Physical Zero-Knowledge Proofs for Akari, Takuzu, Kakuro and KenKen - - PowerPoint PPT Presentation

▶
physical zero knowledge proofs for akari takuzu kakuro
SMART_READER_LITE
LIVE PREVIEW

Physical Zero-Knowledge Proofs for Akari, Takuzu, Kakuro and KenKen - - PowerPoint PPT Presentation

Oct 19, 2023 532 likes •1.01k views

Physical Zero-Knowledge Proofs for Akari, Takuzu, Kakuro and KenKen X. Bultel 1 J. Dreier 2 J-G. Dumas 3 P. Lafourcade 1 1 LIMOS, University Clermont Auvergne, France 2 Universit e de Lorraine, LORIA, Nancy, France 3 LJK, Universit e Grenoble

slide-1
SLIDE 1

Physical Zero-Knowledge Proofs for Akari, Takuzu, Kakuro and KenKen

  • X. Bultel1
  • J. Dreier2

J-G. Dumas3

  • P. Lafourcade1

1LIMOS, University Clermont Auvergne, France 2Universit´

e de Lorraine, LORIA, Nancy, France

3LJK, Universit´

e Grenoble Alpes, Grenoble, France

FUN’16, 9th June 2016, Sardinia

X.Bultel et al. ZKP for Akari et al. FUN’16 1 / 29

slide-2
SLIDE 2

Zero-Knowledge proof of knowledge

Prover knows Verifier knows a solution s of P the problem P I do not know s.

bla bla...

− − − − − − − − − − − − − − − − − − →

bla bla?

← − − − − − − − − − − − − − − − − − −

bla bla!

− − − − − − − − − − − − − − − − − − → accept or reject s as a solution of P

X.Bultel et al. ZKP for Akari et al. FUN’16 2 / 29

slide-3
SLIDE 3

Completeness

Prover knows Verifier knows a solution s of P the problem P I do not know s.

bla bla...

− − − − − − − − − − − − − − − − − − →

bla bla?

← − − − − − − − − − − − − − − − − − −

bla bla!

− − − − − − − − − − − − − − − − − − → Hum, ok... I’m convinced! s is a solution of P

X.Bultel et al. ZKP for Akari et al. FUN’16 3 / 29

slide-4
SLIDE 4

Soundness

Prover does not know Verifier knows a solution s of P the problem P I do not know s.

bla bla...

− − − − − − − − − − − − − − − − − − →

bla bla?

← − − − − − − − − − − − − − − − − − −

bla bla!

− − − − − − − − − − − − − − − − − − → Hum, ... I detect a problem! s is not a solution

X.Bultel et al. ZKP for Akari et al. FUN’16 4 / 29

slide-5
SLIDE 5

Zero-Knowledge

Prover knows Verifier knows a solution s of P the problem P I do not know s.

bla bla...

− − − − − − − − − − − − − − − − − − →

bla bla?

← − − − − − − − − − − − − − − − − − −

bla bla!

− − − − − − − − − − − − − − − − − − → I do not learn anything about s

X.Bultel et al. ZKP for Akari et al. FUN’16 5 / 29

slide-6
SLIDE 6

Origins of ZKP

Introduced by S. Goldwasser, S. Micali, and C. Rackoff in 1985.

  • O. Goldreich, S. Micali, and A. Wigderson 1991: Polynomial ZKP

for every problem in NP under the existence of one-way functions.

X.Bultel et al. ZKP for Akari et al. FUN’16 6 / 29

slide-7
SLIDE 7

Related Works

  • R. Gradwohl, M. Naor, B. Pinkas, and G. N. Rothblum (FUN’07)

Physical (using cards) ZKP for Sudoku.

Prover Verifier I do not know s.

bla bla bla...

− − − − − − − − − − − − − − − − − − →

bla bla bla?

← − − − − − − − − − − − − − − − − − −

bla bla bla!

− − − − − − − − − − − − − − − − − − → accept or reject I detect a problem...

