2
$\begingroup$

I like the idea of a Zero Knowledge range proof. But I read that, to prove my age in a range, a commitment is required by a trusted party (TP) stating my age. How does that work? is the commitment a certificate from the TP?

Also, if I need a user “A” to prove to the verifier his current location (longitude, latitude) in a range without stating the exact location, can the zero knowledge range proof be helpful in that problem? Who should commit to that secret (in This case, user “A”'s current location) so it should be accurate? Can the TP be a trusted timestamped service or Google?

Improve this question
$\endgroup$
1
  • $\begingroup$ I can see that English is not your first language. But in that case, please try and keep to commonly accepted standards when it comes to white space, question marks and such. And please "prof" read your question before posting it, errors in the title really stand out. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jan 31, 2019 at 15:16

1 Answer 1

Reset to default
2
$\begingroup$

Yes, you need a commitment. The commitment comes from anyone who is trusted by the verifier to commit to genuine data. So to prove age, the date of birth, say seconds from epoch could come from a government issued ID. In case of lat-long, a location provider trusted by the verifier should be used so if verifier trusts Google.

There is vast literature and implementations and they provide varying guarantees like if you provide a proof to the same verifier twice but use the same commitment, the verifier will know that he has interacted with you before or not. Depends if you care about this or not. Regarding how they work, there are several techniques, a recent and popular is Bulletproofs. Another is this paper.

Improve this answer
$\endgroup$
17
  • $\begingroup$ Can the verifier be the Etherum blockchain? And the prover proves a specific statement that is on the blockchain ( his location in a particular area ) ?? $\endgroup$
    – Mohamed
    Commented Jan 31, 2019 at 18:38
  • $\begingroup$ For the ones i mentioned in the answer, yes, the verifier can be on Ethereum (a smart contract). Have a look at this repo. Yes, the commitment to the location can be on chain. $\endgroup$
    – lovesh
    Commented Jan 31, 2019 at 20:14
  • $\begingroup$ Thanks. I read the paper. It seems there are a lot of exchanged messages between the prover and verifier (Blockchain). Is that okay since the gas consumption would be very high?? $\endgroup$
    – Mohamed
    Commented Jan 31, 2019 at 20:35
  • $\begingroup$ according to the paper , the commitment is done by the prover on a number that is in the group. How the commitment can be provided such that it can be verified by the the verifier that a third party verified it? I think the commitment is only known for the prover. $\endgroup$
    – Mohamed
    Commented Feb 1, 2019 at 6:16
  • $\begingroup$ The paper shows the interactive version of the proof which can be turned to a non-interactive one by using Fiat Shamir so you can let go of the step where verifier sends a challenge. Secondly, the first step of verifer is publishing of signatures which needs to be done only once by the verifier per range. The verifier can publish his signatures on the range and every prover can read them. So there is only 1 message sent by the prover if the verifier has published signatures already $\endgroup$
    – lovesh
    Commented Feb 1, 2019 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.