TL;DR: This ABSOLUTELY does not work and presents a huge security risk. Posting it anyways in case there are other threats I missed or to dissuade any other person who comes up with this idea.
Hi! I’m sort of new to cryptography. I’m starting to venture into ZK schemes. For a small project of mine with which I intend to put in practice what I learnt so far, I came up with a protocol and I’d love to know if it’s good (i.e. safe, truly non-interactive and ZK, etc). It’s pretty much reusing the Schnorr signature construction and verification protocol.
- Players are Alice, Bob and the Crowd.
- All players agree on using a cryptographically secure cyclic subgroup of a certain elliptic curve, with generator $G$.
- Bob has a public/private key pair ($b$,$B=bG$).
Alice has a secret $s$, to which she commits publicly by announcing $S$ (constructed as $S=sG$).
Bob wants to prove to any member of the Crowd that he knows $s$, but without revealing anything about $s$ (ZK). Plus, he wants his proof to be non-interactive and reusable by any skeptic member of the Crowd.
- Alice publicly announces $S$.
- Bob claims to know $s$ and submits a proof $p=s-b$.
- The Crowd takes it as a valid proof iff $pG+B=S$.
- For Bob to be able to construct a valid $p=s-b$ at will, he is required to know $s$. He knows the verification involves removing the $-b$ part, so not knowing $s$ means not being able to end up with $S$ in the end.
- Bob does not give away any information on $s$ because it is masked by the addition with $-b$. Since no one else knows $b$, it essentially uniformally randomizes the values.
- The Crowd knows that Bob actually knows because generating the proof involves knowing $b$ as well as $s$ for a similar principle to the first point. If someone knew $s$ but not $b$, they could not subtract the correct amount $-b$ which is restored during the verification process and the end result of it would not be $S$.
- Is this a valid non-intearctive ZK scheme?
- Is it a good one if so?
- Are there any advantages of using zkSNARKs over such a scheme, with the function being proven is, for instance, that the user knows the hash of the word and the hash of the word concatenated with their own public key?
This absolutely does not work. It’s hugely risky as any prover (Bob in this case) could have their private key leaked: any other player knowing $s$ (Alice in this case, and any other who got a hold of $s$ by whatever means) could just do $b = s - p$. In the Schnorr signature scheme, there’s a factor accompanying $b$. But this factor is publicly known, as it’s used in the verification protocol, and thus fails to protect $b$ in this case. The key takeaway, which I’m glad I can take as a lesson, is that in the Schnorr protocol it’s paramount to keep $k$ safe.