X.Bultel et al. ZKP for Akari et al. FUN’16 7 / 29

slide-8
SLIDE 8

Contributions

Physical Zero-Knowledge Proofs for 4 NP-complete games: Akari

  • 4

1

Takuzu

1 1 1

Kakuro

4 3 4 3

KenKen

+ 6 − 1 ∗ 18

X.Bultel et al. ZKP for Akari et al. FUN’16 8 / 29

slide-9
SLIDE 9

1

Zero-Knowledge Proofs and Logical Games Zero-Knowledge proofs Related Works

2

Akari Rules for Akari ZKP Protocol

3

Kakuro Rules for Kakuro ZKP Protocol Extension to KenKen

4

Conclusion

X.Bultel et al. ZKP for Akari et al. FUN’16 9 / 29

slide-10
SLIDE 10

Akari

GOAL: Place lights on the white cells on the grid such that 3 constraints are respected

  • 4

1

X.Bultel et al. ZKP for Akari et al. FUN’16 10 / 29

slide-11
SLIDE 11

Akari

A light illuminates the whole row and column up to a black cell.

  • 4

1

  • X.Bultel et al.

ZKP for Akari et al. FUN’16 11 / 29

slide-12
SLIDE 12

Contraints (1/3)

Two lights cannot illuminate each other

  • 4
  • 1
  • 4
  • 1
  • X.Bultel et al.

ZKP for Akari et al. FUN’16 12 / 29

slide-13
SLIDE 13

Contraints (2/3)

All cells are illuminated !

  • 4
  • 1
  • 4
  • 1
  • X.Bultel et al.

ZKP for Akari et al. FUN’16 13 / 29

slide-14
SLIDE 14

Contraints (3/3)

Numbers in black cells = adjacent lights

  • 4
  • 1
  • 4
  • 1
  • X.Bultel et al.

ZKP for Akari et al. FUN’16 14 / 29

slide-15
SLIDE 15

Prover Commitment

  • 4
  • 1
  • 4

1 Prover commitment: use the empty grid, empty cards and cards.

X.Bultel et al. ZKP for Akari et al. FUN’16 15 / 29

slide-16
SLIDE 16

Prover Commitment

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ Prover commitment: use the empty grid, empty cards and cards. put a packet of identical cards on each white cell according to the solution.

X.Bultel et al. ZKP for Akari et al. FUN’16 15 / 29

slide-17
SLIDE 17

Verification (1/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ Numbers in black cells = adjacent lights

X.Bultel et al. ZKP for Akari et al. FUN’16 16 / 29

slide-18
SLIDE 18

Verification (1/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ Numbers in black cells = adjacent lights For each black cell with number x: pick one card in all adjacent white cells and shuffle them.

X.Bultel et al. ZKP for Akari et al. FUN’16 16 / 29

slide-19
SLIDE 19

Verification (1/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ Numbers in black cells = adjacent lights For each black cell with number x: pick one card in all adjacent white cells and shuffle them. V checks that there is exactly x cards.

X.Bultel et al. ZKP for Akari et al. FUN’16 16 / 29

slide-20
SLIDE 20

Verification (2/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ No two lights see each other ⇔ At most one by row/column.

X.Bultel et al. ZKP for Akari et al. FUN’16 17 / 29

slide-21
SLIDE 21

Verification (2/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ No two lights see each other ⇔ At most one by row/column. For each row/column, take one card per cell and shuffle them.

X.Bultel et al. ZKP for Akari et al. FUN’16 17 / 29

slide-22
SLIDE 22

Verification (2/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ No two lights see each other ⇔ At most one by row/column. For each row/column, take one card per cell and shuffle them. case 1, empty cards: P adds a card

X.Bultel et al. ZKP for Akari et al. FUN’16 17 / 29

slide-23
SLIDE 23

Verification (2/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ No two lights see each other ⇔ At most one by row/column. For each row/column, take one card per cell and shuffle them. case 1, empty cards: P adds a card → exactly 1

X.Bultel et al. ZKP for Akari et al. FUN’16 17 / 29

slide-24
SLIDE 24

Verification (2/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ No two lights see each other ⇔ At most one by row/column. For each row/column, take one card per cell and shuffle them. case 1, empty cards: P adds a card → exactly 1 case 2, one : P adds an empty card

X.Bultel et al. ZKP for Akari et al. FUN’16 17 / 29

slide-25
SLIDE 25

Verification (2/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ No two lights see each other ⇔ At most one by row/column. For each row/column, take one card per cell and shuffle them. case 1, empty cards: P adds a card → exactly 1 case 2, one : P adds an empty card → exactly 1 V checks that there is exactly one card.

