Computerphile · YouTube · 9:39
This 150-second introductory lecture explains zero-knowledge proofs through a physical two-pen analogy. After motivating privacy-enhancing technologies, the speaker defines a zero-knowledge proof as a protocol that lets a prover convince a verifier of a statement about a secret without revealing the secret. He then demonstrates a game with one red pen and one blue pen, where the verifier is treated as color blind. In one round, the verifier randomly swaps or does not swap the pens behind his back, and the prover must identify whether a swap occurred. The clip emphasizes that one successful round is weak evidence because a cheating prover has chance of guessing correctly, so repetition is needed. This introductory lecture segment explains zero-knowledge proofs through two concrete analogies: a probabilistic pen-color identification game and a deterministic card-color verification. It establishes the core intuition that repeated interaction reduces cheating probability, then formally defines the three essential criteria—correctness, soundness, and the zero-knowledge property—using the preceding examples to illustrate how a prover can demonstrate truth without leaking underlying secrets like card ranks or pen colors. This 150-second clip uses a tabletop demonstration with two pens as candidates to explain how zero-knowledge proofs can secure electronic voting. The speaker encodes a vote as 1 and 0, treats the envelope as encryption, and explains that encrypted ballots can be aggregated without revealing individual votes. He then identifies two required validity proofs: first, that the encrypted values sum to 1, and second, that each encrypted value is binary, because otherwise a voter could cheat with values like -1 and +2. The clip ends just as he introduces another attack involving copying and pasting someone else’s encrypted vote. This clip explains a zero-knowledge-proof-based approach to private electronic voting. The speaker says the third zero-knowledge proof is used to show that the voter knows the contents of an encrypted ballot without revealing those contents. He clarifies that the 'envelopes' are really encryption, that individual votes cannot be decrypted separately, and that decryption happens only after all votes are summed. As a result, the system can verify that each vote is binary and known to the voter while preventing recovery of which person chose which option. The same idea is said to apply to online petition signing. Near the end, the dialogue uses a card example—proving the card is red without revealing its number—to restate the general zero-knowledge principle: prove a statement about a secret without revealing the secret. The last seconds switch to channel branding and previews of other videos.
Use the learning inspector for key ideas and moments, or open the reading tabs for the complete notes.
Generated from the video's visuals and explanation; not verbatim speech.
The clip opens with a practical motivation: many useful technologies depend on personal data, and that data may be private or sensitive. The speaker frames privacy-enhancing technologies as a way to keep the benefits of modern systems without surrendering private information.
He then introduces zero-knowledge proofs as one example of such technology. At 44.0-46.0 seconds, a title card appears with the text <zero knowledge proof> and <computerphile>, marking the shift from motivation to definition.
The speaker defines a zero-knowledge proof as a protocol involving a prover and a verifier. The prover can demonstrate a statement about a secret without revealing the secret itself. In plain terms, the goal is to convince someone that you know something or that a property holds, while keeping the underlying private information hidden.
To make the abstraction concrete, he introduces a two-pen game. One pen is red and one is blue. The prover can see the difference, but the verifier is assumed to be color blind and cannot tell the pens apart. Around 80.0 seconds, the video overlays the text <red/blue colour blindness simulation> and visually alters the image so the audience shares the verifier's limitation.
The protocol for one round is then demonstrated. The prover hands the two pens to the verifier in random order. The verifier puts them behind his back and randomly decides whether to swap them. He then brings the pens back into view. The prover must answer whether a swap occurred. In the first shown round, the prover answers that the pens were not swapped.
The speaker immediately explains why this single success is not yet convincing. If the prover were cheating and had no real ability to distinguish the pens, he would still have a 50% chance of guessing correctly in one round. Symbolically, . Therefore one round provides only weak evidence.
The clip ends by starting a second round, reinforcing the central lesson of the analogy: repeated interaction is needed to reduce the probability that a false prover keeps getting lucky. The mathematical point established here is not a full formal security proof, but the intuitive soundness requirement that multiple rounds strengthen belief.
The segment opens with a practical demonstration of zero-knowledge proofs using two pens. The speaker explains that if a verifier randomly swaps the pens behind their back, a prover claiming to distinguish colors faces a binary guess. A color-blind impostor would succeed by chance with probability per round. By repeating the protocol, the cumulative cheating probability drops to after two rounds and after three, establishing statistical confidence without ever revealing which pen is red or blue. A visual simulation of red-blue color blindness reinforces why the secret capability is necessary for soundness.
Transitioning to a deterministic example, the speaker introduces a standard 52-card deck. After drawing one card at random and keeping it hidden, the goal shifts to proving the card is red without disclosing its rank or suit. Unlike the probabilistic pen game, this protocol achieves certainty in a single interaction. The prover reveals the remaining 51 cards, specifically pointing out that exactly 26 of them are black (spades and clubs). Since the deck contains precisely 26 black cards total, the absence of any black card among the revealed set logically necessitates that the single hidden card belongs to the red subset. Crucially, the verifier confirms the color property while gaining zero information about the card's identity, perfectly embodying the zero-knowledge ideal.
Having grounded the concepts in tangible analogies, the speaker formalizes the requirements for a valid zero-knowledge proof into three distinct criteria. First, correctness guarantees that honest execution always leads to acceptance. Second, soundness prevents deception: a prover lacking the secret witness cannot fabricate a convincing transcript, as demonstrated by the color-blind pen guesser failing repeated trials. Third, the zero-knowledge property ensures informational minimality; the verifier's final knowledge state must be simulatable without access to the secret, meaning they learn only the truth of the assertion (e.g., 'the card is red') and absolutely no auxiliary data. These definitions bridge the intuitive demonstrations to rigorous cryptographic theory, setting the stage for discussing real-world applications beyond the classroom examples.
The clip opens by presenting electronic voting as a concrete application of zero-knowledge proofs. The speaker’s goal is to show how a voting system can remain secret while still forcing ballots to obey strict validity rules.
To make the idea tangible, the election is reduced to two candidates, represented physically by two pens on the table. The speaker then encodes his preference numerically: he writes 1 for the candidate he supports and 0 for the candidate he does not support.
Next, he folds the paper and places it into an envelope. This action is explicitly interpreted as encryption: the envelope stands for hiding the ballot values under some cryptographic scheme, although the exact scheme is not specified in this excerpt.
A second participant repeats the same procedure, writing his own 1 and 0 and sealing them in an envelope while the first speaker looks away. This reinforces that each voter independently submits an encrypted ballot.
