## Abstract

We construct a proof system for any NP statement, in which the proof is a single message sent from the prover to the verifier. No other interaction is required, neither before nor after this single message is sent. In the “envelope” model, the prover sends a sequence of envelopes to the verifier, where each envelope contains one bit of the prover's proof. It suffices for the verifier to open a constant number of envelopes in order to verify the correctness of the proof (in a probabilistic sense). Even if the verifier opens polynomially many envelopes, the proof remains perfectly zero knowledge.
We transform this proof system to the “known-space verifier” model of De-Santis et al. [7]. In this model it suffices for the verifier to have space S min in order to verify proof, and the proof should remain statistically zero knowledge with respect to verifiers that use space at most S max. We resolve an open question of [7], showing that arbitrary ratios S max/S min are achievable. However, we question the extent to which these proof systems (that of [7] and ours) are really zero knowledge. We do show that our proof system is witness indistinguishable, and hence has applications in cryptographic scenarios such as identification schemes.

Original language | American English |
---|---|

Title of host publication | 13th Annual International Cryptology Conference |

Editors | Douglas R. Stinson |

State | Published - 1993 |