0

In zero knowledge, in the context of graph 3-coloring, I do not understand how the prover is actually showing that he solved the problem.

The context:

  • both know the graph (the prover and the verifier)

  • the prover solves a 3-coloring of the graph

  • repeat:

    *the prover randomly permutes the colors

    *the verifier asks for the coloring of an edge

    *if the colors are different the process continues, and the verifier is more convinced that the prover actually solved the 3-coloring, if not, the verifier knows that the prover did not solve the 3-coloring

My question is: why couldn't a false prover (someone that does not know how to solve for the coloring) just always provide 2 different random colors?

Rafael
  • 21
  • 2

1 Answers1

1

Your misunderstanding stems from stating a wrong protocol for ZK 3-color verification. In fact the protocol is a bit more complex:

The prover first "commits" to colors. This means that he cannot change its commitment afterwards, but at the same time, he does not reveal the colors themselves.

Then, once the verifier asks for an edge, the prover "opens" its commitment, revealing the colors of that edge alone.

Since its commitment is binding, the prover cannot change the colors after committing to them. So if the prover does not have a legal coloring, he must commit to some invalid coloring of at least one edge, and will be found with some small probability.

This is repeated, each time with a new permutation of the colors, and new commitments.

Ran G.
  • 20,884
  • 3
  • 61
  • 117