Questions tagged [zero-knowledge]
The zero-knowledge tag has no usage guidance.
30
questions
0
votes
1
answer
47
views
which zero knowledge proof technique is suitable for identity verification system?
I am a beginner in the cryptographic field but as a graduation project, I have to build an identity verification and management system using zero-knowledge proofs.
I see a lot of zkp techniques, ...
- 1
0
votes
0
answers
38
views
Zero Knowledge 3-coloring, but we allow malicious V to challenge two edges
So I think I understand how zero knowledge protocol with 3-coloring is supposed to work. But in an attempt to increase soundness of the protocol, we allow the verifier V to challenge two edges per ...
3
votes
0
answers
57
views
Are there reputable public proving parameters for universal zkSNARK systems?
I have seen that Filecoin performed a public set-up ceremony for their zkSNARK system. Because Filecoin uses the Groth16 prover (which has a circuit-specific set-up), the output of this ceremony was ...
- 73
1
vote
1
answer
92
views
Encryption scheme with variable and provable key-length
I'm currently studying the possibility of a novel ransomware technique, where an adversary instead of forcing the victim to pay a ransom, forces them to brute force a key of given length and thus ...
- 227
3
votes
3
answers
246
views
State of the art for Graph Isomorphism
I want to know the state of the art result for proving knowledge of graph isomorphism. As described here, the classical Goldreich-Micali-Wigderson (GMW) protocol is a $\Sigma$-protocol with soundness ...
- 350
2
votes
0
answers
125
views
Equality of ElGamal plaintext & Pedersen commitment message
Let's imagine two entities: Bob and Alice. Bob's public key is $B = bG$. Alice's public key is $A = aG$.
Alice encrypts her number $n$ with Bob's public key so Bob could decrypt it ($n$ is small ...
- 33
1
vote
1
answer
135
views
Many-out-of-many proofs
I need to prove that given vector of commitments of length N contains N-1 commitments to zero (and one to an arbitrary number).
More formally, given vector:
$$\textbf{a} = \begin{bmatrix}
C(0, r_1)...
- 33
1
vote
0
answers
194
views
ZK-STARK soundness
I've been reading about ZK-STARK. There's an example that appears in several blogs. The most detailed explanation of that specific example which I have found so far is in this blog.
The description of ...
0
votes
1
answer
97
views
PCD vs Recursive SNARK vs Non-uniform IVC
I was wondering if anyone could clarify the differences between PCD vs Recursive SNARKs(like pickles) vs Non-uniform IVC(like hypernova)
They all seem very similar to me
1
vote
1
answer
85
views
Which Rust library is recommended if I would like to implement PLONK? [closed]
I think it should have APIs for polynomials, FFT and bilinear mapping if KZG commitment scheme is used.
- 61
2
votes
0
answers
63
views
Poly-commitment based on Bulletproofs
I am reviewing the ZKP course, represented by the university of Berkley (https://zk-learning.org/). In pages 41 and 42 of lecture 6 that is attached below (https://zk-learning.org/assets/lecture6.pdf),...
- 181
1
vote
0
answers
102
views
Is the Lemma4.5 in the Plonk paper correctly described？
In lemma4.5, of PlonK: Permutations over Lagrange-bases for
Oecumenical Noninteractive arguments of
Knowledge
they claim that we can construct a polynomial protocol $P^*$ with an $S$-ranged polynomial ...
- 93
0
votes
0
answers
22
views
How can we construct a ZKPoK which hides both $x$ and the witness $W_x$ in dynamic accumulators?
Consider a verification equation $ e(\Delta,\tilde{G}) = e(W_x,x\tilde{G}+pk_{acc})$ from a pairing based accumulator which uses the value $x$ and the corresponding witness $W_x$ to verify that a ...
2
votes
1
answer
126
views
Can a 3-coloring for a graph be represented as a circuit?
I was looking at a layman explanation for zero-knowledge proofs in zk-SNARKs here.
The idea there is that if one knows a solution (3) to a question (find a value of ...
- 693
0
votes
0
answers
18
views
Data structures for linking blockchain accounts
I want to use a data structure like merkle tree in a hypothetical blockchain that, if needed, can fast check whether a wallet/account has received directly or indirectly from a specific list of ...
- 1
2
votes
0
answers
36
views
Proving the minimal entropy of Dilithium-QROM?
