In https://www.win.tue.nl/~berry/papers/crypto99.pdf, Schoenmakers proposes a publicly verifiable secret sharing scheme, that uses a non-interactive DLEQ proof to allow any participant to verify the shares of the secret (section 3.1 of the paper).

In "Distribution of the shares", it says "Applying Fiat-Shamir’s technique, the challenge $c$ for the protocol is computed as a cryptographic hash of $X_i , Y_i , a_{1i} , a_{2i} , 1 ≤ i ≤ n$."

And later, "Using $y_i , X_i , Y_i , r_i , 1 ≤ i ≤ n$ and $c$ as input, the verifier computes $a_{1i} , a_{2i}$ as

$$a_{1i} = g^{ri} X_i^c,$$ $$a_{2i} = y_i^{ri} Y_i^c ,$$

and checks that the hash of $X_i , Y_i , a_{1i} , a_{2i} , 1 ≤ i ≤ n$, matches $c$."

My question is: how can the challenge $c$ be used as input of the hash that computes itself (the challenge $c$), or am I misunderstanding?


1 Answer 1


Here's my understanding:

  • The input of the hash is $x_i,y_i,a_{1i},a_{2i}$.
  • The output of the hash is $c$.

The wording is '$c$ is computed as ...'

And later the verifier checks if $c$ matches the Output of the hash function used on the same input variables. If different values were used in the original run, the hash would differ.

So yes, you misunderstood the statement.

  • $\begingroup$ The problem is that $a_{1i}$ and $a_{2i}$ are computed using $c$, I edited the question to add that. $\endgroup$
    – Fiono
    Feb 20, 2020 at 14:22
  • 1
    $\begingroup$ The values $a_{1i}$ and $a_{2i}$ can be computed in a different way by the signer $i$. Specifically $a_{1i}=g^w$ and $a_{2i}=y^w$ where $w$ is a value known to the signer but not the verifier. This allows the signer to compute $c$ and then the value $r_i$ that makes the verifiers expressions correct. $\endgroup$
    – Daniel S
    Mar 16, 2021 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.