A non-interactive zero-knowledge proof allows a prover to send one proof message that a verifier can check without an ensuing challenge-response conversation, while satisfying an appropriate zero-knowledge proof definition. Non-interactive describes the proof exchange; it does not mean that setup assumptions disappear.^[ref]

In a common reference string model, both parties use public setup data $\sigma$. The prover constructs a proof $\pi$ for a public statement $x$, and the verifier evaluatesThe setup's distribution and the adversary's knowledge of its generation must be specified. In the tutorial's basic common-random-string model, the zero-knowledge simulator produces a reference-string/proof pair with the required computational indistinguishability from a real pair.^[ref]

An original toy relation separates a statement from a cryptographic witness. Let the public values be $n=15$ and $y=4$, and ask whether there is a value $w$ withThe value $w=2$ satisfies the relation because $2^2\equiv 4(\mathrm{mod}15)$. Sending $w$ directly verifies that example but reveals that witness; it does not demonstrate a zero-knowledge property. A non-interactive proof would instead require a defined proof construction, verifier and simulation argument.

The tiny modulus is chosen only for transparent modular arithmetic; it is not a secure cryptographic parameter. Likewise, a single short message is not automatically a non-interactive zero-knowledge proof: efficient verification, soundness and information disclosure remain separate obligations.

A zero-knowledge simulator is an efficient randomized algorithm that reproduces the relevant verifier-view distribution of a zero-knowledge proof without receiving the prover's secret cryptographic witness. Depending on the definition, the real and simulated views must be identical, statistically close or satisfy computational indistinguishability.^[ref]

The graph-isomorphism proof protocol provides an illuminating example for honest-verifier zero knowledge. On a fixed public isomorphic pair $G_0,G_1$, a real prover sends a random relabeling $H$, receives a uniform challenge bit $b$, and supplies a graph isomorphism from $G_b$ to $H$.^[ref]

An explicit simulation reverses that construction. First choose a uniform bit $b$ and a uniform vertex permutation $\rho$. Setand output the transcript $(H,b,\rho )$. The simulator never needs a mapping between $G_0$ and $G_1$. For an isomorphic public pair, random relabelings of either graph have the same probability distribution; conditional on $b$, the response mapping is uniform in both constructions. Thus the honest verifier's transcript distribution is reproduced exactly.

This does not give a live cheating prover control of the verifier's future challenge. The simulator chooses a complete transcript in a different order from the real exchange. Nor does this simple sampler establish security against an arbitrary malicious verifier, whose challenge could depend on $H$.

The example exposes the central requirement: producing one plausible accepting transcript is insufficient. The simulator must reproduce the specified distribution within the required efficiency bound and adversary model.

Honest-verifier zero knowledge is the zero-knowledge proof simulation requirement restricted to a verifier that follows its prescribed algorithm. The zero-knowledge simulator reproduces that verifier's view without the prover's secret cryptographic witness. General zero knowledge must account for permitted deviations by the verifier as well.^[ref]

In the graph-isomorphism proof protocol, the honest verifier chooses an independent uniform challenge bit. A simulator can first choose $b$, sample a uniform permutation $\rho$, set $H=\rho (G_b)$ and output $(H,b,\rho )$. For isomorphic public graphs, this has the same distribution as the honest conversation.^[ref]

An original small example shows what changes if the verifier deviates. Suppose $H$ is a uniform relabeling of a three-vertex path. There are three labeled paths; two contain the edge $\{1,2\}$. A different verifier could choose $b=1$ exactly when that edge is present, soThe elementary honest-verifier simulator chooses a uniform bit and instead gives $\mathrm{Pr}(b=1)=1/2$. It therefore fails to reproduce this changed verifier's view.

This comparison does not show that the standard graph protocol lacks general zero knowledge. It shows that a simulator for the honest verifier does not automatically prove the stronger property. The general analysis may use rewinding in cryptographic proofs to simulate challenges that depend on the first message. The stated adversary model is part of the theorem.

