"Zero Knowledge Proof" is an interactive method for one party to prove to another that a statement is true, without revealing anything other than the veracity of the statement.

learn more… | top users | synonyms

1
vote
2answers
139 views

Verifying Without Knowing Key

Say user Bob sends an encrypted message to a server. People can download the message from this server and later get the key directly from Bob. Is it possible for the server to somehow verify that ...
0
votes
1answer
62 views

Zero Knowledge Proof extended Schnorr - average secrets

I am trying to compute and an overall average number of given secrets from inside the commitments. I have the following set-up: Three commitments; $C_{1}(id, num, r) = g_{1}^{id} g_{2}^{num} ...
1
vote
0answers
68 views

Simulation-Based Proof: When a Secret Key is Involved

Assume we have a protocol in which a party receives an encrypted random polynomial. The polynomial is encrypted using his public key. We want to construct a simulator for this party (so this party ...
3
votes
1answer
87 views

Is Using Digital Signatures to prove identity a zero knowledge proof?

Suppose Alice publishes a book with a public key in it, and later wants to prove that she wrote the book. She could sign challenge messages with her private key, and others could verify those signed ...
12
votes
2answers
796 views

Proving knowledge of a preimage of a hash without disclosing it?

We consider a public hash function $H$, assumed collision-resistant and preimage-resistant (for both first and second preimage), similar in construction to SHA-1 or SHA-256. Alice discloses a value ...
2
votes
2answers
247 views

Zero knowledge-proof for discrete log that is not honest-verifier

Take a cyclic group of prime order. The Schnorr-protocol for proving knowledge of the discrete logarithm of some group element is honest-verifier zero-knowledge, meaning that if the verifier chooses ...
3
votes
1answer
87 views

what is the difference between proofs and arguments of knowledge?

What is the difference between proofs and arguments of knowledge in the context of zero-knowledge? I have read this sentence in this ePrint: It is useful to distinguish between zero-knowledge ...
0
votes
1answer
152 views

Two-party equality computation

Alice and Bob each secretly chooses an integer between 1 and 10, a and b. They want to know (with high probability) whether or ...
3
votes
1answer
105 views

Why doesn't this operation reveal the voter's message?

I am working my way through this paper. I am trying to figure out the OR zero knowledge proof in figure 2. The prover is verifying that she has correctly voted, and that her input satisfies ...
0
votes
2answers
173 views

Finding out the greater number under zero-knowledge conditions?

Is it possible to construct a zero knowledge proof that one encrypted number is larger (or not) than another encrypted number without releasing the values of either numbers?
3
votes
1answer
314 views

Sigma-protocol for 3SAT problem

I have some questions from previous years exams, I hope you could help me with them. :) Let $g,h$ denote generators of a group $G$ of large prime order $n$ such that $\log_g h$ is unknown to anyone. ...
0
votes
1answer
135 views

Zero Knowledge - Who is greater?

I just encountered the term "zero-knowledge" and wanted to know more about it. I understood that there is a zero knowledge protocol between two parties to determine whether $x$ is greater than, equal ...
11
votes
2answers
3k views

Zero knowledge proof protocol example?

Alice is color blind. She never knows if her gloves are matched. Her brother Bob always teases her saying her gloves are mismatched and she should go change them. Alice wants to know if ...
4
votes
3answers
289 views

Homomorphism and Zero Knowledge in FIPS 140-2 compliant systems

I am analyzing a system that needs to be at least level 3 FIPS 140-2 compliant. The system may leverage from homomorphic and Zero Knowledge constructs, but, as far as I can see, the algorithms ...
0
votes
0answers
139 views

Is there any zero-knowledge technique to verify proof of knowledge of shared secret key?

Generally, to verify knowledge/key generated between two interacting parties in an authentication protocol uses Hash, MAC, Digital Signatures or encryption (based on random challenge). But I would ...
2
votes
2answers
249 views

Simulation based proofs: Simple examples

I am aware that,(in theory) in order to proof that a scheme is secure using simulation based proof we replace an adversary in real world with a simulator in ideal world. Then we try to show that their ...
5
votes
1answer
285 views

Hamiltonian Path Zero Knowledge Proof using Commitments to a Series of Edges

Commonly, Zero Knowledge Proofs based on the Hamiltonian Path or Cycle problems are given as follows: The Prover has a graph $G$, for which he knows a Hamiltonian Path (or Cycle). $G$ is also known ...
3
votes
3answers
150 views

In interactive proofs, do we assume that the prover can always solve the problem?