The speaker then explains the aggregation stage. All encrypted ballots can be combined so that only the totals for each candidate are revealed, not the individual votes. In the example, the public output would be the number of votes for blue and the number of votes for red.
At this point the discussion turns to cheating. The election rule is that each voter must choose exactly one candidate, neither both nor none. Therefore the first zero-knowledge proof required by the protocol is that the encrypted values in a ballot sum to 1.
However, the speaker immediately shows that this first condition is not enough. A malicious voter could submit -1 in one slot and +2 in the other; the sum is still 1, but those are not valid binary votes. This counterexample motivates a second zero-knowledge proof: each encrypted value must belong to the set {0,1}.
Finally, the speaker introduces another possible attack, namely copying and pasting someone else’s previous encrypted vote. The clip ends before the corresponding defense is developed, so this last threat remains only partially addressed within the provided segment.
The clip opens mid-explanation: after describing a ballot placed in an envelope without knowing its contents, the speaker introduces a further safeguard.
He calls this safeguard the third zero-knowledge proof. Its purpose in the voting example is to prove that the voter actually knows the hidden contents of the encrypted ballot—that is, knows what he is voting for—without revealing those contents.
The speaker says this extra proof mitigates three problems associated with naive electronic voting. The clip does not restate the three problems here, but it makes clear that the proof is meant to repair weaknesses in a simpler e-voting design.
He then broadens the application: the same idea can be used for online petition signing, or e-petitioning systems. The common theme is using electronic convenience while preserving privacy.
The interviewer asks whether anyone could simply look inside the envelopes and check that the contents are binary and sum to one. This question motivates the next clarification about what the 'envelope' really is.
The speaker answers that the envelopes are not literal paper envelopes at all. They are encryption of the enclosed data. This shifts the discussion from a physical sealing metaphor to a cryptographic one.
Because the ballots are encrypted, the speaker says there is no way to decrypt each single vote individually. No party is both willing and able to open one ballot at a time.
Instead, decryption is available only after all votes have been summed together. This aggregate-only rule is central to the privacy argument.
From that rule, the speaker draws the consequence that the final result cannot reveal which person voted for which option. The mapping from voter identity to choice remains hidden.
What can still be known, he says, is that each participant submitted a binary vote, that the vote sums to one, and that the voter knew the content of the vote. These are validity and knowledge properties, not disclosures of the secret choice itself.
When the interviewer asks whether this belongs to the encryption protocol, the speaker distinguishes layers: the encryption protocol protects the ballot, and the zero-knowledge protocol works on top of it to prove properties about the protected data.
He then states the key conceptual split. The public statement is that the vote is binary. The secret is the actual content of the vote, namely whether it is 0 or 1.
This, he says, is exactly the structure of a zero-knowledge proof: proving a statement about a secret without revealing the secret itself.
The interviewer offers a simpler analogy from an earlier card example: one can prove that a card is red without revealing its number. The speaker confirms that this is the same pattern.
Returning to voting, he restates that the secret is the voter's choice, 0 or 1, while the claim to be proved is only that the choice is binary.
The educational segment ends and the video transitions to a Computerphile title card with channel branding.
The final seconds show end-screen previews for other videos. The audio now belongs to a different discussion about computing and energy cost, specifically the claim that erasing information, not computation itself, costs energy.
A zero-knowledge proof is an interactive protocol in which a prover convinces a verifier that a statement about a secret is true without revealing the secret itself. This clip presents the idea at an introductory level, focusing on the prover-verifier structure and the secrecy requirement.
The speaker motivates zero-knowledge proofs by noting that many useful technologies require personal data, which may be private or sensitive. Privacy-enhancing technologies aim to preserve access to useful services while reducing the need to expose raw private data.
The red-blue pen game models a situation where the prover can distinguish two objects but the verifier cannot. The challenge is to prove that the objects are different without disclosing which object has which property. The on-screen <red/blue colour blindness simulation> makes this asymmetry visible to the audience.
In one round, the prover gives the two pens in random order, the verifier hides them behind his back and randomly chooses whether to swap them, then the prover must state whether a swap happened. This creates a test of the prover's hidden distinguishing ability without directly revealing the colors.
After one correct answer, the verifier should still be cautious because a cheating prover could have guessed correctly by chance. The clip states the single-round guessing probability explicitly, showing why repetition is necessary for stronger confidence.
Interactive protocols where repeated random challenges exponentially reduce a dishonest prover's success probability, allowing verification of secret knowledge without disclosure.
Proving a hidden card is red by revealing all 26 black cards from the remainder of a 52-card deck, forcing logical deduction of color while preserving rank secrecy.
Guarantees that when both prover and verifier follow the protocol honestly, the verifier accepts the proof with probability 1.
Ensures that a prover without the secret witness cannot convince the verifier except with negligible probability, validated by the failure of color-blind guessing in repeated trials.
Requires that the verifier learns nothing beyond the validity of the statement itself; their transcript must be efficiently simulatable without the secret.
The speaker uses electronic voting to illustrate why zero-knowledge proofs matter in practice. The central tension is that the system must verify ballot validity without revealing any individual vote.
In the tabletop example, the two candidates are represented by two pens. A voter writes 1 for the supported candidate and 0 for the unsupported candidate, turning the election into a pair of numeric ballot entries.
Putting the completed ballot into an envelope is explicitly described as encryption. The envelope hides the values from public view, while the underlying cryptographic scheme is left unspecified in this clip.
Once all voters have submitted encrypted ballots, the protocol can combine them and reveal only the totals for each candidate. This preserves secrecy at the level of individual votes.
To enforce that each voter chooses exactly one candidate, the protocol needs a proof that the encrypted ballot entries add up to 1. This rules out voting for both candidates or for none.
The speaker gives the counterexample of submitting -1 and +2. Their sum is still 1, but these are not valid binary votes, so the sum condition by itself does not guarantee ballot validity.
A second proof is required to show that each encrypted value is either 0 or 1. Together with the sum-to-one condition, this ensures that the ballot corresponds to exactly one valid candidate choice.
Near the end, the speaker raises another threat: one voter may reuse another voter’s encrypted ballot by copying and pasting it. The clip stops before explaining the mitigation.
The speaker defines the third zero-knowledge proof as the proof that the voter knows the contents of the encrypted ballot without revealing those contents. In the voting setting, this means proving knowledge of what one is voting for while keeping the actual choice secret.
The clip states that this additional proof mitigates three problems of naive electronic voting. The exact three problems are referenced from earlier context and are not restated in this excerpt, but the purpose is clearly to strengthen privacy and correctness in the voting protocol.
