I have some questions from previous years exams, I hope you could help me with them. :)

Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) honest-verifier zero-knowledge. Show how to transform this protocol into a $\Sigma$-protocol for the same relation by assuming that the verifier generates $c \in C$ at random (with uniform distribution), where $(C,+)$ is an additive finite group.

  • $\begingroup$ Are you using "an additive finite group" for "a group whose binary operation is $\hspace{1.7 in}$ written $\textbf{+}$" or "a quotient group of $\langle \mathbb{Z},+\rangle$"? $\;\;$ $\endgroup$ – user991 Dec 4 '12 at 0:46
  • $\begingroup$ I think it is "a group whose binary operation is written +". $\endgroup$ – Peter De Vries Dec 4 '12 at 0:54
  • $\begingroup$ What is your (or your lecturer's) definition of a Sigma-protocol? I'm presuming (s)he is including full ZK among the properties since the question mentions "only HVZK", is that what you're after? $\endgroup$ – Bristol Dec 13 '12 at 14:02
  • $\begingroup$ The question used to be an exercise in these Lecture Notes Cryptographic Protocols. It is now included as Proposition 5.2 with a full proof. (A bit long to copy and paste as part of this answer.) $\endgroup$ – Berry Schoenmakers Feb 10 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.