# Tag Info

Here is a protocol that seems to fit your requirements: Let P be a prover and V be a verifier. $g_1,g_2,g_3$ are all generators of a group of order $p$ in which the discrete logarithm cannot be solved efficiently (note: you don't need Diffie-Hellman to be hard, discrete log is sufficient). (I assume that neither P nor V know the discrete log of $g_i$ in base ...