1
$\begingroup$

I'm searching for a ZKP package that supports asymmetric encryption so I can implement the following scenario:

Carol encrypts message $m$ with Alice's public key and sends the ciphertext to Alice. Bob and Alice both know $\operatorname{hash}(m)$, but because $m$ is encrypted by Alice's public key Bob doesn't know $m$--only Alice knows $m$.

Here is the part that needs ZKP: Alice wants to prove to Bob that this ciphertext is actually the encryption of a message whose hash is $\operatorname{hash}(m)$.

In other words, I want to be able to prove that I have a value whose hash is equal to y = hash(a), and whose encrypted form is z = enc(a), but I don't want to reveal a.

I searched in ZKP packages thoroughly, but none of them can implement encryption, so I take it that ZKP isn't the solution.

Do any of the available packages support what I am trying to do?

Improve this question
$\endgroup$
3
  • 2
    $\begingroup$ With package do you mean "software package"? Because that kind of reference requests are off topic. However, asking for a name of such a scheme is not. Once you've got the right terms it is possible to do an internet search yourself... $\endgroup$
    – Maarten Bodewes ♦
    Apr 12, 2019 at 14:03
  • $\begingroup$ yeah I mean a software package and I don't know such a thing exists or not. $\endgroup$
    – Mahsa Bastankhah
    Apr 15, 2019 at 4:55
  • $\begingroup$ I recommend looking for Zk-SNARK. Here is a library called jsnark github.com/akosba/jsnark. It has circuits for encryption. Could you specify what is the use case for the scenario in the question ? $\endgroup$
    – Mohamed
    Jun 24, 2019 at 6:20

2 Answers 2

Reset to default
1
$\begingroup$

If you wanted to prove a statement like hash(a) = y, I would recommend you to use a generic zero-knowledge protocols which proves the computation of a boolean circuit using a witness w like presented here and here. The authors first paper even published a reference implementation of SHA256 on github. Even though it's not impossible to additionally prove a statement like z = enc(a), I would recommend you not to do that for several reasons:

  • The performance will likely be poor due to the expected circuit size and depth.

  • Considering the adversary model you want to be secure against and the algorithm you choose, it may be still possible to create attacks if you don't pay attention.

Improve this answer
$\endgroup$
-1
$\begingroup$

If possible, just wrap the message (in your case - the $hash(m)$) with HMAC which is used for authentication.

According to wikipedia:

In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key. It may be used to simultaneously verify both the data integrity and the authentication of a message, as with any MAC

There are plenty of HMAC implementations so it will be easy to find a package suitable to your needs.

Improve this answer
$\endgroup$
1
  • $\begingroup$ HMAC is used when we want to commit a value and at the same time prove that actually it's our own message.I guess U didn't get the problem right.In another word my problem is : I want to be able to prove that I have a value a which its hash is equal to y = hash(a) and its encrypted form is z = enc(a) but I don't want to reveal the a $\endgroup$
    – Mahsa Bastankhah
    Apr 22, 2019 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.