Is it possible to construct a set membership proof to show $\delta \in \Psi$ where $\delta$ is publicly known and $\Psi$ should stay only known to the prover?

It seems rather impossible but I would like some confirmation.

  • $\begingroup$ To clarify things. You have a set which is only known to the prover and the prover wants to show that some public value belongs to that set? Clearly you can do that. Commit to each element of the set and prove in zero knowledge that one of the commitments open to the public value without revealing which one (a simple or proof with classical sigma proofs for instance will do that). $\endgroup$ – DrLecter May 29 '15 at 20:39

Yes. $\:$ The verifier(s) need(s) to know a statistically binding commitment to $\Psi \hspace{-0.02 in}$.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.