Course outline
Module 1
Module 1: Introduction to Zero-Knowledge Proofs
Introduction to Zero-Knowledge Proofs
Knowledge check
Q1. What is the core idea of a zero-knowledge proof?
- A. Proving a statement is true while revealing the underlying secret information
- B. Proving a statement is true without revealing any information beyond the validity of the statement
- C. Encrypting a message so that only the recipient can read it
- D. Verifying a transaction by checking every participant's full history
Q2. Which three properties must a zero-knowledge proof system satisfy?
- A. Speed, scalability, and decentralization
- B. Completeness, soundness, and zero-knowledge
- C. Confidentiality, integrity, and availability
- D. Encryption, hashing, and signing
Q3. In the context of zero-knowledge proofs, who is the prover?
- A. The party who checks whether the statement is true
- B. The party who tries to convince the verifier that a statement is true
- C. A trusted third party who issues the proof parameters
- D. The network node that stores the blockchain ledger
Q4. What does the soundness property guarantee?
- A. An honest prover can always convince an honest verifier of a true statement
- B. A dishonest prover cannot convince the verifier of a false statement, except with negligible probability
- C. The verifier learns nothing about the secret
- D. The proof can be verified in constant time
Q5. Which real-world example best illustrates a zero-knowledge proof?
- A. Showing your passport to prove your age at a bar
- B. Proving you are over 18 to a website by demonstrating a valid credential without disclosing your birthdate
- C. Writing your password on a sticky note
- D. Sending an encrypted email to a colleague
Module 2
Module 2: Core Properties: Completeness, Soundness, and Zero-Knowledge
Core Properties: Completeness, Soundness, and Zero-Knowledge
Knowledge check
Q1. In a zero-knowledge proof, which property guarantees that an honest prover who knows the secret can always convince an honest verifier?
- A. Soundness
- B. Completeness ✓
- C. Zero-knowledge
- D. Non-interactivity
Why: Completeness means that if the statement is true and both parties follow the protocol honestly, the verifier will accept the proof with overwhelming probability.
Q2. Which property ensures that a cheating prover cannot convince the verifier of a false statement, except with negligible probability?
- A. Completeness
- B. Zero-knowledge
- C. Soundness ✓
- D. Simulation
Why: Soundness protects the verifier: if the statement is false, no prover (even a dishonest one) can make the verifier accept, except with negligible probability.
Q3. What does the zero-knowledge property guarantee?
- A. The verifier learns the secret witness after the proof is complete
- B. The verifier learns nothing beyond the validity of the statement being proven ✓
- C. The prover never needs to know the secret
- D. The proof can be checked without any computation
Why: Zero-knowledge means the verifier gains no information beyond the fact that the statement is true; any information they could obtain could be simulated without the secret.
Q4. Consider a prover claiming to know a password without revealing it. If the prover actually does not know the password but still convinces the verifier with high probability, which property has been violated?
- A. Zero-knowledge
- B. Completeness
- C. Soundness ✓
- D. Perfect secrecy
Why: Convincing the verifier of a false claim (not knowing the password) breaks soundness, which is the property that prevents cheating provers from succeeding.
Q5. Why is the simulator concept important when defining zero-knowledge?
- A. It allows the prover to generate fake secrets
- B. It shows that a verifier could produce indistinguishable transcripts without the secret, so the real transcript leaks nothing ✓
- C. It speeds up verification by skipping steps
- D. It proves that soundness holds for all inputs
Why: If a simulator can produce transcripts that look like real interactions without knowing the secret, then the real interactions cannot reveal the secret, which formalizes zero-knowledge.
Module 3
Module 3: Interactive Proof Systems
Interactive Proof Systems
Knowledge check
Q1. In an interactive proof system, what are the two main roles involved?
- A. A prover and a verifier ✓
- B. A sender and a receiver
- C. A miner and a validator
- D. A client and a server only
Why: Interactive proof systems involve a prover, who tries to convince of a statement's truth, and a verifier, who checks the prover's messages and decides whether to accept or reject.
Q2. Which of the following best describes the completeness property of an interactive proof system?
- A. A cheating prover can convince the verifier of a false statement with high probability
- B. If the statement is true, an honest prover can convince the verifier to accept with high probability ✓
- C. The verifier must always run in exponential time
- D. The prover must reveal its secret input to the verifier
Why: Completeness means that for true statements, an honest prover following the protocol will cause the verifier to accept with high probability.
Q3. What does the soundness property guarantee in an interactive proof?
- A. Every true statement can be proven in one message
- B. The verifier learns nothing beyond the statement being true
- C. For false statements, no cheating prover can convince the verifier to accept except with small probability ✓
- D. The prover and verifier must share a secret key
Why: Soundness ensures that a false statement cannot be proven except with negligible probability, protecting the verifier against cheating provers.
Q4. What role does randomness play in the verifier of an interactive proof system?