I am working with the securit yof CRYSTAL's Dilithium signature in the QROM. I am working with Kiltz et al.'s approach through lossy ID-schemes and looking at the proof of minimal entropy for the $DFS[...
- 335
2
votes
1
answer
47
views
Can we pad witness of bulletproof and dory to be exponential size?
Bulletproof and dory reduce the witness size by a half during each interaction, until the witness is compressed to be only one element. But what about the witness is not precisely exponential size? ...
- 61
4
votes
1
answer
407
views
How can a verifier benefit from being malicious or dishonest in a Zero Knowledge interactive proof?
Several texts talk about malicious/dishonest verifiers in a zero-knowledge interactive proof but none of them properly detail how a dishonest verifier can gain extra knowledge over an honest verifier ...
- 2,169
3
votes
1
answer
95
views
Does NordPass Make the Same Error SpiderOak Stopped Making in 2017?
According to a Reddit post I am participating in, SpiderOak “repented” of its incorrect usage of the term “zero knowledge” in 2017, as shown here:
https://medium.com/@SpiderOak/why-we-will-no-longer-...
- 185
1
vote
0
answers
23
views
Honest verifier zero knowledge property for this protocol
This is zero-knowledge proof that show x is not a quadratic residue.
I am trying to verify Honest verifier zero knowledge property.
My steps were these:
Let S be a simulator that does not know how to ...
- 173
4
votes
1
answer
81
views
sUF-CMA security of Lyubashevsky's ID and signature protocol
I have been working on the post-quantum safe ID/signature-schemes of Vadim Lyubashevsky (https://www.iacr.org/archive/asiacrypt2009/59120596/59120596.pdf).
I am in particular studying the security ...
- 335
5
votes
2
answers
117
views
Coin flipping without commitments or random oracles
It's well known that two parties, Alice and Bob, can flip a fair coin using commitments.
Alice picks a random number $a \in \mathbb{Z}_q$ and computes $c_a = Com(a, r_a)$ where $r_a \xleftarrow{R} \...
- 163
3
votes
1
answer
110
views
Why is Lagrange interpolation required in Batch Opening case of KZG/Kate PCS?
From here - Batch Opening of KZG PCS
One can prove multiple evaluations $(\phi(e_i) = y_i)_{i\in I}$,for arbitrary points $e_i$ using a constant-sized KZG batch proof, $\pi_I = g^{q_I(\tau)}$, where
\...
- 2,169
2
votes
1
answer
160
views
Zero knowledge proof for GCD
Let A(x) and B(x) be two secret polynomials. Suppose a user publishes commitments $C_A$ and $C_B$ to these polynomials (such that the lengths of $C_A$ and $C_B$ are sublinear in the degree of $A(x)$ ...
- 79
1
vote
0
answers
41
views
Zero-knowledge data storage with peace of mind. MAC/Encryption with two keys?
Background
Bob's goal: Receive data E = E(D) (encryption of D) from Alice that he knows for sure is encrypted and that he can't possibly decrypt (without brute force). This gives his data backup ...
- 233
0
votes
0
answers
90
views
Definition of "zero-knowledge encryption"
I'm reading headlines on the tune of "…bring zero-knowledge encryption to file storage". Googling "zero-knowledge encryption" returns statements like "cloud storage or backup ...
- 138k
1
vote
0
answers
28
views
Design ZKP to satisfy x1*x2(mod n)=x3 from(Pallier encryptions)
I have 3 Pailler encryption p1=E(x1;r1),p2=E(x2;r2);p3=E(x3;r3) such that
x1*x2(mod n)=x3. P(Prover) knows (x1,r1);(x2,r2);(x3,r3).
Can I design a ZKP(interactive & non-interactive) for P to ...
- 11
3
votes
2
answers
490
views
How does taking the difference between commitments verifies that the messages are correct?
I have read that perdersen commitment can be used to hide the messages such as transactions by participants. The verifier will just have to make sure that the difference of the commitments is zero. ...
- 225
3
votes
1
answer
167
views
How can you use ZK-proofs and public key signatures in this situation?
Let us say that we have 3 entities: an Issuer I , a user/prover P and a verifier V.
...
- 125
1
vote
1
answer
61
views
Input Delayed Sigma-Protocol
In a Sigma-protocol, the steps are (1) commitment, (2) challenge, and (3) response. In general, the prover has a statement and witness that they can use to compute the commitment step. But in some ...
- 395