New answers tagged zero-knowledge-proofs
An interactive proof system, including one with zero knowledge property (a zero-knowledge proof) is to recognize a language. That is, to decide whether an input belongs to a subset or the whole set (universe). Proof of knowledge is an interactive system with a knowledge extractor algorithm. Now consider Pedersen commitments, where any group element could be ...
U-Prove TokenID is a hash output, so it may be not the best way to prove "not the same" statement. One would also consider inequality proof for a subset of user attributes instead. For each such attribute pair, "not the same" would mean an inverse exists for attribute difference, modulo group order. One would prove knowledge of such inverses while keeping ...
To prove that product holds over integers, one would start from commitments with groups of a hidden order. That is, proving party should not know order of the group, which is the case with RSA-like multiplicative group. Consider Prover responses $\rho_x = tx + \alpha_x$, $\rho_y = ty + \alpha_y$, $\rho_z = tz + \alpha_z$ to Verifier challenge $t$ with ...
Zero knowledge property here is simulator availability that produces indistinguishable protocol transcript. In other words, proving party can deny being ever engaged in a protocol. One would use Pedersen commitments to avoid leaking any information about his secret.
An efficient proof of "more or equal" statement about integers committed is possible starting from Lagrange 4-squares theorem as follows: use a group of a hidden order (that is, unknown to proving party), like RSA; find four integers such that sum of their squares is the difference of original numbers committed; commit that four numbers and send all ...
You are on the right track. However, as Ricky Demer points out in the comments, your suggestion would not work because the input is encrypted with different public keys. To fix this you need to use the properties of the threshold-encryption scheme. In a threshold-encryption scheme the players run a key-generation protocol in order to generate a common ...
From y you don't get any information about x, because of the 'mod p' part, which makes the result y random.
A zero-knowledge proof is a protocol by which the Prover demonstrate to the Verifier that he knows the solution to a given problem, without giving to the Verifier any additional information about the solution -- that is, no information that the Verifier could not already obtain alone. In the case of the discrete logarithm, the y value is not part of what the ...
See definitions in "SNARKs for C:Verifying Program Executions Succinctly and in Zero Knowledge (extended version)" - https://eprint.iacr.org/2013/507.pdf
Top 50 recent answers are included