Non-Conversation-Based Zero Knowledge∗

In a zero-knowledge proof system Π a honest verifier V accepts or rejects a proof basing its decision on the common input, its randomness and the exchanged messages. Π is conversation based if an observer D guesses V ′ decision only knowing the common input and the exchanged messages and without knowing V ’s randomness. In this paper we prove a separation between conversation-based and non-conversation based zero knowledge. In particular we show that a variant of 3-round conversation-based black-box concurrent zero knowledge with sequential soundness in the Bare Public-Key model already known to be impossible for non-trivial languages, is instead possible using a non-conversation-based protocol. The result is obtained considering an impatient verifier, that is a natural extension of the non-aborting verifier previously used in [Rosen, CRYPTO 2000]. ∗The work presented in this paper has been supported in part by the European Commission through the IST Program under contract IST-2002-507932 ECRYPT and through the FP6 program under contract FP6-1596 AEOLUS.