Tuesday, April 1, 2008

* PSPACE is subset of IP

PSPACE IS SUBSET OF IP

Use of a number of ideas.  Most importantly, arithmetization.

We first note that IP is closed under poly-time (or logspace
reductions).  If we have an IP protocol for language L and we have L'
<=P L, then given a string w in L', the Verifier can compute the
reduction from L' to L, and then use the IP protocol for L.

So it is sufficient for us to devise an IP protocol for QBF.  Recall
that QBF is to determine whether the following formula is satisfiable.

Q_1x_1 Q_2x_2 Q_3x_3 ... Q_mx_m F(x_1, ..., x_m),

where Q_i is either Exists or Forall and F is a Boolean formula.  

For a boolean formula f, we already have a polynomial F.  How to
handle quantifiers?

For Forall x_k f(x_1, ..., x_k) we replace by

Pi_{x_k} F(x_1,...,x_{k-1},x_k) = F(x_1,...,x_{k-1},0) * F(x_1,...,x_{k-1},1)

For Exists x_k f(x_1, ..., x_k) we replace by

U_{x_k} F(x_1,...,x_{k-1},x_k) = 1 - (1-F(x_1,...,x_{k-1},0)) *
(1-F(x_1,...,x_{k-1},1))

Proceeding thus, we obtain that QBF

Exists x_1 Forall x_2 ... Forall x_n f(x_1,...,x_n) is satisfiable iff

U_{x_1} Pi_{x_2} ... Pi_{x_n} F(x_1,...,x_n) = 1

We can apply the same technique as for co-NP to calculate the value of
this expression mod q for some prime q.  We have a problem though.
How large can the value be?  How large should q be?

Each Pi or U could double the degree of a variable.  So the degree of
any variable could be exponential in n.  Let us still define the protocol
completely.

Define P_i(x_i) as follows.  

P_i(x_i) = Q_{x_{i+1}} ... Q_{x_{n}} F(r_1,...,r_{i-1},x_i,x_{i+1},...,x_n)

P->V: Large prime q.

V: Verifies primality of q.  Then, sets v_0 = 1.

For i = 1 to n:

P->V: Sends P'_i(x_i)  

[Tries to convince verifier that U_{x_i} Pi_{x_{i+1}} ... Pi_{x_n}
F(r_1,...,r_{i-1},x_i,...,x_n) = v_{i-1}.]

V: If Q is Pi, then verify that P'_i(0)*P'_i(1) = v_{i-1}.  Select r_i at
random from Z_q and set v_i = P'_i(r_i).

   If Q is U, then verify that 1 - (1 - P'_i(0))(1 - P'_i(0)) = v_{i-1}.
Select r_i at random from Z_q and set v_i = P'_i(r_i).

V->P: Send r_i

End For

V: Verify whether v_n = F(r_1,r_2,...,r_n) and accept if so.
 
The above protocol works, but for the fact that the polynomials P'_i
may have to be exponential degree.  How can we reduce the degree of
these polynomials?  Note that the only check that the verifier does is
for values 0 and 1.  For computing these values, we can reduce the
degree of x_i down to 1.

We apply a degree reduction operation between each two quantifiers for
every variable that is quantified outside.

U_{x_1} R_{x_1} Pi_{x_2} R_{x_1} R_{x_2} U_{x_3} ... Pi_{x_n} R_{x_1}
... R_{x_n} F(x_1,...,x_n) = 1

R_{x_i} is an operator that reduces the degree of x_i in every term,
where it is nonzero, to 1.

NEW AND CORRECT IP PROTOCOL

In each round k, the verifier holds a value v_k and the prover wants
to convince the verifier that

v_k = O_{k+1}...O_\ell Phi_k mod q

where Phi_k is some polynomial (computed on some value).  At the end
the round the verifier will compute some v_{k+1} and will then want to
be convinced that

v_{k+1} = O_{k+2}...O_\ell Phi_{k+1} mod q

for some Phi_{k+1}.

BEGIN PROTOCOL

P->V: Large prime q.

V: Verifies primality of q.  Then, sets v_0 = 1.

For i = 1 to \ell:

-----
Case 1: Quantifier is Pi

[Prover wants to convince the verifier that 

v_k = Pi_{x_i} R_{x_1} ... U_{x_{i+1}} R... Pi_{x_n} R...R
Phi(r_1,...,r_{i-1},x_i,...,x_n) ]

P->V: Sends P'(x_i)

V: Verify that P'(0)*P'(1) = v_k.  Select r_i at random from Z_q and
set v_{k+1} = P'(r_i).

-----

Case 2: Quantifier is U

[Prover wants to convince the verifier that 

v_k = U_{x_i} R_{x_1} ... U_{x_{i+1}} R... Pi_{x_n} R...R
Phi(r_1,...,r_{i-1},x_i,...,x_n) ]

P->V: Sends P'(x_i)

V: Verify that 1 - (1-P'(0))(1-P'(1)) = v_k.  Select r_i at random from Z_q
and set v_{k+1} = P'(r_i).
------

Case 3: Quantifier is R

[Prover wants to convince the verifier that 

v_k = R_{x_i}...R_{x_j} U_{x_{j+1}} R... Pi_{x_n} R...R
Phi(r_1,...,r_j,x_{j+1},...,x_n) ]

P->V: Sends P'(x_i)

V: Verify that [R_{x_i}P'(x_i)](r_i) = v_k.  Select r_i at random from
Z_q and set v_{k+1} = P'(r_i).
------

V->P: Send r_i

End For

V: Verify that v_\ell = F(r_1,r_2,...,r_n) and accept if so.

END PROTOCOL 

Degree of polynomial.  Once a reduction is done, the degree is at most
2.  Before the reduction (in the first n operators), the degree is at
most 3m, where phi is a 3SAT formula with m clauses.