New answers tagged zero-knowledge-proofs
Zero knowledge property here is simulator availability that produces indistinguishable protocol transcript. In other words, proving party can deny being ever engaged in a protocol. One would use Pedersen commitments to avoid leaking any information about his secret.
An efficient proof of "more or equal" statement about integers committed is possible starting from Lagrange 4-squares theorem as follows: use a group of a hidden order (that is, unknown to proving party), like RSA; find four integers such that sum of their squares is the difference of original numbers committed; commit that four numbers and send all ...
You are on the right track. However, as Ricky Demer points out in the comments, your suggestion would not work because the input is encrypted with different public keys. To fix this you need to use the properties of the threshold-encryption scheme. In a threshold-encryption scheme the players run a key-generation protocol in order to generate a common ...
From y you don't get any information about x, because of the 'mod p' part, which makes the result y random.
A zero-knowledge proof is a protocol by which the Prover demonstrate to the Verifier that he knows the solution to a given problem, without giving to the Verifier any additional information about the solution -- that is, no information that the Verifier could not already obtain alone. In the case of the discrete logarithm, the y value is not part of what the ...
See definitions in "SNARKs for C:Verifying Program Executions Succinctly and in Zero Knowledge (extended version)" - https://eprint.iacr.org/2013/507.pdf
Top 50 recent answers are included