日常生活中，我們或許會想說服別人我們知道某一件秘
密，但同時不希望讓他知道這個秘密是什麼。在密碼學中，
我們可以利用零知識證明法來達到目的；但在日常生活中，
我們是否可以輕易地做到此目的，而不需要使用複雜的理論
或是高科技的運算工具呢？答案是可以的。
本論文探討如何說服他人相信「我們知道邏輯繪圖遊戲
(Nonogram)的答案」這個秘密，也就是說，對於一個知道如
何解決邏輯繪圖遊戲的人，他可以利用我們的方法，讓別人
相信他知道答案，但又不會洩漏答案出去。並且我們只會運
用在日常生活中實際存在的東西，就可以完成全部的證明。
在此，我們利用密碼學中的零知識證明法的理論，加上
我們所設計的工具－刮刮卡（用來取代傳統的彌封信封），
讓知道答案的人和懷疑的人兩者的互動中，進而達成我們所
要求的目的。
由於在零知識證明法的理論中存在懷疑者遭到矇騙的
機率，也就是誤判的機率，因此我們利用其他各種現實世界
裡的機制，來降低誤判的發生。如此一來，我們即可經由重
複個數次的證明，來提升懷疑者的相信程度了。
我們的方法最終可以達到完整的正確性、零知識的洩漏
和只有二分之一的誤判率。

In daily life, we may want to convince others that we know a secret,
while at the same time, we do not want to let them know what the secret
is. In cryptography, there is a notion of zero-knowledge proof system, in
which we can apply to achieve the goal. One may wonder if it is still
possible to achieve the goal without using complicated theorems or
powerful computational machines, and just by utilizing things that are
easily reachable in our daily life? The answer is “yes.”
This thesis studies various protocols for convincing others that “we
know the solution of a Nonogram puzzle.” In other words, a person
(called prover) who knows the solution of a particular Nonogram puzzle
can apply our protocols to persuade another person (called verifier) that
he knows the solution; at the same time he will not leak any information
about the solution. Moreover, we show that our protocols can be
implemented easily using only physical objects that are around us in our
daily life.
Our protocols are based on the traditional zero-knowledge proof
system, together with a specially designed scratch-off card as our physical
tool. The prover can then convince the verifier through a series of
interaction between them.
Yet, when the prover does not know the solution, there are some
chances (called soundness probability) that a verifier wrongly believes
this false prover. To counter this, we propose various strategies so that
the soundness probability can be reduced.
In summary, our final protocol can achieve perfect completeness (i.e., a
prover knowing the solution can always convince the verifier),
zero-knowledge property (i.e., no leakage of information) and 1/2
soundness (i.e., a false prover has only 1/2 chance to fool the verifier).

[1] S. Cook. The Complexity of Theorem Proving Procedures, in Proceedings of Third Annual
ACM Symposium on the Theory of Computing (STOC), pages 151{158, 1971.
[2] M. Fischer and R.Wright. Bounds on Secret Key Exchange Using a Random Deal of Cards.
Journal of Cryptology, 9(2):71{99, 1996.
[3] M. Garey and D. Johnson. Computers and Intractability: A Guide to the Theory of NP-
Completeness, 1979.
[4] O. Goldreich. Foundations of Cryptography: Basic Tools, Cambridge University Press,
2001.
[5] O. Goldreich, S. Micali, and A. Wigderson. Proofs that Yield Nothing But their Validity,
and a Methodology of Cryptographic Protocol Design. Journal of the ACM, 38:691{729,
1991.
[6] S. Goldwasser, S. Micali, and C. Racko®. The Knowledge Complexity of Interactive Proof-
Systems, in Proceedings of Seventeenth Annual ACM Symposium on the Theory of Com-
puting (STOC), pages 291{304, 1985.
[7] R. Gradwohl, M. Naor, B. Pinkas, and G. Rothblum. Cryptographic and Physical Zero-
Knowledge Proof Systems for Solutions of Sudoku Puzzles, in Proceedings of Fun with
Algorithms (FUN), pages 166{182, 2007.
[8] Kakuro, Wikipedia, the free encyclopedia (based on 6 May 2008 version),
http://en.wikipedia.org/wiki/Kakuro
[9] R. Kaye. Minesweeper is NP-complete. Mathematical Intelligencer,22(2):9{15, 2000.
[10] T. Moran and M. Naor. Basing Cryptographic Protocols on Tamper-Evident Seals, in
Proceedings of 32nd International Colloquium on Automata, Language, and Programming
(ICALP), pages 285{297, 2005.
[11] M. Naor. Bit Commitment Using Pseudo-Randomness. Journal of Cryptology, 4:151{158,
1991.
[12] J.-J. Quisquater, M. Quisquater, M. Quisquater, M. Quisquater, L. Guillou, M. Guillou,
G. Guillou, A. Guillou, G. Guillou, S. Guillou, and T. Berson. How to Explain Zero-
Knowledge Protocols to Your Children, in Proceedings of Nineth Annual International
Cryptology Conference (CRYPTO), pages 628{631, 1989.
[13] Y. Takayuki. On the NP-completeness of the Slither Link Puzzle (in Japanese). IPSJ
SIGNotes ALgorithms, 74:25{32, 2000.
[14] N. Ueda and T. Nagao. NP-completeness Results for Nonogram via Parsimonious Reduc-
tions. Technical Report TR96-0008, Department of Computer Science, Tokyo Institute of
Technology, 1996.
[15] T. Yato. Complexity and Completeness of Finding Another Solution and its Application to
Puzzles, Master's thesis, University of Tokyo, Department of Information Science, 2003.
[16] Zero-Knowledge Proof, Wikipedia, the free encyclopedia (based on 6 June 2008 version),
http://en.wikipedia.org/wiki/Zero Knowledge