# How to prove possession of a CL signature in zero-knowledge?

Assume that we have the following signature scheme CL Signature:

• Choose two cyclic groups $$G = \langle g \rangle$$ and $$G_T = \langle g_T \rangle$$ of order $$q$$, that have a pairing $$e$$.
• Uniformly and randomly choose two elements $$x,y \in \mathbb{Z}_q$$, and compute $$X = g^x$$ and $$Y = g^y$$.
• The secret key is $$sk = (x,y)$$, while the public key is $$pk = (q, G, G_T, g, g_T, e, X, Y)$$.
• On input a message $$m \in \mathbb{Z}_q$$, secret key $$sk$$ and public key $$pk$$, choose a random $$a \in G$$ and output the signature: $$\sigma = (a, a^y, a^{x + xym}) = (a,b,c).$$
• To verify a signature $$\sigma = (a, a^y, a^{x + xym}) = (a,b,c)$$, check that $$e(a, Y) = e(g, b) \quad e(X, a) \cdot e(X,b) = e(g, c).$$

Now, say that I want to prove that I know a signature $$\sigma$$ on a message $$m$$ without revealing any the signature $$\sigma$$ or the message $$m$$.

The paper explains that the first step to perform such a proof is to "blind" the signature to form $$\tilde{\sigma} = (a^{r'}, b^{r'}, c^{r'r}) = (\tilde{a}, \tilde{b}, \tilde{c}^r) = (\tilde{a}, \tilde{b}, \hat{c})$$ and send this blinded signature to the verifier. This clearly satisfies that $$e(\tilde{a}, Y) = e(g, \tilde{b})$$ and it also satisfies the second verification equation with $$\tilde{c}$$, but not with the actual one $$\hat{c}$$.

My question is, which is the objective of sending $$\hat{c}$$ and not $$\tilde{c}$$ directly?

• Hi Bean Guy, can you think of a more specific title for this question? – Maarten Bodewes Dec 9 '20 at 14:15
• If you send $\tilde a,\tilde b, \tilde c$ then you are sending a valid signature for $m$, don't you? Then it won't be ZK because the verifier is indeed learning something it didn't know, namely a valid signature on $m$. – AntonioFa Dec 9 '20 at 16:16
• @AntonioFa Perfect. – Bean Guy Dec 10 '20 at 9:37