= Non-interactive zero-knowledge proof
A \b[non-interactive zero-knowledge proof] allows a prover to send one proof message that a verifier can check without an ensuing challenge-response conversation, while satisfying an appropriate <zero-knowledge proof> definition. Non-interactive describes the proof exchange; it does not mean that setup assumptions disappear.<Zero-Knowledge: a tutorial by Oded Goldreich>[Section8, single-message model and shared reference string]{ref}
In a <common reference string> model, both parties use public setup data $\sigma$. The prover constructs a proof $\pi$ for a public statement $x$, and the verifier evaluates
$$
V(\sigma,x,\pi)\in\{0,1\}.
$$
The setup's distribution and the adversary's knowledge of its generation must be specified. In the tutorial's basic common-random-string model, the <zero-knowledge simulator> produces a reference-string/proof pair with the required <computational indistinguishability> from a real pair.<Zero-Knowledge: a tutorial by Oded Goldreich>[Section8, real and simulated reference-string/proof distributions]{ref}
An original toy relation separates a statement from a <cryptographic witness>. Let the public values be $n=15$ and $y=4$, and ask whether there is a value $w$ with
$$
w^2\equiv y\pmod n.
$$
The value $w=2$ satisfies the relation because $2^2\equiv4\pmod{15}$. Sending $w$ directly verifies that example but reveals that witness; it does not demonstrate a zero-knowledge property. A non-interactive proof would instead require a defined proof construction, verifier and simulation argument.
The tiny modulus is chosen only for transparent <modular arithmetic>; it is not a secure cryptographic parameter. Likewise, a single short message is not automatically a <non-interactive zero-knowledge proof>: efficient verification, soundness and information disclosure remain separate obligations.
Back to article page
