I have three nodes in a network: $\mathcal{S}$,$\mathcal{T}$,$\mathcal{R}$.

$\mathcal{S}$ supplies data $x$ to $\mathcal{T}$. $x$ is signed so $\mathcal{T}$ knows it actually comes from $\mathcal{S}$. $\mathcal{T}$ computes $f(x)=y$ and sends $y$ to $\mathcal{R}$. $\mathcal{R}$ uses the result $y$ in some computation. $f$ Is implemented in code and the code is public.

Question: Is there a way for $\mathcal{R}$ to know for sure that $y$ is the result of the correct application of $f$ to data supplied by $\mathcal{S}$, without disclosing $x$?

In other words: Can $\mathcal{T}$ prove that it correctly applied $f$ to trusted data when computing $y$, without disclosing $x$?

  • $\begingroup$ The S is needed here because S is the party providing the data x and R wants to learn f(x) = y if I understand it correctly. But why is T needed here? Do you want to hide to S who T is computing with? $\endgroup$ Sep 12, 2019 at 9:16
  • $\begingroup$ The task of T is to perform the computation f whilst keeping the original data x hidden from R and providing only the result y. But how does R know the result can be trusted? In my usecase, x is sensitive data (incomes) and there are many nodes R but only a single node T. I do not want the sensitive data to end up in many nodes R, with all the associated risks, but I DO want the R's to know they can trust the result y computed by T. Hence the question. $\endgroup$
    – user456045
    Sep 13, 2019 at 12:13

1 Answer 1


Use a zk-SNARK, proving the following statement:

Private data: $x$. Public data: $y, pk, \sigma$

I know an $x$ such that $f(x) = y \land \textsf{Ver}(pk, x, \sigma)$

Where $\textsf{Ver}$ is the secure signature scheme verifier algorithm, $x$ is the secret input, $y$ is the output of $f$ applied on $x$, $\sigma$ is the signature of $\mathcal{S}$ on $x$, and $pk$ is the public key of $\mathcal{S}$.

As long as your signature scheme does not reveal your message contents within the signature $\sigma$, your scheme will be zero-knowledge. If it does, you can hash it prior to supplying it to the protocol:

Private data: $x, \sigma$. Public data: $y, pk, \sigma'$

I know an $x$ such that $f(x) = y \land \textsf{Ver}(pk, x, \sigma) \land H(\sigma) = \sigma'$

Where $\sigma'$ is the hash of the signature.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.