# State of the art in zero knowledge proof compilers?

What is the current state of the art zero knowledge proof compiler ? I need one that can minimally handle double exponentiation by a known value E.g.

$$Pok\{(\alpha):h=g^{\alpha^b}\}$$ where b, g and h are public but $\alpha$ is secret.

Preferably it should be able to handle double discrete log proofs E.g.

$$Pok\{(\beta):h=g^{a^\beta}\}$$ where a, g and h are public and $\beta$ s secret.

ZKPDL does not handle at least the later case.

• Fixed that, \alpha should be a and is known. – imichaelmiers Mar 22 '13 at 6:03
• Is the order of $g$ known and public? $\:$ – user991 Mar 22 '13 at 7:31
• The order of g is known and public. – imichaelmiers Mar 23 '13 at 0:31
• Have you checked Charm or results from the CACE (Computer Aided Cryptography Engineering) project? – DrLecter Oct 29 '13 at 23:23

In Stadler's notation, given $g$, $y$, and $V = g^{y^\alpha}$, and $A = h^\alpha$ for some generator $h$, Stadler's protocol shows how to prove that $\log_h A = \log_y(\log_g V)$. Now, to solve your problem, let $V$, $g$, and $y$ be known. To prove knowledge of $\alpha$, have the verifier choose a generator $h$. The prover provides $A = h^\alpha$ and uses Stadler's protocol to prove that $\log_h A = \log_y(\log_g V)$.