We know the "sequential" DL-based interactive proof system zero-knowledge, and the "parallel" isn't DL-based interactive

[answerhappygod]

We Know The Sequential Dl Based Interactive Proof System Zero Knowledge And The Parallel Isn T Dl Based Interactive 1 (412.69 KiB) Viewed 12 times

We know the "sequential" DL-based interactive proof system zero-knowledge, and the "parallel" isn't DL-based interactive proof system zero-knowledge. Proof: Let S be a probabilistic polynomial-time simulator for DL-based interactive proof system, where S is defined as follows: (a) Guess c ER Z2 and choose B ER Z (b) Compute A' = B²/y mod n. (c) Invoke V(A¹) = C. (d) If c = c, return (A', c', B) as an accepting transcript. Otherwise, repeat the step (a). = The expected execution time of simulator S is ts 2(t+ty), where te is the execution time of the step (a), step (b), and step (d), and ty is the execution time of verifier V. The sequential DL-based interactive proof system is zero-knowledge because we can construct the probabilistic polynomial-time simulator S' to simulate the accepting transcript trp,v(x) by trs,v(x) as follows: for (i = 0; i < k; ++i) cout << S(V); (1) The expected execution time of simulator S' is tg = k.ts. The parallel DL-based interactive proof system is not zero-knowledge because we can only construct the probabilistic exponential-time simulator S' to simulate the accepting transcript trp,y(x) by trs,v(x) as follows: (a) Guess (₁, ₂,...,C.) ER (Z₂)k and choose B ER Z (b) Compute A' = B²/1₁ mod n. =1 (c) Invoke V(A') = (C₁, C2, ..., CK). (d) If (₁,₂,..., k) = (C₁, C2, ..., ck), return (A', c₁, c₂,...,C,B) as an accepting transcript. Otherwise, repeat the step (a). The expected execution time of simulator S' is tg' = 2k (te + tv), where tË is the execution time of the step (a), step (b), and step (d), and ty is the execution time of verifier V. Why isn't the "parallel" FS interactive proof system zero-knowledge? (Use above information and Proof that)