5

Why was the simulator/extractor specifically given the power to rewind "time" instead of a different super power?

Was it defined in the first ZKP paper that the simulator and extractor would have this power as a "standard" and then everyone went with it or was there more thought put into it when giving it this super power?

I just want to understand how someone came to the conclusions(their though process) that rewinding "time" was the power that should be given instead of something else as this super power is very useful for a lot of ZKP proofs....so at the very least I think it was NOT a arbitrary choice to have this super power.

CLox
  • 195
  • 4

1 Answers1

1

Not sure, but my educated guess is that's because interactive protocols (from which ZKPs appear if you had zero-knowledgeness to completeness and soundness properties) rely deeply on order of messages exchanged between Prover and Verifier. So the ability to exchange that order seems a "natural" way to act out of protocol rules.

But I also think that from a general/"philosophical" point of view that's not mandatory, to avoid a simulator break soundness or an extractor to break zero-knowledgeness it's enough the simulator/extractor cannot be a valid party in the protocol, so is't enough they play out of rules whichever way they want.. but again, playing with time order seems so convenient ;)

my2cents :)

baro77
  • 790
  • 4
  • 10