安全与隐私pages.cs.wisc.edu编辑精选
如何向孩子解释零知识协议（1998）
How to explain zero-knowledge protocols to your children (1998) [pdf]
2014 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
这是 1998 年一篇用讲故事的方式向孩子解释零知识证明的经典短文（PDF）。作者通过寓言式的情节，说明如何在不泄露秘密本身的前提下向他人证明自己知道某个秘密。文章多次登上 Hacker News 首页，被视为密码学入门的绝佳科普材料。
为什么经久不衰：它用最通俗的比喻讲清了零知识证明这一抽象概念，二十多年后仍是密码学入门的最佳读物之一，尤其在零知识证明技术兴起的今天更具现实意义。
HN 评论精选
零知识证明若能在人脑中实现，将彻底改变密码认证，可惜目前没有实用方案。
零知识证明是个非常实用的问题。如果你能让算法相信你知道密码、却不必输入密码，你就能免疫键盘记录器和密码泄露——也永远不用改密码。遗憾的是，目前没有能靠人脑心算完成的实用零知识证明，所以我们还是得把密码输入设备或依赖二次验证。理论上讲，简单实用的脑内零知识证明可能存在，但显然还没有。
logicallee查看英文原文
Zero-knowledge proofs are an extremely practical problem. If you could convince an algorithm that you know a password, without having to type it, you would be impervious to keyloggers or any loss of your password - you would never have to change your password, either. Unfortunately, there are no practical zero-knowledge proofs anyone can use in their heads. For this reason we are left typing them at least into the local device we're using - or having to use a second factor. Passwords can't stay in our head. That's a shame, because there's no theoretical reason for this to be so. Theoretically, easy, practical zero-knowledge proofs we can implement in our heads could exist. But apparently they don't.
称赞这篇论文的写作方式，并推荐类似的优秀科普资源。
很棒的小论文，真希望有更多这样的文章！顺便推荐 betterexplained.com，作者用更直观的新方式讲解数学概念。另外 Fermat's Library 不久前还为这篇论文做了批注。
tom_pulo查看英文原文
Awesome little paper. I wish there were more papers like this! BTW, you guys might enjoy https://betterexplained.com - the author explains math concepts in new more intuitive ways. The folks at Fermat's Library actually annotated this paper not too long ago: https://fermatslibrary.com/s/how-to-explain-zero-knowledge-protocols-to-your-children
批评文章后半部分对儿童读者来说写得不够清晰。
如果考虑到目标读者是儿童，那么在'嫉妒的记者'一段之前，文章的清晰度就开始崩塌了：引入概率却不解释其意义，还有'真品'的概念、法庭的胡言乱语、模拟和平行之类的东西，甚至中途还丢掉了认证的概念。说实话，我很惊讶 Alice 和 Bob 没有出现在剧情里……哦，原来是 Paul 和 Carole。
metaphor查看英文原文
If I try to keep in mind that the target audience is children, then the paragraph just before The Jealous Reporter is where I feel the clarity in prose really starts to fall apart. Introducing the concept of probability without really explaining its significance...or the notion of something being genuine...all this random court mumbo jumbo...simulation and parallel stuff...filming high-rise apartments with caves stuffed in them to achieve something that may not be optimal...even dropped authentication somewhere in there. Really? I'm honestly surprised Alice and Bob didn't somehow find their way into this plot...or was that Paul and Carole.
分享一个用扑克牌实现的现实版零知识证明方案，直观展示其原理。
我的密码学老师 Jacques Patarin 用一个简单的现实版零知识方案介绍零知识证明：只需 5 张牌，3 张相同的红牌和 2 张相同的黑牌。Alice 和 Bob 各拿一红一黑，通过把牌放在中间那张红牌的上方或下方来表达'是'或'否'，然后充分洗牌混淆。最后如果两张黑牌相邻（或在牌堆两端），说明两人都说了'是'。
littlestymaar查看英文原文
Jacques Patarin[1], my cryptography teacher at university introduced us with zero-knowledge proofs with a simple real-life zero knowledge scheme. All you need is 5 cards, 3 identical red and 2 identical blacks. You give one black and one red to each person (Alice and Bob), and keep the last red. The scheme is the following: Alice will puts her two cards ON TOP of the remaining red card: to say yes, she puts her black card on top of her red card, to say no she does the opposite (red on top of black). Bob will put his pair of cards BELOW the remaining red card, and to say yes he puts his black card at the bottom, with his red card in between, and to say no he does the opposite. Then you cut the deck enough times to obfuscate who've done what, and you know that they've both day yes if you have the two blacks cards next to each other (or both at each ends of the deck). If anyone (or both of them) said no, you'd have black cards separated by one red card. [1] https://fr.wikipedia.org/wiki/Jacques_Patarin
零知识证明如今已能用于证明大规模计算的正确性，应用前景惊人。
如今我在做'执行证明'和'数据可用性证明'，这是零知识证明在超长数值序列上的有趣应用。它能近乎魔法般地证明：一台按规范运行的虚拟计算机执行了 N 十亿步，给定特定输入和程序，产出了特定输出——而这一切被总结成一个验证者可以快速检查的简短证明，无需重跑计算。
jlokier查看英文原文
These days I'm working on "proof of execution" and "proof of data availability", which are an interesting application of zero-knowledge proofs to very large sequences of values. The steps aren't revealed, but the rule which the steps must follow is revealed. It's almost magical how it's possible to prove that N billion steps of a simulated virtual computer, run exactly according to specification, complete with CPU and memory, given a particular set of input files (or even a hash of an input) and program (or hash of a program), produces a particular set of output files. All summarised in a short proof that a verifier can easily and quickly check, so it doesn't have to redo the computation itself - it can trust the outputs it receives, due to the proof.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选