Zero element

Abstract: Quadratic residuosity and graph isomorphism are classic problems and the canonical examples of zero-knowledge languages. However, despite much research effort, all previous zero-knowledge proofs for them required either unproven complexity assumptions or an unbounded number of rounds of message exchange. For both (and similar) languages, we exhibit zeroknowledge proofs that require 5 rounds and no unproven assumptions. Our solution is essentially optimal, in this setting, due to a recent lower bound argument of Goldreich and Krawczyk. 1 I n t r o d u c t i o n Interactive proofs and especially zero-knowledge ones have found many applications, most notably in the field of secure protocols. In all such proofs, interaction is the crucial resource, as prover and verifier exchange messages in rounds. The fundamental problem here is whether the number of rounds induces a hierarchy. Tha t is, can we prove more languages in zero knowledge given more rounds? In a cryptographic sett ing the answer is no. But little is known for perfect zero-knowledge proofs. These are the ones tha t can be proven to be zero-knowledge without making use of unproven complexity assumptions. For this reason, perfect zero-knowledge is the right context for studying the intrinsic properties of this notion. There is a gap in what we are able to prove about perfect Zero-Knowledge (ZK): Goldreich and Krawczyk [3] * Suppo r t ed in pa r t by NSF g ran t CCR-87-19689. t S u p p o r t e d in pa r t by NSF g ran t DCR-84-13577 a n d A R O g ran t DAALO3-86-K-0171 . I Pa r t of th is work was done at B o s t o n Univers i ty , D e p a r t m e n t of C o m p u t e r Science, par t ia l ly s u p p o r t e d by NSF g ran t DCR-8607492. Permission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct commercial advantage, the ACM copyright notice and the title of the publication and its date appear, and notice is given that copying is by permission of the Association for Computing Machinery. To copy otherwise, or to republish, requires a fee and/or specific permission. show that a language outside BPP requires more than 3 rounds from any perfect ZK proof. On the other hand, the classic examples for perfect zero-knowledge, the languages of quadratic residuosity and graph isomorphism, required an unbounded number of rounds. In this paper we show T h e o r e m The languages of graph isomorphism and quadratic residuosity have 5 round perfect zero knowledge interactive proofs. More generally, we show that any random self-reducible language [7] has a 5 round perfect zero knowledge interactive proof. Perfect zero-knowledge works by carefully exploiting the structure of the problem at hand. It is important not only in practice (where we do not know which functions are one-way), but also in a theoretical setting. For example, our best way to prove that a language L, for which no efficient algorithm is known, is not NPcomplete involves exhibiting a perfect zero-knowledge proof for it [2]. Let us now see, at a very high level, why achieving perfect ZK in constant rounds is hard. Essentially, in a ZK proof, the confidence that a theorem is true is transferred by discrete amounts , or tokens. Each token consists of an elementary protocol that decreases the probabil i ty of error by a factor of, say, 2. Thus, after k tokens have been exchanged, this probabil i ty will be reduced to 2 -k . Tokens can be exchanged sequentially or in parallel ( that is concurrently). The ZK constraint implies that the messages exchanged for a single token can be simulated in expected polynomial time. Tha t is, a probabilistic, efficient simulator can output a token in expected, say, 2 trials without any intervention of the prover, and knowing nothing about the proof. Thus, if the proof transfers tokens one at a time, it is easy for the simulator to generate the view relative to k of them: in expected two trials the simulator will output a "good" first token; after that , in expected two more trials, will output a second "good" token, and so on. Thus, overall, the entire view of the protocol can be © 1990 ACM 089791-361-2/90/0005/0482 $1.50 482 simulated in expected 2k trials. If, however, the prover transfers tokens "all together," the job of the simulator is much harder: the expected number of trials so that all k of them are simultaneously "good," is 2 k. This phenomenon which will be made more precise in the context of graph isomorphism is what defeated researchers ever since ZK came about. The main result of this paper is a technique for squeezing the number of rounds in a interactive proof, while preserving simulatability. The proof of our main theorem involves several new ideas; in particular, a non-cryptographic committal scheme and a novel method of simulation in modes. In fact, although the protocol only requires 5 rounds and is surprisingly simple, the simulation argument is complex. Moreover, our result is essentially optimal due to the general 4-round lower bound of Goldreich and Krawczyk [3]. In this extended abstract we confine ourselves to a proof that graph isomorphism has a 5 round perfect zero knowledge interactive proof. 2 D e f i n i t i o n s 2 .1 P r o b a b i l i t y S p a c e s a n d A l g o r i t h m s These notations and conventions for probabilistic algorithms are derived from [6] and further extended. We emphasize the number of inputs received by an algorithm as follows. If algorithm A receives only one input we write "A(.)"; if it receives two we write "A(., .)", and so on. If A is a probabilistic algorithm then, for any input i the notation A(i) refers to the probability space which to the string (r assigns the probability that A, on input i, outputs or. If S is a probability space we denote by Ps (e ) the probability that S associates with element e. We denote by IS] the set of elements to which S assigns positive probability. If f ( . ) and g( . , . . . ) are probabilistic algorithms then f ( g ( . , . . . ) ) is the probabilistic algorithm obtained by composing f and g (i.e. running f on g's output) . For any inputs x , y , . . , the associated probability space is denoted f (g (x , y , . . . ) ) . If 5: is a probability space then x *-S denotes the algorithm which assigns to x an element randomly selected according to S (that is, x is assigned the value e with probability P s ( e ) ) (in the case that [,9] consists of 3nly one element e we write x ~ e rather than x +--{e}). For probability spaces S, T . . . . , the notation P ( p ( x , y , . . . ) : x ~--S ; y ~--T ; . . . ) denotes the probability that the predicate p(x, y , . . . ) is true after the (ordered) execution of the algorithms x ~-S, y ~ T, etc. The notation f f ( x , y , . . . ) : x ~-S ; y *--7 " ; . . . } t denotes the probability space which to the string ~r assigns the probability P(cr = f ( x , y , . . . ) : x *-S ; y *-T ; . . . ) , f being some function. If S is a finite set we will identify it with the probability space which assigns to each element of S the uniform probability U(S) = ]-~. (Then x ~-S denotes the operation of selecting an element of 5' uniformly at random, and Ps (e ) = U(S) for any e E S). We let P P T denote the set of probabilistic (expected) polynomial time algorithms. 2 . 2 I n t e r a c t i v e T M s a n d P r o t o c o l s Full descriptions of interactive Turing Machines and protocols appear in [5]; we will only summarize the notation we use. The probability that (A, B) accepts the common input x is denoted P ( ( A , B ) accepts x ) , and the probability space of all conversations between A and B on input x is denoted (A ~ B) (x ) (the probability in both cases is taken over the random tapes of both A and B). Sometimes we want to make the coin tosses of B explicit. For any R E {0, 1}* we write B ( R ) for the (deterministic) machine B with R as its random tape. Then (A ~-~ B (R) ) ( x ) denotes the probability space of conversations between A and B(R) on input x (the probability is over the random tapes of A). We let B(R;x ,oq131 . . . a i l f l i -1 ) denote the next message that B ( R ) sends when the conversation up to this point was cq/31 . . . oli_l~i_ 1. Finally, it is convenient to define the state of the ITM B at any point in its computation as consisting of the contents of its tapes, the positions of the heads on these tapes, and the internal state of the machine. 2 . 3 I n t e r a c t i v e P r o o f S y s t e m s a n d Z e r o K n o w l e d g e Def in i t i on 2.1 An interactive protocol (P, V) is an interactive proof system for the language L if the following conditions hold: • Completeness: For every x E L, P ( ( P , V) accepts x) > 1 2 -I~l .

