0
$\begingroup$

Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (c_1, X, r_1, r_2): c_1=Com(X,r_1) \land c_2=Com(c_1,r_2)\}$? Zerocoin has a similar but not the same protocol as the $X$ known to the verifier in that protocol.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.