An Almost-Constant Round Interactive Zero-Knowledge Proof

The concept of interactive zero-knowledge proofs (IZKPs) was introduced by Goldwasser, Micali and Rackoff [13]. They considered a setting in which a “powerful” prover P wants to convince a verifier V that a string x belongs to a language L c (0, l}*. With interactive proofs, P and I/ may toss coins and exchange messages (strings). Thus when x EL, V is only convinced with a high probability, greater than 1 1 x ) -k, where I x I is the length of x. When x P L, V is convinced with probability less than 1 x 1 -k. Intuitively a proof is zero-knowledge if it reveals no more than is strictly necessary, i.e., that x EL. Feige, Fiat and Shamir extended these proofs to IZKPs of knowledge of a Boolean predicate p(.; 1 [S]. For these, P wants to convince I/ that it “knows” a “witness” s for x such that p(x, s). Of particular interest are Arthur-Merlin IZKPs [l] for which the messages of V are the outcomes of V’s coin tosses. Goldreich and Krawczyk [ll] have shown that a constant round Arthur-Merlin proof which is zero-knowledge using“black-box” simulation induces a language L whose elements