# Proof of application of $f(x)$ without disclosing input $x$

I have three nodes in a network: $$\mathcal{S}$$,$$\mathcal{T}$$,$$\mathcal{R}$$.

$$\mathcal{S}$$ supplies data $$x$$ to $$\mathcal{T}$$. $$x$$ is signed so $$\mathcal{T}$$ knows it actually comes from $$\mathcal{S}$$. $$\mathcal{T}$$ computes $$f(x)=y$$ and sends $$y$$ to $$\mathcal{R}$$. $$\mathcal{R}$$ uses the result $$y$$ in some computation. $$f$$ Is implemented in code and the code is public.

Question: Is there a way for $$\mathcal{R}$$ to know for sure that $$y$$ is the result of the correct application of $$f$$ to data supplied by $$\mathcal{S}$$, without disclosing $$x$$?

In other words: Can $$\mathcal{T}$$ prove that it correctly applied $$f$$ to trusted data when computing $$y$$, without disclosing $$x$$?

• The S is needed here because S is the party providing the data x and R wants to learn f(x) = y if I understand it correctly. But why is T needed here? Do you want to hide to S who T is computing with? – Martin Kromm Sep 12 '19 at 9:16
• The task of T is to perform the computation f whilst keeping the original data x hidden from R and providing only the result y. But how does R know the result can be trusted? In my usecase, x is sensitive data (incomes) and there are many nodes R but only a single node T. I do not want the sensitive data to end up in many nodes R, with all the associated risks, but I DO want the R's to know they can trust the result y computed by T. Hence the question. – user456045 Sep 13 '19 at 12:13

Use a zk-SNARK, proving the following statement:

Private data: $$x$$. Public data: $$y, pk, \sigma$$

I know an $$x$$ such that $$f(x) = y \land \textsf{Ver}(pk, x, \sigma)$$

Where $$\textsf{Ver}$$ is the secure signature scheme verifier algorithm, $$x$$ is the secret input, $$y$$ is the output of $$f$$ applied on $$x$$, $$\sigma$$ is the signature of $$\mathcal{S}$$ on $$x$$, and $$pk$$ is the public key of $$\mathcal{S}$$.

As long as your signature scheme does not reveal your message contents within the signature $$\sigma$$, your scheme will be zero-knowledge. If it does, you can hash it prior to supplying it to the protocol:

Private data: $$x, \sigma$$. Public data: $$y, pk, \sigma'$$

I know an $$x$$ such that $$f(x) = y \land \textsf{Ver}(pk, x, \sigma) \land H(\sigma) = \sigma'$$

Where $$\sigma'$$ is the hash of the signature.