Uriel Feige

Zero-knowledge proofs of identity

In this paper we extend the notion of interactive proofs of assertions to interactive proofs of knowledge. This leads to the definition of unrestricted input zero-knowledge proofs of knowledge in which the prover demonstrates possession of knowledge without revealing any computational information whatsoever (not even the one bit revealed in zero-knowledge proofs of assertions). We show the relevance of these notions to identification schemes, in which parties prove their identity by demonstrating their knowledge rather than by proving the validity of assertions. We describe a novel scheme which is provably secure if factoring is difficult and whose practical implementations are about two orders of magnitude faster than RSA-based identification schemes. The advantages of thinking in terms of proofs of knowledge rather than proofs of assertions are demonstrated in two efficient variants of the scheme: unrestricted input zero-knowledge proofs of knowledge are used in the construction of a scheme which needs no directory; a version of the scheme based on parallel interactive proofs (which are not known to be zero knowledge) is proved secure by observing that the identification protocols are proofs of knowledge.

The dense k-subgraph problem

Abstract. This paper considers the problem of computing the dense k -vertex subgraph of a given graph, namely, the subgraph with the most edges. An approximation algorithm is developed for the problem, with approximation ratio O(nδ) , for some δ < 1/3 .

Witness indistinguishable and witness hiding protocols

A two par ty protocol in which par ty A uses one of several secret witnesses to an NP assertion is witness indistinguishable if par ty B cannot tell which witness A is actually using. The protocol is witness hiding if by the end of the protocol B cannot compute any new witness which he did not know before the protocol began. Witness hiding is a natural security requirement, and can replace zero knowledge in many cryptographic protocols. We prove two central results: 1. Unlike zero knowledge protocols, witness indistinguishablity is preserved under arbi t rary composition of protocols, including parallel execution. 2. If a s ta tement has at least two independent witnesses, then any witness indistinguishable protocol for this s ta tement is also

Zero Knowledge and the Chromatic Number

We present a new technique, inspired by zero-knowledge proof systems, for proving lower bounds on approximating the chromatic number of a graph. To illustrate this technique we present simple reductions frommax-3-coloringandmax-3-sat, showing that it is hard to approximate the chromatic number within?(N?) for some?>0. We then apply our technique in conjunction with the probabilistically checkable proofs of Hastad and show that it is hard to approximate the chromatic number to within?(N1??) for any?>0, assuming NP?ZPP. Here, ZPP denotes the class of languages decidable by a random expected polynomial-time algorithm that makes no errors. Our result matches (up to low order terms) the known gap for approximating the size of the largest independent set. PreviousO(N?) gaps for approximating the chromatic number (such as those by Lund and Yannakakis, and by Furer) did not match the gap for independent set nor extend beyond?(N1/2??).

Interactive proofs and the hardness of approximating cliques

The contribution of this paper is two-fold. First, a connection is established between approximating the size of the largest clique in a graph and multi-prover interactive proofs. Second, an efficient multi-prover interactive proof for NP languages is constructed, where the verifier uses very few random bits and communication bits. Last, the connection between cliques and efficient multi-prover interaction proofs, is shown to yield hardness results on the complexity of approximating the size of the largest clique in a graph. Of independent interest is our proof of correctness for the multilinearity test of functions.

Approximating clique is almost NP-complete

The computational complexity of approximating omega (G), the size of the largest clique in a graph G, within a given factor is considered. It is shown that if certain approximation procedures exist, then EXPTIME=NEXPTIME and NP=P.<<ETX>>

Approximating the value of two power proof systems, with applications to MAX 2SAT and MAX DICUT

It is well known that two prover proof systems are a convenient tool for establishing hardness of approximation results. In this paper, we show that two prover proof systems are also convenient starting points for establishing easiness of approximation results. Our approach combines the Feige-Lovasz (STOC92) semidefinite programming relaxation of one-round two-prover proof systems, together with rounding techniques for the solutions of semidefinite programs, as introduced by Goemans and Williamson (STOC94). As a consequence of our approach, we present improved approximation algorithms for MAX 2SAT and MAX DICUT. The algorithms are guaranteed to deliver solutions within a factor of 0.931 of the optimum for MAX 2SAT and within a factor of 0.859 for MAX DICUT, improving upon the guarantees of 0.878 and 0.796 of Goemans and Williamson (1994).<<ETX>>

Maximizing Non-monotone Submodular Functions

Submodular maximization generalizes many important problems including Max Cut in directed and undirected graphs and hypergraphs, certain constraint satisfaction problems, and maximum facility location problems. Unlike the problem of minimizing submodular functions, the problem of maximizing submodular functions is NP-hard. In this paper, we design the first constant-factor approximation algorithms for maximizing nonnegative (non-monotone) submodular functions. In particular, we give a deterministic local-search

Relations between average case complexity and approximation complexity

\frac{1}{3}

Zero knowledge proofs of knowledge in two rounds

-approximation and a randomized