The speaker says the construction is not limited to elections. It can also be applied to signing petitions online, showing that the same privacy-preserving proof pattern can support e-petitioning systems.
When asked whether people could look inside the envelopes, the speaker clarifies that the envelopes are metaphorical. They are encryption of the enclosed data, so the security comes from cryptographic protection rather than a physical seal.
The protocol is described so that no one can decrypt a single ballot on its own. This prevents an authority or attacker from opening one vote at a time and learning individual choices.
According to the speaker, decryption becomes possible only after all votes have been summed together. This aggregate-only decryption rule is what allows a final result to be computed without exposing individual ballots.
Explore conditions, steps and evidence. Supplementary explanations are labeled separately from content shown in the video.
The speaker says the chance of cheating is 25% for one round and decreases to 12.5% when the experiment is repeated.
25\%, 12.5\%
Probability that a color-blind prover can successfully guess whether the pens were swapped in one or two rounds of the pen protocol.
Real-valued probabilities between 0 and 1.
The speaker states they have a classic card deck of 52 cards.
A standard red-backed deck of playing cards is shown on the table.
52
Total number of cards in the classic deck used for the second example.
Positive integer.
The speaker says he will show exactly 26 cards that are actually black.
A spread of black-suited cards (spades and clubs) is laid out on the paper.
26
Number of black cards revealed from the remaining 51 cards in the deck.
Positive integer.
The speaker says he will write a one and a zero to represent his vote for the two candidate pens.
A handwritten 1 is visible on the paper near the blue pen, and a handwritten 0 is visible near the red pen.
1, 0
Binary vote values indicating support or non-support for a candidate.
Integers used as encrypted ballot entries.
The speaker states that the first zero-knowledge proof is that the sum of the things inside your envelope sums up to one.
The sum of the encrypted vote values in one voter’s envelope.
Encrypted integer values corresponding to the candidates.
The speaker gives an example of cheating by putting minus one in one envelope and plus two in the other one.
-1, +2
Non-binary encrypted values that still satisfy the sum-to-one condition but violate valid voting rules.
Integer values outside the allowed binary vote set.
The speaker says the secret is whether the vote is 0 or 1.
0, 1
Possible values of a single encrypted binary vote.
\{0,1\}
The speaker says the vote is binary and sums up to one.
The phrase 'sum up to one' is spoken without a displayed formula; it is unclear whether this refers to one ballot having exactly one selected option or to a normalized representation of a binary choice.
Constraint used to express that the vote content is binary / has total weight one.
Spoken constraint; no explicit algebraic notation shown
The speaker says zero-knowledge proofs are protocols which let a prover prove a statement about a secret without giving up that secret.
On-screen title text reads <zero knowledge proof> and <computerphile> around 44.0-46.0 seconds.
A zero-knowledge proof is presented as an interactive protocol between a prover and a verifier. The prover demonstrates that some statement about a secret is true while keeping the secret itself hidden. In this clip the emphasis is on proving knowledge of a secret or a property of it without revealing the secret.
There is a prover and a verifier.
The prover has access to a secret or private information.
The goal is to convince the verifier of a statement about that secret.
The secret itself must not be revealed.
The speaker explains that many useful technologies require user data, which may be private or sensitive, and privacy-enhancing technologies aim to let users benefit from technology without giving back their data.
He introduces zero-knowledge proofs as one example of privacy-enhancing technologies.
Privacy-enhancing technologies are described as tools that allow people to use modern services while protecting sensitive data. Zero-knowledge proofs are introduced as a specific example in this broader category.
The setting involves useful technologies that normally require personal data.
The data may be private or sensitive.
The desired outcome is to retain privacy while still using the technology.
The speaker proposes an intuitive game with two pens to explain zero-knowledge proofs.
He states that the verifier is color blind and cannot distinguish red from blue, while the prover can distinguish them.
Two physical pens are shown; in the normal-color view they appear red and blue.
Green overlay text reads <red/blue colour blindness simulation> from about 80.0 seconds onward.
The video uses a physical demonstration with two pens, one red and one blue. The prover knows which pen is which, but the verifier is modeled as color blind and therefore cannot tell them apart by sight. The task is to prove that the two pens are distinguishable without revealing which one is red and which one is blue.
There are exactly two objects being compared, here two pens.
The prover can distinguish the two objects.
The verifier cannot distinguish them directly.
The proof must not reveal the identity of either object.
The prover says he will give the two pens in random order, ask the verifier to put them behind his back, and swap or not swap at random.
After the verifier returns the pens, the prover announces whether they were swapped.
During the color-blind simulation, the two pens look indistinguishable to the viewer, matching the stated premise that the verifier cannot tell red from blue.
The verifier physically hides the pens behind his back and then presents them again.
In one round, the prover hands over the two pens in random order. The verifier secretly chooses either to keep the order or to swap the pens behind his back, then shows the pens again. The prover must state whether a swap occurred. This gives a concrete interactive test of whether the prover can truly distinguish the pens without telling the verifier which color each pen is.
The initial handover order is random.
The verifier's choice to swap or not swap is random.
The prover observes the returned arrangement and must answer whether a swap happened.
The verifier does not learn the color identity from the answer alone.
The speaker says the verifier only kind of believes him after one successful round because the prover could have simply guessed randomly.
He explicitly states there was a 50% chance to guess the right answer.
A single correct answer is weak evidence because a cheating prover who cannot actually distinguish the pens still has probability of guessing correctly in one round. Therefore one round does not establish trust strongly; repeated rounds are needed to reduce the chance of accidental success.
The verifier's swap decision is random with two equally likely choices.
The prover may be cheating and have no real distinguishing ability.
Only one round has been completed.
The speaker explains that repeating the pen swap experiment decreases the probability of cheating, which is the idea behind zero-knowledge proofs.
A zero-knowledge proof allows a prover to convince a verifier of a statement's truth without revealing any additional information. The video illustrates this using a pen color identification game where the prover's ability to correctly identify swaps across multiple rounds exponentially decreases the chance of them guessing correctly by luck.
The prover must possess a secret capability (e.g., distinguishing colors).
The verifier controls the randomization (e.g., swapping pens behind their back).
The protocol is repeated multiple times to reduce the soundness error.
The speaker demonstrates proving a card is red without revealing its number by showing all 26 black cards from the rest of the deck.
The speaker holds a red-backed card, then spreads out a pile of black-suited cards on the table.
To prove a randomly selected card from a 52-card deck is red without revealing its specific rank or suit, the prover shows the verifier the other 51 cards. If exactly 26 of those remaining cards are black (spades and clubs), the hidden card must be red. This reveals only the color property, satisfying the zero-knowledge requirement.