X.Bultel et al. ZKP for Akari et al. FUN’16 17 / 29

slide-26
SLIDE 26

Verification (3/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ All cells are illuminated ⇔ For each cell, at least one in its row and column.

X.Bultel et al. ZKP for Akari et al. FUN’16 18 / 29

slide-27
SLIDE 27

Verification (3/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ All cells are illuminated ⇔ For each cell, at least one in its row and column. For each cell, take one card per cell in the same row and column and shuffle them.

X.Bultel et al. ZKP for Akari et al. FUN’16 18 / 29

slide-28
SLIDE 28

Verification (3/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ All cells are illuminated ⇔ For each cell, at least one in its row and column. For each cell, take one card per cell in the same row and column and shuffle them. case 1, one : P adds a card

X.Bultel et al. ZKP for Akari et al. FUN’16 18 / 29

slide-29
SLIDE 29

Verification (3/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ All cells are illuminated ⇔ For each cell, at least one in its row and column. For each cell, take one card per cell in the same row and column and shuffle them. case 1, one : P adds a card → exactly 2

X.Bultel et al. ZKP for Akari et al. FUN’16 18 / 29

slide-30
SLIDE 30

Verification (3/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ All cells are illuminated ⇔ For each cell, at least one in its row and column. For each cell, take one card per cell in the same row and column and shuffle them. case 1, one : P adds a card → exactly 2 case 2, two : P adds an empty card

X.Bultel et al. ZKP for Akari et al. FUN’16 18 / 29

slide-31
SLIDE 31

Verification (3/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ All cells are illuminated ⇔ For each cell, at least one in its row and column. For each cell, take one card per cell in the same row and column and shuffle them. case 1, one : P adds a card → exactly 2 case 2, two : P adds an empty card → exactly 2

X.Bultel et al. ZKP for Akari et al. FUN’16 18 / 29

slide-32
SLIDE 32

Verification (3/3)

  • 4
  • 1
  • ✂

✂ ✂ ✂ ✂ ✂ 4 ✂ ✂ ✂ ✂ ✂ 1 ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ ✂ All cells are illuminated ⇔ For each cell, at least one in its row and column. For each cell, take one card per cell in the same row and column and shuffle them. case 1, one : P adds a card → exactly 2 case 2, two : P adds an empty card → exactly 2 V checks that there is exactly two cards.

X.Bultel et al. ZKP for Akari et al. FUN’16 18 / 29

slide-33
SLIDE 33

1

Zero-Knowledge Proofs and Logical Games Zero-Knowledge proofs Related Works

2

Akari Rules for Akari ZKP Protocol

3

Kakuro Rules for Kakuro ZKP Protocol Extension to KenKen

4

Conclusion

X.Bultel et al. ZKP for Akari et al. FUN’16 19 / 29

slide-34
SLIDE 34

Kakuro: Cross Sums

4 3 4 3 4 3 4 3

3 1 1 2

Digits from 1 to 9. Triangular cell = sum of digits in the row/column A number can appear only once per row/column.

