Assume that hash(X) == Y

  • Alice knows both X and Y
  • Bob only knows Y

Alice generates a random nonce N and shares it with Bob.

Alice calculates H = hash(X⊕N) and shares H with Bob.

Can Alice prove to Bob that H really is hash(X⊕N) without sharing the value of X?


  • X, Y, N, H are all 32 bytes.

  • The hash function is SHA-256.

  • $\begingroup$ @Maeher says: This makes no sense. You seem to be assuming that Bob needs to verify without Alice' help. But the question clearly asks whether Alice can prove the fact to Bob. Naturally she can do that by just proving in ZK that there exists an X such that Y=H(X) and H=H(X+N). I think he is right so I am deleting my answer. $\endgroup$ – kodlu Nov 9 '19 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.