Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (c_1, X, r_1, r_2): c_1=Com(X,r_1) \land c_2=Com(c_1,r_2)\}$? Zerocoin has a similar but not the same protocol as the $X$ known to the verifier in that protocol.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.