Walter Unger WS 2012/2013
Sascha Geulen November 21, 2012
Exercise
Algorithmic Cryptography
Sheet 6
Exercise 6.1: (4 points)
Consider the following protocol for Graph 3-Coloring:
Common Input: A graph G= (V, E).
Secret of the Prover: A 3-coloring col :V → {1,2,3}.
Prover: Choose permutationπover{1,2,3}. For eachv ∈V, send lockable boxBv with δ(Bv) =π(col(v)).
Verifier: Choose an edge (u, v)∈E.
Prover: Show the permuted color of the verticesuandv, i.e., send δ(Bu) andδ(Bv).
Verifier: Check whether δ(Bu)6=δ(Bv).
(a) Prove: The protocol is a Zero-Knowledge-Proof, i.e., it satisfies the following three properties:
Completeness: If the prover knows the secret, he can convince the ver- ifier.
Soundness: If the prover does not know the secret, he cannot con- vince the verifier, except with some small probability.
Zero-Knowledge: There exists a probabilistic simulator that computes an accepting transcript in polynomial time that looks sta- tistically (algorithmically) the same as a transcript be- tween the prover and a verifier.
(b) What is the cheating probability?
Exercise 6.2: (4 points)
Construct a Zero-Knowledge-Proof based on the following problem:
THREE VERTEX-DISJOINT PATHS OF FIXED LENGTH
Input: Graph G= (V, E), s, t∈V, and k ∈ {1, . . . ,|V|}.
Question: Are there three vertex-disjoint paths of length k from s tot?
Definition: Three paths are vertex-disjoint if the intersection of the vertex sets of the paths without the start and end vertex is empty.
Exercise 6.3: (4 points) Construct a Zero-Knowledge-Proof without any restriction for the following prob- lem:
THREE VERTEX-DISJOINT PATHS
Input: Graph G= (V, E), and s, t∈V.
Question: Are there three vertex-disjoint paths from s tot?
Exercise 6.4: (4 points)
Construct a Zero-Knowledge-Proof based on the following problem:
NOT-ALL-EQUAL 3-SAT
Input: Set X of variables, collection C of clauses over X such that each clause c∈C has |c|= 3.
Question: Is there a truth assignment for X such that each clause in C has at least one true literal and at least one false literal?
Deadline: Wednesday, November 28, 2012, 15:00,
in the lecture or in the letterbox in front of i1.
