Tagged Questions

Zero-knowledge proofs are an interactive method for one party to prove to another that a statement is true, without revealing anything other than the veracity of the statement.

368 views

Mutual verification of shared secret

Is it possible to develop a scheme where two parties, unsure if they have the same secret, can verify that the other does or does not share the same secret, without one party being able to cheat and ...
509 views

Why aren't zero-knowledge proofs used for authentication in practice?

I read on Wikipedia that zero-knowledge proofs are not used for authentication in practice. Instead (I think) the server is entrusted with seeing a password in plaintext form, which it should then add ...
221 views

Zero knowledge / proof of knowledge sudoku solution

I recently started a coursera course "cryptography 1" provided by Stanford university. In one point when explaining zero proof knowledge the instructor mentions the following: Almost any puzzle ...
86 views

124 views

Verification of Pinocchio (verifiable computation)

I am reading the Pinocchio paper. The calculated result $y$ is a part of the verification input, but it seems to me, the verification procedure does not utilize the result $y$. Can anyone can help me ...
95 views

Proving that a plaintext is the Paillier decryption of a certain ciphertext [duplicate]

Assume that Alice received 100 ciphertexts encrypted with additive homomorphic encryption, say Paillier, using the same public key that belongs to Bob. Alice added all of them, and wants to know the ...
77 views

Zero knowledge proof relation + number is binary

I want to develop a ZKPK for the following problem: $$Y=g_0^{r_Y} \prod_{i=1}^n g_i^{s_i}$$ and $$Z=h_0^{r_Z} \prod_{i=1}^n h_i^{s_i}$$ I want to proof knowledge of $r_Y,r_Z$ and $s_i$ which I have ...
148 views

difference between soundness in ZKPoK and special soundness for sigma proofs

What is the difference between soundness in ZKPoK and special soundness for sigma proofs?
280 views

Zero knowledge-proof for discrete log that is not honest-verifier

Take a cyclic group of prime order. The Schnorr-protocol for proving knowledge of the discrete logarithm of some group element is honest-verifier zero-knowledge, meaning that if the verifier chooses ...
103 views

Common reference string in NIZK

I want to ask that does the common reference string in NIZK have to be random? Or can it be anything?
73 views

Zero knowledge of two factor

Here I overconfident in myself state that I can show, that n has two factors. This is not completely true, can possibly show $n$ is composite - prover generates RSA key with modulo $n$, and gives $e$ ...
95 views

Blum primes [x=3(mod 4)] zero knowledge proof?

Lets say we have 2 primes, $p \equiv q \equiv 3 \pmod{4}$, and we make $n=p \times q$ public. I can, without revealing factors, show that $n$ has two prime factors. How can i zero knowledge prove ...
104 views

Is this an example of a zero knowlege proof?

My Math Structures professor mentioned the strange concept of a zero knowledge proof to me after class one day, and I decided to do some reading about it. After reading the relatively famous "How to ...
185 views

Zero Knowledge Non Interactive Proof with random oracle

I am trying to write an assay about Non Interactive Zero-Knowledge proofs and would like to take the simple discrete logarithm problem example fallowing the Feige-Fiat-Shamir heuristics. I understand ...
67 views

Why is it a quadratic equation?

In Groth-Sahai NIZK proof system, they have defined something called Quadratic Equation in $\mathbb{Z}_n$ as shown below. But, my idea of quadratic equation was a second order polynomial equation in a ...
72 views

435 views

Correctness vs Completeness

What is the conceptual difference between the definition of correctness and completeness in verifiable cryptographic protocols? They justify that if a statement is correct then the verification should ...
80 views

NIZK Proof of knowledge N of M discrete logarithms (threshold)

It is well known how to produce a NIZK that curvepoints $aG$ and $aP$ have the same discrete logarithm $a$ with respect to the curvepoints they are multiplied by. There is also a way to prove that a ...
50 views

Group Dependent Language

The text below has been taken from the below paper Groth-Sahai Paper. The relevant part is highlighted in red. What does this group-dependent language mean in this context? From the definition of a ...
177 views

Finding out the greater number under zero-knowledge conditions?

Is it possible to construct a zero knowledge proof that one encrypted number is larger (or not) than another encrypted number without releasing the values of either numbers?
82 views

159 views

Burn after read algorythm. Software verification on compromised environment. Software smart card

Please help me pick right design of software… I have to design client-server software, where the server should verify that the client runs software from specific source code. It has to be verifiable ...
244 views

Is there a simple zero knowledge proof of $x$ for $b=x^x\pmod p$?

We have a multiplicative cyclic group $G$ which is a subgroup of $(\mathbb{Z}/n\mathbb{Z})∗$. There are two parties, Alice and Bob: If: Alice knows: $b$ and $x$ such that $x^x = b$; Bob knows: $b$. ...
95 views

Reliability of a single-pass deniable authentication protocol?

I look for one-pass deniable authentication protocol with a short message payload for my project and find a solution: ...
166 views

Zero-knowledge proof for committing a choice?

Let's say there are 100 choices (which are publicly known), each represented as a different string, and today you have to choose one of them. You need not reveal what that choice is right now, though. ...
100 views

Generating shared secret random permutation

There are three blind card game players. Each player does not trust any other, even prejudicing other two players may not be blind, or there may be others in the room, peeking at their cards. In ...