Assume that we have the following signature scheme CL Signature:

  • Choose two cyclic groups $G = \langle g \rangle$ and $G_T = \langle g_T \rangle$ of order $q$, that have a pairing $e$.
  • Uniformly and randomly choose two elements $x,y \in \mathbb{Z}_q$, and compute $X = g^x$ and $Y = g^y$.
  • The secret key is $sk = (x,y)$, while the public key is $pk = (q, G, G_T, g, g_T, e, X, Y)$.
  • On input a message $m \in \mathbb{Z}_q$, secret key $sk$ and public key $pk$, choose a random $a \in G$ and output the signature: $$\sigma = (a, a^y, a^{x + xym}) = (a,b,c).$$
  • To verify a signature $\sigma = (a, a^y, a^{x + xym}) = (a,b,c)$, check that $$e(a, Y) = e(g, b) \quad e(X, a) \cdot e(X,b) = e(g, c).$$

Now, say that I want to prove that I know a signature $\sigma$ on a message $m$ without revealing any the signature $\sigma$ or the message $m$.

The paper explains that the first step to perform such a proof is to "blind" the signature to form $\tilde{\sigma} = (a^{r'}, b^{r'}, c^{r'r}) = (\tilde{a}, \tilde{b}, \tilde{c}^r) = (\tilde{a}, \tilde{b}, \hat{c})$ and send this blinded signature to the verifier. This clearly satisfies that $$e(\tilde{a}, Y) = e(g, \tilde{b})$$ and it also satisfies the second verification equation with $\tilde{c}$, but not with the actual one $\hat{c}$.

My question is, which is the objective of sending $\hat{c}$ and not $\tilde{c}$ directly?

  • $\begingroup$ Hi Bean Guy, can you think of a more specific title for this question? $\endgroup$ – Maarten Bodewes Dec 9 '20 at 14:15
  • $\begingroup$ If you send $\tilde a,\tilde b, \tilde c$ then you are sending a valid signature for $m$, don't you? Then it won't be ZK because the verifier is indeed learning something it didn't know, namely a valid signature on $m$. $\endgroup$ – AntonioFa Dec 9 '20 at 16:16
  • $\begingroup$ @AntonioFa Perfect. $\endgroup$ – Bean Guy Dec 10 '20 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.