Eecient Non-interactive Zero-knowledge Proofs of Circuit Satissability

We show how to construct a \zero-knowledge proof" that a circuit of size m is satissable. The proof is a string of length O(m lg m) which is constructed (and can be veriied) using a trusted random string of length O(m lg m). The probability of failure or of cheating is exponentially small in a security parameter which is deened independently 1 of the circuit size. Our methods assume that a Quadratic Residuos-ity Bit Commitment Scheme is available as a primitive and does not consider the cost of establishing this scheme, only the cost of using it. Thus, these \proofs" are essentially non-interactive zero-knowledge proofs, with a couple of changes to the standard deenition, though they can easily be modiied to t the standard deenition. The techniques used yield more eecient \proofs" than those previously known.