Lecture 11: From Practice to Theory

What this lecture covers

This lecture steps back from the practical SNARK constructions of earlier lectures to ask what theoretical guarantees actually back them. It answers why interactive zero-knowledge protocols are harder to reason about than their non-interactive counterparts, why the Fiat-Shamir transform (used throughout the course to remove interaction) is only proven secure under a modeling assumption, and what can still be proven without that assumption.

After watching, you can explain why parallel repetition of a zero-knowledge protocol can break its zero-knowledge property, what the random oracle model assumes and why it is not literally achievable, and how recent theoretical work builds Fiat-Shamir instantiations and batch-NP SNARKs from falsifiable cryptographic assumptions instead of random oracles.

Key ideas

• Falsifiable assumption: a security assumption tied to a concrete, efficiently checkable computational task (e.g., discrete log is hard, LWE is hard), as opposed to an idealized model like the random oracle.
• Parallel repetition breaks zero knowledge: repeating a sound zero-knowledge protocol many times in parallel reduces soundness error as expected, but the standard simulator no longer runs in polynomial time, and a result by Dwork-Naor-Reingold-Stockmeyer shows a real tension between zero knowledge and Fiat-Shamir instantiability for such protocols.
• Random oracle model (ROM): an idealized assumption that an adversary can only use a hash function as a black box, never its internal structure; the Fiat-Shamir transform provably removes interaction from constant-round public-coin protocols in this model.
• Correlation intractability: a hash family is correlation intractable for a relation R if it is hard to find an input x with (x, hash(x)) in R; this is the property used to instantiate Fiat-Shamir without a literal random oracle.
• Uninstantiability results: there exist functions (via a diagonalization argument, hashing a function's own description) for which no efficient hash family can be correlation intractable, and there exist specific interactive protocols, secure under Fiat-Shamir in the ROM, that are provably insecure under every concrete hash function.
• Snarks with knowledge soundness resist falsifiable-assumption constructions: extracting a long witness from a short proof seems to require a non-falsifiable "magic extraction" assumption, which is why general-purpose SNARKs still rely on random oracles or knowledge assumptions.
• Somewhere statistically binding commitment: a succinct commitment (like a Merkle tree variant) that can be sampled to be statistically binding to one chosen position while looking computationally indistinguishable from any other choice, used to make a batch protocol behave as if it were statistically sound.
• SNARKs for batch NP: proving many small NP statements with a proof whose length depends only polylogarithmically on the number of statements; shown to be buildable without random oracles, and powerful enough to also yield SNARKs for deterministic computation.

Walkthrough

Why proof system theory matters, and three research threads (0:01)

The lecture opens by situating cryptographic proof systems as foundational to both practical security (digital signatures, authentication) and theoretical cryptography (secure multiparty computation). It frames the field's questions into three overlapping threads: feasibility (can a protocol with given properties exist at all, and under what setup or adversary model), minimizing assumptions (trusted setup versus plain model, falsifiable versus non-falsifiable assumptions), and efficiency (rounds, communication, prover and verifier time).

Interactive zero knowledge and the parallel repetition problem (7:04)

Using the three-coloring zero-knowledge protocol from the course's first lecture as a running example, the lecture reviews how the commit-challenge-open structure achieves soundness and zero knowledge via a rewinding simulator. It then shows that naively repeating this protocol in parallel to shrink soundness error breaks the simulation argument, since the simulator would need exponentially many guesses to match the verifier's now much larger challenge space. It cites the Dwork-Naor-Reingold-Stockmeyer result showing this parallel-repeated protocol cannot be both zero knowledge and Fiat-Shamir-instantiable, and surveys open directions this motivates: minimal round complexity, more prover-efficient protocols, and security against quantum or concurrent adversaries.

Proving Fiat-Shamir sound in the random oracle model (22:17)

The lecture defines succinct non-interactive arguments (SNARGs) and recaps the Fiat-Shamir transform, then sketches a proof that Fiat-Shamir is sound when the hash function is modeled as a random oracle: any prover breaking the non-interactive protocol with a bounded number of hash queries can be converted into a prover breaking the interactive protocol, at the cost of a security loss proportional to the number of queries (and growing with the number of rounds).

Where the random oracle heuristic fails (30:23)

The lecture presents a diagonalization-style counterexample: for the function that runs a program on its own description, no efficient hash family can be correlation intractable, because feeding a hash function's own description into itself always breaks the property. It notes this requires unbounded input length, so bounded-input-length correlation intractability remains plausible. It then cites Barak-Goldreich-Kalai-style results showing specific constant-round protocols that are secure under Fiat-Shamir with a random oracle but provably insecure with any concrete hash function, and connects this concern to recursive SNARK composition, where a SNARK verifies a proof about a hash function applied to related inputs.

Building correlation-intractable hash functions from falsifiable assumptions (44:51)

The lecture shows that general SNARKs with knowledge soundness resist falsifiable-assumption constructions, since extracting a witness from a short proof needs an assumption that effectively "magics" the extraction. It then narrows scope to bounded-length, bounded-time correlation intractability, and sketches a construction from fully homomorphic encryption: the hash key hides an encrypted function G, hashing evaluates G homomorphically, and a proof by contradiction (using a specially chosen G* and indistinguishability of encryptions) shows the resulting hash family is correlation intractable. It surveys further constructions from learning-with-errors and decisional Diffie-Hellman assumptions.

From correlation intractability to sound Fiat-Shamir instantiation (1:08:05)

The lecture connects correlation intractability back to Fiat-Shamir by defining "bad" verifier challenges (those for which some prover message would make the verifier accept) and showing that avoiding correlation with the relation of bad challenges yields a sound non-interactive protocol, at least for statistically sound interactive protocols with round-by-round soundness.

SNARKs for batch NP without random oracles (1:15:06)

The lecture works through the Chaudhary-Jain-Jin construction: starting from a PCP-based SNARG template (Kilian-Micali style) that is not statistically sound, it batches many small NP statements together and uses a somewhere statistically binding commitment, sampled to be information-theoretically bound to whichever statement happens to be false, to recover a form of statistical soundness that correlation intractability can then secure. Recursion is used to remove the remaining dependence on the number of statements, yielding a succinct proof.

Open problems (1:31:22)

The lecture closes by naming two open questions: characterizing which interactive protocols can be soundly Fiat-Shamir-compiled without random oracles (the IOP-based SNARKs taught earlier in the course remain unresolved), and whether SNARKs for general NP statements can ever be built from falsifiable assumptions at all.

Before you watch

• Review the zero-knowledge three-coloring protocol and simulation paradigm from the course's first lecture, since this lecture builds directly on it.
• Recall the interactive-oracle-proof and PCP-based SNARK constructions from earlier lectures, since the batch-NP construction reuses that template.
• Familiarity with the Fiat-Shamir transform as used elsewhere in the course is assumed throughout.

Check your understanding

1. Why does parallel repetition of the three-coloring zero-knowledge protocol reduce soundness error but break the standard simulation argument for zero knowledge?
2. What does the random oracle model assume about an adversary's use of a hash function, and why can no real hash function literally satisfy that assumption?
3. What is a correlation-intractable hash function, and how does the "run a program on its own description" counterexample show some correlation intractability notions are impossible?
4. Why do SNARKs with knowledge soundness appear resistant to constructions from falsifiable assumptions, while plain soundness (SNARGs) is more open?
5. How does a somewhere statistically binding commitment let the batch-NP protocol behave as if it were statistically sound, even though the full commitment cannot be?