- A. The verifier must be deterministic so the prover can predict its messages
- B. The verifier uses random challenges, which prevent a prover from anticipating its questions in advance ✓
- C. The verifier generates random proofs that the prover then checks
- D. Randomness is forbidden because it reveals the secret
Why: Random challenges from the verifier prevent a dishonest prover from preparing answers ahead of time, which is essential for achieving soundness.
Q5. Which complexity class is equal to the class of problems with interactive proof systems, as established by the IP = PSPACE theorem?
- A. NP
- B. P
- C. PSPACE
- D. EXPTIME
Why: The IP = PSPACE theorem, proved by Shamir in 1990, shows that the class of languages with interactive proof systems is exactly PSPACE.
Module 4
Module 4: Non-Interactive Proofs and the Fiat-Shamir Heuristic
Non-Interactive Proofs and the Fiat-Shamir Heuristic
Knowledge check
Q1. What is the main purpose of a non-interactive zero-knowledge proof compared to an interactive one?
- A. It removes the need for the prover to know the secret
- B. It allows a proof to be produced once and verified by anyone without back-and-forth communication with the prover
- C. It guarantees the verifier learns the full secret
- D. It eliminates the need for a soundness property
Q2. In the Fiat-Shamir heuristic, what is typically used to replace the verifier's random challenge?
- A. A timestamp from the prover's system clock
- B. The output of a cryptographic hash function applied to the transcript so far
- C. A fixed constant agreed upon in advance
- D. The prover's private key
Q3. Why must the hash input in Fiat-Shamir include the prover's first message (the commitment)?
- A. To make the proof shorter in size
- B. So that the challenge depends on the commitment and the prover cannot choose the commitment after seeing the challenge
- C. To allow the verifier to skip checking the challenge
- D. To encrypt the statement being proved
Q4. Which property is most at risk if the Fiat-Shamir heuristic is implemented incorrectly by omitting the public statement from the hash input?
- A. Completeness, since honest provers can no longer generate proofs
- B. Soundness, since a prover may be able to forge proofs for false statements
- C. Efficiency, since the proof becomes larger
- D. Zero-knowledge, since the verifier learns the witness directly
Q5. What does it mean for a non-interactive proof to rely on a random oracle model in its security analysis?
- A. The prover must consult a trusted third party for randomness
- B. The hash function is modeled as an ideal source of unpredictable outputs that behaves like a truly random function
- C. The verifier generates random numbers that are published on a blockchain
- D. The proof uses encryption with randomly generated keys for each statement
Module 5
Module 5: Commitment Schemes and Cryptographic Foundations
Commitment Schemes and Cryptographic Foundations
Knowledge check
Q1. What is the primary purpose of a commitment scheme in cryptography?
- A. To encrypt a message so only the recipient can read it
- B. To let a party fix a value now and reveal it later without being able to change it ✓
- C. To prove a statement is true without revealing any information
- D. To generate random numbers that no one can predict
Why: A commitment scheme lets a committer bind themselves to a chosen value while keeping it hidden, then later reveal it. It provides two core properties: hiding (the value stays secret) and binding (the committer cannot change the value after committing).
Q2. Which two security properties must a commitment scheme satisfy?
- A. Confidentiality and integrity
- B. Hiding and binding ✓
- C. Soundness and completeness
- D. Anonymity and non-repudiation
Why: Hiding ensures the committed value remains secret until revealed, while binding ensures the committer cannot open the commitment to a different value than the one originally committed to.
Q3. In a simple hash-based commitment, what is typically computed to produce the commitment?
- A. The commitment is the raw message sent in plaintext
- B. The commitment is a hash of the message concatenated with a random nonce ✓
- C. The commitment is the private key of the committer
- D. The commitment is a digital signature on the message
Why: Hashing the message together with a random nonce (or salt) produces a commitment that hides the message, since the random value prevents guessing the input, and binds the committer because finding a different input with the same hash is infeasible.
Q4. Why is a random nonce (blinding factor) included in a hash-based commitment?
- A. To make the commitment faster to compute
- B. To prevent brute-force guessing of the committed value when it comes from a small set of possibilities ✓
- C. To allow the commitment to be reversed later
- D. To ensure the hash function output is always the same length
Why: If the committed value is from a small space, such as yes/no or a small number, an attacker could hash every possibility and compare. A random nonce makes each commitment unique and unguessable, preserving the hiding property.
Q5. Which property would be violated if a committer could later claim they had committed to a different value than originally fixed?
- A. Hiding
- B. Binding ✓
- C. Zero knowledge
- D. Completeness
Why: Binding is the property that prevents the committer from opening a commitment to a value different from the one originally committed. Violating it allows the committer to change their answer after the fact.
Module 6
Module 6: zk-SNARKs and Succinct Proof Systems
zk-SNARKs and Succinct Proof Systems
Knowledge check
Q1. What does the acronym zk-SNARK stand for?
