# “forward-secure” zero knowledge protocols

Has anything been done on the modification of the zero knowledge condition
where the distinguisher has access to the witness used by the prover and
the random bits used by the algorithm that generated the auxiliary input?

(Or is that, in fact, how the zero knowledge condition is usually defined?)

This seems like it would be important for using ZK protocols as pieces of larger protocols,
since whether or not an adversary succeeds could depend on that information.

• Why don’t you just consider the witness and the random bits (I do not know what you mean by the latter, but whatever it is) also as part of the auxiliary input? Then I think that this is the same as the usual definition of zero-knowledge. – Tsuyoshi Ito Mar 1 '12 at 13:44
• Because then the simulator would have access to the witness used, so the simulator could just run an interaction between the cheating verifier and the prover. $\:$ ("random bits" = independent $\{0,1\}$-valued random variables with the uniform distribution) $\;\;$ – user6973 Mar 1 '12 at 20:51

• (My understanding of the standard definition is that) The cheating prover and the distinguisher are both given the output of an arbitrary algorithm whose input was the instance to be proven; that output is the "auxiliary input". $\:$ In particular, (my understanding is that) the random bits used by that algorithm are normally not available to the distinguisher. $\;\;$ – user6973 Mar 22 '12 at 17:33