The deck contains exactly 26 red and 26 black cards.
The target card is drawn uniformly at random.
The prover reveals the identities of the remaining 51 cards.
The speaker defines the first criterion as correctness: if both people are honest, everything works fine.
Correctness requires that if both the prover and the verifier follow the protocol honestly, the verifier will always accept the proof and be convinced of the statement's truth.
Both the prover and the verifier act honestly according to the protocol rules.
The speaker defines soundness: if the prover does not know the secret, they cannot prove the statement.
Soundness ensures that a dishonest prover who does not possess the secret knowledge cannot successfully convince the verifier of the statement. In the pen example, a color-blind person would fail to consistently guess the swaps.
The prover lacks the secret information required to make the statement true.
The speaker defines the third characteristic as zero-knowledge: after following the protocol, the verifier learns nothing more than the statement itself.
The zero-knowledge property mandates that the interaction reveals no information beyond the validity of the statement being proved. For instance, in the card example, the verifier learns the card is red but gains no knowledge of its number or specific identity.
The verifier's view of the interaction can be simulated without access to the prover's secret.
The speaker introduces e-voting as a very nice example of how to use a zero-knowledge proof to make e-voting work fine.
The clip presents electronic voting as an applied setting where zero-knowledge proofs can enforce ballot validity while preserving secrecy.
There are multiple candidates.
Votes are encrypted before aggregation.
Validity must be checked without revealing individual votes.
The speaker says the election has two candidates, represented by the pens, and that he wants to vote for the pen on the right.
Two pens are placed on the table, one blue and one red, with handwritten 1 and 0 marks on the paper.
In the physical demonstration, each candidate receives a numeric ballot entry: 1 means vote for that candidate and 0 means do not vote for that candidate.
Exactly two candidates are considered.
Each candidate receives one ballot value.
The intended vote is for exactly one candidate.
The speaker states that zero-knowledge proofs let a prover prove a statement about a secret without actually giving up that secret.
A prover can convince a verifier of a statement about a secret without revealing the secret itself.
There is a prover and a verifier.
The prover possesses a secret or private information relevant to the statement.
For the protocol class introduced in this clip.
The speaker says the prover had a 50% chance to guess the right answer if he did not really know which pen was which.
If a prover cannot distinguish the two pens, then in one round of the protocol the probability of answering correctly by chance is .
The verifier chooses uniformly between swapping and not swapping.
The prover has no actual distinguishing information.
Only one round is considered.
For a single round of the two-pen protocol under uniform random choice by the verifier.
The speaker states that repeating the experiment decreases the probability of cheating to 12.5% and so on.
Repeating an interactive proof protocol with independent random challenges reduces the probability of a dishonest prover succeeding exponentially.
The prover has no prior knowledge of the challenge.
Each round's challenge is independent of previous rounds.
For all rounds n, the success probability is bounded by ()^n.
The speaker says the election is all about voting for exactly one candidate, not both and not none of them.
A valid ballot in the demonstrated election must select exactly one candidate.
There are two candidates in the example.
Each candidate receives one ballot value.
For every voter, the submitted ballot must correspond to exactly one chosen candidate.
The speaker gives the counterexample of putting minus one in one envelope and plus two in the other one, noting that the sum is still one but this should not be allowed.
Requiring only that encrypted ballot values sum to 1 is insufficient, because non-binary values can satisfy the same equation.
Ballot entries are integers.
Only the sum condition is enforced.
There exists a pair of values, for example -1 and +2, whose sum is 1 but which are not valid binary votes.
The speaker says, 'And this mitigates the three problems that we could have with naive e-voting.'
The three problems are referenced from earlier context and are not listed in this clip.
Adding the third zero-knowledge proof mitigates the three problems associated with naive e-voting.
The voting setting described earlier in the video applies.
The proof establishes that the voter knows the encrypted ballot contents.
For the e-voting setting under discussion.
The speaker says there is no way to decrypt each single vote and that you can only decrypt once all the votes have been summed up.
The exact cryptographic construction is not named or formally specified in this clip.
Individual encrypted votes cannot be decrypted separately; decryption is available only after all votes have been aggregated.
Votes are represented as encrypted 'envelopes'.
The protocol follows the aggregation rule described by the speaker.
For all votes in the described tallying process.
The speaker says there is no way to recover which person voted for which option, and the only knowable facts are that the vote was binary, summed to one, and known to the voter.
The clip does not provide a formal proof of this privacy property.
After tallying, the protocol reveals only that each vote was valid and known to the voter, not which voter chose which option.
Aggregate-only decryption is enforced.
Validity checks are performed via the zero-knowledge layer.
For the final published outcome of the described voting protocol.
The speaker says the binary nature of the vote is the statement, the vote content is the secret, and this matches the definition of a zero-knowledge proof.
In the voting example, proving that the vote is binary while keeping the actual content hidden is an instance of proving a statement about a secret without revealing the secret.
The ballot content is treated as the secret witness.
The binary-validity condition is treated as the public statement.
For the voting scenario discussed in this clip.
The speaker introduces the pen game as an easy way to understand the intuition behind zero-knowledge proofs.
He narrates the full sequence: hand over pens randomly, hide behind back, optionally swap, return pens, prover guesses whether swapped, then notes the 50% chance of lucky guessing.
The color-blind simulation visually supports the premise that the verifier cannot distinguish the pens by color.
Start with two objects that the prover can distinguish but the verifier cannot.
Stated directly by the speaker and illustrated by the red/blue pens.
Let the verifier randomly choose whether to swap the objects after receiving them.
This is the protocol rule described in the audio.
Ask the prover to announce whether a swap occurred.
This produces a yes/no response that can be checked without naming the colors.
If the prover is cheating, a single correct answer can happen by luck with probability one half.
Explicitly stated by the speaker as a 50% chance to guess the right answer.
Therefore one successful round gives only partial belief, motivating repeated rounds.
Direct conclusion from the speaker's explanation that the verifier is not really sure after one round.
The pen game illustrates that a zero-knowledge style proof needs repeated interaction because a single round can be passed by chance with probability .
The speaker calculates the cheating chance as 25% initially, then 12.5% upon repetition.
A color-blind prover has a 50% chance of guessing whether the pens were swapped.
Binary choice with uniform random swapping by the verifier.
To succeed twice independently, the probabilities multiply.
Independence of verifier's random choices across rounds.
Extending to three rounds yields a 12.5% success rate for a cheater.
Continued multiplication by 0.5 for each additional independent round.