- A. Zero-Knowledge Secure Non-interactive Argument of Knowledge
- B. Zero-Knowledge Succinct Non-interactive Argument of Knowledge ✓
- C. Zero-Knowledge Simple Network Authentication Random Key
- D. Zero-Knowledge Standardized Numeric Arithmetic Redundancy Kernel
Why: zk-SNARK stands for Zero-Knowledge Succinct Non-interactive Argument of Knowledge. 'Succinct' means proofs are very small and fast to verify, 'non-interactive' means no back-and-forth between prover and verifier is needed, and 'argument of knowledge' means the prover convinces the verifier they know a witness.
Q2. What does the 'succinct' property of a zk-SNARK mean?
- A. The proof reveals only the final answer to the computation
- B. The proof is very small in size and quick for a verifier to check, regardless of the computation's size ✓
- C. The prover must write the proof in a short amount of time
- D. The proof can only be used once before it expires
Why: Succinctness means the proof size and verification time are small, typically polylogarithmic in the size of the computation. A verifier can check a proof of a very large computation quickly, which is what makes zk-SNARKs practical for blockchains.
Q3. Which property ensures that a dishonest prover cannot convince a verifier of a false statement?
- A. Zero-knowledge
- B. Completeness
- C. Soundness ✓
- D. Non-interactivity
Why: Soundness guarantees that if a statement is false, no cheating prover can produce a convincing proof except with negligible probability. Completeness ensures honest provers can convince verifiers of true statements, and zero-knowledge ensures nothing beyond the statement's validity is revealed.
Q4. What is a 'trusted setup' in many zk-SNARK constructions?
- A. A process where the verifier is audited by a third party before use
- B. A one-time generation of public parameters that requires secret randomness which must be destroyed afterward ✓
- C. A mandatory agreement between the prover and verifier on the proof format
- D. A hardware security module that stores the prover's private key
Why: Many zk-SNARKs require a one-time ceremony to generate common reference parameters using secret randomness ('toxic waste'). If this randomness is not destroyed, a party who retains it could forge proofs. Protocols like Groth16 require this, while others like STARKs avoid it.
Q5. What is the main role of the 'witness' in a zk-SNARK?
- A. It is a public record that the proof was verified on-chain
- B. It is the secret information the prover knows that satisfies the statement being proven ✓
- C. It is a third party who vouches for the prover's identity
- D. It is the hash of the public parameters used in the setup
Why: The witness is the private input the prover possesses, such as a password or secret value, that makes the statement true. The zk-SNARK lets the prover demonstrate knowledge of this witness without revealing it.
Module 7
Module 7: Real-World Applications of Zero-Knowledge Proofs
Real-World Applications of Zero-Knowledge Proofs
Knowledge check
Q1. Which real-world application most directly uses zero-knowledge proofs to let a user prove they are over a certain age without revealing their date of birth?
- A. Public key encryption for email
- B. Age verification using credential-based zero-knowledge proofs ✓
- C. Blockchain mining with proof of work
- D. Standard password hashing for logins
Why: Age verification with zero-knowledge proofs lets a holder of a signed credential prove a statement like 'I am over 18' without disclosing the underlying birthdate. Public key encryption, proof of work, and password hashing do not provide this selective disclosure property.
Q2. In a blockchain context, what is a primary purpose of zk-rollups?
- A. To store the entire transaction history on every node
- B. To batch many transactions off-chain and post a validity proof on-chain to increase throughput ✓
- C. To remove the need for any consensus mechanism
- D. To make all transaction amounts publicly visible
Why: zk-rollups execute transactions off-chain, bundle them, and submit a succinct validity proof to the main chain. This lets the chain verify correctness cheaply, which increases throughput while inheriting the base layer's security.
Q3. Which privacy-focused cryptocurrency is known for using zero-knowledge proofs (zk-SNARKs) to shield transaction details such as sender, receiver, and amount?
- A. Bitcoin
- B. Ethereum mainnet without extensions
- C. Zcash ✓
- D. Litecoin
Why: Zcash introduced zk-SNARKs to allow shielded transactions where the sender, recipient, and amount can be hidden while the network still verifies that no coins were created or double-spent. Bitcoin and Litecoin have transparent ledgers, and Ethereum mainnet does not hide transaction details by default.
Q4. How can zero-knowledge proofs help with identity and access control in a company setting?
- A. Employees must share their full credentials with every system
- B. An employee can prove they hold a required clearance or role without revealing their name or employee ID to the verifier ✓
- C. Access is granted to anyone who requests it
- D. Passwords are stored in plain text for faster checking
Why: ZK proofs allow an employee to demonstrate a specific attribute, such as holding a required clearance, without disclosing unnecessary identifying details. This supports the principle of data minimization in access control systems.
Q5. Which statement best describes the main benefit of zero-knowledge proofs in financial compliance?
- A. They eliminate the need for regulators to exist
- B. They let institutions prove they meet regulatory requirements, such as solvency or sanctions screening, without revealing sensitive underlying data ✓
- C. They make all financial records publicly searchable
- D. They guarantee that no fraud can ever occur
Why: Zero-knowledge proofs allow a firm to demonstrate compliance, such as having reserves above a threshold or passing a sanctions check, while keeping customer data and proprietary details confidential. They support verification without full disclosure rather than replacing regulation or guaranteeing fraud prevention.