Zero-Knowledge-Beweis
A cryptographic method that allows a party to prove that it knows a secret without revealing the secret itself. The basis for privacy-preserving authentication and blockchain applications.
A zero-knowledge proof (ZKP) allows one party (the prover) to prove to another (the verifier) that they know a piece of information—without revealing that information.
The Ali Baba Cave Analogy
The classic explanatory model: A cave has two entrances (A and B) that meet at a secret intersection. The intersection can be opened with a password.
Peggy (the prover) claims to know the password. Victor (the verifier) is supposed to verify this without learning the password:
- Peggy enters the cave and randomly chooses entrance A or B (Victor does not see which one)
- Victor calls from outside: "Come out through entrance A!" (random choice)
- If Peggy knows the password: she can always come out through the correct entrance
- Without the password: 50% chance of success (wrong entrance → cannot get through)
- After 20 repetitions: Probability of cheating = (1/2)²⁰ = 0.000095%
→ Victor is convinced without knowing the password.
Properties of Zero-Knowledge Proofs
- Completeness: If the statement is true, an honest prover convinces the verifier
- Soundness: A dishonest prover cannot deceive the verifier (with negligible probability)
- Zero-Knowledge: The verifier learns nothing except the fact that the statement is true
Practical Applications
Password Authentication:
- Classic: Server stores password hash, user sends password - server can reconstruct it
- ZKP-based: User proves knowledge of password without sending it - no password leak even if the server is compromised
zk-SNARKs (Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge):
- Zcash cryptocurrency: Transactions without revealing sender/recipient/amount
- Ethereum Layer 2 (zkSync, StarkNet): Scaling through batch proofs
Privacy-preserving credentials:
- "I am over 18 without showing my date of birth"
- "I am an EU citizen without showing my passport"
- "My creditworthiness is good without disclosing my salary"
Relevance to IT Security
ZKP is used for privacy-preserving authentication systems in which the authentication server is not supposed to store sensitive information. Still a research topic in the enterprise sector—already mainstream in blockchain/Web3.
