I am studying the zerocoin paper‡. More precisely I am stuck at page 6, on the Spend function (in paragraph "B. Our construction"). I am not understanding how the ZKSoK is computed. Let's consider the Pedersen commitment as $$C\gets g^Sh^r\bmod p$$

I've found a lot of examples online but they all refer to a case where the "secret" is $ω$: $x=g^ω$ And $x$ is public. I understand the steps in this cases but I am not sure about two things on zerocoin:

  1. Does the provider give $S$ ($S$=serial number) to the verifier, in order to be able to do the verification?
  2. What is the condition that says if the proof is valid or not?

‡ Paywalled


1 Answer 1

  1. Yes, the value $S$ is public. From the notation on page 5, "All values not enclosed in ()’s are assumed to be known to the verifier." This makes sense in the scheme, since, once a coin is spent, its serial becomes public and cannot be used again.

  2. You can make efficient ZKPs for a wide range of linear relations about the exponents of some group elements with known bases. Camenisch and Stadler is the usual paper cited here (and in fact, is cited on page 5). Another, perhaps more easy to understand one is by Maurer.

  • $\begingroup$ I still do not understand how $S$ is involved during the generation of the proof. More precisely, referring to the example 1 of the Camenisch and Stadler paper, I do not understand where to use it. $\endgroup$
    – riccardo
    Commented Mar 23, 2023 at 14:45
  • $\begingroup$ Example 1 doesn't have the form of a Pedersen commitment. It's $g^x$ rather than $g^x h^y$. Example 4 is closer to what you want. This other answer specifies the Pedersen opening protocol directly. $\endgroup$
    – rozbb
    Commented Mar 24, 2023 at 19:38
  • $\begingroup$ I've seen the answer and I get it, but what prevents an attacker from properly compute zkp and then provide another $S$? How is the proof and $S$ linked together, and how is $S$ correctness verified by the verifier? $\endgroup$
    – riccardo
    Commented Mar 25, 2023 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.