4 3 4 3

2 2 2 1

X.Bultel et al. ZKP for Akari et al. FUN’16 20 / 29

slide-35
SLIDE 35

Digit Encoding

Using black and red cards. To represent a number x put in an envelope: 9 − x black cards x red cards For 3: →

X.Bultel et al. ZKP for Akari et al. FUN’16 21 / 29

slide-36
SLIDE 36

Prover Commitment

Draw an empty grid 4 3 4 3

3 1 1 2

Commitment: 4 3 4 3

×7 for 3, 4, 5, 6, 7, 8 and 9

X.Bultel et al. ZKP for Akari et al. FUN’16 22 / 29

slide-37
SLIDE 37

Prover Commitment

Draw an empty grid On each empty cell: put 4 identical envelopes encoding the digit 4 3 4 3

3 1 1 2

Commitment: 4 3 4 3 ×4 ×4 ×4 ×4

×7 for 3, 4, 5, 6, 7, 8 and 9

X.Bultel et al. ZKP for Akari et al. FUN’16 22 / 29

slide-38
SLIDE 38

Prover Commitment

Draw an empty grid On each empty cell: put 4 identical envelopes encoding the digit On each triangular cell: put envelopes encoding all missing digits in the row/column 4 3 4 3

3 1 1 2

Commitment: 4 3 4 3 ×4 ×4 ×4 ×4

×7 for 3, 4, 5, 6, 7, 8 and 9

X.Bultel et al. ZKP for Akari et al. FUN’16 22 / 29

slide-39
SLIDE 39

Verification (1/2)

A number appears only once per row/column For each row/column, pick an envelope per cell plus the envelopes on the triangular cell. 4 3 4 3

×7

X.Bultel et al. ZKP for Akari et al. FUN’16 23 / 29

slide-40
SLIDE 40

Verification (1/2)

A number appears only once per row/column For each row/column, pick an envelope per cell plus the envelopes on the triangular cell. Shuffle and open them. 4 3 4 3

×9

X.Bultel et al. ZKP for Akari et al. FUN’16 23 / 29

slide-41
SLIDE 41

Verification (1/2)

A number appears only once per row/column For each row/column, pick an envelope per cell plus the envelopes on the triangular cell. Shuffle and open them. Verify that all numbers between 1 and 9 appear exactly once. 4 3 4 3

1,2,3,4,5,6,7,8,9

X.Bultel et al. ZKP for Akari et al. FUN’16 23 / 29

slide-42
SLIDE 42

Verification (2/2)

The sum per row and per column corresponds to the number in the triangular cell Randomly picks one envelope per cell in the row/column. Opens (face down) the content of each envelope and shuffle it. Check that red cards corresponds to the number given in the triangular cell. 4 3 4 3

1 2

+ =

  • X.Bultel et al.

ZKP for Akari et al. FUN’16 24 / 29

slide-43
SLIDE 43

KenKen

+ 6 − 1 ∗ 18 + 6 − 1 ∗ 18

3 1 2 1 2 3 2 3 1

Addition: similar to Kakuro. Multiplication: addition of the exponent of each prime factors. 9 × 6 = (2032) × (2131) = 20+132+1 = 54 Substraction/division: finding the maximum.

X.Bultel et al. ZKP for Akari et al. FUN’16 25 / 29

slide-44
SLIDE 44

Conclusion

Physical Zero-Knowledge Proofs for: Akari

  • 4

1

Takuzu

1 1 1

Kakuro

4 3 4 3

KenKen

+ 6 − 1 ∗ 18

More Games !

X.Bultel et al. ZKP for Akari et al. FUN’16 26 / 29

slide-45
SLIDE 45

Conclusion

Physical zero-knowledge mechanisms for several constraints: At least/most one occurence of a symbol in a row/column. Equality of the number of 1 and 0 per row/column. Result of the addition/substraction of cells. Result of the multiplication/division of cells. Number of adjacent symbol. All rows/columns are different. No k consecutive identical symbols.

X.Bultel et al. ZKP for Akari et al. FUN’16 27 / 29

slide-46
SLIDE 46

Thank you for your attention. Questions?

X.Bultel et al. ZKP for Akari et al. FUN’16 28 / 29

slide-47
SLIDE 47

Takuzu Rules: Binary Puzzle

Goal: fill the grid with 0’s and 1’s 1 1 1 Each row/column has exactly the same number of 1’s and 0’s Each row/column is unique In each row/column there can be no more than 2 identical numbers next to each other: 110010, but 110001 1 1 1 1 1 1 1 1

X.Bultel et al. ZKP for Akari et al. FUN’16 29 / 29