Subquadratic zero-knowledge

The communication complexity of zero-knowledge proof systems is improved. Let C be a Boolean circuit of size n. Previous zero-knowledge proof systems for the satisfiability of C require the use of Ω(kn) bit commitments in order to achieve a probability of undetected cheating not greater than 2^-k. In the case k=n, the communication complexity of these protocols is therefore Ω(n²) bit commitments. A zero-knowledge proof is given for achieving the same goal with only O(n^m+ k√n^m) bit commitments, where m =1+ε_n and ε_n goes to zero as n goes to infinity. In the case k=n, this is O(n√n^m). Moreover, only O(k) commitments need ever be opened, which is interesting if committing to a bit is significantly less expensive than opening a commitment