# Zero knowledge proof of the sum of two values

Given $v \in Z$, a prover knows $v$ and the verifier knows an encryption of $v$.

The prover provides the verifier with the encryptions of two values $m$ and $n$

How can the verifier verify that $m+n=v$ ?

I cannot find any scheme/algorithm in the literature I have searched, other than range proofs, and I am looking for pointers.

To illustrate, here is a naive (and wrong) approach to the problem.

Assuming a generator $g$ in a group of order $p$, co-primes.

The verifier knows $g^v$, the prover can provide $g^m$ and $g^n$. The verifier then verifies that $g^mg^n=g^{m+n}=g^v \pmod p$.

However if the prover provides $m'$ and $n'$ such that $m'+n'=m+n+k(p-1), k \in Z^*$ then the equation above verifies although $m'+n'> v$

(according to Fermat little's theorem $g^{k(p-1)}=(g^{p-1})^k \equiv 1 \pmod p$)

• How is $v$ "given"? The verifier must know something about it, otherwise there is nothing to prove. Aug 25, 2018 at 6:29
• @fkraiem The verifier knows a "blinded" $v$ whatever the encryption/blinding scheme is. In the naive scheme above, the verifier knows $g^v$
– BGR
Aug 25, 2018 at 6:31
• @fkraiem I have reworded the question following Yehuda Lindell remark below
– BGR
Aug 25, 2018 at 22:27
• Seems that selecting a certain homomorphic (partial) encryption algorithm will do - crypto.stackexchange.com/questions/3626/… may be limiting v?
– Moti
Aug 26, 2018 at 2:40
• @Moti thanks. Building a ZKP around an additive homomorphic encryption scheme is likely the right direction. Will give it a try (but I would still prefer a reviewed existing formalization rather than "building" my own)
– BGR
Aug 26, 2018 at 6:07

For this, it suffices to use additively homomorphic encryption. There are two possibilities for this: Paillier and ElGamal in the exponent.

For Paillier, given an encryption of $v$, $m$ and $n$, one can compute an encryption of zero by $v - m - n$. In the Damgard-Jurik paper, there is a very efficient zero-knowledge proof for proving that a ciphertext is an encryption of 0. So, this solves your problem.

For ElGamal, typical encryption is $(g^r,h^r\cdot m)$ where $h$ is the public-key. This is not additively homomorphic. However, you can change this to $(g^r,h^r\cdot g^m)$ and now you can add and subtract ciphertexts. With the same method as above, one can compute $v-m-n$ inside the ciphertext and then get an encryption of 0 which is just $(g^r,h^r)$. This implies that $(g,h,g^r,h^r)$ is a Diffie-Hellman tuple and this can be easily proved using known techniques for Sigma protocols. Note that this scheme is not efficiently decryptable, since decrypting only gives $g^m$ and you need to solve the discrete log problem to find $m$. Thus, if $m$ is from a small range, you can do this. Otherwise you cannot. However, it is an additively homomorphic commitment scheme, which may suffice for your application.

• Thank you. I am going through the Damgard-Jurik Paper. For ElGamal, I do not understand how the additive version does not suffer from the same flaw as my naive scheme above i.e. assuming $p$ is the order of the group, an encryption of $v-m'-n'$ with $m'+n'=m+n+k(p-1)$ is also an encryption of zero but $m'+n'$ is not equal to $v$
– BGR
Aug 27, 2018 at 5:32
• @Yehuda I am looking into the encryption used for bitcoin. Is there an application/program that allow experimenting with this encryption (basically ElGamal). My email [email protected] thanks
– Moti
Aug 27, 2018 at 7:25
• For ElGamal, not that I know of. For Paillier, yes. Just Google and you'll find some. Aug 27, 2018 at 7:41
• @BrunoGrieder Your solution is not secure since $g^v$ does not fully hide $v$. That’s why you need ElGamal in the exponent. Nevertheless, note that both for ElGamal in the exponent and Paillier, equality is only modulo the group order. If you want equality over the integers, then you need the numbers to be small relative to the modulus, and you need to add range proofs to prove that v,m,n are all “small”. This will guarantee no modulo operation. Aug 28, 2018 at 9:33
• @YehudaLindell Sure my solution is not secure; it was noted as a "wrong" scheme. I will check what is best for my application between range proofs and enforcing, if I can, that numbers remains at least twice smaller than the modulus. Thanks again.
– BGR
Aug 28, 2018 at 19:01