I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do this, but I don't fully understand this.

At the middle of the last paragraph of 3.3 (page 11 of the document) it is mentioned that the condition $0 \leq p \leq b$ is implied by the conjuction of the following conditions:

  1. $b = \sum_{j}^{} b_{j}2^j $

  2. $ b_{l-1}, ... , b_{0}$ and $ p_{l-1}, ... , p_{0}$ are all bits.

  3. $p \leq b$, where p and b have been sent by the Buyer to the Vendor in encryptions of separate bits and the Vendor has composed p and b using the homomorphism of the ecnryption scheme used.

I don't understand how they solve 3. $p \leq b$.

How can the vendor make a comparison of these encrypted numbers and be sure that indeed $p \leq b$ ? They say that $p \leq b$ can be represented as a monotone formula with leaves that are equalities, but I cannot see how does that solve the problem.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.