Reputation
416
Top tag
Next privilege 500 Rep.
Cast close & reopen votes
Badges
2 11
Newest
 Yearling
Impact
~5k people reached

Aug
24
comment understanding the proof of knowledge
By the paper being linked, it looks like we're talking about Zero-Knowledge Proofs of Knowledge.
Aug
24
accepted How does the simulator of the special-honest verifier zero-knowledge property works?
Aug
19
comment How does the simulator of the special-honest verifier zero-knowledge property works?
Also, in your answer you're assuming that the challenge space has length 2, right?
Aug
19
comment How does the simulator of the special-honest verifier zero-knowledge property works?
Amazing answer, thanks a lot. Would then be correct to say that the expected running time of the simulator for the HVZK case is constant (a valid transcript is produced with only one run)? I wonder, though, why is the expected running time of M for the ZK case (with possibly dishonest verifier V*) polynomial? Wouldn't it be also constant (M succeeds after 2 attempts)?
Aug
18
awarded  Yearling
Aug
18
answered How does the simulator of the special-honest verifier zero-knowledge property works?
Aug
18
revised How does the simulator of the special-honest verifier zero-knowledge property works?
corrected a problem with the question
Aug
14
comment How does the simulator of the special-honest verifier zero-knowledge property works?
But still my question was more related to the simulator itself, on what it can or cannot do, within the particular case in which the verifier is assumed to be honest (i.e. his challenge will be random).
Aug
14
comment How does the simulator of the special-honest verifier zero-knowledge property works?
As far as I know, the difference between zero-knowledge (ZK) and honest-verifier zero-knowledge (HVZK) were not the ones you mention, but rather that in ZK we consider the verifier to be potentially dishonest (and thus his challenge might not be random, but dependent on the commitment, for example), while in the HVZK the verifier is considered honest and thus his challenge is considered to be drawn at random. Then we have the distinction between HVZK and Special HVZK. In the "special" case, the simulator is given a challenge and it has to produce a valid transcript.
Aug
14
revised How does the simulator of the special-honest verifier zero-knowledge property works?
Improved formatting and writing, since I haven't had any replies yet, and I'm afraid it can be because it's not understandable.
Aug
12
asked How does the simulator of the special-honest verifier zero-knowledge property works?
Aug
5
accepted Why is the definition of Special-honest verifier zero-knowledge probabilistic?
Aug
5
comment Why is the definition of Special-honest verifier zero-knowledge probabilistic?
Thanks for your answer, it really makes sense. But I have one question related to this. If the simulator indeed managed to convince the verifier more than once by using the same $a$, as you mention, wouldn't that imply at the same time, by the Special Soundness property, that a knowledge extractor (or even the verifier itself) would then be able to obtain the witness, which would in turn be contradictory, since the simulator doesn't know it? I'm a bit confused.
Aug
4
asked Why is the definition of Special-honest verifier zero-knowledge probabilistic?
May
6
awarded  Popular Question
Feb
25
revised understanding forking lemma
fixed grammar
Feb
25
suggested approved edit on understanding forking lemma
Feb
20
comment How to find generator $g$ in a cyclic group?
Oh right, now everything makes sense! So if we have that $h^2 \mod p \neq 1$, then this is at the same time telling us that $h^2$ is a quadratic residue and therefore must be in the subgroup of order $q$. Thanks a lot for you clarification and for having edited your answer.
Feb
20
comment How to find generator $g$ in a cyclic group?
There's something that seems confusing in your answer and I hope you can clarify it. If we select a safe prime $p=2q+1$ and we now want to select a generator $g$ within the subgroup of size $q$, you suggest to take a random value $h$ between $2$ and $p-1$ and then compute $h^{(p-1)/q} \mod p$, which would be the same as computing $h^2 \mod p$. If the result of this is not $1$ this definitely means that $h$ is not a generator of the subgroup of order $2$, but this doesn't necessarily mean that it's a generator of the one of order $q$, we still would have to check that $h^q=1 \mod p$, don't we?
Jul
2
awarded  Curious