On the Relationship Between Statistical Zero-Knowledge and Statistical Randomized Encodings

Abstract

Statistical Zero-knowledge proofs Goldwasser et al. [GMR89] allow a computationally unbounded server to convince a computationally limited client that an input x is in a language $$\varPi $$ without revealing any additional information about x that the client cannot compute by herself. Randomized encoding RE of functions Ishai and Kushilevitz [IK00] allows a computationally limited client to publish a single randomized message, $$\mathsf {Enc} x$$ , from which the server learns whether x is in $$\varPi $$ and nothing else. It is known that $$\mathcal {SRE} $$ , the class of problems that admit statistically private randomized encoding with polynomial-time client and computationally unbounded server, is contained in the class $$\mathcal {SZK} $$ of problems that have statistical zero-knowledge proof. However, the exact relation between these two classes, and, in particular, the possibility of equivalence was left as an open problem. In this paper, we explore the relationship between $$\mathcal {SRE} $$ and $$\mathcal {SZK} $$ , and derive the following results:In a non-uniform setting, statistical randomized encoding with one-side privacy $$\textit{1}\mathcal {RE} $$ is equivalent to non-interactive statistical zero-knowledge $$\mathcal {NISZK} $$ . These variants were studied in the past as natural relaxation/strengthening of the original notions. Our theorem shows that proving $$\mathcal {SRE} =\mathcal {SZK} $$ is equivalent to showing that $$\textit{1}\mathcal {RE} =\mathcal {SRE} $$ and $$\mathcal {SZK} =\mathcal {NISZK} $$ . The latter is a well-known open problem Goldreich et al. [GSV99].If $$\mathcal {SRE} $$ is non-trivial not in $$\mathcal {BPP} $$ , then infinitely-often one-way functions exist. The analog hypothesis for $$\mathcal {SZK} $$ yields only auxiliary-input one-way functions Ostrovsky [Ost91], which is believed to be a significantly weaker implication.If there exists an average-case hard language with perfect randomized encoding, then collision-resistance hash functions CRH exist. Again, a similar assumption for $$\mathcal {SZK} $$ implies only constant-round statistically-hiding commitments, a primitive which seems weaker than CRH. We believe that our results sharpen the relationship between $$\mathcal {SRE} $$ and $$\mathcal {SZK} $$ and illuminates the core differences between these two classes.