The soundness error halves with each additional round of the protocol.
The speaker argues that if 26 of the remaining cards are black, the hidden card must be red.
A standard deck has 52 cards divided equally into black and red suits.
Definition of a classic card deck.
The prover shows exactly 26 black cards from the remaining 51.
Explicit action in the protocol demonstration.
Since no red cards were revealed among the 26 black ones, all 26 red cards remain unaccounted for except the hidden one.
Set subtraction based on partition of the deck.
The single unrevealed card must therefore be red.
Pigeonhole principle applied to the remaining card count.
Revealing all 26 black cards logically forces the conclusion that the unseen card is red, without exposing its rank.
The speaker first notes cheating possibilities, then introduces the sum-to-one proof, then gives the -1/+2 counterexample, and finally adds the binary-range proof.
Represent the two encrypted ballot entries for the two candidates.
The physical example assigns one value per candidate.
Enforce that the voter chose exactly one candidate.
This is the first validity condition stated in the clip.
Show that the sum condition alone admits invalid ballots.
The speaker explicitly gives this cheating example.
Add a second condition requiring each encrypted value to be binary.
This rules out the -1/+2 style attack while preserving secrecy.
A secure e-voting protocol needs at least two zero-knowledge checks: one for sum-to-one and one for binary range membership.
The speaker moves from introducing the third zero-knowledge proof, to its role in fixing naive e-voting, to explaining encryption, aggregate decryption, and the statement/secret distinction.
The clip summarizes the protocol conceptually and omits formal definitions of the underlying encryption and proof system.
Start from the voting example and identify the additional proof needed: the voter must prove knowledge of the encrypted ballot contents.
Directly stated by the speaker as 'the third zero knowledge proof'.
Use this proof to address the shortcomings of naive e-voting.
The speaker explicitly says it mitigates the three problems of naive e-voting.
Interpret the 'envelope' not as paper but as encryption of the vote contents.
The speaker clarifies that these are encryption of what is inside.
Restrict decryption so that individual votes cannot be opened separately; only the aggregate can be decrypted after summation.
Stated directly in the answer to the interviewer's question about looking inside.
Conclude that the final output cannot map voters to choices, while still allowing verification that each ballot was binary and known to the voter.
The speaker states there is no way to recover which person voted for which option, and only validity/knowledge can be known.
Identify the public statement as 'the vote is binary' and the secret as the actual vote content, matching the definition of a zero-knowledge proof.
Explicitly stated by the speaker near the end of the main segment.
The clip presents a conceptual chain: encrypted ballots plus aggregate-only decryption plus zero-knowledge validity proofs yield electronic voting that verifies ballot correctness without revealing individual choices.
The speaker says the intuition can be understood via a game with two pens.
Two pens are physically handled between the speaker and another person.
A green-labeled simulation makes the pens appear indistinguishable, representing color blindness.
The first round ends with the prover saying the pens were not swapped.
A second round begins with the verifier putting the pens behind his back again.
The exact visual color assignment in every frame is partly obscured by the simulation overlay and camera angle.
The final result of the second round is not shown within this clip.
Show that two pens are distinguishable even though the verifier is color blind, without revealing which pen is red and which is blue.
There are two pens, one red and one blue.
The prover can distinguish the colors.
The verifier cannot distinguish the colors.
The verifier will randomly decide whether to swap the pens behind his back.
Convince the verifier that the pens are distinguishable while preserving the hidden color assignment.
Give the two pens to the verifier in random order.
This is the first protocol step stated by the prover.
Ask the verifier to place the pens behind his back and either swap them or leave them unchanged at random.
This creates the hidden binary choice that the prover must detect.
Have the verifier bring the pens back into view.
This allows the prover to compare the returned arrangement with the original one.
The prover announces whether the pens were swapped.
This is the response that tests the prover's distinguishing ability.
After one successful round, note that the verifier still has reason to doubt because the answer could have been a lucky guess.
The speaker explicitly says the verifier only kind of believes him because of the 50% chance.
Begin another round to strengthen confidence.
The video shows the second round starting immediately after the first explanation.
The clip demonstrates one complete successful round and starts a second round; the explicit lesson is that repetition is needed for stronger assurance.
Verification is interactive: if the prover repeatedly identifies the swap correctly across multiple rounds, the chance of sustained lucky guessing becomes small. The clip itself only fully verifies the first round and states the single-round guessing probability.
The speaker describes swapping pens and asking the color-blind person to identify the swap.
Two pens (one red, one blue) are held up to the camera; a color blindness simulation filter is briefly applied.
The exact physical mechanics of the swap behind the back are not fully visible due to camera angle.
Convince a verifier that you can distinguish between a red and a blue pen without revealing which is which, assuming the verifier might be color-blind or testing your ability.
One red pen and one blue pen.
Verifier randomly decides whether to swap them behind their back.
Prove knowledge of the color difference with high confidence while revealing zero information about the actual colors.
The verifier introduces randomness by deciding whether to exchange the pens' positions.
Standard interactive protocol challenge generation.
The prover uses their secret knowledge (color vision) to answer the challenge.
Response phase of the ZKP.
Multiple iterations ensure that a lucky guesser cannot sustain success.
Amplification of soundness through repetition.
After sufficient repetitions, the verifier is statistically convinced the prover knows the colors, yet learns nothing about which pen is actually red or blue.
Statistical bound on cheating probability approaches zero as n increases.
The speaker selects a card and proposes to prove it is red without giving away the number.
Speaker draws a card, places it face down, and later spreads black cards on the table.
The specific rank of the chosen card is never revealed, consistent with the protocol's goal.
Given a randomly selected card from a 52-card deck, prove to a verifier that it is red without disclosing its suit or numerical value.
A standard 52-card deck containing 26 red and 26 black cards.
One card is drawn and kept hidden by the prover.
Demonstrate the color property of the hidden card while preserving perfect secrecy about its identity.
The prover shows the entire remainder of the deck to the verifier.
Providing evidence for the verification step.
The verifier checks that exactly half of the revealed cards belong to the black suits.
Verification algorithm execution.
By elimination, the only possible color left for the single unrevealed card is red.
Combinatorial deduction from fixed deck composition.
The verifier accepts the proof that the card is red, having gained absolutely no information regarding its rank or specific suit.
Count of revealed black cards matches total black cards in deck minus zero.
The speaker says he wants to vote for the pen on the right, writes a one and a zero, puts the vote inside the envelope, and identifies the vote one as voting for pen blue.
The paper shows a handwritten 1 near the blue pen and a handwritten 0 near the red pen; the sheet is folded and inserted into an envelope.
