Tag Info

New answers tagged


After lots of additional googling I have found some answers: These lecture notes, slides 12 through 23; in particular slide 22, which presents a ZK proof of knowledge of five moves; This paper by Ronald Cramer, Ivan Damgård and Philip MacKenzie, that presents a ZK proof (p. 365) of four moves. Denoting the order of the group by p, both of these have ...


There are two answers. One, go non-interactive with the Fiat-Shamir transform. This requires the Random Oracle Model (ROM) to analyse, but the ROM is standard enough in cryptography and ROM proofs have been used in practice for long enough that this shouldn't worry you. It gets you full ZK, curiously enough for the exact same reason that plain Schnorr is ...


Sure. Use the strong RSA assumption. The accumulator of $x_1,\dots,x_k$ is $A = g^{x_1 x_2 \cdots x_k} \bmod n$, where $n$ is a RSA modulus and $g$ is a fixed base. To prove that the accumulator $A$ contains $x$, exhibit a value $h$ such that $h^x=A \pmod n$. This is secure under the strong RSA assumption, and has a discrete log "feel" to it.

Top 50 recent answers are included