<?xml version="1.0" encoding="iso-8859-1"?>
<?xml-stylesheet href="paper.xsl" type="text/xsl"?>

<paper xmlns="http://www.cse.ucsd.edu/daniele/XML">

  <filename>ZKgame</filename>

  <title>The round-complexity of black-box zero-knowledge:
  a combinatorial characterization</title>
  
  <author>Daniele Micciancio</author>
  <author>Scott Yilek</author>
  
  <reference>
    <conference>Theory of cryptography conference</conference>
    <conf href="http://www.cs.nyu.edu/tcc08/">TCC 2008</conf>
    <address>New York, NY, USA</address>
    <year>2008</year>
    <month>3</month>
    <pages>535-552</pages>
    <doi>10.1007/978-3-540-78524-8_29</doi>
    <volume>4948</volume>
  </reference>

  <abstract>
    <p xmlns="http://www.w3.org/1999/xhtml">
      The round-complexity of black-box zero-knowledge has for years
      been a topic of much interest.  Results in this area generally
      focus on either proving lower bounds in various settings (e.g.,
      <cite>Canetti, Kilian, Petrank, and Rosen</cite> prove
      concurrent zero-knowledge (cZK) requires <em>Omega(log n / log
      log n)</em> rounds and <cite>Barak and Lindell</cite> show no
      constant-round single-session protocol can be zero-knowledge
      with strict poly-time simulators), or giving upper bounds (e.g.,
      <cite>Prabhakaran, Rosen, and Sahai</cite> give a cZK protocol
      with <em>omega(log n)</em> rounds).  In this paper we show that
      though proving upper bounds seems to be quite different from
      demonstrating lower bounds, underlying both tasks there is a
      single, simple combinatorial game between two players: a
      rewinder and a scheduler.  We give two theorems relating the
      success of rewinders in the game to both upper and lower bounds
      for black-box zero-knowledge in various settings (sequential
      composition, concurrent composition, etc).  Our game and
      theorems unify the previous results in the area, simplify the
      task of proving upper and lower bounds, and should be useful in
      showing future results in the area.
    </p>
  </abstract>
</paper>