The spoken phrase 'pen on the right' and the visible placement of the blue pen are not perfectly aligned in the sampled frames, but the intended mapping is clear from the written 1 and 0.
Encode a vote for one of two candidate pens and hide it in an envelope.
Two candidates are represented by a blue pen and a red pen.
The voter wants to vote for the blue pen.
Produce an encrypted ballot representing exactly one vote.
Write 1 for the preferred candidate.
The speaker says the vote one means he wants to vote for pen blue.
Write 0 for the non-preferred candidate.
The speaker says the zero means he does not want to vote for this pen.
Hide the written values inside the envelope.
The speaker equates putting the vote inside the envelope with encryption.
The ballot is (1,0), encrypted inside the envelope.
The sum is 1 and both entries are binary, so the ballot satisfies the two validity conditions introduced later.
The second participant asks whether he has to write one and zero, and the speaker confirms and instructs him to put them there.
The second participant writes on a sheet and places it into an envelope while the first speaker looks away.
The exact handwritten digits are not clearly legible in the sampled frames, but the dialogue confirms the intended values are 1 and 0.
Show that each voter independently submits an encrypted binary ballot.
The first voter has already demonstrated the procedure.
The second voter must perform the same action.
Create a second encrypted ballot without revealing its contents to the other voter.
The second voter writes one and zero for the two candidates.
The dialogue explicitly says he has to write one and zero.
The second voter seals the ballot in an envelope.
The speaker instructs him to put them there, continuing the encryption metaphor.
A second encrypted ballot is produced in the same format as the first.
The procedure mirrors the first example and supports later aggregation of multiple encrypted votes.
The entire main segment explains an electronic voting protocol using encrypted envelopes, aggregate decryption, and zero-knowledge proofs of ballot validity and knowledge.
At 17.520-19.520 and 36.520-37.520, hands handle white paper sheets and pens on a table, visually reinforcing the envelope/ballot metaphor.
The clip does not provide a fully formal specification of the cryptosystem or the exact zero-knowledge relation.
How can an electronic voting system let a voter submit a secret choice while still proving that the choice is valid and known to the voter?
Votes are represented metaphorically as envelopes.
The envelopes are actually encryption of the vote contents.
The desired public statement is that the vote is binary / sums to one.
The secret is the actual vote content, 0 or 1.
Decryption is allowed only after all votes are summed.
Explain how zero-knowledge proofs and encryption preserve ballot secrecy while enabling verification.
Introduce the third zero-knowledge proof as proving knowledge of the encrypted ballot contents.
Stated directly by the speaker at the beginning of the clip.
State that this proof mitigates the three problems of naive e-voting.
Explicit audio claim.
Clarify that the 'envelope' is encryption, not a literal physical container.
Speaker's direct explanation in response to the interviewer.
Explain that individual votes cannot be decrypted; only the aggregate can be decrypted after summation.
Speaker's direct explanation.
Conclude that the system can verify binary validity and voter knowledge without revealing which voter chose which option.
Speaker's summary of what remains knowable after tallying.
Express the hidden ballot value as a binary secret.
Derived from the speaker's statement that the secret is whether the vote is 0 or 1.
The example shows a voting protocol where encrypted ballots are checked for validity and knowledge via zero-knowledge proofs, while aggregate-only decryption prevents recovery of individual voter choices.
Internal consistency check: the clip repeatedly contrasts public verifiability ('binary', 'knew the content') with secrecy of the actual vote value (0 or 1).
Black screen with green terminal-style text reading <zero knowledge proof> and <computerphile>.
green monospaced text
black background
The lecture cuts from the speaker to a title card.
The title text appears in a terminal-like style.
The topic remains zero-knowledge proofs.
The title card marks the formal introduction of the subject after the motivational opening.
Green overlay text reads <red/blue colour blindness simulation>.
The image shifts into a stylized simulation where the two pens no longer appear clearly red versus blue to the viewer.
The same physical pen demonstration continues under the altered visual filter.
The precise mapping of each pen's true color is not always visible during the filtered sections.
two pens
speaker
overlay text
simulated color palette
The visual color representation changes from ordinary view to a simulated color-blind view.
The pens become visually indistinguishable or much less distinguishable.
The physical objects remain the same two pens.
The protocol structure continues unchanged during the visual effect.
The animation operationalizes the verbal premise that the verifier is color blind, making the audience experience the hidden-information condition of the analogy.
The verifier receives the pens, hides them behind his back, then returns them.
The prover says he will give the pens in random order and asks whether to swap or not.
After the return, the prover states that the pens were not swapped.
The exact hand positions before and after concealment are partly off-camera.
two pens
verifier's hands
prover
The pens move from prover to verifier.
The verifier conceals them behind his back.
The pens are presented again.
The prover gives a swap/no-swap answer.
There are always exactly two pens in play.
The purpose is to test detection of a hidden binary choice.
This visual sequence turns the abstract protocol definition into a concrete interactive experiment.
A green text overlay '<red/blue colour blindness simulation>' appears, and the video applies a filter making the red and blue pens appear similar shades of orange/brown.
Red pen
Blue pen
Text overlay
Color filter effect
Original distinct red and blue colors shift to indistinguishable warm tones.
Overlay text explicitly labels the simulation state.
Physical positions and shapes of the pens remain unchanged.
Speaker's gestures and speech continue normally.
The visual effect demonstrates why a color-blind individual cannot serve as a reliable prover in the pen identification task, grounding the soundness argument in perceptual limitation.
Close-up shot shows a fan of playing cards laid on lined paper, exclusively displaying spade and club symbols.
Playing cards (spades/clubs)
Lined notebook paper
Hand pointing
Cards transition from being held in stack to being spread flat for counting.
Visual focus shifts from speaker's face to tabletop evidence.
All visible cards share black suit markings.
No red-suited cards appear in the spread.
This visual confirms the prover's claim of revealing exactly 26 black cards, providing the necessary evidence for the verifier to deduce the hidden card's color without seeing it.
The camera tilts down to a round table with two pens, paper, envelopes, markers, a deck of cards, and a phone.
Handwritten 1 and 0 marks appear on the paper next to the pens.
blue pen
red pen
paper sheet
white envelopes
markers
deck of cards
phone
The speaker points to the two candidate pens.
He writes 1 and 0 on the paper to encode his vote.
There are exactly two candidate objects on the table.
The vote is represented numerically rather than by names.
The tabletop objects instantiate a two-candidate election and a binary ballot encoding.
