# Zero knowledge proof of the sum of two values

Given $v \in Z$, a prover knows $v$ and the verifier knows an encryption of $v$.

The prover provides the verifier with the encryptions of two values $m$ and $n$

How can the verifier verify that $m+n=v$ ?

I cannot find any scheme/algorithm in the literature I have searched, other than range proofs, and I am looking for pointers.

To illustrate, here is a naive (and wrong) approach to the problem.

Assuming a generator $g$ in a group of order $p$, co-primes.

The verifier knows $g^v$, the prover can provide $g^m$ and $g^n$. The verifier then verifies that $g^mg^n=g^{m+n}=g^v \pmod p$.

However if the prover provides $m'$ and $n'$ such that $m'+n'=m+n+k(p-1), k \in Z^*$ then the equation above verifies although $m'+n'> v$

(according to Fermat little's theorem $g^{k(p-1)}=(g^{p-1})^k \equiv 1 \pmod p$)

• How is $v$ "given"? The verifier must know something about it, otherwise there is nothing to prove. – fkraiem Aug 25 '18 at 6:29
• @fkraiem The verifier knows a "blinded" $v$ whatever the encryption/blinding scheme is. In the naive scheme above, the verifier knows $g^v$ – BGR Aug 25 '18 at 6:31
• @fkraiem I have reworded the question following Yehuda Lindell remark below – BGR Aug 25 '18 at 22:27
• Seems that selecting a certain homomorphic (partial) encryption algorithm will do - crypto.stackexchange.com/questions/3626/… may be limiting v? – Moti Aug 26 '18 at 2:40
• @Moti thanks. Building a ZKP around an additive homomorphic encryption scheme is likely the right direction. Will give it a try (but I would still prefer a reviewed existing formalization rather than "building" my own) – BGR Aug 26 '18 at 6:07

For Paillier, given an encryption of $v$, $m$ and $n$, one can compute an encryption of zero by $v - m - n$. In the Damgard-Jurik paper, there is a very efficient zero-knowledge proof for proving that a ciphertext is an encryption of 0. So, this solves your problem.
For ElGamal, typical encryption is $(g^r,h^r\cdot m)$ where $h$ is the public-key. This is not additively homomorphic. However, you can change this to $(g^r,h^r\cdot g^m)$ and now you can add and subtract ciphertexts. With the same method as above, one can compute $v-m-n$ inside the ciphertext and then get an encryption of 0 which is just $(g^r,h^r)$. This implies that $(g,h,g^r,h^r)$ is a Diffie-Hellman tuple and this can be easily proved using known techniques for Sigma protocols. Note that this scheme is not efficiently decryptable, since decrypting only gives $g^m$ and you need to solve the discrete log problem to find $m$. Thus, if $m$ is from a small range, you can do this. Otherwise you cannot. However, it is an additively homomorphic commitment scheme, which may suffice for your application.
• Thank you. I am going through the Damgard-Jurik Paper. For ElGamal, I do not understand how the additive version does not suffer from the same flaw as my naive scheme above i.e. assuming $p$ is the order of the group, an encryption of $v-m'-n'$ with $m'+n'=m+n+k(p-1)$ is also an encryption of zero but $m'+n'$ is not equal to $v$ – BGR Aug 27 '18 at 5:32
• @BrunoGrieder Your solution is not secure since $g^v$ does not fully hide $v$. That’s why you need ElGamal in the exponent. Nevertheless, note that both for ElGamal in the exponent and Paillier, equality is only modulo the group order. If you want equality over the integers, then you need the numbers to be small relative to the modulus, and you need to add range proofs to prove that v,m,n are all “small”. This will guarantee no modulo operation. – Yehuda Lindell Aug 28 '18 at 9:33