Abstract
Protecting secrets is a key challenge in our contemporary information-based era. In common situations, however, revealing secrets appears unavoidable; for instance, when identifying oneself in a bank to retrieve money. In turn, this may have highly undesirable consequences in the unlikely, yet not unrealistic, case where the bankâs security gets compromised. This naturally raises the question of whether disclosing secrets is fundamentally necessary for identifying oneself, or more generally for proving a statement to be correct. Developments in computer science provide an elegant solution via the concept of zero-knowledge proofs: a prover can convince a verifier of the validity of a certain statement without facilitating the elaboration of a proof at all1. In this work, we report the experimental realization of such a zero-knowledge protocol involving two separated verifierâprover pairs2. Security is enforced via the physical principle of special relativity3, and no computational assumption (such as the existence of one-way functions) is required. Our implementation exclusively relies on off-the-shelf equipment and works at both short (60âm) and long distances (â¥400âm) in about one second. This demonstrates the practical potential of multi-prover zero-knowledge protocols, promising for identification tasks and blockchain applications such as cryptocurrencies or smart contracts4.
This is a preview of subscription content, access via your institution
Access options
Access Nature and 54 other Nature Portfolio journals
Get Nature+, our best-value online-access subscription
$29.99 /Â 30Â days
cancel any time
Subscribe to this journal
Receive 51 print issues and online access
$199.00 per year
only $3.90 per issue
Buy this article
- Purchase on SpringerLink
- Instant access to full article PDF
Prices may be subject to local taxes which are calculated during checkout
Similar content being viewed by others
Data availability
All data supporting the findings of this article are available from the corresponding authors upon request.
Code availability
All code supporting the findings of this article are available from the corresponding authors upon request.
References
Goldwasser, S., Micali, S. & Rackoff, C. The knowledge complexity of interactive proof systems. In Proc. Seventeenth Annual ACM Symposium on Theory of Computing 291â304 (ACM, 1985).
Ben-Or, M., Goldwasser, S., Kilian, J. & Wigder-son, A. Multi-prover interactive proofs: how to remove intractability assumptions. In Proc. Twentieth Annual ACM Symposium on Theory of Computing 113â131 (ACM, 1988).
Kilian, J. Strong separation models of multi prover interactive proofs. In DIMACS Workshop on Cryptography (DIMACS, 1990).
Ben-Sasson, E., Bentov, I., Horesh, Y. & Riabzev, M. Scalable, transparent, and post-quantum secure computational integrity. Preprint at https://eprint.iacr.org/2018/046.pdf (2018).
Goldwasser, S., Micali, S. & Rackoff, C. The knowledge complexity of interactive proof systems. SIAM J. Comput. 18, 186â208 (1989).
Rivest, R. L., Shamir, A. & Adleman, L. A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21, 120â126 (1978).
Garey, M. R. & Johnson, D. S. Computers and Intractability: A Guide to the Theory of NP-Completeness (W. H. Freeman & Co., 1979).
Goldreich, O., Micali, S. & Wigderson, A. Proofs that yield nothing but their validity or all languages in NP have zero-knowledge proof systems. J. ACM 38, 690â728 (1991).
Fortnow, L. The complexity of perfect zero-knowledge. In Proc. Nineteenth Annual ACM Symposium on Theory of Computing 204â209 (ACM, 1987).
Ben Sasson, E. et al. Zerocash: decentralized anonymous payments from Bitcoin. In Proc. IEEE Symp. Security and Privacy 459â474 (IEEE, 2014).
Bernstein, D. J. & Lange, T. Post-quantum cryptography. Nature 549, 188â194 (2017).
Arute, F. et al. Quantum supremacy using a programmable superconducting processor. Nature 574, 505â510 (2019).
Kent, A. Unconditionally secure bit commitment. Phys. Rev. Lett. 83, 1447â1450 (1999).
Crépeau, C., Massenet, A., Salvail, L., Stinchcombe, L. & Yang, N. Practical relativistic zero-knowledge for NP. In Proc. 1st Conf. Information-Theoretic Cryptography 4, 1â18 (LIPiCS, 2020).
Mizuno, K. & Nishihara, S. Constructive generation of very hard 3-colorability instances. Discret. Appl. Math. 156, 218â229 (2008).
Katz, J. & Lindell, Y. Introduction to Modern Cryptography 3rd edn (CRC, 2020).
Verbanis, E. et al. 24-hour relativistic bit commitment. Phys. Rev. Lett. 117, 140506 (2016).
Li, N., Li, C., Helleseth, T., Ding, C. & Tang, X. Optimal ternary cyclic codes with minimum distance four and five. Finite Fields their Appl. 30, 100â120 (2014).
