# Randomizable zero-knowledge proofs?

I was wondering whether there exists randomizable zero-knowledge proofs. What I mean by randomizable is that assume I have a zero-knowledge proof of knowledge $$\pi$$, stating that I know $$x \in \mathbb{Z}_q$$ for a prime $$q$$, such that $$Q = g^x$$, and I randomize $$Q$$ as $$Q' = Q^r$$ for a random $$r \in \mathbb{Z}_q$$. Then, I wish to prove that $$Q'$$ is a randomized version of $$Q$$. So, is it possible to somehow also randomize the proof $$\pi$$ into $$\pi'$$ for this?

Yes there are. I guess you're looking into non-interactive zero-knowledge (NIZK) proofs, since you're assuming that you have at hand a proof $$\pi$$. A common approach for building NIZKs in crypto is to rely on the Groth-Sahai methodology, which produces highly structured NIZKs using elliptic curves equipped with a bilinear maps. It was first observed in this paper that Groth-Sahai proofs can be randomized - i.e., you can randomize a statement together with its proof so that the randomized proof is indistinguishable from an honest proof computed on the randomized statement. This was used to build anonymous credentials with strong properties, and had many other applications in subsequent works.