Sedgewick & Wayne (2004); Chazelle (2005) Sedgewick & Wayne (2004); Chazelle (2005)

Linear-reduces: Cost of reduction is proportional to size of input

 Traveling Salesman Problem

Best known algorithm takes exponential time!

P NP Problems that can be solved in polynomial time Problems that have polynomial time proofs If input size = N, then time is O(N ) c Suffices to look at Yes/No problems

3-Coloring Not known to be in P

3-Coloring But is in NP

A polynomial time proof of 3-Coloring

Don’t all problems have polynomial time proofs? Piano mover’s problem Winning strategies

P NP Problems that can be solved in polynomial time Problems that have polynomial time proofs (Note that P is symmetric with yes/no but NP is not) COMPOSITE is in NP (easy); so is PRIME (hard)

 P = NP ?

P NP Problems that can be solved in polynomial time Problems that have polynomial time proofs NP-Complete: Any problem A in NP such that any problem in NP polynomial-reduces to it Over 10,000 known NP-complete problems !

FACTORING Given graph G, can it be colored red, white, blue? Given n-bit integer x and k, does x have a factor 1<x<k ? 3-COLOR FACTORING and 3-COLOR are in NP 3-COLOR is NP-complete  3-color efficiently and destroy ALL e-commerce!

Zero Knowledge Can I convince you I have a proof without revealing anything about it?

3-Coloring

Prover interacts with Verifier

3-Coloring Prover hides coloring

3-Coloring Verifier checks an edge at random

3-Coloring Verifier spots a lie with probability 1/E

3-Coloring Verifier repeats 100E times

If Verifier spots no lies, she concludes the graph is 3-colorable Prover fools Verifier with negligible probability

Is it Zero-Knowledge? Verifier can color most of the graph!

Not Zero-Knowledge! Why do we require the Verifier to check randomly?

Repeat 100 E times: 1. Prover: shuffle colors 2. Verifier: Check any edge

Random permutation Shuffle colors: what’s that? (6 possibilities)

Step 1: Prover shuffles coloring

Step 2: Prover hides coloring

Step 3: Verifier checks an edge

Step 1: Prover shuffles coloring

Step 2: Prover hides coloring

Step 3: Verifier checks an edge, etc

Why is it zero-knowledge? No matter what the Verifier does, she only sees a random pair of colors So, she can simulate the whole protocol by herself – no need for the prover.

Every problem in NP has a zero-knowledge proof

PCP Can I convince you I have a proof of Riemann’s hypothesis by letting you look at only 2 lines picked at random? (probabilistically checkable proofs) Yes, with probability of error 1/google

My proof of RH Slightly longer proof of RH compiler

Check two lines If OK, accept proof, else reject The probability of accepting bad proof or rejecting correct proof is <