## A Zero Knowledge Sumcheck and its Applications

- Alessandro Chiesa, Michael A. Forbes, Nicholas Spooner
- IACR Cryptology ePrint Archive
- 2017

- Published 2016 in Electronic Colloquium on Computational Complexity

We present the first constructions of single-prover proof systems that achieve perfect zero knowledge (PZK) for languages beyond NP, under no intractability assumptions: 1. The complexity class #P has PZK proofs in the model of Interactive PCPs (IPCPs) [KR08], where the verifier first receives from the prover a PCP and then engages with the prover in an Interactive Proof (IP). 2. The complexity classNEXP has PZK proofs in the model of Interactive Oracle Proofs (IOPs) [BCS16, RRR16], where the verifier, in every round of interaction, receives a PCP from the prover. Unlike PZK multi-prover proof systems [BGKW88], PZK single-prover proof systems are elusive: PZK IPs are limited toAM ∩ coAM [For87, AH91], while known PCPs and IPCPs achieve only statistical simulation [KPT97, GIMS10]. Recent work [BCGV16] has achieved PZK for IOPs but only for languages in NP, while our results go beyond it. Our constructions rely on succinct simulators that enable us to “simulate beyondNP”, achieving exponential savings in efficiency over [BCGV16]. These simulators crucially rely on solving a problem that lies at the intersection of coding theory, linear algebra, and computational complexity, which we call the succinct constraint detection problem, and consists of detecting dual constraints with polynomial support size for codes of exponential block length. Our two results rely on solutions to this problem for fundamental classes of linear codes: • An algorithm to detect constraints for Reed–Muller codes of exponential length. • An algorithm to detect constraints for PCPs of Proximity of Reed–Solomon codes [BS08] of exponential degree. The first algorithm exploits the Raz–Shpilka [RS05] deterministic polynomial identity testing algorithm, and shows, to our knowledge, a first connection of algebraic complexity theory with zero knowledge. Along the way, we give a perfect zero knowledge analogue of the celebrated sumcheck protocol [LFKN92], by leveraging both succinct constraint detection and low-degree testing. The second algorithm exploits the recursive structure of the PCPs of Proximity to show that small-support constraints are “locally” spanned by a small number of small-support constraints.

@article{BenSasson2016OnPC,
title={On Probabilistic Checking in Perfect Zero Knowledge},
author={Eli Ben-Sasson and Alessandro Chiesa and Michael A. Forbes and Ariel Gabizon and Michael Riabzev and Nicholas Spooner},
journal={Electronic Colloquium on Computational Complexity (ECCC)},
year={2016},
volume={23},
pages={156}
}