# Tag Info

12

A non-interactive ZK proof is when you play with yourself. Or, more accurately, with an impartial version of yourself. In a normal ZK proof, the prover first issues a bunch of commitments, then the verifier issues challenges that the prover complies with; this proves anything only as long as the verifier is assumed to issue challenges normally without any ...

11

If k is a constant, such as 3, it becomes possible to select a pair (N,g) such that the discrete log of k to the base g is known, which would enable the two-for-one guessing attack again.

8

Yes. Such proofs are possible for El Gamal. It involves a zero knowledge proof of equality of a discrete log, together with the homomorphic property of El Gamal encryption. Recall that given $E(a)$ and $E(b)$, anyone can form $E(a/b)$ using the homomorphic property of El Gamal. Suppose $E(a/b)=(r,s)=(g^k,h^k a/b)$ (where $g$ is the generator and $h$ is ...

7

The security goal behind SRP is that an attacker that could either pretend to be a client (and attempt to log into a server that knows the key), pretend to be a server (and allow clients that know the key to attempt to log in), or actively monitor (and modify) the communications between a valid client and a valid server, would learn nothing from an exchange, ...

7

Verifiable to someone who already has the correct answer Verifiable to whom? Someone else with the correct answer? Then you may be able to get away with a salted bcrypt hash; e.g., you can easily say make a cryptographically strong one-way hash of an answer: >>> import bcrypt #using py-bcrypt python module >>> hashed_answer = ...

7

The GQ identification scheme is essentially a zero-knowledge proof of a value $x$ such that $x^\mu \equiv J \pmod N$ where $N$ is an RSA modulus and $(\mu,N)$ are system parameters and $J$ is known to the verifier and $x$ only known to the prover. Now your question is not directly concerned with the aforementioned proof where a user shows the possession of ...

6

I don't believe your protocol meets the standard definition of Zero Knowledge Proof, as a cheating verifier can learn more information about the secret than allowed. In particular, suppose we have a cheating verifier (server) that has a list of one million potential passwords. Then, he can run your protocol with a client that knows the password, run the ...

6

This is a classical example. Here is the proof system… Bob gives two gloves to Alice so that she is holding one in each hand. Bob can see the gloves at this point, but Bob doesn't tell Alice which is which. Alice then puts both hands behind her back. Next, she either switches the gloves between her hands, or leaves them be, with probability $1/2$ each. ...

6

Yes. The easiest way is if $K$ is an RSA private key, and Bob has the public key. Then, here's how it works; we'll call the ciphertext that Bob has $C$: Bob selects a random number $r$, and computes both $C \cdot r^e \bmod N$ and $r^{-1} \bmod N$ (where $e$ and $N$ are the public exponent and the modulus from the public key) Bob sends $C \cdot r^e \bmod ... 5 I'm not sure what I can add that wasn't covered in the talk. The approach is that Alice commits to the preimage and sends the commitment to Bob. The commitment has homomorphic properties, meaning it is possible to do computation on the value. For example, if Alice commits to$x$and$y$, Bob may be able to compute a commitment to$z$where$z=f(x,y)$for ... 5 Protocols for selecting uninfluenced random numbers typically fall into two camps: random beacons and coin-tossing protocols. A random beacon is a source of randomness that is agreed by everyone to be unpredictable. For example, you can funnel a large amount of financial data into a small random number. While you cannot prove you didn't know what the ... 5 If Alice guesses$e$then she chooses a random value$x$and computes$h = g^x v^{-e}$, a value which she sends to Bob at step 1. At step 3, Alice sends$x$. When Bob does step 4, he recomputes$g^x v^{-e}$and finds$h$, and he is happy. However, Alice does not know$s$. The "commitment" at step 1 is a way for Alice to say: "I know a$r$corresponding to ... 5 Suppose that we have Eve, that knows what$e$is going to be, and does not need to know the prover's private key$a$, just the public one$v$. She then sends$g^k \cdot v^{-e}$as her first "move", where she can choose her own$k$(you can modify the$k$in different plays to make it all look nice and random...). The verifier sends$e$as expected, of ... 5 In the other answers, you'll find how to simulate a proof if you know$e$. This answer is meant to provide some "color commentary" on the other answers. It is a companion piece. Notation In step 1, Alice sends$g^r$. Call this value$a=g^r$. In step 3, Alice sends$r+se$. Call this value$b=r+se$. In step 1-3, one value is sent in each step: {$a,e,b$}. ... 5 Let me attack if you (the verifier) always select$b = 1$as a random challenge. The zero-knowledge proof for QR. Let us recall the zero-knowledge proof for QR. The common inputs are$y$and$x$and the prover possesses a witness$w$which satisfies$w^2 \equiv y \pmod{x}$. The prover generates a randomness$r \gets \mathbb{Z}_x$and sends$a = r^2 ...

