Commitment Schemes and Zero-Knowledge Protocols

This article is an introduction to two fundamental primitives in cryptographic protocol theory: commitment schemes and zero-knowledge protocols, and a survey of some new and old results on their existence and the connection between them. 1 What’s in this article? This article contains an introduction to two fundamental primitives in cryptographic protocol theory: commitment schemes and zero-knowledge protocols. We also survey some new and old results on their existence and the connection between them. Finally, some open research problems are pointed out. Each of the two main sections (on commitments, resp. zero-knowledge) contain its own introduction. These can be read independently of each other. But you are well advised to study the technical sections on commitment schemes before going beyond the introduction to zero-knowledge. The reader is assumed to have some basic knowledge about cryptography and mathematics, in particular public key cryptography and the algebra underlying the RSA and discrete log based public key systems. Concepts such as groups and homomorphisms will be used without further introduction. 2 Commitment Schemes