3
$\begingroup$

I am studying the zerocoin paper‡. More precisely I am stuck at page 6, on the Spend function (in paragraph "B. Our construction"). I am not understanding how the ZKSoK is computed. Let's consider the Pedersen commitment as $$C\gets g^Sh^r\bmod p$$

I've found a lot of examples online but they all refer to a case where the "secret" is $ω$: $x=g^ω$ And $x$ is public. I understand the steps in this cases but I am not sure about two things on zerocoin:

  1. Does the provider give $S$ ($S$=serial number) to the verifier, in order to be able to do the verification?
  2. What is the condition that says if the proof is valid or not?

‡ Paywalled

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

  1. Yes, the value $S$ is public. From the notation on page 5, "All values not enclosed in ()’s are assumed to be known to the verifier." This makes sense in the scheme, since, once a coin is spent, its serial becomes public and cannot be used again.

  2. You can make efficient ZKPs for a wide range of linear relations about the exponents of some group elements with known bases. Camenisch and Stadler is the usual paper cited here (and in fact, is cited on page 5). Another, perhaps more easy to understand one is by Maurer.

Improve this answer
$\endgroup$
3
  • $\begingroup$ I still do not understand how $S$ is involved during the generation of the proof. More precisely, referring to the example 1 of the Camenisch and Stadler paper, I do not understand where to use it. $\endgroup$
    – riccardo
    Mar 23 at 14:45
  • $\begingroup$ Example 1 doesn't have the form of a Pedersen commitment. It's $g^x$ rather than $g^x h^y$. Example 4 is closer to what you want. This other answer specifies the Pedersen opening protocol directly. $\endgroup$
    – rozbb
    Mar 24 at 19:38
  • $\begingroup$ I've seen the answer and I get it, but what prevents an attacker from properly compute zkp and then provide another $S$? How is the proof and $S$ linked together, and how is $S$ correctness verified by the verifier? $\endgroup$
    – riccardo
    Mar 25 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.