5

Here's what can happen if you don't do this verification: Suppose Alice, Bob and company generate their public key shares honestly, $h_2, h_3, ..., h_n$ Now, Snidely Whiplash (who is also a trustee) is the last to contribute his share, he selects a private key $x_{evil}$ and computes $h_{evil} = g^{x_{evil}}$. However, instead of sharing $h_{evil}$ as his ...

5

Alice can prove that the decryption of $C$ is $M$. This can be done using zero knowledge proofs. Simple example: Suppose $C = (x,w)$ is an ElGamal encryption of $M$ under public key $y$, that is $(x,w) = (g^r, y^r M)$ for some $r$. Suppose that the decryption key is $a$, that is, $y=g^a$. Then we know that $M = wx^{-a}$, or $x^a = w/M$. That is, the ...

5

Formally, this is all very complicated, but informally: An interactive proof is a conversation between a prover and a verifier that ends with the verifier either accepting or rejecting. The interactive proof can be zero knowledge, in which case a cheating verifier does not learn anything new by talking to the honest prover. The interactive proof can be a ...

5

Let $\#G$ denote the number of elements in the group. In your particular case, $\#G = \varphi{}(n)$ (and even $\#G = n-1$ if $n$ is prime). Let $\xleftarrow{\$}$denote a uniformly random sampling from a finite set of elements. Furthermore,$\mathbb{Z}_m$denotes the set of non-negative integers smaller than$m$and$\stackrel{?}{=}$denotes a equality test ... 5 Assumption: the normal user can read the message, which is displayed on his screen. Generic attack: the user uses a camera to take a snapshot of the screen when the message is displayed. And voila! What you seek is demonstrated to be impossible. 5 Use the exponential variant of ElGamal, where the plaintext is encoded in the exponent. Elliptic curve ElGamal is fine. In fact, any public key cryptosystem which allows raising ciphertexts to a power such that this operation corresponds homomorphically to multiplication for the plaintext. Your commitments are$c_x = \mathsf{E}(x)$;$c_y = \mathsf{E}(y)$; ... 4 There's one important difference about SRP and EKE that wasn't clearly explained above : SRP is an augmented password authenticated key exchange EKE (at least the initial version that RFC 6124 uses) is not This means that with EKE as described in RFC 6124 both the server and the client must know the password. Whereas with SRP the server only knows a ... 4 The original 1986 Fiat-Shamir paper can be found here. The subsequent Feige-Fiat-Shamir 1988 paper can be found here, and contains the answer (Section 3): The$S_j$(which are witnesses to the quadratic residuosity character of the$I_j$) are effectively hidden by the difficulty of extracting square roots$\bmod n$, and thus A can establish his ... 4 Well, if fake-Alice guesses the challenge exponent$e$in step 1, then she can guess the value of$v^{-e}$. That means she can pick an arbitrary value to stand in for$r+se$, compute$g^{r+se}v^{-e}$, and send that as her commitment in step 1. Then, assuming Bob sends the guessed exponent in step 1, fake-Alice sends the value$r+se$that she picked above. ... 4 First let's develop a zero knowledge interactive proof. The verifier doesn't know$p,q$as otherwise he could just take the roots. Let$a$be the putative residue, and have$P$know a square root$t$. So P will take a random number$r$and send$r^2$to V. V will send a bit, either$0$or$1$. If$0$P sends$r$to V. If$1$P sends$rt$to V. This is ... 4 Zero knowledge in general What are they good for? What is a typical scenario? This is an interesting question. One application is authentication: You can choose the secret yourself and not even the server will know it, and it will never be transmitted in any way. You just prove you know the secret again and again. However, in practice this is rarely ... 4 Private Set Intersection How about a private set intersection protocol? The banks input is a set of all of their account numbers, the user's input is their account number (a single member set). The output could be given to the user, or the bank, or both, depending on your needs. You would need a way to protect against guessing account numbers. For ... 4 The description of this "kid zero knowledge" example follows the strucure of how interactive proofs that are zero-knowledge usually work: The prover sends a commitment (walks into one of the two sides) The verifier challenges the prover (tosses the coin to decide which side the prover should walk out) The prover gives a response (walks out the side the ... 4 Guillou and Quisquater (link) present a zero-knowledge proof of an RSA signature. Basically, the scheme is as follows: Public knowledge: RSA modulus$n$, public RSA exponent$v$, preimage$X$. Secret knowledge for prover:$A$, such that$A^v = X \mod n$.$$\begin{matrix} \mathcal{P} & & \mathcal{V} \\ r \xleftarrow{\$} \mathbb{Z}_n^* ...

4

She can generate a key-pair and include the public key in the book. Having the private counterpart she can at any time proove that she wrote the book by signing an arbitrary statament.

Only top voted, non community-wiki answers of a minimum length are eligible