On a moonless night the spy returns to the castle after a reconnoitering mission to the enemy camp. As he nears the gate a voice whispers, What's the password? But is it friend or foe who whispers? How can the spy show that he knows the password without actually revealing it to a possible imposter? The spy's dilemma is commonplace now with the widespread use of telecommunications. When your automatic teller machine communicates with your bank, each must be assured that the other is legitimate; the electronic must be unforgeable and must be of no use to imposters and eavesdroppers. One method that has been proposed for exchanging passwords in this context is the zero-knowledge proof. Renaissance mathematicians developed their own primitive zero-knowledge proof systems. When both Tartaglia and Fior claimed knowledge of an algebraic solution to cubic equations, a contest was arranged in which each proposed thirty problems for the other to solve. In the end, Tartaglia had solved all thirty, thus providing a convincing demonstration that he knew the method without actually revealing it. Fior solved none. (It turned out that each had worked out solutions to certain classes of cubics, but neither had solved the general problem [2]). We've progressed considerably in formalizing this idea. An interactive protocol comprises two algorithms P (the prover) and V (the verifier) that read a common input string w of length Iwl and then compute and communicate in alternating turns to determine whether w has some specified property. The verifier is polynomially-bounded: it must eventually halt and its total computation time must be bounded by a fixed polynomial in Iw 1. When it halts, the verifier outputs either accept or reject depending upon whether the property holds for w. The verifier is probabilistic, that is, allowed to make random choices during the computation according to the results of coin tosses. The prover is allowed to have unlimited computational power. A language is a set of strings. An interactive proof system for Z is an interactive protocol in which P helps V to decide whether w E -Z. We require that with high probability the verifier be correct when accepting or rejecting the membership of w in -Z. More precisely, for every constant c > 0, for sufficiently large w E -Z the probability (over all coin tosses) that V halts and accepts must be at least 1 Iwl c. If w e -Z then we require that no prover P* be able to convince V otherwise: that is, for every c > 0 and large enough w, and for any interactive protocol (P*, V), V rejects with probability at least 1 Iw Ic.