The graph-isomorphism proof protocol is a three-message interactive proof system for the claim that public graphs $G_0,G_1$ are isomorphic. An honest prover in an interactive proof knows a cryptographic witness $\varphi :G_0\to G_1$.^[ref]

The prover samples a uniform vertex permutation $\pi$ and sends $H=\pi (G_0)$. The verifier in an interactive proof replies with a uniform bit $b$. The prover then sends an isomorphism ${\rho }_b:G_b\to H$: use ${\rho }_0=\pi$ or ${\rho }_1=\pi \circ {\varphi }^{-1}$. The verifier checks the mapping and its effect on all edges.

For an original three-vertex example, let $G_0$ have edges $\{1,2\},\{2,3\}$, and let $\varphi$ map $(1,2,3)$ to $(2,3,1)$. Then $G_1$ has edges $\{2,3\},\{1,3\}$. Choose $\pi$ mapping $(1,2,3)$ to $(2,1,3)$; the sent graph $H$ has edges $\{1,2\},\{1,3\}$. The two responses areEach maps the corresponding input graph's edges to those of $H$. These tiny graphs illustrate the checks, not a difficult cryptographic instance.

An honest prover always passes. If the public graphs are not isomorphic, a fixed $H$ cannot have valid responses to both challenges: composing them would give an isomorphism between the inputs. Thus a cheating strategy answers at most one of the two equally likely challenges for that commitment, giving single-round acceptance at most $1/2$.

The standard protocol also admits zero-knowledge simulator constructions. An elementary sampler proves honest-verifier zero knowledge; treating arbitrary verifier strategies requires an additional simulation argument.^[ref]

Luma is a video signal formed by combining nonlinear RGB component signals. It is conventionally written $Y^{\prime }$, with the prime warning that the components have already undergone a nonlinear encoding. It differs from physical luminance, which describes light with a photometric scale.

Under Recommendation ITU-R BT.709-6,The coefficients sum to one, so a neutral signal $R^{\prime }=G^{\prime }=B^{\prime }=t$ has luma $Y^{\prime }=t$. The same recommendation specifies a nonlinear conversion $f$ from a normalized linear primary signal $E$:The primed components are formed separately before combining them.^[ref]

An original calculation shows why the order matters. For a linear red primary $(R,G,B)=(1,0,0)$, the primed triple is also $(1,0,0)$ and luma is 0.2126. Combining the linear channels first gives normalized linear luminance $Y=0.2126$; applying $f$ to that scalar gives approximately 0.4485. ThusNonlinear encoding does not commute with this channel combination.

In YCbCr, luma is stored alongside colour-difference information. Chroma subsampling can preserve the luma sampling grid while reducing the other components' sampling. A luma image can therefore retain fine spatial variation without carrying every colour distinction of the original image; it is not a complete colour description.

Chroma subsampling represents colour-difference components on a coarser spatial grid than luma. In YCbCr video, 4:4:4 chroma sampling keeps full sample counts for every component; 4:2:2 chroma subsampling halves the colour-difference count horizontally; 4:2:0 chroma subsampling halves it horizontally and vertically.^[ref]

For an original eight-bit $4\times 2$ image with no padding or alpha, full sampling uses eight samples in each of three components: 24 bytes. With horizontal halving, the count becomes $8+4+4=16$ bytes. Halving in both directions gives $8+2+2=12$ bytes. These count active samples, not the allocation overhead of a particular pixel format.

The reduction loses information unless the discarded variations are otherwise constrained. For a stipulated pair of neighbouring samples with constant luma, let one colour-difference channel have values $+0.1$ and $-0.1$. Averaging the pair and retaining only the average stores zero. Reconstructing both positions as zero cannot recover which one was originally positive. Fine colour variation can therefore disappear even though both luma samples remain intact.

A low-pass filter before reducing the sampling rate controls aliasing; merely dropping alternate samples need not. Later chroma reconstruction estimates the missing positions. It must respect chroma sample location: equal sample counts do not determine where those samples lie relative to the luma grid. The Microsoft primary guide explicitly distinguishes different 4:2:0 grids and discusses interpolation during format conversion.^[ref]

Storage organization is independent of this sampling ratio. NV12 interleaves the two reduced components in a second plane, while a fully planar pixel format can store them in separate planes. Rearranging the same samples changes layout, not sampling resolution.