I'm having a difficult time understanding a concept from interactive proofs: A trivial interactive proof for the graph isomorphism problem is having the prover just send a permutation that shows an ...
7
votes
2answers
568 views

What is an example of a secure sigma proof?

I want to implement Threshold Elgamal as described in section 6.3.1 and in the decryption phase each party must broadcast a sigma proof to show that it actually has a valid secret share of the secret ...
6
votes
2answers
206 views

Hamiltonicity proof of knowledge

I'm learning the POK notion and definitions and as a self exercise I wante to prove the statement that the Hamiltonicity protocol is a POK system with knowledge error $1/2$. So the question will be ...
4
votes
0answers
185 views

Zero-knowledge proof for the product of additive Paillier ciphers

Suppose that Alice received the cipher values: $E(x_1), E(x_2), ..., E(x_n)$ that are encrypted using Paillier cryptosystem by $n$ entities with Bob's public key. Alice computes $E(\sum x_i)$ from ...
2
votes
0answers
166 views

Zero Knowledge Argument for Subset Sum

What is the currently most efficient (interactive) zero knowledge proof/argument for the subset sum problem? The most recent relevant paper I have found is Efficient Modular NIZK Arguments from Shift ...
3
votes
2answers
259 views

Proof that a hash matches an encrypted file

Assume that Alice has a file $F$ which she is going to send, in encrypted form to Bob. Alice possesses $F$ and an encryption key $K$. She sends to Bob the encryption of $F$ using $K$, $E(F,K)$ as ...
5
votes
1answer
192 views

Zero knowledge proof of shared secret

Alice holds a secret $a \in X$. Bob holds a secret $b \in X$. Is there a protocol that lets them compute $f(a, b) = \begin{cases} 1 & \textrm{if } a = b \\ 0 & \textrm{else} \end{cases}$ If ...
4
votes
0answers
166 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
11
votes
1answer
3k views

What are SNARKs?

What does it mean and what is it used for, I have been hearing this term a lot lately. From the context I've heard it talked about it seems to be connected with zero knowledge?
5
votes
1answer
233 views

Zero-Knowledge Proof of a polynomial

I have two secret values $L_1$, $L_2$, and two Pedersen commitments $C_1 = C(L_1)$, $C_2=C(L_2)$. The commitments $C_1$, $C_2$ are public. Given a challenge $c$, I want to output $d = c*L_1+L_2$ and ...
14
votes
4answers
2k views

What is a Non-Interactive Zero Knowledge Proof?

I understand the concept of a Zero Knowledge Proof thanks to the easy to understand analogy of Alibaba's cave. However, this seems to require interaction between the verifier and the other party. I ...
2
votes
1answer
154 views

How to prove secret value in Pedersen commitment is equal to secret value in Fujisaki commitment?

We have Pedersen commitment C to the secret value x, and Fujisake commitment C' to the secret value x. How can we make a zero-knowledge proof of equality for x value in the commitments?
7
votes
1answer
237 views

Simulation-based proofs and universal composability proofs

I recently read Ran Canetti's famous UC paper but I'm still trying to wrap my head around the concepts. I think this answer has me confused a bit, particularly where it says The stand-alone ...
4
votes
1answer
176 views

Consequence of a change on the Guillou-Quisquater Protocol

In the Guillou-Quisquater Protocol, the prover convinces the verifier that he knows an $e$-th root of an element $y \in \mathbb{Z}^*_n$ ($p, q, e$ are primes, $n = pq$ and $e$ is coprime with ...
1
vote
1answer
117 views

With ECDSA is there a way for the verifier to calculate any properties of $k$?

With ECDSA, given $(r,s)$ and $m$, is there a way for a verifier to calculate any (boolean) properties of $k$, without knowing $k$ or the private key $D_A$? (I understand that $k$ should be random, ...
4
votes
0answers
163 views

Salary Negotiation Problem

Imagine Alice is applying for a new job. Alice has an idea of the minimum salary that she is willing to accept—let's call this value A. Bob, the hiring manager for ...
0
votes
1answer
194 views

How to prove knowledge of discrete logarithm in a product?

