🔢 mathematics

A proof complexity perspective on effectively zero-knowledge proofs

This paper reformulates Ilango's effectively zero-knowledge proofs in logical terms to provide simplified proofs of their existence and key properties, and further demonstrates how they can be transformed into genuinely zero-knowledge proofs under a hardness conjecture regarding proof complexity generators.

Original authors: Jan Krajicek

Published 2026-07-16

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Jan Krajicek

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Secret Keepers of Logic

Imagine a world where you want to prove you know a secret—like the password to a treasure chest—without ever actually saying the password out loud. This is the magic of Zero-Knowledge Proofs (ZK). In the realm of computer science and cryptography, these are like "magic tricks" where a prover convinces a verifier that a statement is true, but the verifier learns absolutely nothing else. It's the ultimate privacy tool: proving you are who you say you are without revealing your identity.

But what if the "proof" isn't just a magic trick, but a logical argument so deep that even the person checking it can't fully understand why it works, only that it must work? This is where Proof Complexity comes in. Think of it as the study of how long and complicated a proof has to be to convince someone. If a proof is too short, it might be a fluke; if it's impossibly long, no one can check it. The paper you are about to read sits right at the intersection of these two worlds. It asks a fascinating question: Can we create a proof that is so logically "heavy" and complex that it looks indistinguishable from a true fact, even if we can't easily find the proof itself? It's like trying to prove a mountain exists by showing a shadow so perfect that no one can tell if the mountain is really there, or if it's just a really good drawing.

The Paper's Big Idea: Proving Without Proving

In this paper, Jan Krajíček takes a new type of zero-knowledge proof, originally invented by Ilango, and rewrites it using the language of pure logic. The goal is to make the concept clearer and to prove that these "effectively zero-knowledge" proofs actually work, using some clever mathematical tools.

Here is the core story: The author builds a "Prover" (the one with the secret) and a "Verifier" (the one checking the work). Usually, a prover shows a witness (the secret) to prove a statement. But in this new setup, the prover doesn't just show the secret; they show a logical consistency. They prove that it is possible for the secret to exist without actually revealing it.

The paper's main finding is a simple but powerful proof that such a system exists. The author shows that if we assume two things—one from cryptography (that certain "witness indistinguishability" tricks work) and one from proof complexity (that there are some problems that are incredibly hard to solve)—then we can build a prover that is "zero-knowledge relative to a theory."

What does that mean in plain English? It means the prover can convince the verifier that a statement is true, and the verifier cannot distinguish this proof from a "true" fact, even if the verifier tries to use their own logical rules to break it. The paper proves that the idea of being "indistinguishable from true" isn't something we have to assume about the prover; it is a natural consequence of how the prover is built. It's like building a robot that is so good at acting human that you don't have to assume it's human; its behavior proves it.

The "Hard" Part: Why It's Not Easy

The paper is careful to note that this isn't a magic wand that solves everything immediately. The existence of these proofs relies on a "conjecture," which is a strong guess that mathematicians believe is true but haven't fully proven yet. Specifically, the paper relies on the idea that there exists a "hard generator"—a machine that creates problems so difficult that no computer can solve them quickly.

The author uses a tool called model theory (which is like looking at different versions of reality or "universes" to see how math behaves) to show that if these hard problems exist, then our zero-knowledge proofs work. The paper argues that if you can't find a short proof for a problem, then there must be a "non-standard" world where the problem is unsolvable, and this gap is exactly what the zero-knowledge proof hides.

From "Effectively" to "Genuinely" Zero-Knowledge

The paper takes a final, exciting step in the third section. It asks: Can we turn this "effectively zero-knowledge" (which depends on logical theories) into "genuinely zero-knowledge" (the kind used in real-world security)?

The answer is "yes, but with a catch." The author shows that if we assume a specific type of hard generator exists (called a "demi-bit") and if the prover and verifier are allowed to share a common random string (like a secret code they both hold before the game starts), then we can build a truly secure, real-world zero-knowledge proof.

The paper suggests that instead of relying on a sequence of hard problems that might be tricky to construct, we can use these "generators" to create the difficulty. The catch is that the prover and verifier need to share that random string. Without it, the system might not be perfectly secure. But with it, the paper outlines a way to make the "effectively zero-knowledge" concept work in the real world, turning a theoretical logic puzzle into a practical privacy shield.

In short, the paper doesn't just say "this works"; it builds a logical bridge showing why it works, provided we accept that some problems are indeed too hard for computers to crack quickly. It turns a complex cryptographic idea into a story about logic, shadows, and the power of things that are hard to prove.