Abstract: The simplest and most familiar compact connected space which can be provided with the structure of a (topological) group is the simple closed curve C (topological circle). Perhaps the most natural example of a compact connected (topological) semigroup is the closed unit interval I with the usual multiplication. The space C admits the unique structure of a group, whereas simple examples show (see Examples 1, 2, 3) that the space I admits many structures of a semigroup. Such multiplications need not be abelian, may admit both nilpotents and idempotents, and may not have a zero element. In this note we initiate the analysis of the semigroup structures with which the space I may be provided. While our theorems are much more general, the following corollary will give a fair picture of our results. Suppose that I admits such a multiplication that its end points play the natural roles of zero and unit. If there are no other idempotents and no nilpotent elements except zero, then the multiplication must be that of the real numbers. The major step in the proof is that of showing that unique qth roots exist for any positive dyadic rational q. It is with pleasure that we acknowledge the helpful suggestions and advice of A. D. Wallace in the preparation of this paper. We define a mob to be a Hausdorff space together with a continuous, associative multiplication. A clan is a compact connected mob with unit. If S is a mob, a set TCS is a left (right) ideal if T,F and STC T(TSC T). A two-sided ideal is both a left and right ideal. Using Clifford's terminology [1], we shall denote the minimal twosided ideal of a mob S by K and the set of idempotents of S by E. By a zero element, we mean an element 0, such that Ox =0 = xO for all xCS. We define an element s to be nilpotent if Sn=O, for some positive integer n. A connected space S is irreducibly connected between two points a and b if no proper connected subset of S contains both a and b. In such a space, every point different from a and b is a cut point, separating the space into exactly two components [6]. We can intro-

Abstract: We study the zero divisor graph determined by equivalence classes of zero divisors of a commutative Noetherian ring R. We demonstrate how to recover information about R from this structure. In particular, we determine how to identify associated primes from the graph.