Definitions Suppose I have two large safe primes $p$ and $q$, and a composite number $N=pq$. I have $G$, a large cyclic subgroup of $\mathbb{Z}^{*}_{N}$; $g$ and $h$ are generators of $G$. I commit ...
2
votes
0answers
158 views

How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
2
votes
1answer
159 views

Is succinct verification of an arbitrary data transformation theoretically possible? Is it feasible? How?

Given input string S, and transformation (i.e. computer program) T, is it possible to provide a succinct proof that another binary string S' is identical to the output T(S)? By "succinct", I ...
0
votes
0answers
159 views

Zero-Knowledge Proof of Subgraph Isomorphism

I'm trying to find a Zero-Knowledge proof of subgraph isomorphism in the following scenario: Alice and Bob both know about graphs G1 and ...
1
vote
2answers
210 views

On the fly signatures and zero-knowledge

I am reading some articles which explain on the fly signatures (also called online/offine signatures). The principle is that a few operations do not depend of the message we want to sign, so these ...
9
votes
3answers
1k views

Perfect zero knowledge for the Schnorr protocol?

Can somebody explain (or point to a reference) why the Schnorr protocol cannot be proved zero knowledge?
-1
votes
1answer
68 views

Hiding and Binding key in Groth-Sahai NIZK proof system

In context of Groth-Sahai NIZK proof system, I have a couple of doubts on Hiding and Binding keys. In case of hiding keys (highlighted in red), how is it ensured that $\tau(A) \subseteq \langle ...
4
votes
1answer
191 views

Changing SRP-6a message order

In SRP-6a, the public key $B$ of the server is normally sent after receiving the public key of the client $A$. Is it okay to send $B$ and $s$ after the client sends its username $I$, but before the ...
4
votes
1answer
179 views

Usage of Zero-knowledge proofs for NP-complete languages

It is well known that if OWFs/PRGs exist, then there is a zero knowledge proof for any NP-complete language, say G3C (graph coloring in 3 colors). The zero-knowledge notion maintains that any ...
7
votes
2answers
223 views

How does the simulator of the special-honest verifier zero-knowledge property works?

I’m a bit confused about what the simulator of the special-honest verifier zero-knowledge property of a $\Sigma$-protocol is supposed/allowed to do and how to prove that it is indeed efficient (i.e. ...
6
votes
4answers
393 views

Why aren't zero-knowledge proofs used for authentication in practice?

I read on Wikipedia that zero-knowledge proofs are not used for authentication in practice. Instead (I think) the server is entrusted with seeing a password in plaintext form, which it should then add ...
2
votes
1answer
185 views

Simulation Based Proof: How the Corrupted Party's Input is Given To Simulator

Imagine we have a 3-party protocol, including client $A$,client $B$ and a server. In this protocol client $B$ encrypts its input under its public key and sends it to the server. The server performs ...
2
votes
1answer
196 views

Why is the definition of Special-honest verifier zero-knowledge probabilistic?

Let $P$ be a prover willing to prove to a verifier $V$ that he knows a witness $w$ satisfying $(x,w) \in R$ for some relation $R$ and some common input $x$. As found in the literature, $P$ can use a ...
1
vote
0answers
84 views

Prove that certain amount of data was stored

I'm looking for a way to prove that a certain amount of data was stored, through some easily verifiable piece of information. Similarly to how proof-of-work can prove through a hash that a certain ...
1
vote
0answers
94 views

Groth-Sahai proofs and hardness assumptions

I am learning Groth-Sahai NIZK proof system for Bilinear groups. While going through the literature, I am getting confused on how the proof system is related to Subspace Decision, SXDH or DLIN ...
1
vote
1answer
278 views

Simulation Based Proof: What Can / Can not Simulator Do?

I have seen some examples in "Foundation of cryptography" and "Efficient two party computation", in which simulator can do some things that in the real world model the parties cannot do, for instance: ...
2
votes
2answers
70 views

Simulator in Private Outsourced Computation over Outsourced Datasets

Please, consider two honest parties $A$ and $B$ outsourced their private data to a malicious server $S$. So the parties store their data in the server. Then at a later point in time they want to ask ...