I'm trying to study the difference between non-interactive zero knowledge (NIZK) proof of knowledge and proof of membership. I have known that in NIZK proof of knowledge the prover wants to convince the verifier that he knows the proof of a given theorem without revealing any additional information about the witness. In NIZK proof of membership the prover just convinces the verifier only of the veridicity of the statement. However, I cannot find good materials describing a formal definition of NIZK proof of membership. I have known that there exists an PPT extractor for NIZK proof of knowledge that can extract the witness, but what about proof of membership? What properties should it satisfy?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.