I try to add a trap door commitment to a non-interactive schnoor protocol. Trap door protocol provide a back door for selected verifier by public key.
Cryptography setup
- $y=g^x$ where $r$ is the secret to prove
- $y'=g^{x'}$ where $y$ is the public key of the verifier and $x'$ is the private key of the verifier
Construct the proof
- Pick $w$, $r$, $d$ randomly in $Z_q$
- $c=g^wy'^r$
- $t=g^d$
- $h=hash_q(c, t)$
- $s=d + (h + w)x$
- $(w, r, t, s)$ is the proof and send to verifier
Verification
- $c=g^w y'^r$
- $h = hash_q(c, t)$
- verify $g^s = ty^{h+w}$
Simulating Transcript
- Pick $\alpha$, $\beta$ randomly in $Z_q$
- $c=g^\alpha$
- $t=g^sy^{-\beta}$
- $h=hash_q(c ,t)$
- $r = (\alpha - w)(-x')$
- $w = \beta - h$
- $(w, r, t, s)$ is the transcript
Because of the trap door commitment, designated verifier ($y'$) can create a valid proof.
But only the designated verifier know the proof is come from himself or prover. For others, they can't tell the proof is come from designated verifier or prover. Only designated verifier or prover know the proof is created by who. So only designated verifier can be convinced in this protocol.
So this protocol, can convince designated verifier knowledge of r in Schnorr Protocol. The verifier can't transfer the proof to others and he is the only one can be convinced.