We have Pedersen commitment C to the secret value x, and Fujisake commitment C' to the secret value x. How can we make a zero-knowledge proof of equality for x value in the commitments?


This may look like a homework, so I would not present any complete "Ctrl-C Ctrl-V" -style solution.

A proof for equality of logarithms was introduced at Chaum, Evertse and van de Graaf paper, "An Improved Protocol for Demonstrating Possession of Discrete Logarithms and Some Generalizations", Eurocrypt 1987. At the core, Prover shows that the same single response would open both commitments.

According to http://kodu.ut.ee/~lipmaa/crypto/link/commitment/, Fujisaki-Okamoto commitment scheme (spelling warning) is somewhat similar to Pedersen. Major difference is operating with a group of an order hidden from Prover, which makes it acceptable to commit to integers (not only elements of a field of residue classes modulo prime group order). This difference does not prevent from using the same response, as was stated.

Having said this, I would encourage to do it yourself.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.