2
$\begingroup$

While going through this paper, I came across the idea of Set Membership proofs. The proof allows a prover to prove that a value is contained in some set. The point where I am confused is, all the elements of the set are known to the prover. All three steps of the proof generation can be run by anyone including the prover. Moreover, it seems that the prover can prove the membership of some value he/wants without revealing the value itself. How does the existence of some such value help him further?

The ring signing protocol is given below. The signer/prover S is sending a membership proof to the user U trying to convince him that S is using a public key which belongs to the ring R consisting of public keys of all ring members. Point of confusion is that, the ring R is public and known to both S and U. If all the elements (i.e. the public keys) of the set (i.e. the ring R) are known to both (i.e. S and U), then what is S trying to achieve by the set membership proof?

enter image description here

$\endgroup$
  • $\begingroup$ The idea is that you can convince a verifier that you know some value of the set (e.g. hidden in a commitment) without revealing the exact value to the verifier. The verifier could then for instance sign this commitment and thus ensuring that an to him unknown element of the set has been used. There are plenty of applications but the question at the moment is too broad. $\endgroup$ – DrLecter Sep 2 '14 at 20:08
  • $\begingroup$ I have updated the original protocol with the ring signing protocol. The signer/prover S is sending a membership proof to the user U trying to convince him that S is using a public key which belongs to the ring R consisting of public keys of all ring members. Point of confusion is that, the ring R is public and known to both S and U. If all the elements (i.e. the public keys) of the set (i.e. the ring R) are known to both (i.e. S and U), then what is S trying to achieve by the set membership proof? $\endgroup$ – Holmes.Sherlock Sep 3 '14 at 4:21
  • 1
    $\begingroup$ Did you read Section 5 (before the actual protocol)? Then it should be clear what the author wants to achieve. The set membership proof is used to demonstrate that the signing key used in the blind signature protocol corresponds to one public key in the ring without revealing which one and thus yielding a blind ring signature. $\endgroup$ – DrLecter Sep 3 '14 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.