snippetModerate
How can you convince your colour-blind friend that two balls have the same colour?
Viewed 0 times
canconvinceyourtheyousamecolourblindballstwo
Problem
I was reading about zero-knowledge proofs. I understand how one can convince their colour-blind friend that the two chosen balls have different colours.
Now what happens if the two chosen balls have the same colour - is there a zero-knowledge proof that will convince your colour-blind friend that they are the same colour? If you follow the classic protocol then you will obtain a 50% chance of guessing correctly that the balls were swapped.
However, this does not rule out the case when the balls are different colour and you were simply lying to obtain the same 50% chance of guessing correctly. In other words, your colour-blind friend will not know whether you are lying or telling the truth.
Now what happens if the two chosen balls have the same colour - is there a zero-knowledge proof that will convince your colour-blind friend that they are the same colour? If you follow the classic protocol then you will obtain a 50% chance of guessing correctly that the balls were swapped.
However, this does not rule out the case when the balls are different colour and you were simply lying to obtain the same 50% chance of guessing correctly. In other words, your colour-blind friend will not know whether you are lying or telling the truth.
Solution
Summary
Suppose Victor, who is colour-blind would like Peggy, who can tell colours to convince him that two balls (the unknown pair) are the same colour. Assume Victor has another pair (the known pair) of balls that have different colours. All balls are either green or red.
Here is the zero-knowledge proof (ZKP). See later sections for the rigorous specification.
Victor will select one ball from the unknown pair and one ball from the known pair randomly and secretly. Then ask Peggy whether the selected pair are the same colour. Repeat this routine as many times as needed.
If Peggy changes his answer if and only if Victor select a different ball from the known pair, Victor gains confidence that the unknown pair are the same colour. Otherwise, the protocol ends immediately with Victor gaining no information.
The setup: preconditions and goals
The ingenious zero-knowledge proof (ZKP) for the case of two balls of different colors is not applicable directly to the case of two balls of the same colour. It turns out the verifier needs to bring two extra balls, at least.
Preconditions:
Peggy are allowed to lie in whatever way.
Goals:
A simple interactive ZKP that proves two balls are the same colour.
-
Victor selects a ball $U$ from the unknown pair and a ball $K$ from the known pair. Victor will keep track of $K$ and the known pair until the end of step 3 below.
Victor displays $U$ and $K$ in some random order to Peggy, asking "are they the same colour?" Peggy replies with either "YES" or "NO".
-
Victor selects ball $U'$ from the unknown pair secretly and randomly, which may or may not be $U$. Victor also select ball $K'$ from the known pair secretly and randomly, which may or may not be $K$. In any case, Victor knows whether $K'$ is $K$ or not.
Victor displays $U'$ and $K'$ in some random order to Peggy, asking "are they the same colour?" Peggy replies with either "YES" or "NO".
-
Note that if the unknown pair are the same colour and Peggy responds correctly, then her two replies are the same if and only if $K'$ is $K$. If that is the case, Victor becomes more likely to believe that the unknown pair are the same colour. Otherwise, Victor will claim Peggy cannot prove that the unknown pair are the same colour and stop the whole protocol.
-
Victor passes the known pair to Peggy, who passes them back after making sure they have different colours as well as shuffling them randomly secretly. If Peggy find they are the same colour instead, Peggy will claim Victor violate the protocol and stop the whole protocol.
-
Repeat step 2 to 4 as many times as necessary until Victor is convinced that the unknown pair are the same colour.
Can Victor just run step 1 repeatedly?
Someone might wonder, can Victor just repeat step 1 with secret and random selections each time, gather the results so that he will know whether the unknown pair have the same colour as one of the balls in the known pair?
That scheme implies that Victor at the end of a successful run of the protocol knows that the colour of the unknown pair is the same as a particular ball in the known pair, a ball that Victor that identify. This is information beyond the same-colour-ness of the unknown pair, even though Victor still does not know the actual colour of the unknown pair. For example, Victor can confidently present three balls of the same color, which is a task that he could not do with certainty had he not known that extra piece of information.
In general, had Victor been able to track the balls selected from the known pair across the whole protocol, he would be able to associate the colour of the unknown pair with one particular ball in the known pair.
These three steps and especially step 4 are designed to prevent leak of knowledge, even if Victor tries to gain extra knowledge without violating the protocol in any way that can be detected by Peggy.
