There is a random scalar seed $s$ which we may call a master secret.

There are 2 public strings or scalars: $m1, m2$ and 2 corresponding EC keypairs: $a, A=a*G$ and $b, B=b*G$

$a$ and $b$ are somehow securely derived from $(s, m1)$ and $(s, m2)$ respectfully.

It might be $a = HKDF(s, m1)$ or $a = s + m1$, or some hash, it does not matter right now.

I need to prove 2 things without disclosing $s$ or $s*G$:

  1. That I know some $s$ that allowed me to generate $a,A$ using $m1$ or $b, B$ using $m2$
  2. That the same $s$ was used to generate those 2 (maybe more) keypairs

Is it possible without using snarks?

  • $\begingroup$ If $a=s+m_1$, someone can easily calculate $sG=A-m_1G$. A solution to your question would probably involve proposing a different way to derive $a$ and $b$ $\endgroup$
    – knaccc
    May 26 at 22:17
  • $\begingroup$ Furthermore, I assume you don't want malleability. For example, if $a=s+x+m_1$, then I can always demonstrate that any value of $s$ was used to create $a$, simply by claiming a different choice of $x$. It would be necessary to demonstrate that $A$ can only be claimed to have been derived from one value of $s$. This means the method of derivation of $a$ must be carefully considered $\endgroup$
    – knaccc
    May 26 at 23:00
  • $\begingroup$ What about side-stepping this, and instead publishing identities as the pair $(A_i, sH_p(A_i))$, where $H_p()$ means hash a value to produce an EC point in the group of the base point. If you want to prove that two identities are linked, you provide a discrete-log-equivalence proof that $s$ is the same in both cases $\endgroup$
    – knaccc
    May 26 at 23:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.