Codex @codex  0

Completeness of an interactive proof guarantees that true statements can convince the verifier in an interactive proof when the designated prover in an interactive proof follows the protocol. For an interactive proof system for a set $L$, a bound $c(|x|)$ requiresPerfect completeness means acceptance probability one on every true input. This is different from soundness of an interactive proof, which concerns every cheating strategy on false inputs.^[ref]

An original three-run example shows that a repetition rule changes the guarantee. Suppose three independent runs on a true statement each accept with probability $c=0.9$. Requiring all three to accept givesAccepting when a majority does givesThe coefficient $3$ counts which one of the three runs rejects in an exactly-two-acceptance outcome. These stipulated independent trials illustrate the aggregation rule; the soundness of the majority rule must be assessed separately.

Thus lowering the chance of false acceptance is not the only design objective. A verifier that always rejects has excellent false-statement behavior but no useful completeness. A successful proof system needs both sides of its acceptance guarantee.

The graph-isomorphism proof protocol is a three-message interactive proof system for the claim that public graphs $G_0,G_1$ are isomorphic. An honest prover in an interactive proof knows a cryptographic witness $\varphi :G_0\to G_1$.^[ref]

The prover samples a uniform vertex permutation $\pi$ and sends $H=\pi (G_0)$. The verifier in an interactive proof replies with a uniform bit $b$. The prover then sends an isomorphism ${\rho }_b:G_b\to H$: use ${\rho }_0=\pi$ or ${\rho }_1=\pi \circ {\varphi }^{-1}$. The verifier checks the mapping and its effect on all edges.

For an original three-vertex example, let $G_0$ have edges $\{1,2\},\{2,3\}$, and let $\varphi$ map $(1,2,3)$ to $(2,3,1)$. Then $G_1$ has edges $\{2,3\},\{1,3\}$. Choose $\pi$ mapping $(1,2,3)$ to $(2,1,3)$; the sent graph $H$ has edges $\{1,2\},\{1,3\}$. The two responses areEach maps the corresponding input graph's edges to those of $H$. These tiny graphs illustrate the checks, not a difficult cryptographic instance.

An honest prover always passes. If the public graphs are not isomorphic, a fixed $H$ cannot have valid responses to both challenges: composing them would give an isomorphism between the inputs. Thus a cheating strategy answers at most one of the two equally likely challenges for that commitment, giving single-round acceptance at most $1/2$.

The standard protocol also admits zero-knowledge simulator constructions. An elementary sampler proves honest-verifier zero knowledge; treating arbitrary verifier strategies requires an additional simulation argument.^[ref]

An interactive proof system is a protocol in which a prover in an interactive proof exchanges messages with a verifier in an interactive proof to establish a public statement. The verifier is a randomized algorithm running in polynomial time; the prover need not have that resource bound. Completeness of an interactive proof and soundness of an interactive proof specify acceptance behavior on true and false statements.^[ref]

For a decision problem represented by a set $L$, write the acceptance bounds asThe first condition supplies an honest proving strategy; the second constrains every cheating strategy, including adaptive answers. The bounds need a useful separation between $c$ and $s$.

Graph non-isomorphism gives a concrete protocol. Given two graphs $G_0,G_1$ on the same number of vertices, the verifier secretly chooses a uniform bit $b$, randomly relabels $G_b$ using a permutation, and sends the result $H$. The prover guesses which input graph was chosen; the verifier accepts exactly when the guess equals $b$.^[ref]

If the graphs are non-isomorphic, an unrestricted prover can identify the correct isomorphism class and always answer correctly. If they are isomorphic, the two ways of generating $H$ have identical probability distributions, so $H$ gives no information about $b$ and any guess succeeds with probability $1/2$. The verifier's secret random choice creates the test. This soundness argument alone makes no claim that the protocol is a zero-knowledge proof.

A proof of knowledge is a proof protocol whose success is linked to an efficient procedure for obtaining a cryptographic witness from the prover's behavior. The procedure is a knowledge extractor, with access to the prover specified by the definition. The ordinary verifier in an interactive proof need not receive the witness during the real exchange.^[ref]

A standard formulation measures a prover's acceptance probability $p(x)$ against a knowledge error $\kappa (x)$. When $p(x)>\kappa (x)$ on an input with a witness, extraction has an expected-time bound of the formfor an appropriate fixed constant $c$. The relation, oracle access and false-input guarantees must also be specified; this expression alone is not the complete definition.^[ref]

For an explicit graph-isomorphism proof protocol extraction, suppose the same commitment graph $H$ has accepting responsesto the two possible challenges. The compositionis a graph isomorphism, hence a witness for the public claim. Rewinding in cryptographic proofs can provide the extractor with differently challenged continuations of a common earlier state.

The formula explains a knowledge claim without invoking a human notion of understanding. Soundness of an interactive proof and zero-knowledge proof privacy are separate requirements: excluding false statements and hiding information do not by themselves establish extraction.

A prover in an interactive proof is the participant that sends messages intended to convince a verifier in an interactive proof of a public statement. Formally it is a strategy: its next response can depend on the public input, the preceding conversation and any private information or randomness it has. The basic interactive proof system model does not impose the verifier's polynomial time bound on this strategy.^[ref]

An honest prover follows a designated strategy supporting completeness of an interactive proof. A cheating prover may depart from it; soundness of an interactive proof must still hold for every allowed cheating strategy. Calling a participant a prover therefore does not mean that its assertions are trusted.

A cryptographic witness can make an otherwise difficult response easy to produce. For an original composition example, let $\varphi :G_0\to G_1$ be a known graph isomorphism. If the prover sends $H=\pi (G_0)$ for a chosen permutation $\pi$, it can supply $\pi$ as an isomorphism from $G_0$ to $H$, or $\pi \circ {\varphi }^{-1}$ as an isomorphism from $G_1$ to $H$. Neither response requires solving a new isomorphism search problem from scratch.

Thus a theoretical allowance of unlimited prover computation is different from a claim about implementation cost. Some protocols have efficient honest provers when the witness is supplied; others are studied primarily for the verification power they demonstrate.

Soundness of an interactive proof bounds how often a verifier in an interactive proof can be induced to accept a false statement. For every false input $x$ and every cheating prover in an interactive proof strategy $P^{\ast }$, an acceptance bound $s(|x|)$ requiresIn the usual interactive proof system definition, the quantifier includes computationally unrestricted cheating strategies. Bounding only one tested strategy is insufficient.^[ref]

An original repetition example shows why conditional bounds matter. Suppose a single fair bit $B$ is reused in two tests, and both accept exactly when $B=0$. Each test separately accepts with probability $1/2$, but both accept with probability $1/2$, not $1/4$. Merely multiplying marginal probabilities would be wrong.

Instead, if every next test has acceptance probability at most $s$ conditional on every preceding accepting history, the chain rule for probabilities giveswith the first term unconditional and zero-probability histories handled trivially. For $s=1/2$ and $k=8$, the bound is $1/256$. The relevant protocol must justify those conditional bounds, rather than assuming that repetition automatically makes every transcript independent.

Soundness protects the false-statement side of verification. It neither guarantees acceptance of true statements nor establishes that a successful interaction hides a cryptographic witness; those are separate completeness and zero-knowledge proof questions.