Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to construct a zero knowledge proof that one encrypted number is larger (or not) than another encrypted number without releasing the values of either numbers?

share|improve this question
Is the encryption public-key? $\:$ If yes, does the prover know the private key $\hspace{1.96 in}$ or the randomness used for encryption? $\;\;\;\;$ – Ricky Demer Sep 23 '14 at 0:25
use orderpreserving encryption ? – sashank Sep 23 '14 at 0:42
I don't care what encryption is used, as long as the values aren't knowable by any but the holder of the value. – B T Sep 23 '14 at 1:06
@BT : $\:$ In that case, you need a statistically binding commitment to the key. $\;\;\;\;$ – Ricky Demer Sep 23 '14 at 1:20
Do you need to compare each number in a pair only once, or multiple times? – Henrick Hellström Sep 23 '14 at 2:03
up vote 3 down vote accepted

Yes, it is possible. Actually, any statement in NP can be proven in zero knowledge. This means that if something can be proven by releasing some information, it is possible to prove the same without releasing any information, i.e. in zero knowledge.

share|improve this answer
Very interesting. The article you link to looks like its for-pay only. What is an NP language? Is there somewhere I can read about them that is more understandable than the wikipedia page? – B T Sep 23 '14 at 4:30
@BT I replaced the link with a free one. I think the wikipedia article on NP is sufficiently understandable. – abacabadabacaba Sep 23 '14 at 4:39
Thanks for the answer, if you know, I'd be very curious to see an explanation of how this could be done specifically – B T Sep 23 '14 at 22:28

An efficient proof of "more or equal" statement about integers committed is possible starting from Lagrange 4-squares theorem as follows:

  1. use a group of a hidden order (that is, unknown to proving party), like RSA;
  2. find four integers such that sum of their squares is the difference of original numbers committed;
  3. commit that four numbers and send all commitments to verifying party;
  4. prove knowledge of two original numbers and 4 "witness" numbers with a Schnorr-like protocol.

Low probability (like inverse challenge space) of protocol soundness error in a single run is the major difference from general proof for any NP statement.

"Proving knowledge" above holds for a protocol of argument type, on condition that proving party cant find logarithm and cant find order of the group used.

Protocol above is a generalization into proving polynomial identities of degree larger that linear in challenge, doable with Schwartz-Zippel lemma.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.