From what I know, proving the existance of a Knowledge Extractor implies perfect soundness.
So why in zk-SNARKs (and similar) we talk about Arguments of Knowledge, where the soundness property is only computational (a.k.a, secure only from computationally bounded Provers), if a Knowledge Extractor also exists? Am I missing something? Maybe a Knowledge Extractor can be proven in different "levels" of security (computational, statistical and perfect)? I never saw that until now tho, and I've always seen Knowledge Extractors as something different to prove, and not directly linked to the soundness property, so I can't figure out an answer.
- 151
- 8
1 Answers
Knowledge soundness can indeed be computational or statistical. There are some classical example, if you want some illustration: the Sigma protocol for correct opening of the Damgard-Fujisaki commitment scheme (a variant of Pedersen over groups of hidden order) is knowledge sound under the RSA assumption (see here). Intuitively, when you go through the proof, this means that your extractor works only if a certain condition is met, and you can show that this condition will always be met, but only if the malicious prover cannot break some hard problem.
SNARKs are an even stranger beast: here, the existence of the efficient extractor itself is essentially the assumption.
So, if you prove unconditionally that there is an extractor, it indeed implies perfect soundness. But if you prove "either there is an extractor or we can break hard problem X", or if the existence of the extractor is actually part of the assumption itself, you clearly don't get perfect soundness as a consequence, only computational soundness.
- 21,719
- 2
- 55
- 78