- Petrank, Tardos
- 1996
(Show Context)
Citation Context ...to be the most interesting one. 1.5 Subsequent works Following the conference publication of this paper, subsequent work has been done in two directions. The first direction, pursued in [7], [13] and =-=[24]-=-, focuses on the oracle (or, equivalently fraction) measure of knowledge complexity and is aimed at relating the knowledge complexity of languages to their computational complexity. The first step was... |

8 | Perfect Zero-Knowledge can be Recognized in Two Rounds - Aiello, Hastad - 1987 |

6 |
Private Coins vs
- Goldwasser, Sipser
- 1989
(Show Context)
Citation Context ... of rounds. A simple enhancement in the construction (see [4, 20]) produces also an interactive proof (P 00 ; V 00 ) for L (the complement of L) which also has a constant number of rounds. (Employing =-=[19]-=- and [5] they get that L and L are in AM[2].) We first note that the use of M in these proof systems is limited. The proof considers only the function f M;x which is defined so that f M;x (r) is the o... |

5 | Computational complexity and knowledge complexity
- Goldreich, Ostrovsky, et al.
- 1994
(Show Context)
Citation Context ...ion 4.3) to be the most interesting one. 1.5 Subsequent works Following the conference publication of this paper, subsequent work has been done in two directions. The first direction, pursued in [7], =-=[13]-=- and [24], focuses on the oracle (or, equivalently fraction) measure of knowledge complexity and is aimed at relating the knowledge complexity of languages to their computational complexity. The first... |

3 |
The Complexity of Perfect Zero-Knowledge", Advances in Computing Research: a research annual
- Fortnow
- 1989
(Show Context)
Citation Context ... (i.e., smaller than any polynomial fraction in the length of the common input). The resulting definition is called statistical (or almost perfect) zero-knowledge. For example, the results of Fortnow =-=[10] and of Ai-=-ello and Hastad [4] on the "complexity of zero-knowledge" refer to this definition. 3. Most liberal is the requirement that the ensembles are indistinguishable by all probabilistic polynomia... |

2 |
Knowledge on the Average
- Aiello, Bellare, et al.
- 1995
(Show Context)
Citation Context ...re in AM"coAM. Thus, unless the polynomial time hierarchy collapses, NP-complete languages have super logarithmic knowledge complexity. The second direction, pursued by Aiello, Bellare and Venkat=-=esan [1]-=-, focuses on knowledgecomplexity under the average oracle measure. Firstly, they introduced a more refined definition of average knowledge-complexity and related it to the notion defined in this paper... |

2 |
Computational Complexity and Knowledge Complexity", 26th
- Goldreich, Ostrovsky, et al.
- 1994
(Show Context)
Citation Context ...ion 4.3) to be the most interesting one. 1.5 Subsequent works Following the conference publication of this paper, subsequent work has been done in two directions. The first direction, pursued in [7], =-=[15]-=- and [26], focuses on the oracle (or, equivalently fraction) measure of knowledge complexity and is aimed at relating the knowledge complexity of languages to their computational complexity. The first... |

2 | Making Zero-Knowledge Provers Ecient - Bellare, Petrank - 1992 |

1 |
Everything Provable is
- Ben-or, Goldreich, et al.
- 1990
(Show Context)
Citation Context ...ng the existence of secure bit commitment scheme (i.e., the existence of one-way functions), all languages having interactive proofs have interactive proofs of computational knowledge-complexity zero =-=[8, 21]-=-. 3.2 Analyzing the examples of the introduction Alice's behavior in Examples 1 and 2 is zero-knowledge and thus of knowledge-complexity zero under all our definitions. In general, it is easy to see t... |

1 |
Perfect Zero-Knowledge in AM " coAM. Unpublished (2-page) manuscript explaining the underlying ideas behind [4
- Hastad
- 1994
(Show Context)
Citation Context ...; V ) guaranteed by the hypothesis 17 . They use the simulator to build a new interactive proof (P 0 ; V 0 ) for L which is of constant number of rounds. A simple enhancement in the construction (see =-=[4, 20]-=-) produces also an interactive proof (P 00 ; V 00 ) for L (the complement of L) which also has a constant number of rounds. (Employing [19] and [5] they get that L and L are in AM[2].) We first note t... |

1 | Perfect Zero-Knowledge in AM \ co-AM. Unpublished 2-page manuscript explaining the underlying ideas behind [AH-91 - astad - 1994 |

1 | A preliminary version appeared - IPPSPACE - 1992 |