TY - GEN
T1 - Interactive PCP
AU - Kalai, Yael Tauman
AU - Raz, Ran
PY - 2008
Y1 - 2008
N2 - A central line of research in the area of PCPs is devoted to constructing short PCPs. In this paper, we show that if we allow an additional interactive verification phase, with very low communication complexity, then for some NP languages, one can construct PCPs that are significantly shorter than the known PCPs (without the additional interactive phase) for these languages. We give many cryptographical applications and motivations for our results and for the study of the new model in general. More specifically, we study a new model of proofs: interactive-PCP. Roughly speaking, an interactive-PCP (say, for the membership x ∈ L) is a proof-string that can be verified by reading only one of its bits, with the help of an interactive-proof with very small communication complexity. We show that for membership in some NP languages L, there are interactive-PCPs that are significantly shorter than the known (non-interactive) PCPs for these languages. Our main result is that for any constant depth Boolean formula Φ(z1,...,zk) of size n (over the gates ∧,∨,⊕,¬), a prover, Alice, can publish a proof-string for the satisfiability of Φ, where the size of the proof-string is poly(k). Later on, any user who wishes to verify the published proof-string needs to interact with Alice via a short interactive protocol of communication complexity poly(logn), while accessing the proof-string at a single location. Note that the size of the published proof-string is poly(k), rather than poly(n), i.e., the size is polynomial in the size of the witness, rather than polynomial in the size of the instance. This compares to the known (non-interactive) PCPs that are of size polynomial in the size of the instance. By reductions, this result extends to many other central NP languages (e.g., SAT, k-clique, Vertex-Cover, etc.). More generally, we show that the satisfiability of ∧i=1n[Φi(z 1,...,zk) = 0], where each Φi(z 1,...,zk) is an arithmetic formula of size n (say, over double-struck G double-struck F[2]) that computes a polynomial of degree d, can be proved by a published proof-string of size poly(k,d). Later on, any user who wishes to verify the published proof-string needs to interact with the prover via an interactive protocol of communication complexity poly(d,logn), while accessing the proof-string at a single location. We give many applications and motivations for our results and for the study of the notion of interactive PCP in general. In particular, we have the following applications: Succinct zero knowledge proofs: We show that any interactive PCP, with certain properties, can be converted into a zero-knowledge interactive proof. We use this to construct zero-knowledge proofs of communication complexity polynomial in the size of the witness, rather than polynomial in the size of the instance, for many NP languages. Succinct probabilistically checkable arguments: In a subsequent paper, we study the new notion of probabilistically checkable argument, and show that any interactive PCP, with certain properties, translates into a probabilistically checkable argument [18]. We use this to construct probabilistically checkable arguments of size polynomial in the size of the witness, rather than polynomial in the size of the instance, for many NP languages. Commit-Reveal schemes: We show that Alice can commit to a string w of k bits, by a message of size poly(k), and later on, for any predicate Φ of size n, whose satisfiability can be proved by an efficient enough interactive PCP with certain properties, Alice can prove the statement Φ(w)=1, by a zero-knowledge interactive proof with communication complexity poly(logn). (Surprisingly, the communication complexity may be significantly smaller than k and n).
AB - A central line of research in the area of PCPs is devoted to constructing short PCPs. In this paper, we show that if we allow an additional interactive verification phase, with very low communication complexity, then for some NP languages, one can construct PCPs that are significantly shorter than the known PCPs (without the additional interactive phase) for these languages. We give many cryptographical applications and motivations for our results and for the study of the new model in general. More specifically, we study a new model of proofs: interactive-PCP. Roughly speaking, an interactive-PCP (say, for the membership x ∈ L) is a proof-string that can be verified by reading only one of its bits, with the help of an interactive-proof with very small communication complexity. We show that for membership in some NP languages L, there are interactive-PCPs that are significantly shorter than the known (non-interactive) PCPs for these languages. Our main result is that for any constant depth Boolean formula Φ(z1,...,zk) of size n (over the gates ∧,∨,⊕,¬), a prover, Alice, can publish a proof-string for the satisfiability of Φ, where the size of the proof-string is poly(k). Later on, any user who wishes to verify the published proof-string needs to interact with Alice via a short interactive protocol of communication complexity poly(logn), while accessing the proof-string at a single location. Note that the size of the published proof-string is poly(k), rather than poly(n), i.e., the size is polynomial in the size of the witness, rather than polynomial in the size of the instance. This compares to the known (non-interactive) PCPs that are of size polynomial in the size of the instance. By reductions, this result extends to many other central NP languages (e.g., SAT, k-clique, Vertex-Cover, etc.). More generally, we show that the satisfiability of ∧i=1n[Φi(z 1,...,zk) = 0], where each Φi(z 1,...,zk) is an arithmetic formula of size n (say, over double-struck G double-struck F[2]) that computes a polynomial of degree d, can be proved by a published proof-string of size poly(k,d). Later on, any user who wishes to verify the published proof-string needs to interact with the prover via an interactive protocol of communication complexity poly(d,logn), while accessing the proof-string at a single location. We give many applications and motivations for our results and for the study of the notion of interactive PCP in general. In particular, we have the following applications: Succinct zero knowledge proofs: We show that any interactive PCP, with certain properties, can be converted into a zero-knowledge interactive proof. We use this to construct zero-knowledge proofs of communication complexity polynomial in the size of the witness, rather than polynomial in the size of the instance, for many NP languages. Succinct probabilistically checkable arguments: In a subsequent paper, we study the new notion of probabilistically checkable argument, and show that any interactive PCP, with certain properties, translates into a probabilistically checkable argument [18]. We use this to construct probabilistically checkable arguments of size polynomial in the size of the witness, rather than polynomial in the size of the instance, for many NP languages. Commit-Reveal schemes: We show that Alice can commit to a string w of k bits, by a message of size poly(k), and later on, for any predicate Φ of size n, whose satisfiability can be proved by an efficient enough interactive PCP with certain properties, Alice can prove the statement Φ(w)=1, by a zero-knowledge interactive proof with communication complexity poly(logn). (Surprisingly, the communication complexity may be significantly smaller than k and n).
UR - http://www.scopus.com/inward/record.url?scp=49049120522&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=49049120522&partnerID=8YFLogxK
U2 - 10.1007/978-3-540-70583-3_44
DO - 10.1007/978-3-540-70583-3_44
M3 - Conference contribution
AN - SCOPUS:49049120522
SN - 3540705821
SN - 9783540705826
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 536
EP - 547
BT - Automata, Languages and Programming - 35th International Colloquium, ICALP 2008, Proceedings
T2 - 35th International Colloquium on Automata, Languages and Programming, ICALP 2008
Y2 - 7 July 2008 through 11 July 2008
ER -