52 Things: Number 6: How can we interpret NP as the set of theorems whose proofs can be checked in polynomial time?

52 Things: Number 6: How can we interpret NP as the set of theorems whose proofs can be checked in polynomial time?

52 件事： 第 6 点：我们如何将 NP 解释为一组定理，其证明可以在多项式时间内检查？

This is the latest in a series of blog posts to address the list of '52 Things Every PhD Student Should Know' to do Cryptography: a set of questions compiled to give PhD candidates a sense of what they should know by the end of their first year. We continue the Complexity Theory section with an alternative definition of NP...
这是一系列博客文章中的最新一篇，旨在解决“每个博士生都应该知道的 52 件事”来做密码学：一组问题汇编，让博士生在第一年结束时了解他们应该知道什么。我们继续复杂性理论部分，对 NP 进行替代定义......

This question is very much a follow up question to the previous one. Last week Guy answered the question of ``What is meant by the complexity class NP?'', while this week I will be answering the related question of ``How can we interpret NP as the set of theorems whose proofs can be checked in polynomial time?''.
这个问题在很大程度上是前一个问题的后续问题。上周，Guy 回答了“复杂性类 NP 是什么意思”的问题，而本周我将回答“我们如何解释 NP 为可以在多项式时间内检查其证明的定理集”的相关问题。

 

Now to me this is a more intuitive definition of what it means for a problem to be in NP. Not only is it a more intuitive definition but it should (hopefully) also be clearer as to why this is a complexity class that is useful both for cryptography and the wider world. Now before we go into what we can use the class of problems for, the definition is as follows:
现在对我来说，这是对问题意味着什么的更直观的定义 NP 。它不仅是一个更直观的定义，而且（希望）也应该更清楚地说明为什么这是一个对密码学和更广阔的世界都很有用的复杂性类。现在，在我们讨论可以使用问题类的用途之前，定义如下：

 

NP is the class of languages that have polynomial time verifiers.
NP 是具有多项式时间验证器的语言类。

 

OK but what does this actually mean? Basically if we have an element x and we want to know if x∈L (where L is some NP language) we have a prover P which given x outputs a witness w, this may take exponential time to find w given x. Then if we give x and w to our verifier V, V can tell if x∈L in polynomial time.
好的，但这实际上意味着什么？基本上，如果我们有一个元素 x ，我们想知道（ x∈L 某种 NP 语言在哪里 L ）我们是否有一个给定 x 输出见证的证明 P 器 w ，这可能需要指数级时间来找到 w 给定 x 的。然后，如果我们给 x 和 w 给我们的验证者 V ， V 可以判断是否 x∈L 在多项式时间内。

 

This definition seems very different from the one given last week but they are in fact equivalent. Informally they are equivalent because the witness w can just be the sequence of decisions the NDT made at each branching point to show that x∈L. For a (slightly) more formal proof of their equalence [1] is a reasonable online source (with references to textbooks).
这个定义似乎与上周给出的定义大不相同，但它们实际上是等价的。非正式地，它们是等价的，因为证人 w 可以只是 NDT 在每个分支点做出的一系列决定，以表明 x∈L .对于它们相等的（稍微）更正式的证明[1]是一个合理的在线资源（参考教科书）。

 

So why might this be useful in cryptography? Well essentially we have a class of languages which can take exponential time to check if you do not know a witness but with a witness it can be done in polynomial time. This has the ``feel'' of a lot of cryptographic algorithms - take Encryption (formalisation to follow in future weeks' blogs) for example; you want it to be exponentially hard to get the message from ciphertext without the key (similar to a witness) but with the key you want it to be efficient (polynomial time) to extract the message.
那么，为什么这在密码学中很有用呢？好吧，从本质上讲，我们有一类语言，它可能需要指数时间来检查你是否不认识一个证人，但有了证人，它可以在多项式时间内完成。这具有许多加密算法的“感觉”——以加密（未来几周的博客中将遵循的形式化）为例;您希望在没有密钥（类似于见证）的情况下从密文获取消息的难度呈指数级增长，但使用密钥，您希望它高效（多项式时间）来提取消息。

 

A warning: While it sounds like a good move to use an NP problem for cryptography it may not be as simple as it first appears. This is because languages are in NP based on the worse case complexity where as for encryption we need it to be hard on average. For example we may have an NP language which has one element that takes exponential time to solve but all others are really efficient to solve - this will not make a good basis for an encryption scheme because we want encryption to be secure for all messages not just one.
警告：虽然将 NP 问题用于密码学听起来是一个好举动，但它可能并不像最初看起来那么简单。这是因为语言 NP 是基于更糟糕的情况复杂性，至于加密，我们需要它平均很难。例如，我们可能有一种 NP 语言，它有一个元素需要指数级的时间来解决，但所有其他元素都非常有效 - 这不会为加密方案提供良好的基础，因为我们希望加密对所有消息都是安全的，而不仅仅是一个消息。

 

Now I am aware that integer factorization isn't known to be NP-complete and isn't known to be in P (See Ryan's blog here for a description) but it makes for a nice example of the point I am trying to make about choosing your NP instances carefully. In general finding a factor of a number is easy (half of them are divisible by two!) but if we choose something sensible we can make it hard to factor. Let us focus on numbers of the form N=p⋅q for p,q prime (a.k.a numbers with only two proper factors). Now if either of these numbers is small then it is again easy, so we want the numbers to be of equal size (this is what we do for RSA). From this it is possible to build an encryption scheme over the top.
现在我知道整数分解不是已知 NP 的 -complete，也不知道是否在 P （有关描述，请参阅此处的 Ryan 博客），但它为我试图提出的关于谨慎选择 NP 实例的观点提供了一个很好的例子。一般来说，找到一个数字的因数很容易（其中一半可以被二整除！），但如果我们选择一些合理的东西，我们就会使因式分解变得困难。让我们关注 p,q 素数形式的 N=p⋅q 数字（又名只有两个适当因数的数字）。现在，如果这些数字中的任何一个都很小，那么它又很容易，因此我们希望这些数字的大小相等（这就是我们为 RSA 所做的）。由此可以在顶部构建加密方案。