The speaker folds the marked paper and inserts it into a white envelope, then holds up the sealed envelope.
folded paper
white envelope
The visible ballot values become hidden inside the envelope.
The ballot content remains the same, only its visibility changes.
The envelope visually represents encryption of the vote before aggregation.
A second participant writes on another sheet and places it into an envelope while the first speaker looks away.
The exact digits written by the second participant are not fully legible in the sampled frames.
second paper sheet
second envelope
first speaker looking away
A second ballot is created and sealed.
The first speaker averts his gaze during the writing step.
The same two-candidate structure is reused.
The procedure remains local to each voter before aggregation.
This demonstrates independent encrypted submissions by different voters.
The speaker gestures with both hands while explaining aggregation of results inside all the envelopes without revealing each vote.
speaker’s hands
sealed envelopes on the table
The speaker moves from describing individual ballots to describing collective computation over many envelopes.
Individual ballots remain sealed during the explanation.
The hand motions illustrate combining many hidden inputs into aggregate totals without opening them.
A man in a blue sweater speaks in an office with bookshelves and a whiteboard behind him.
The camera alternates between medium and closer shots of the same speaker.
Male speaker in blue sweater
Bookshelf with binders and books
Whiteboard with faint orange markings
Camera framing shifts between medium and close-up views.
The speaker gestures while talking.
The setting remains the same office environment.
The speaker remains the visual focus throughout the main segment.
These visuals support a lecture/interview explanation rather than a formal board derivation.
Cutaway to hands handling white paper sheets and pens on a round table.
This appears while the speaker is discussing the voting example and applications.
The papers are not labeled as ballots in the image; the connection to the spoken 'envelope' metaphor is contextual.
Two hands
White paper sheets
Pens
Round table
Laptop edge
Light panel
Playing cards box
Hands lift and manipulate a sheet of paper.
The shot briefly interrupts the talking-head view.
The tabletop setting remains constant during the cutaway.
The cutaway visually reinforces the idea of sealed physical documents being used as a metaphor for encrypted votes.
Another brief cutaway shows hands clasped over papers on the same table.
It occurs during the exchange about whether people could look inside the envelopes.
No explicit on-screen text identifies the papers as votes.
Clasped hands
White papers
Pens
Tabletop items
The shot switches from the speaker to the tabletop and back again.
Same table and props as the earlier cutaway.
This visual repetition keeps the physical-envelope metaphor present while the speaker explains that the real mechanism is encryption.
The speaker says the verifier only kind of believes him after one round because the prover could have guessed randomly with 50% chance.
A single correct answer in the pen game proves the prover truly knows which pen is which.
One correct answer is insufficient because a cheating prover still has probability of guessing correctly in a single round; repeated rounds are needed to build confidence.
The speaker defines zero-knowledge proofs as proving a statement about a secret without giving up the secret.
This misconception is not explicitly named in the clip; it is added as a common clarification based on the definition given.
Zero-knowledge means the verifier learns nothing at all from the interaction.
In the clip's usage, the key requirement is that the secret itself is not revealed; the verifier can still learn the truth of the stated proposition.
The speaker emphasizes that the whole point of zero-knowledge proofs is learning nothing more than the statement itself.
Learners often assume that successfully proving a statement necessarily exposes the witness or secret used to verify it.
True zero-knowledge protocols guarantee that the verifier's transcript can be generated without the secret; in the card example, knowing the card is red provides no information about its rank.
The speaker explicitly warns that putting minus one in one envelope and plus two in the other still gives sum one, but this should not be allowed.
If the encrypted votes sum to 1, the ballot must be valid.
No. The clip gives the counterexample (-1,+2), whose sum is 1 but whose entries are not binary votes.
The speaker says putting the vote inside the envelope actually means encrypting them using a specific type of scheme, which is not the scope of that video.
The physical envelope itself provides the security of the e-voting protocol.
The envelope is only a metaphor; the real security comes from an encryption scheme that the clip does not specify.
The interviewer asks whether people could look inside the envelopes; the speaker replies that they are not really envelopes but encryption.
One might think the protocol relies on literal sealed envelopes that could be opened by someone with access.
The speaker explicitly corrects this: the 'envelopes' are encryption of the contents, not physical containers.
The speaker says there is no way to decrypt each single vote and that decryption happens only after all votes have been summed up.
One might assume that after submission, an authority could decrypt one ballot at a time.
In the described protocol, decryption is only available after aggregation, preventing per-ballot disclosure.
The speaker distinguishes the statement 'the vote is binary' from the secret vote content and says this is still the definition of zero knowledge proof.
One might think that proving something about a secret necessarily reveals the secret itself.
The clip stresses that the public statement can be verified while the actual vote content remains hidden.
The speaker says one nice example of privacy-enhancing technologies is the zero-knowledge proof.
Zero-knowledge proofs are presented as a specific example within the broader class of privacy-enhancing technologies.
The speaker says an easy way to understand the intuition behind zero-knowledge proof is the game with these two pens.
The two-pen game is used as an intuitive application of the abstract zero-knowledge proof concept.
The speaker notes a 50% chance of guessing correctly and then suggests doing it again.
The need to repeat the protocol depends on the observation that a single round can be passed by chance with probability .
The speaker transitions from the pen example to the card example saying 'I have a second one to make things absolutely clear.'
The pen example relies on probabilistic soundness requiring repetition, whereas the card example achieves deterministic soundness in a single round while maintaining zero-knowledge through combinatorial elimination.
The speaker references the pen example immediately after defining soundness.
The abstract definition of soundness is concretely illustrated by the impossibility of a color-blind prover consistently winning the pen guessing game.
The speaker cites the card example when explaining the zero-knowledge property.
The card protocol serves as the primary application demonstrating that verification can succeed while leaking strictly zero information about the hidden attribute (rank).
The speaker introduces e-voting as an example of how to use a zero-knowledge proof.
The e-voting application motivates the need for zero-knowledge validity checks on encrypted ballots.
After writing 1 and 0, the speaker says putting the vote inside the envelope means encrypting them.
The binary ballot values are the plaintext objects that the envelope metaphor encrypts.
The speaker explains aggregating results inside all the envelopes without revealing each vote.
Encrypted ballots must exist before they can be aggregated without disclosure.
The speaker first defines the sum-to-one proof, then gives the -1/+2 counterexample, then says a second proof is needed for binary values.
The sum-to-one check enforces the total count, while the binary-range check enforces the allowed value set; neither alone is sufficient.
The speaker uses the -1/+2 example to show why the binary-range proof is necessary.