Tassa, T. & Villar, J. L. On proper secrets, (t, k)-bases and linear codes. Des. Codes Cryptogr. 52, 129â154 (2009).
Lunghi, T. et al. Practical relativistic bit commitment. Phys. Rev. Lett. 115, 030502 (2015).
Bell, J. S. On the EinsteinâPodolskyâRosen paradox. Phys. Phys. Fiz. 1, 195â200 (1964).
Kempe, J., Kobayashi, H., Matsumoto, K., Toner, B. & Vidick, T. Entangled games are hard to approximate. SIAM J. Comput. 40, 848â877 (2011).
Chailloux, A. & Leverrier, A. Relativistic (or 2-prover 1-round) zero-knowledge protocol for NP secure against quantum adversaries. In Advances in Cryptology â EUROCRYPT 2017 (eds. Coron, J. S. & Nielsen, J.) 369â396 (Springer, 2017).
Ji, Z. Binary constraint system games and locally commutative reductions. Preprint at https://arxiv.org/abs/1310.3794 (2013).
Groth, J. Non-interactive zero-knowledge arguments for voting. In Applied Cryptography and Network Security (eds. Ioannidis, J., Keromytis, A. & Yung, M.) 467â482 (Springer, 2005).
Micali, S. & Rabin, M. O. Cryptography miracles, secure auctions, matching problem verification. Commun. ACM 57, 85â93 (2014).
Glaser, A., Barak, B. & Goldston, R. J. A zero-knowledge protocol for nuclear warhead verification. Nature 510, 497â502 (2014).
Group of Applied Physics. Google Maps https://goo.gl/maps/qhriiVPu8ktAqfZd9 (2020).
Acknowledgements
Financial supports by the Swiss National Science Foundation (starting grant DIAQ, NCCR-QSIT) and the European project OpenQKD are gratefully acknowledged by N.B., S.D., R.H., W.X. and H.Z. P.A., C.C. and N.Y. are grateful to Québecâs FRQNT and Canadaâs NSERC for making this work financially possible.
Author information
Authors and Affiliations
Contributions
P.A. and C.C. generated the graph used. N.B. and H.Z. supervised the research. C.C. and N.Y. came up with the protocol and C.C. was the theoretical leader. S.D. ensured the link between theory and experiment. R.H. was responsible for the experimental implementation, with support by S.D. and H.Z. W.X. contributed at early stage of the project. S.D. and C.C. wrote the initial draft, with the other authors providing editorial comments.
Corresponding authors
Ethics declarations
Competing interests
The authors declare no competing interests.
Additional information
Peer review information Nature thanks Thomas Vidick and the other, anonymous, reviewer(s) for their contribution to the peer review of this work. Peer reviewer reports are available.
Publisherâs note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Extended data figures and tables
Extended Data Fig. 1 Illustration of a round of the protocol.
The colours are consistent with those of Fig. 1a and depict a typical round where the verifiers ask the same edge to the provers, here \(\{1,2\}\), but where \(b\ne b\text{'}\) so that they check in the end that \({a}_{0}+a{\text{'}}_{0}\) ⢠\({a}_{1}+a{\text{'}}_{1}({\rm{m}}{\rm{o}}{\rm{d}}\,3)\). In this example we have \({{\ell }}_{1}^{0}=2,{{\ell }}_{1}^{1}=1,{{\ell }}_{2}^{0}=0,{{\ell }}_{2}^{1}=1\); note that, despite the adjacency of the vertices 1 and 2, the equality \({{\ell }}_{1}^{1}={{\ell }}_{2}^{1}\) is legal as the labellings \({{\ell }}_{k}^{b}\) do not need to be colourings.
Extended Data Fig. 2 Illustration of the hardware used in our two implementations.
a, b, The GPS version (a) and the triggered version (b). The essential difference is the method used for synchronizing the verifiersâ questions. In a the connection is wireless as it uses communication with satellites at the expense of a higher imprecision thus further verifierâprover pairs. In b the connection is physical and oriented from the first to the second verifier; the former sends a trigger through the fibre and delays their action by the time needed for this signal to reach the latter. With a better accuracy this second method allows for shorter distances between the verifierâprover pairs, here 60âm but arguably improvable.
Supplementary information
Rights and permissions
About this article
Cite this article
Alikhani, P., Brunner, N., Crépeau, C. et al. Experimental relativistic zero-knowledge proofs. Nature 599, 47â50 (2021). https://doi.org/10.1038/s41586-021-03998-y
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1038/s41586-021-03998-y
