{[ promptMessage ]}

Bookmark it

{[ promptMessage ]}

lect18

# lect18 - 6.841 Advanced Complexity Theory Lecture 18...

This preview shows pages 1–2. Sign up to view the full content.

6.841 Advanced Complexity Theory Apr 13, 2009 Lecture 18 Lecturer: Madhu Sudan Scribe: Jinwoo Shin In this lecture, we will discuss about PCP ( probabilistically checkable proof ). We first overview the history followed by the formal definition of PCP and then study its connection to inapproximability results. 1 History of PCP Interactive proofs were first independently investigated by Goldwasser-Micali-Rackoff and Babai. Goldwasser- Micali-Wigderson were focused on the cryptographic implications of this technique; they are interested in zero-knowledge proofs, which prove that one has a solution of a hard problem without revealing the solution itself. Their approach is based on the existence of one-way functions. Another development on this line was made by BenOr-Goldwasser-Kilian-Wigderson who introduced several provers. 2 IP has two provers who may have agreed on their strategies before the interactive proof starts. However, during the interactive proof, no information-exchange is allowed between two provers. The verifier can them questions in any order. The authors showed that with 2 provers, zero-knowledge proofs are possible without assuming the existence of one-way functions. Clearly, 2 IP is at least as powerful as IP since the verifier could just ignore the second prover. Further- more, one can define 3 IP , 4 IP , . . . , MIP and naturally ask whether those classes get progressively more powerful. It turns out that the answer is no by Fortnow-Rompel-Sipser. They proved that 2 IP = 3 IP = . . . = MIP = OIP , where OIP is called oracle interactive proof . OIP is an interactive proof system with a memoryless oracle; all answers are committed to the oracle before the interactive proof starts and the oracle just answer them (without considering the previous query-history) when the verifier query them. Now we consider the difference between OIP and NEXPT IME . They both have an input x of n bits and a proof(certificate) π of length 2 n c for some constant c . The difference relies on the verifier V . If L NEXPT IME , there exists a deterministic-exptime V such that If x L , then there exists a π such that V ( x, π ) accepts, If x / L , then π , V ( x, π ) rejects. Similarly, if L OIP , there exists a randomized-polytime V such that If x L , then there exists a π such that V ( x, π ) accepts with high probability, If x / L , then π , V ( x, π ) accepts with low probability. Hence the relation OIP NEXPT IME is obvious since one can build the verifier for NEXPT IME by simulating all random coins of V in OIP . More interestingly, Babai-Fortnow-Lund showed the other direction OIP NEXPT IME . Using this relation MIP = OIP = NEXPT IME , Feige-Goldwasser-

This preview has intentionally blurred sections. Sign up to view the full version.

View Full Document
This is the end of the preview. Sign up to access the rest of the document.

{[ snackBarMessage ]}