3 ms·
Roughly speaking, the question here is: can you simulate a multi-edge protocol. That is, can you achieve the following properties using rewinding: 1. The 'fake
by matthewdgreen 12y ago
Roughly speaking, the question here is: can you simulate a multi-edge protocol. That is, can you achieve the following properties using rewinding:
1. The 'fake Prover' simulating the protocol has no knowledge of an actual graph coloring.
2. From the Verifier's PoV, the distribution of the simulated (rewinding-based & fake) protocol transcript is identical to that of a real protocol run where the Prover really does a solution.
3. The simulation still requires only time polynomial in the problem instance (when you include all the rewinding trips).
I think if you follow this through you'll find that simulating a multi-edge protocol that 'looks like' a real transcript is highly challenging.
The reason for condition (3) is to rule out an obvious hack wherein the simulation takes so long that the 'fake Prover' can simply find solve the problem (e.g., by finding a graph coloring in an exponential number of time steps).
- thaumasiotes 12y agoAs I see it, if the transcript consists of a record like the following: Trial 1: PASS Trial 2: PASS Trial 3: PASS Trial 4: PASS etc. etc, then simulating a two-edge protocol is, while more time-consuming than simulating a one-edge protocol, still pretty easy. If the record looks like Trial 1: PASS (v1 red -- v2 green, v3 green -- v4 blue) Trial 2: PASS (v1 blue -- v2 red, v7 blue -- v9 red) Trial 3: PASS (v1 green -- v2 red, v7 green -- v4 red) then after Trial 3 you can tell that the prover is cheating. The fake trials seem to achieve your properties (1) and (3). I guess they violate #2? What is the "distribution" of a simulated transcript?