The binary-range proof is introduced specifically to eliminate the counterexample showing that sum-to-one alone is inadequate.
The speaker introduces another optional issue involving copying and pasting someone else’s previous vote.
The mitigation is not reached within the clip.
After explaining encrypted aggregation, the speaker broadens the threat model to include reuse of another voter’s encrypted ballot.
The speaker directly defines zero-knowledge proofs in this interval.
The speaker motivates privacy-enhancing technologies by noting that useful technologies often require sensitive data.
The speaker introduces the two-pen game as an intuition builder.
The color-blind simulation visually supports the analogy.
The speaker says one round is not enough because of the 50% guessing chance.
The overlay text explicitly labels the simulation as <red/blue colour blindness simulation>.
The visual filter makes the pens hard to distinguish.
Discussion of decreasing probability through repetition.
Explanation of showing 26 black cards to prove the hidden one is red.
Enumeration of correctness, soundness, and zero-knowledge criteria.
The speaker introduces e-voting as a nice example of using zero-knowledge proofs.
The speaker explains writing a one and a zero for the two candidate pens.
The speaker says putting the vote inside the envelope means encrypting them.
The speaker describes aggregating results inside all the envelopes without revealing each vote.
Covered · Motivational introduction to privacy-enhancing technologies and the need to protect sensitive data.
Covered · Title-card transition into the main topic.
Covered · Verbal definition of zero-knowledge proofs as protocols proving statements about secrets without revealing the secrets.
Covered · Introduction of the two-pen analogy and the color-blind verifier premise.
Covered · Execution of one full round of the pen-swapping protocol.
Covered · Explanation that a single success can occur by chance with probability .
Covered · A second round begins, reinforcing the need for repetition; the outcome of that second round is not reached within the clip.
Covered · Pen swap ZKP intuition and probability derivation.
Covered · Transition between examples.
Covered · Card color ZKP demonstration and logical deduction.
Covered · Summary of intuition before formal criteria introduction.
Covered · Formal definitions of ZKP criteria and misconception clarification.
Covered · Closing remark transitioning to real-life applications.
Covered · Introduction of e-voting as a zero-knowledge-proof application.
Covered · Two-candidate setup and binary encoding of the vote.
Covered · Envelope metaphor for encryption and sealing the first ballot.
Covered · Second voter repeats the same encrypted-ballot procedure.
Covered · Explanation of aggregating encrypted votes without revealing individual ballots.
Covered · Election rule and first zero-knowledge proof that the votes sum to one.
Covered · Counterexample showing sum-to-one alone is insufficient.
Covered · Second zero-knowledge proof requiring binary encrypted values.
Covered · Introduction of a further copy-paste attack; mitigation is not reached in this clip.
Covered · Tail end of a previous sentence about voting on top of an envelope; no new standalone mathematical point beyond the transition into the third zero-knowledge proof discussion.
Covered · Introduction of the third zero-knowledge proof and its claimed role in addressing problems of naive e-voting.
Covered · Extension of the idea to online petition signing and summary of the privacy benefit.
Covered · Interviewer asks whether people could look inside the envelopes; this sets up the encryption clarification covered immediately after.
Covered · Core explanation that the envelopes are encryption, decryption is aggregate-only, and only validity/knowledge can be verified without voter-to-choice recovery.
Covered · Interviewer asks whether this is part of the encryption protocol; speaker explains that the zero-knowledge layer works with encryption and restates the statement/secret distinction.
Covered · Card-color analogy confirms the same zero-knowledge pattern in a simpler example.
Covered · Outro title card with channel branding; no mathematical content.
Covered · End-screen previews for other videos; audio shifts to a different topic about computing and energy cost, outside the main zero-knowledge lesson.
Reviewed subject paths
The first zero-knowledge proof checks that the encrypted ballot entries add up to 1, enforcing that the voter selected exactly one candidate rather than none or both. This rules out voting for both candidates or for none.
Conditions: There are two candidate slots in the example.; Each slot contains one encrypted value.; The proof must hold without revealing the individual values.
Electronic voting is presented as an applied setting where zero-knowledge proofs can enforce ballot validity while preserving secrecy. The system must verify that each voter chooses exactly one candidate and that the vote is binary, without revealing the individual voter's choice.
Conditions: There are multiple candidates.; Votes are encrypted before aggregation.; Validity must be checked without revealing individual votes.
To prove a randomly selected card from a 52-card deck is red without revealing its specific rank or suit, the prover shows the verifier the other 51 cards. If exactly 26 of those remaining cards are black (spades and clubs), the hidden card must be red.
Conditions: The deck contains exactly 26 red and 26 black cards.; The target card is drawn uniformly at random.; The prover reveals the identities of the remaining 51 cards.
A valid zero-knowledge proof protocol must satisfy three criteria: Correctness guarantees that honest execution always leads to acceptance. Soundness prevents deception, ensuring a prover lacking the secret witness cannot fabricate a convincing transcript.
Conditions: The protocol involves a prover and a verifier.; The prover possesses a secret or private information relevant to the statement.; The goal is to convince the verifier of a statement about that secret without revealing the secret.
The protocol combines encrypted ballots so that only the totals for each candidate are revealed, not the individual voters' choices. All encrypted ballots can be combined using a mathematical protocol that preserves the sum without decrypting the individual components.
Conditions: All ballots are encrypted before submission.; Aggregation is performed on encrypted data.; Only final totals are revealed.
The envelope is used as a concrete metaphor for cryptographic encryption of the ballot values. Putting the vote inside the envelope actually means encrypting them using a specific type of scheme, hiding the ballot values from public view while preserving later aggregation properties.
Conditions: The ballot values are hidden from public view.; Encryption is assumed to preserve later aggregation properties.; The specific cryptosystem is not named in this clip.
In the physical demonstration, each candidate receives a numeric ballot entry: 1 means vote for that candidate and 0 means do not vote for that candidate. This binary encoding turns the election into a pair of numeric ballot entries, allowing the system to mathematically verify that exactly one candidate is chosen.
Conditions: Exactly two candidates are considered.; Each candidate receives one ballot value.; The intended vote is for exactly one candidate.
Repeating the experiment exponentially decreases the probability of a cheating prover successfully guessing the swaps by chance. A single round provides only weak evidence because a color-blind impostor has a 50% chance of guessing correctly.
Conditions: The prover must possess a secret capability (e.g., distinguishing colors).; The verifier controls the randomization (e.g., swapping pens behind their back).; The protocol is repeated multiple times to reduce the soundness error.
Continue with related videos in the same subject.
YouTube3:24
YouTube1:57
YouTube7:47