a590003

2.3 Non-Interactive Simulation-Sound Adaptive Zero-Knowledge Proofs
We define the notion of a non-interactive simulation-sound adaptive zero-knowledge proof system
[BFM88, FLS90, BSM + 91, Sah99].
Definition 2.4. A non-interactive simulation-sound adaptive zero-knowledge proof system for
a language L = ∪ k∈N L(k) with a witness relation R L = ∪ k∈N R L(k) is a tuple of probabilistic
polynomial-time algorithms Π = (CRSGen, P, V, S 1 , S 2 ) with the following properties:
1. Perfect completeness: For every k ∈ N and (x, w) ∈ R L(k) it holds that
[
Pr V(1 k , x, π, crs) = 1
crs ← CRSGen(1 k ]
)
∣ π ← P(1 k = 1
, x, w, crs)
where the probability is taken over the internal randomness of CRSGen, P and V.
2. Adaptive soundness: For every algorithm P ∗ there exists a negligible function ν(·) such
that [
Pr x /∈ L(k) and V(1 k , x, π, crs) = 1
crs ← CRSGen(1 k ]
)
∣ (x, π) ← P ∗ (1 k ≤ ν(k)
, crs)
for all sufficiently large k, where the probability is taken over the internal randomness of
CRSGen, P ∗ , and V.
3. Adaptive zero knowledge: For every probabilistic polynomial-time algorithm A there exists
a negligible function ν(·) such that
[
] [
Adv ZK
Π,A(k) def ∣
= ∣Pr Expt ZK
Π,A(k) = 1 − Pr Expt ZK
∣∣
Π,A,S 1 ,S 2
(k) = 1]∣
≤ ν(k)
for all sufficiently large k, where the experiment Expt ZK
Π,A (k) is defined as:
(a) crs ← CRSGen(1 k )
(b) b ← A P(1k ,·,·,crs) (1 k , crs)
(c) Output b
and the experiment Expt ZK
Π,A,S 1 ,S 2
(k) is defined as:
(a) (crs, τ) ← S 1 (1 k )
(b) b ← A S′ 2 (1k ,·,·,τ) (1 k , crs), where S ′ 2 (1k , x, w, τ) = S 2 (1 k , x, τ)
(c) output b
4. Simulation soundness: For every probabilistic polynomial-time algorithm A there exists a
negligible function ν(·) such that
[
]
Adv SS
Π,A(k) def = Pr Expt SS
Π,A(k) = 1 ≤ ν(k)
for all sufficiently large k, where the experiment Expt SS
Π,A (k) is defined as:
(a) (crs, τ) ← S 1 (1 k )
(b) (x, π) ← A S 2(1 k ,·,τ) (1 k , crs)
(c) Denote by Q the set of S 2 ’s answers to A’s oracle queries
(d) Output 1 if and only if x /∈ L(k), π /∈ Q, and V(1 k , x, π, crs) = 1
9
3. Targeted Malleability