There already exist interactive proof protocols with logarithmic communication for proving that a secret multi-exponent $x ∈ Z^{n}_{q}$ for a public multi-exponentiation $P = \textbf{g}^{\textbf{x}} ∈ G$ is mapped to a given public value y under an arbitrary but given group homomorphism $f : Z_{q}^{n} → G_{T}$, where $\textbf{x} ∈ Z_{q}^{n}$ and $\textbf{g} ∈ G^n$ . For example, https://eprint.iacr.org/2020/753.pdf.

I was wondering if the same thing was possible where the map is not a homomorphism, but we allow for linear communication in group elements, and we do not require that x be in the form of a secret multi-exponent (Although it wouldn't hurt).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.