Consider a verification equation $ e(\Delta,\tilde{G}) = e(W_x,x\tilde{G}+pk_{acc})$ from a pairing based accumulator which uses the value $x$ and the corresponding witness $W_x$ to verify that a value $x$ is accumulated in the accumulator $\Delta$.

For anonymous credential system for multishow unlinkability, we often need to present a ZKPoK $\pi_v$ showing that $x$ is accumulated in $\Delta$ without revealing $x$ and the witness $W_x$.

\begin{equation} \label{piverification} \begin{split} \pi_{v} &= \mathrm{ZKPoK}\{(x,W_x): e(\Delta,\tilde{G}) = e(W_x,x\tilde{G}+pk_{acc}) \wedge Commit(x,\tilde{r})\}. \end{split} \end{equation}

How can we construct a ZKPoK which hides both $x$ and $W_x$ ?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.