So I want to create a zero-knowledge proving system for numbers (think loans and bank accounts, I want to prove my paycheck is more than x dollars per month).

I was thinking about using a zero-knowledge proof for the preimage of a hash. So let's say my employer hashes my paycheck in such a way (e.g. using merkle trees) that my net received is hashed individually. I can use a preimage proof to prove I know the preimage of the hash, but that does not get me anywhere. I want to prove the preimage of the hash is bigger than some set amount.

But that also is not very useful as I don't want to disclose the hash of my paycheck, because it's not difficult to hash all possible amounts (let's say 500.00-5000.00, that's only 450k options) and check if it's equal.

So what I thought about doing is append a random string to the amount, and hash that. Is there a way I can prove that a hash of a string containing a number is bigger than some amount? Or am I thinking about this the wrong way?

  • $\begingroup$ Have you looked into range proofs: arxiv.org/abs/1907.06381? $\endgroup$
    – Sam Jaques
    Jan 20, 2022 at 16:02
  • $\begingroup$ My answer here crypto.stackexchange.com/questions/96232/… shows how to use a Pedersen Commitment instead of a hash, and how to create a Schnorr-ring-signature-based range proof that proves the commitment is greater than or equal to a certain value $\endgroup$
    – knaccc
    Jan 20, 2022 at 17:30

1 Answer 1


One of criteria of a good hash functions is that it does not reveal any information about preimage. That's why the answer is: No, for a good hash function it is not possible to say anything about the preimage.

Suppose it would be possible. Suppose some hash function would really answer if the hashed number is bigger than the given one. Then it would be easy to find that number.

  1. Use hash to check if the hashed number is bigger than 1 000 000.
  2. If not bigger, take the median, 500 000. Use hash to check it the hashed number is bigger than 500 000.
  3. If bigger, take median from the higher half, 750 000. If not bigger, take median from the lower half, 250 000. Etc. For 1 000 000 you will get the hashed number after just 20 steps, with precision +-1. If you do 7 more steps, you will know the number with precision 0.01.
  • $\begingroup$ Okay but I want someone to prove to someone else that their paycheck is bigger than some value. They can take their knowledge of what's in the hash and use that to generate a proof. Those proofs won't be generated automatically, the user needs to sign it with the value only they know is in the hash. What should I use for this application? $\endgroup$
    – vrwim
    Jan 20, 2022 at 11:58
  • $\begingroup$ This answer is wrong. @vrwim Yes, you are right that it can be done. It should be possible be produce a zero knowledge proof that some value v encoded there is bigger than x for some known x without revealing anything else about x. You cannot binary search the value with that information alone because someone else cannot check whether it is bigger than some other value y as well or not unless the prover decides to prove that as well. The problem is obviously in NP and every problem in NP has a zero knowlege proof $\endgroup$ Jan 20, 2022 at 16:03
  • $\begingroup$ Best I know of for such proofs would be ZK SNARK over the boolean circuit for calculating the hash, It is very good for verification (the proof is short and has sublinear verification time w.r.t. witness size). Generating the proof takes some time because of the need to compile the hash program and some elliptic curve operations. $\endgroup$ Jan 20, 2022 at 16:15
  • $\begingroup$ See wisdom.weizmann.ac.il/~oded/gmw1.html $\endgroup$
    – kelalaka
    Jan 20, 2022 at 18:07
  • $\begingroup$ @Manish Adhikari: Your comment is wrong. I think you have not understood the question. The question is not if ZP proof is possible. The question is if a static hash that was calculated by the prover in advance (without any interaction with verifier) can be used for ZK proof. It is impossible because of the reason I have described in the answer. $\endgroup$
    – mentallurg
    Jan 20, 2022 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.