| A Brief Introduction to Zero-Knowledge (by O.G.) | p. 1 |
| Preliminaries | p. 3 |
| Interactive Proofs and Argument Systems | p. 4 |
| Computational Difficulty and One-Way Functions | p. 6 |
| Computational Indistinguishability | p. 7 |
| Definitional Issues | p. 8 |
| The Simulation Paradigm | p. 9 |
| The Basic Definition | p. 10 |
| Variants | p. 11 |
| Zero-Knowledge Proofs for Every NP-set | p. 15 |
| Constructing Zero-Knowledge Proofs for NP-sets | p. 15 |
| Using Zero-Knowledge Proofs for NP-sets | p. 17 |
| Composing Zero-Knowledge Protocols | p. 18 |
| Sequential Composition | p. 19 |
| Parallel Composition | p. 20 |
| Concurrent Composition (With and Without Timing) | p. 22 |
| Introduction to Concurrent Zero-Knowledge | p. 25 |
| Zero-Knowledge Proof Systems | p. 26 |
| Concurrent Composition of ZK | p. 26 |
| On the Feasibility of cZK | p. 27 |
| The Round-Complexity of cZK | p. 27 |
| From Repetition to Composition | p. 28 |
| A "Typical" ZK Protocol for NP | p. 29 |
| Composition of ZK Protocols | p. 32 |
| A Second Look at the Feasibility of cZK | p. 33 |
| A Troublesome Scheduling | p. 33 |
| The Richardson-Kilian Protocol and Its Analysis | p. 35 |
| Improving the Analysis of the RK Protocol | p. 36 |
| What About Non-Black-Box Simulation? | p. 36 |
| Organization and the Rest of This Book | p. 37 |
| Preliminaries | p. 39 |
| General | p. 39 |
| Basic Notation | p. 39 |
| Probabilistic Notation | p. 39 |
| Computational Indistinguishability | p. 39 |
| Interactive Proofs | p. 40 |
| Zero-Knowledge | p. 41 |
| Witness Indistinguishability | p. 41 |
| Concurrent Zero-Knowledge | p. 42 |
| Black-Box Concurrent Zero-Knowledge | p. 43 |
| Conventions Used in Construction of Simulators | p. 44 |
| Commitment Schemes | p. 46 |
| cZK Proof Systems for NP | p. 49 |
| Blum's Hamiltonicity Protocol | p. 50 |
| The Richardson-Kilian cZK Protocol | p. 51 |
| The Prabhakharan-Rosen-Sahai cZK Protocol | p. 53 |
| Simulating the RK and PRS Protocols - Outline | p. 55 |
| Analyzing the Simulation - Outline | p. 58 |
| The Simulator Runs in Polynomial Time | p. 59 |
| The Simulator's Output is "Correctly" Distributed | p. 59 |
| The Simulator (Almost) Never Gets "Stuck" | p. 59 |
| cZK in Logarithmically Many Rounds | p. 67 |
| Detailed Description of the Simulator | p. 67 |
| The Main Procedure and Ideas | p. 68 |
| The Actual Simulator | p. 74 |
| The Simulator's Running Time | p. 75 |
| The Simulator's Output Distribution | p. 75 |
| The Probability of Getting "Stuck" | p. 77 |
| Counting Bad Random Tapes | p. 83 |
| Special Intervals Are Visited Many Times | p. 90 |
| Extensions | p. 95 |
| Applicability to Other Protocols | p. 95 |
| cZK Arguments Based on Any One-Way Function | p. 96 |
| Applicability to Resettable Zero-Knowledge | p. 98 |
| cZK Arguments with Poly-Logarithmic Efficiency | p. 99 |
| A Simple Lower Bound | p. 101 |
| Proof of Theorem 6.1 | p. 101 |
| Schedule, Adversary Verifiers and Decision Procedure | p. 102 |
| Proof of Lemma 6.1.5 | p. 105 |
| Existence of Useful Initiation Prefixes | p. 107 |
| The Structure of Good Subtrees | p. 109 |
| Black-Box cZK Requires Logarithmically Many Rounds | p. 111 |
| Proof Outline | p. 112 |
| The High-Level Framework | p. 112 |
| The Schedule and Additional Ideas | p. 114 |
| The Actual Analysis | p. 119 |
| The Actual Proof | p. 119 |
| The Concurrent Adversarial Verifier | p. 119 |
| The Actual Verifier Strategy Vg,h | p. 126 |
| The Decision Procedure for L | p. 130 |
| Performance on no-instances | p. 132 |
| The Cheating Prover | p. 133 |
| The Success Probability of the Cheating Prover | p. 137 |
| Legal Transcripts Yield Useful Block Prefixes | p. 142 |
| Existence of Potentially Useful Block Prefixes | p. 144 |
| Existence of Useful Block Prefixes | p. 152 |
| Conclusions and Open Problems | p. 161 |
| Avoiding the Lower Bounds of Chapter 7 | p. 161 |
| Open Problems | p. 162 |
| A Brief Account of Other Developments (by O.G.) | p. 165 |
| Using the Adversary's Program in the Proof of Security | p. 167 |
| Witness Indistinguishability and the FLS-Technique | p. 169 |
| Proofs of Knowledge | p. 171 |
| How to Define Proofs of Knowledge | p. 171 |
| How to Construct Proofs of Knowledge | p. 172 |
| Non-interactive Zero-Knowledge | p. 173 |
| Statistical Zero-Knowledge | p. 174 |
| Transformations | p. 175 |
| Complete Problems and Structural Properties | p. 176 |
| Resettability of a Party's Random-Tape (rZK and rsZK) | p. 176 |
| Zero-Knowledge in Other Models | p. 177 |
| References | p. 179 |
| Table of Contents provided by Publisher. All Rights Reserved. |