The Gold Standard of Zero-Knowledge Proofs | Separating Zero Knowledge from Witness Indistinguishability

The short answer is that zero knowledge requires an efficient simulator whose output matches the relevant verifier view without receiving the prover’s witness. This chapter treats define zero knowledge through simulation as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. For a fictional protocol the real verifier view contains public statement x, random coins, three messages and output; the simulator receives x and the permitted auxiliary input but no witness Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. if the simulated and real view distributions are indistinguishable, the interaction adds no efficiently detectable witness-dependent information beyond the allowed inputs The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. give the verifier correlated auxiliary input and restate whether the simulator receives it; the security claim changes if the quantifier or input is omitted Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to say the witness never appears in plaintext, therefore the proof is zero knowledge. The shortcut fails because correlations among messages can leak information Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Perfect, statistical and computational zero knowledge use different comparison standards, and verifier class and setup matter. The present boundary is the declared definition Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Preserve the protocol, relation, verifier view, simulator code or theorem, auxiliary input, randomness, setup, security parameter and exact indistinguishability statement. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Next chapter

The short answer is that witness indistinguishability compares verifier views produced using any two valid witnesses for the same public statement. This chapter treats define witness indistinguishability as a two-witness game as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. A statement x has valid witnesses w0 and w1; a hidden bit selects which witness the prover uses, and an efficient verifier tries to guess that bit from its view Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. the property holds when the verifier’s advantage over one-half is negligible under the stated model The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. replace w1 with a value that is not a valid witness; the comparison no longer instantiates the WI definition Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to compare witnesses for different public statements. The shortcut fails because the statement itself can reveal which case was used Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. The game protects witness choice, not every other fact that the transcript may reveal. The present boundary is pairwise valid-witness indistinguishability Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Retain x, the relation check for both witnesses, selection experiment, verifier strategy, auxiliary input, advantage expression and security-parameter dependence. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that when every real verifier view can be replaced by the same witness-free simulated distribution, views from two valid witnesses cannot be efficiently distinguished under matching conditions. This chapter treats show why zero knowledge implies witness indistinguishability as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. If view(x,w0) and view(x,w1) are each indistinguishable from Sim(x), a distinguisher between the two would contradict one of those simulation links through a hybrid argument Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. the shared simulated distribution removes the witness from the middle of the comparison The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. change the verifier class or setup in only one statement; the implication cannot be copied until the definitions are aligned Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to state the implication without checking auxiliary input, computational versus statistical type or protocol model. The shortcut fails when the claims quantify over different worlds Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. The reasoning is definitional and depends on the exact ensembles and efficiency bounds. The present boundary is matched definitions Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Write the three distributions, two indistinguishability steps, distinguisher reduction, advantage bound and every shared assumption explicitly. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that WI can hide which witness was used while allowing information shared by all valid witnesses to remain in the verifier’s view. This chapter treats show why witness indistinguishability need not be zero knowledge as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. A fictional protocol sends a one-way image common to the witness family in addition to a WI proof; the verifier may not identify w0 versus w1 but still receives information no witness-free simulator is known to reproduce Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. the WI game compares only two real witness choices and has no obligation to simulate the whole view from the public statement alone The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. remove the extra common leakage and test whether a simulator now exists; passing WI still does not construct that simulator automatically Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to treat cannot tell which witness as learns nothing. The shortcut fails because those are different quantifiers and comparison distributions Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. A counterexample needs a complete protocol and assumption to prove formal separation; this teaching case illustrates the missing obligation. The present boundary is conceptual comparison Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. List what changes between w0 and w1, what remains common, what the verifier learns, and why the WI experiment does not test the common information. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that the WI advantage records how far a verifier’s witness-bit guess is from one-half under equal witness selection. This chapter treats calculate a distinguishing advantage as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. Across a fictional analysis the verifier guesses correctly with probability 0.503, giving advantage 0.003 under the convention absolute probability minus one-half Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. a small observed advantage in one finite exercise is a number, while cryptographic WI requires a negligible bound across the security parameter The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. double the number of samples or change the security parameter and report a confidence analysis without calling sampling noise a proof Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to declare WI because one experiment is near 50 percent. The shortcut fails because computational security is an asymptotic claim over all efficient distinguishers Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Empirical testing cannot enumerate adversaries or replace a reduction. The present boundary is interpreting a game statistic Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Preserve witness selection, random seeds, trials, verifier code, success counts, advantage convention, confidence interval and the theorem or assumption supporting the general claim. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that if a statement has only one valid witness, there is no distinct witness pair for the WI game to protect. This chapter treats recognise when witness indistinguishability is vacuous as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. A relation maps x to a unique witness w; every allowed comparison chooses w on both sides, so WI says nothing about whether the transcript reveals w Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. pairwise indistinguishability is automatically satisfied when the pair cannot differ The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. use a statement with two independently valid witnesses and rerun the comparison; the property becomes nontrivial Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to advertise WI as witness privacy for a unique-witness relation. The shortcut fails because the defining game has no alternative witness Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Whether a relation has unique witnesses can itself depend on representation and the statement. The present boundary is witness-set structure Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Record the exact relation, valid-witness set, uniqueness claim and whether alternative encodings represent genuinely different witnesses. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that witness hiding asks whether the verifier can compute a new witness, while WI asks whether it can distinguish which valid witness was used. This chapter treats keep witness hiding separate from witness indistinguishability as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. A verifier may fail to identify whether w0 or w1 was used yet compute a third valid witness from information common to the interaction Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. success in the two-witness choice game does not directly test witness recovery The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. define a recovery experiment with prior witness knowledge and a new-witness success condition instead of reusing the WI advantage Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to say indistinguishable witnesses are automatically hidden in every setting. The shortcut fails without the conditions connecting WI and witness hiding Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Classic results use conditions such as independent witnesses, and exact definitions matter. The present boundary is property separation Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Preserve the verifier’s initial knowledge, witness relation, recovery output, novelty condition, success probability and theorem assumptions. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that a property preserved under one execution is not automatically preserved under sequential, parallel or concurrent composition unless a theorem covers that setting. This chapter treats understand composition as its own claim as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. Two WI protocol instances run in parallel with correlated verifier state; the classic WI composition result addresses a broader setting than simply rerunning a one-instance experiment Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. composition changes the joint view and the verifier’s ability to correlate messages The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. move from parallel sessions to an interleaved concurrent schedule and cite the exact theorem rather than changing the label silently Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to assume zero knowledge and WI have identical composition behaviour. The shortcut fails because their simulators and comparison games impose different obligations Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Modern protocol classes and setup models have specialised composition theorems. The present boundary is theorem-scoped composition Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Record session count, scheduling, shared state, auxiliary input, setup reuse, adversarial interface and the theorem whose hypotheses match the composition. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that neither ZK nor WI hides information deliberately placed in the public statement or logically implied by it. This chapter treats keep public-statement leakage outside the witness-choice claim as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. A credential statement publicly names a narrow membership category; the proof may hide which credential witness was used while the category remains disclosed Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. the verifier receives x before the witness comparison or simulation begins The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. coarsen the public predicate and evaluate whether the application still proves what it needs while revealing less Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to call the entire application private because the proof has a cryptographic privacy property. The shortcut fails when inputs, timing or outputs disclose the sensitive fact Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Application privacy includes metadata, setup, side channels and downstream decisions beyond the proof transcript. The present boundary is statement design Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Inventory every public input, setup string, message length, timing field, verifier output and deduction that follows before analysing witness privacy. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that a robust claim names the verifier strategies and correlated auxiliary information quantified by the definition. This chapter treats state malicious-verifier and auxiliary-input scope as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. An honest-verifier transcript comparison uses a prescribed random challenge, while a malicious verifier chooses challenges from earlier messages and retains correlated state Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. a simulator or WI reduction proved for the first verifier does not automatically cover the second The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. supply the verifier with auxiliary information correlated with one witness and test whether the theorem’s quantifiers already include it Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to write for any verifier while using a proof that only analyses prescribed challenges. The shortcut fails at the quantifier Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Black-box versus non-black-box simulation and setup access can also change the model. The present boundary is explicit adversary scope Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Preserve verifier code class, auxiliary input, challenge rule, state, simulator access, rewinding or extraction assumptions and the exact theorem statement. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that a security conclusion should show how a distinguisher would break a named assumption or prior property and how its advantage changes. This chapter treats audit reductions, assumptions and advantage loss as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. A reduction turns a WI distinguisher with advantage epsilon into a distinguisher against the underlying commitment with advantage at least epsilon divided by two under the stipulated hybrid Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. the quantitative route connects the protocol claim to the assumption rather than relying on an adjective The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. compose k hybrids and track whether the bound becomes epsilon divided by k or loses additional factors Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to cite hardness without mapping the adversary’s inputs and outputs. The shortcut fails because the reduction may not run in the required time or distribution Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. Concrete bounds can be loose and asymptotic negligibility does not choose deployment parameters. The present boundary is traceable proof logic Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Retain assumptions, game sequence, simulator or reduction code, running time, query counts, advantage conventions, abort probabilities and final parameter inequality. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Next chapter

