Hamiltonian cycle for a large graph Zero-knowledge proof

1 hamiltonian cycle large graph

1.1 completeness
1.2 zero-knowledge
1.3 soundness

hamiltonian cycle large graph

the following scheme due manuel blum.

in scenario, peggy knows hamiltonian cycle large graph g. victor knows g not cycle (e.g., peggy has generated g , revealed him.) finding hamiltonian cycle given large graph believed computationally infeasible, since corresponding decision version known np-complete. peggy prove knows cycle without revealing (perhaps victor interested in buying wants verification first, or maybe peggy 1 knows information , proving identity victor).

to show peggy knows hamiltonian cycle, , victor play several rounds of game.

at beginning of each round, peggy creates h, graph isomorphic g (i.e. h g except vertices have different names). since trivial translate hamiltonian cycle between isomorphic graphs known isomorphism, if peggy knows hamiltonian cycle g must know 1 h.
peggy commits h. using cryptographic commitment scheme. alternatively, number vertices of h, each edge of h write small piece of paper containing 2 vertices of edge , put these pieces of paper upside down on table. purpose of commitment peggy not able change h while @ same time victor has no information h.
victor randomly chooses 1 of 2 questions ask peggy. can either ask show isomorphism between h , g (see graph isomorphism problem), or can ask show hamiltonian cycle in h.
if peggy asked show 2 graphs isomorphic, first uncovers of h (e.g. turning pieces of papers put on table) , provides vertex translations map g h. victor can verify indeed isomorphic.
if peggy asked prove knows hamiltonian cycle in h, translates hamiltonian cycle in g onto h , uncovers edges on hamiltonian cycle. enough victor check h indeed contain hamiltonian cycle.

completeness

if peggy know hamiltonian cycle in g, can satisfy victor s demand either graph isomorphism producing h g (which had committed in first step) or hamiltonian cycle in h (which can construct applying isomorphism cycle in g).

zero-knowledge

peggy s answers not reveal original hamiltonian cycle in g. each round, victor learn h s isomorphism g or hamiltonian cycle in h. need both answers single h discover cycle in g, information remains unknown long peggy can generate distinct h every round. if peggy not know of hamiltonian cycle in g, somehow knew in advance victor ask see each round cheat. example, if peggy knew ahead of time victor ask see hamiltonian cycle in h generate hamiltonian cycle unrelated graph. similarly, if peggy knew in advance victor ask see isomorphism generate isomorphic graph h (in not know hamiltonian cycle). victor simulate protocol himself (without peggy) because knows ask see. therefore, victor gains no information hamiltonian cycle in g information revealed in each round.

soundness

if peggy not know information, can guess question victor ask , generate either graph isomorphic g or hamiltonian cycle unrelated graph, since not know hamiltonian cycle g cannot both. guesswork, chance of fooling victor 2, n number of rounds. realistic purposes, infeasibly difficult defeat 0 knowledge proof reasonable number of rounds in way.