I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do this, but I don't fully understand this.

At the middle of the last paragraph of 3.3 (page 11 of the document) it is mentioned that the condition $0 \leq p \leq b$ is implied by the conjuction of the following conditions:

  1. $b = \sum_{j}^{} b_{j}2^j $

  2. $ b_{l-1}, ... , b_{0}$ and $ p_{l-1}, ... , p_{0}$ are all bits.

  3. $p \leq b$, where p and b have been sent by the Buyer to the Vendor in encryptions of separate bits and the Vendor has composed p and b using the homomorphism of the ecnryption scheme used.

I don't understand how they solve 3. $p \leq b$.

How can the vendor make a comparison of these encrypted numbers and be sure that indeed $p \leq b$ ? They say that $p \leq b$ can be represented as a monotone formula with leaves that are equalities, but I cannot see how does that solve the problem.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.