12

When I read about zero knowledge proof, I keep encountering the term NP-statement. I am aware of complexity classes but I am a little unclear on how it ties up to NP-statement.

I came across the following here: C++ library for zkSNARKs

A computation can be expressed as an NP statement, in forms such as the following:

  • "The C program foo, when executed, returns exit code 0 if given the input bar and some additional input qux."

  • "The Boolean circuit foo is satisfiable by some input qux."

  • "The arithmetic circuit foo accepts the partial assignment bar, when extended into some full assignment qux."

  • "The set of constraints foo is satisfiable by the partial assignment bar, when extended into some full assignment qux."

A prover who knows the witness for the NP statement (i.e., a satisfying input/assignment) can produce a short proof attesting to the truth of the NP statement.

Can any body show how an NP problem can be described in the form of an NP statement with an example?

tatepairing
  • 323
  • 2
  • 7

5 Answers5

7

Intuitively, an NP problem is one that if you have a solution it is computationally easy to verify it, but it is not known if it is also computationally easy to find. Of course there exist formal definitions, based on deterministic and non deterministic Turing machines. Any standard complexity textbook will have these definitions.

Their connection with zero knowledge proofs comes from the 1987, Goldreich, Micali and Wigderson paper that proves that all NP problems have zero knowledge proofs (assuming secure bit commitment). An excellent tutorial on how this is done can be found in Matthew Green's blog. All this were written for classical zero knowledge systems, but they apply to zkSnarks as well.

Panagiotis Grontas
  • 863
  • 5
  • 15
5

Formally, zero-knowledge proof (ZKP) is constructed on top of NP problems. In ZKP, a prover intends to prove to a verifier that he knows the solution (witness) of some published NP-problem, without revealing this solution.

NP statement is actually a description of the NP problem.

So, roughly speaking, NP statement is what you want to prove/verify in ZKP.

Mikhail Koipish
  • 783
  • 4
  • 10
1

A decision problem is an NP problem when it runs in polynomial time on a non-deterministic Turing machine. It is a big class of problems, that contains most problems that you are used to: boolean satisfaction (NP-complete $\subset$ NP), and also the "easier" problems (polynomial time on a deterministic Turing machine): "is this list sorted?". Intuitively, NP contains problems that run in exponential time or faster.

When we say that an NP-statement can be proven in zero-knowledge (what indeed Goldreich et al. proved), it means that any NP problem instance can be proven to be true in zero-knowledge. For example, that a specific list is sorted has a proof protocol in zero-knowledge.

Ruben De Smet
  • 2,530
  • 15
  • 27
1

NP statements are those that, in this context, cannot be easily generated without knowing some secret (a proving key for zk-SNARK circuits). They are easily verifiable, however. In the case of zk-SNARKs, only demonstrate knowledge of a secret without revealing any information without a decryption key. When a paper mentions a language NP, they are referring to statements that satisfy the above properties. zk-SNARKs are an example of NP statements, so are cryptographic signatures and CRHF outputs.

NP is short for Non-deterministic Polynomial. P is short for Polynomial. Often, these refer to time complexity, less often for space (disk/RAM usage) complexity. NP is called NP because they can be solved with NP Turing machines, which can be thought of as infinite computers running every possible solution of a problem at the same time, and arriving at the solution in a polynomial amount of time. This is clearly impossible with current technology. Complexity classes tend to overlap as well, with some NP problems being part of BQP, such as RSA semiprime factorization, elliptic curve and regular discrete logarithm problems. These are breakable with sufficiently powerful quantum computers under polynomial time.

Expectator
  • 362
  • 3
  • 10
0

I agree with Panagiotis Grontas' answer. An NP statement is a statement about a problem for which we do not know has an easy solution, but if we are actually given a solution we can verify its correctness easily.

Example:

"The Boolean circuit foo is satisfiable by some input qux." - Given qux, you could plug it in the circuit and determine if foo is satisfied or not in poly-time. But finding such a qux which satisfies foo will be difficult.

Aashaka
  • 1
  • 1