# Tagged Questions

"Zero Knowledge Proof" is an interactive method for one party to prove to another that a statement is true, without revealing anything other than the veracity of the statement.

48 views

### What is the non-programmable random oracle model?

I would like to know the difference between the random oracle model and the non-programmable random oracle model. ​ What is the difference?
188 views

### Verifying Without Knowing Key

Say user Bob sends an encrypted message to a server. People can download the message from this server and later get the key directly from Bob. Is it possible for the server to somehow verify that ...
95 views

### Zero-knowledge proof system which is not proof of knowledge?

I have learned that a zero-knowledge (ZK) proof system can be constructed by making use of the three-color problem. In this particular case, the proof system also happens to be proof of knowledge (POK)...
98 views

267 views

### Zero knowledge-proof for discrete log that is not honest-verifier

Take a cyclic group of prime order. The Schnorr-protocol for proving knowledge of the discrete logarithm of some group element is honest-verifier zero-knowledge, meaning that if the verifier chooses ...
120 views

### what is the difference between proofs and arguments of knowledge?

What is the difference between proofs and arguments of knowledge in the context of zero-knowledge? I have read this sentence in this ePrint: It is useful to distinguish between zero-knowledge ...
184 views

### Two-party equality computation

Alice and Bob each secretly chooses an integer between 1 and 10, a and b. They want to know (with high probability) whether or ...
133 views

### Why doesn't this operation reveal the voter's message?

I am working my way through this paper. I am trying to figure out the OR zero knowledge proof in figure 2. The prover is verifying that she has correctly voted, and that her input satisfies \log_gx=\...
176 views

### Finding out the greater number under zero-knowledge conditions?

Is it possible to construct a zero knowledge proof that one encrypted number is larger (or not) than another encrypted number without releasing the values of either numbers?
316 views

### Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
165 views

### Zero Knowledge - Who is greater?

I just encountered the term "zero-knowledge" and wanted to know more about it. I understood that there is a zero knowledge protocol between two parties to determine whether $x$ is greater than, equal ...
3k views

### Zero knowledge proof protocol example?

Alice is color blind. She never knows if her gloves are matched. Her brother Bob always teases her saying her gloves are mismatched and she should go change them. Alice wants to know if Bob ...
320 views

### Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms ...
172 views

### Is there any zero-knowledge technique to verify proof of knowledge of shared secret key?

Generally, to verify knowledge/key generated between two interacting parties in an authentication protocol uses Hash, MAC, Digital Signatures or encryption (based on random challenge). But I would ...
261 views

### Simulation based proofs: Simple examples

I am aware that,(in theory) in order to proof that a scheme is secure using simulation based proof we replace an adversary in real world with a simulator in ideal world. Then we try to show that their ...
318 views

### Hamiltonian Path Zero Knowledge Proof using Commitments to a Series of Edges

Commonly, Zero Knowledge Proofs based on the Hamiltonian Path or Cycle problems are given as follows: The Prover has a graph $G$, for which he knows a Hamiltonian Path (or Cycle). $G$ is also known ...
179 views

### In interactive proofs, do we assume that the prover can always solve the problem?

I'm having a difficult time understanding a concept from interactive proofs: A trivial interactive proof for the graph isomorphism problem is having the prover just send a permutation that shows an ...
605 views

### What is an example of a secure sigma proof?

I want to implement Threshold Elgamal as described in section 6.3.1 and in the decryption phase each party must broadcast a sigma proof to show that it actually has a valid secret share of the secret ...
207 views

### Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
213 views

### Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
196 views

### Zero Knowledge Argument for Subset Sum

What is the currently most efficient (interactive) zero knowledge proof/argument for the subset sum problem? The most recent relevant paper I have found is Efficient Modular NIZK Arguments from Shift ...
289 views

### Proof that a hash matches an encrypted file

Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob. Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as ...
222 views

147 views

### With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$? (I understand that $k$ should be random, ...
198 views

### Salary Negotiation Problem

Imagine Alice is applying for a new job. Alice has an idea of the minimum salary that she is willing to accept—let's call this value A. Bob, the hiring manager for ...
226 views

### How to prove knowledge of discrete logarithm in a product?

Definitions Suppose I have two large safe primes $p$ and $q$, and a composite number $N=pq$. I have $G$, a large cyclic subgroup of $\mathbb{Z}^{*}_{N}$; $g$ and $h$ are generators of $G$. I commit ...
188 views

### How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
188 views

### Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How?

Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ...
190 views

### Zero-Knowledge Proof of Subgraph Isomorphism

I'm trying to find a Zero-Knowledge proof of subgraph isomorphism in the following scenario: Alice and Bob both know about graphs G1 and ...
238 views

### On the fly signatures and zero-knowledge

I am reading some articles which explain on the fly signatures (also called online/offine signatures). The principle is that a few operations do not depend of the message we want to sign, so these ...
1k views

### Perfect zero knowledge for the Schnorr protocol?

Can somebody explain (or point to a reference) why the Schnorr protocol cannot be proved zero knowledge?
69 views