Lecture 1: Introduction and History of Zero Knowledge Proofs

What this lecture covers

This opening lecture asks a simple question: can a prover convince a verifier that a mathematical claim is true without revealing why it's true? Shafi Goldwasser builds up to zero knowledge proofs starting from classical NP proofs, where a short witness string convinces a polynomial-time verifier, then shows why that model reveals too much.

The lecture introduces interaction and randomness as the two new ingredients that make zero knowledge possible, works through several concrete examples (quadratic residues, graph isomorphism, three-coloring), and ends with a tour of how interactive proofs reshaped complexity theory. After watching, you should be able to explain what completeness, soundness, and the simulation paradigm mean, and why zero knowledge proofs need both interaction and randomness.

Key ideas

• NP proof: a short witness string that a polynomial-time verifier checks; it convinces the verifier but usually leaks extra information (such as the actual prime factors or a square root).
• Completeness and soundness: completeness means an honest prover always convinces the verifier of a true claim; soundness means no prover, however powerful, can convince the verifier of a false claim except with negligible probability.
• Zero knowledge: an interactive proof is zero knowledge if whatever the verifier learns during the interaction could have been produced by the verifier alone, using a simulator, without talking to a prover.
• Simulation paradigm: a protocol is zero knowledge for a claim if there's a simulator whose output distribution is computationally indistinguishable from the real interaction's transcript.
• Proof of knowledge: a proof system proves knowledge of a witness if an extractor, allowed to rewind and re-run the prover, can recover that witness with high probability.
• Commitment scheme: a way to seal a value (like a color) so it's hidden until later revealed, satisfying hiding (can't tell what's inside) and binding (can't change it once sealed).
• Zero knowledge for all of NP: assuming one-way functions exist, every NP language has a computational zero knowledge interactive proof, built from a zero knowledge protocol for graph three-coloring.
• Arthur-Merlin games and Fiat-Shamir: when the verifier only tosses public coins, the interaction can often be collapsed into a single non-interactive message using a hash function in place of the verifier's coin tosses.

Walkthrough

Classical proofs and NP proofs (0:00)

The lecture opens by contrasting classical mathematical proofs with the computer-science model of an NP proof, where a prover sends a witness string and a polynomial-time verifier checks it. Examples include proving a number is a product of two large primes, proving a value is a quadratic residue mod n, and proving two graphs are isomorphic. In each case, the verifier ends up learning more than just "the claim is true" — it also learns the witness itself.

Interaction and randomness (12:13)

To hide the witness, the proof model changes: the verifier becomes an active participant who tosses coins and asks unpredictable questions, and the model accepts a small, quantifiable probability of error. The lecture illustrates this with a physical example — convincing a color-blind verifier that a page has two colors by having them flip the page and asking the prover to detect the flip, repeated to shrink the error probability.

Quadratic residues and the formal definition (19:22)

The quadratic residue example is developed into a full zero knowledge protocol: the prover commits to a random square, and the verifier chooses which of two related square roots to see. Repeating this catches a cheating prover with high probability. This leads to the formal definitions of an interactive proof, the verifier's "view," the simulation paradigm, and computational versus perfect zero knowledge.

Proofs of knowledge and graph isomorphism (48:50)

The lecture defines what it means for a prover to "know" a witness, using a rewinding extractor that runs the prover multiple times from the same starting point. It then applies the same ideas to graph isomorphism: the prover commits to a random relabeling of one graph and reveals an isomorphism to whichever original graph the verifier asks for.

Zero knowledge for all of NP (59:59)

Goldwasser Song and coauthors' result that, assuming one-way functions exist, every NP language has a zero knowledge interactive proof is introduced via a protocol for graph three-coloring: the prover commits to a randomly permuted coloring and reveals the colors of a randomly chosen edge, repeating until the error probability is negligible. Since three-coloring is NP-complete, this extends to any NP statement through reduction.

Applications and non-isomorphism (1:16:16)

The lecture covers early applications such as identity authentication without storing passwords, and protocol transformation from honest to malicious players. It then shows a harder example: proving two graphs are not isomorphic, which has no short NP witness but does have an interactive proof, motivating the more general question of what interactive proofs can achieve beyond NP.

Complexity theory highlights (1:32:32)

The lecture closes with a survey of how interactive proofs influenced complexity theory: proving PSPACE statements interactively, multi-prover interactive proofs, the PCP theorem, and recent results connecting multi-prover proofs to quantum computation.

Before you watch

• Basic familiarity with NP, polynomial time, and what a witness is will help, since the lecture builds directly on the classical NP proof model.
• Some comfort with modular arithmetic (quadratic residues mod n) makes the central running example easier to follow.
• No prior cryptography background is assumed; the lecture defines commitment schemes and one-way functions as it goes.

Check your understanding

1. Why does sending a factorization or a square root as an NP proof fail to be zero knowledge?
2. In the two-color page example, why does repeating the coin-flip protocol reduce the verifier's chance of being fooled?
3. What does it mean for a simulator's output to be "computationally indistinguishable" from a real interaction's view?
4. Why is proving graph non-isomorphism harder than proving isomorphism, and how does the lecture's protocol get around this?
5. What role does the random permutation of colors play in the zero knowledge three-coloring protocol?