2
$\begingroup$

There is a random scalar seed $s$ which we may call a master secret.

There are 2 public strings or scalars: $m1, m2$ and 2 corresponding EC keypairs: $a, A=a*G$ and $b, B=b*G$

$a$ and $b$ are somehow securely derived from $(s, m1)$ and $(s, m2)$ respectfully.

It might be $a = HKDF(s, m1)$ or $a = s + m1$, or some hash, it does not matter right now.

I need to prove 2 things without disclosing $s$ or $s*G$:

  1. That I know some $s$ that allowed me to generate $a,A$ using $m1$ or $b, B$ using $m2$
  2. That the same $s$ was used to generate those 2 (maybe more) keypairs

Is it possible without using snarks?

Improve this question
$\endgroup$
3
  • $\begingroup$ If $a=s+m_1$, someone can easily calculate $sG=A-m_1G$. A solution to your question would probably involve proposing a different way to derive $a$ and $b$ $\endgroup$
    – knaccc
    May 26 at 22:17
  • $\begingroup$ Furthermore, I assume you don't want malleability. For example, if $a=s+x+m_1$, then I can always demonstrate that any value of $s$ was used to create $a$, simply by claiming a different choice of $x$. It would be necessary to demonstrate that $A$ can only be claimed to have been derived from one value of $s$. This means the method of derivation of $a$ must be carefully considered $\endgroup$
    – knaccc
    May 26 at 23:00
  • $\begingroup$ What about side-stepping this, and instead publishing identities as the pair $(A_i, sH_p(A_i))$, where $H_p()$ means hash a value to produce an EC point in the group of the base point. If you want to prove that two identities are linked, you provide a discrete-log-equivalence proof that $s$ is the same in both cases $\endgroup$
    – knaccc
    May 26 at 23:10

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.