I'm trying to understand if this design is possible. I want to build a mapping that is zero-knowledge, between a (pubkey, proposalId) => bytes form, without revealing the key.

Let's say we build a ZK circuit with private inputs (pubkey, proposalId), and the public input (sig), where sig = sign(H(pubkey, proposalId), pubkey). It's my understanding that if you sign with a public key, it's effectively public-key encryption, where you can only decrypt with the private key.

If the circuit logic verified that you could decrypt the sig, and hence the commit to (pubkey, proposalId) was valid, then you could use sig as a key in the ZK mapping. Am I correct in my thinking?

  • 3
    $\begingroup$ Can you formally define "zero knowledge mapping"? $\endgroup$ – Geoffroy Couteau Feb 12 '19 at 8:01
  • $\begingroup$ @GeoffroyCouteau I've realised a more correct description is just a one-to-one mapping between a public-key and a value, without revealing the public-key. $\endgroup$ – liamzebedee Feb 12 '19 at 10:18
  • $\begingroup$ Why wouldn't you want to reveal the public key? That's the very purpose of a public key... $\endgroup$ – AleksanderRas Feb 12 '19 at 12:01
  • $\begingroup$ So if I get it right, what you want has nothing to do with zero-knowledge, you just want a one-way permutation? $\endgroup$ – Geoffroy Couteau Feb 12 '19 at 12:10
  • $\begingroup$ Thank you @GeoffroyCouteau - that is exactly the term I was searching for. Will edit/update the question. $\endgroup$ – liamzebedee Feb 12 '19 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.