Let's say you are using a $\Sigma$ protocol ZK proof to prove knowledge of $x_1, x_2$ so that $Y = g_1^{x_1}g_2^{x_2}$. Of course $g_1$, $g_2$ are generators within cyclic group G of prime order q, with q of sufficient size.

My question is, if $z = dlog_{g_1}g_2$ is known to the prover, how would that affect the soundness of the proof? If the value of z is known to the verifier, how would that affect honest-verifier z-k property?

Intuitively it seems like knowing z would break things, but I don't see how.


The important thing to understand is that if the prover knows such a $z$, then the commitment is not binding. In particular, for any $Y$ and any $x_1'$ it can find $x_2'$ such that $Y=g_1^{x_1'}\cdot g_2^{x_2'}$. Thus, it can open the commitment to any $x_1'$ it likes. As such, it can also prove knowledge of any $x'_1,x'_2$ it wishes. This does not break soundness, since it indeed knows such an $x'_1,x'_2$ and so everything is true.

If $z$ is known to the verifier, then this actually makes no difference, because Pedersen is a perfectly hiding commitment.

In general, you should study more about Pedersen commitments, and then understand the $\Sigma$ protocol issue.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.