There are many other solutions
This answer shows a brilliant simpler solution, assuming the availability of two identical boxes in addition to the required known pairs of balls.
This answer is a simpler-to-explain variant of this answer.
Suppose Victor, who is colour-blind would like Peggy, who can tell colours to convince him that two balls (the unknown pair) are the same colour. Assume Victor has another pair (the known pair) of balls that have different colours. All balls are either green or red.
Here is the zero-knowledge proof (ZKP). See later sections for the rigorous specification.
Victor will select one ball from the unknown pair and one ball from the known pair randomly and secretly. Then ask Peggy whether the selected pair are the same colour. Repeat this routine as many times as needed.
If Peggy changes his answer if and only if Victor select a different ball from the known pair, Victor gains confidence that the unknown pair are the same colour. Otherwise, the protocol ends immediately with Victor gaining no information.
The setup: preconditions and goals
The ingenious zero-knowledge proof (ZKP) for the case of two balls of different colors is not applicable directly to the case of two balls of the same colour. It turns out the verifier needs to bring two extra balls, at least.
Preconditions:
- There are two people, Victor and Peggy. Victor is colour-blind.
Peggy are allowed to lie in whatever way.
- Victor has two balls, the known pair, one of which is red and one of which is green. Victor does not know which one is red, however.
- There are two other balls, the unknown pair. Both are either red or green. Both may or may not be the same colour.
- All balls are identical except possibly by their colour.
Goals:
- Victor wants to be convinced of the same-colour-ness of the unknown pair if they are the same color. Victor should not be fooled into believing the same-colour-ness of the unknown pair if they are not.
- If the unknown pair are the same colour, at the end of protocol, Victor should not have gained any information except that same-colour-ness as long as Peggy did not found Victor had violated the protocol.
A simple interactive ZKP that proves two balls are the same colour.
-
Victor selects a ball $U$ from the unknown pair and a ball $K$ from the known pair. Victor will keep track of $K$ and the known pair until the end of step 3 below.
Victor displays $U$ and $K$ in some random order to Peggy, asking "are they the same colour?" Peggy replies with either "YES" or "NO".
-
Victor selects ball $U'$ from the unknown pair secretly and randomly, which may or may not be $U$. Victor also select ball $K'$ from the known pair secretly and randomly, which may or may not be $K$. In any case, Victor knows whether $K'$ is $K$ or not.
Victor displays $U'$ and $K'$ in some random order to Peggy, asking "are they the same colour?" Peggy replies with either "YES" or "NO".
-
Note that if the unknown pair are the same colour and Peggy responds correctly, then her two replies are the same if and only if $K'$ is $K$. If that is the case, Victor becomes more likely to believe that the unknown pair are the same colour. Otherwise, Victor will claim Peggy cannot prove that the unknown pair are the same colour and stop the whole protocol.
-
Victor passes the known pair to Peggy, who passes them back after making sure they have different colours as well as shuffling them randomly secretly. If Peggy find they are the same colour instead, Peggy will claim Victor violate the protocol and stop the whole protocol.
-
Repeat step 2 to 4 as many times as necessary until Victor is convinced that the unknown pair are the same colour.
Can Victor just run step 1 repeatedly?
Someone might wonder, can Victor just repeat step 1 with secret and random selections each time, gather the results so that he will know whether the unknown pair have the same colour as one of the balls in the known pair?
That scheme implies that Victor at the end of a successful run of the protocol knows that the colour of the unknown pair is the same as a particular ball in the known pair, a ball that Victor that identify. This is information beyond the same-colour-ness of the unknown pair, even though Victor still does not know the actual colour of the unknown pair. For example, Victor can confidently present three balls of the same color, which is a task that he could not do with certainty had he not known that extra piece of information.
In general, had Victor been able to track the balls selected from the known pair across the whole protocol, he would be able to associate the colour of the unknown pair with one particular ball in the known pair.
These three steps and especially step 4 are designed to prevent leak of knowledge, even if Victor tries to gain extra knowledge without violating the protocol in any way that can be detected by Peggy.
There are many other solutions
This answer shows a brilliant simpler solution, assuming the availability of two identical boxes in addition to the required known pairs of balls.
This answer is a simpler-to-explain variant of this answer.
Context
StackExchange Computer Science Q#150548, answer score: 18
Revisions (0)
No revisions yet.