The short answer is that a defensible report identifies exactly which privacy property was proved, for which relation, verifier, setup and composition, and what remains outside it. This chapter treats build a privacy-property receipt as a defined comparison. Keep language and relation, public statement, valid witness set, prover and verifier algorithms, verifier auxiliary input, setup, transcript and internal view, security parameter, indistinguishability type, simulator access, quantifier order, composition setting and computational assumptions in separate fields. Two values can share a subject or unit and still answer different questions.

Worked example. The receipt states computational WI for any two valid witnesses under malicious verifiers with auxiliary input in the declared model, while recording that no full zero-knowledge simulator claim is made Write the unit and basis beside every number, keep the intermediate result visible, and retain enough raw information for another reader to reproduce the answer without guessing a software default.

Why the result follows. the wording prevents witness-choice privacy from expanding into learns nothing The decisive operation is named before the conclusion. That makes a disagreement traceable to a denominator, measurement state, model or evidence threshold instead of leaving it as a vague conflict between labels.

Changed-context transfer check. add a zero-knowledge theorem with matching scope and update the receipt only after comparing its simulator and assumptions Rebuild the result from the altered premise. State the first intermediate value that changes, propagate it through the remaining steps, and identify any part of the earlier conclusion that still holds.

A common misconception is that nearby measurements are interchangeable. Here, The shortcut is to end with privacy preserved. The shortcut fails because readers cannot tell which game, leakage or implementation was assessed Correct the shortcut by naming the operation and the information it retains or discards, then show one case in which the values move differently.

Limits and caveats. A mathematical theorem does not by itself validate code, setup generation, side-channel resistance or application data handling. The present boundary is property accounting Security properties attach to a precisely specified protocol and model; an informal transcript example or paper game does not prove that an implementation, transformation or composed application satisfies either definition. Report any convention, instrument setting or model choice that can change the boundary of the claim.

Practical evidence check. Include relation, statement and witness set, protocol version, setup, verifier class, property and type, simulator or game, assumptions, composition, public leakage, implementation checks and approved claim. Preserve the raw inputs, exclusions, units, uncertainty basis and calculation trail. A reader should be able to change one premise and obtain the transfer result without guessing the sample, conditions, measurement state or evidence basis used.

Contents · Previous chapter · Return to the Zero-Knowledge Proofs subject guide