Technical Summary: A Proof Complexity Perspective on Effectively Zero-Knowledge Proofs

Problem Statement
The paper addresses the concept of "effectively zero-knowledge" (ZK) proofs, a variant introduced by Ilango [4] that relies on ideas from mathematical logic. Ilango's original formulation avoided standard logical notions (such as theories, provability, and consistency) in favor of algorithmic simulations. The paper identifies a specific limitation in Ilango's definition: the property that a proof is "indistinguishable from true" is embedded directly into the definition of the prover rather than being derived as a consequence. Furthermore, the construction of effectively ZK proofs relies on conjectures from both cryptography and proof complexity, specifically regarding the existence of hard propositional tautologies for specific proof systems. The paper seeks to reformulate this concept using the language of logic and proof complexity to provide simpler proofs of existence and to clarify the relationship between the prover's definition and the "indistinguishability" property.

Methodology
The author employs the framework of proof complexity and bounded arithmetic, specifically utilizing theories capable of reasoning about computations and proofs (such as $S^1_2$ and $S_2$ ). The methodology involves:

Logical Reformulation: Replacing algorithmic simulations with formal theories $T$ and their extensions $T^*$ . The prover is defined relative to a theory $T$ , and the ZK property is characterized by the non-existence of short proofs within $T$ for the non-existence of a simulator.
Model Theory of Arithmetic: The proofs utilize non-standard models of arithmetic and the "overspill principle." Specifically, the paper relies on a theorem by K.-Pudlák [13] which links the non-existence of short propositional proofs in a proof system $P(T)$ to the existence of extensions of models of bounded arithmetic where certain formulas are satisfiable.
Proof Complexity Generators: In the final section, the paper explores transforming effectively ZK proofs into "genuinely" zero-knowledge proofs. This is achieved by replacing the sequence of hard tautologies $\Psi$ with proof complexity generators. The construction assumes the existence of "demi-bits" (a type of hard generator defined by Rudich [16]) and allows the prover and verifier to share a common random string.

Key Contributions and Results

Reformulation of the Prover: The paper defines a prover $Prover[A, B, \Psi]$ relative to a theory $T$ . The ZK property is defined not by the immediate existence of a simulator, but by the condition that for any polynomial size $d$ , the theory $T$ cannot prove (with proofs of super-polynomial size) that no simulator of size $n^d$ exists.
Derivation of "Indistinguishability from True": A primary result (Theorem 2.4) demonstrates that the property of being "indistinguishable from true" is a consequence of the ZK definition relative to a theory, rather than a prerequisite. If a statement $S(n)$ is provable in $T$ to follow from the existence of a simulator, and the prover is ZK relative to $T$ , then $S(n)$ must be true for all but finitely many $n$ . This contrasts with Ilango's definition where this was part of the prover's axiomatic requirements.
Existence Proof (Theorem 2.2): The paper proves that if $A, B$ form a Non-Interactive Witness Indistinguishable (NIWI) scheme and the sequence of tautologies $\Psi$ is hard for the proof system $P(T^*)$ , then the constructed prover is ZK relative to $T$ . The proof utilizes non-standard models to show that the existence of a simulator is consistent with the theory, thereby preventing short proofs of its non-existence.
Transformation to Genuine ZK (Section 3): The paper shows that the concept of effectively ZK can be converted into standard zero-knowledge proofs (where a simulator actually exists) under specific assumptions. By utilizing proof complexity generators derived from "demi-bits" and allowing the parties to share a common random string, the hardness of the underlying formulas can be guaranteed uniformly. This bypasses the need for the prover and verifier to trust a specific sequence of tautologies without verification.

Significance and Claims
The paper claims to offer a "simple proof" of the existence and key properties of effectively zero-knowledge proofs by leveraging the logical structure of proof complexity. Its significance lies in:

Conceptual Clarity: It clarifies the logical underpinnings of effectively ZK proofs, showing that the "indistinguishability from true" property is a derivable consequence of the prover's definition relative to a theory.
Bridging Logic and Cryptography: It explicitly connects the cryptographic notion of witness indistinguishability with the logical notion of model extensions and the non-existence of short proofs.
Path to Standard ZK: It outlines a theoretical pathway to transform these conditional, logic-based proofs into standard zero-knowledge proofs, contingent on the existence of hard proof complexity generators (specifically demi-bits) and the use of a common random string.

The author remains modest regarding the construction of the hard sequences themselves, noting that while conjectures exist (e.g., regarding the existence of generators hard for all proof systems), a proof that a specific construction works remains an open problem in proof complexity. The paper serves as a theoretical refinement and a bridge between the logical formulation of ZK and standard cryptographic definitions.

The Secret Keepers of Logic

The Paper's Big Idea: Proving Without Proving

The "Hard" Part: Why It's Not Easy

From "Effectively" to "Genuinely" Zero-Knowledge

Technical Summary: A Proof Complexity Perspective on Effectively Zero-Knowledge Proofs

More like this