Questions tagged [zero-knowledge-proofs]

Zero-knowledge proofs are an interactive method for one party to prove to another that a statement is true, without revealing anything other than the veracity of the statement.

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

What is the adversary advantage for soundness of a sigma protocol?

Does a sigma protocol have an adversary advantage of zero for soundness? Or is this affected by the probability distribution of the indistinguishability of the simulator? Will in that case using the ...
0
votes
0answers
13 views

Universal Computation “measurement” using SNARKs?

If SNARKs are able to prove computations of arbitrary complexity and difficulty were executed correctly, would it be possible to use them to create a Proof of Work consensus system where ANY ...
2
votes
0answers
40 views

Demo a Proprietary Signal Processing Algorithm Without Cheating

I have a proprietary signal processing algorithm, $F(s)$, which I would like to demo to my customers. The demo starts with the customer uploading a binary signal $S_0$ to my website. I then generate a ...
0
votes
0answers
27 views

Zero knowledge proof of Paillier cryptosystem

I have read the paper recently and I am curious about part 3. According to part 3, Bob sends a zero-knowledge proof such that $c_B=b\times_{E}c_A+_E E_A(\beta')$. Then Alice should first decrypt the ...
2
votes
0answers
30 views

Predicting with a machine learning model while preserving the privacy

Imagine Alice has trained a machine learning model. She wants to store her model in a blockchain so that everyone can use it; however, she wants her model to be private so that no one can steal her ...
2
votes
0answers
31 views

Zero knowledge proof for verifying a machine learning model

Imagine Alice has trained a machine learning model. Bob wants to verify that whether Alice actually trained the model or not, but Alice does not want to reveal her model (because the model is personal ...
1
vote
0answers
31 views

how to verify the digital signature in a zero knowledge proof

I know that the zero knowledge proof is able to prove to the verifier that the holder does in fact posess the digital signature issued from an issuing 3rd party but... How does the verifier validate ...
0
votes
0answers
22 views

Can zk-SNARKs prove satisfiability for NP-hard languages?

In general, I think of zk-SNARK circuits representing a language in NP, meaning it is "computationally easy" to verify. However I was reading about a recent zk-SNARK (Sonic) which has as ...
1
vote
1answer
65 views

Zero-knowledge proof for multiplication in the exponent

We have $c_1=g_1^x$, $c_2=g_2^y$ and $c_3=g_3^{x/y}$, where $g_1,g_2,g_3$ are generator of a group of order $n$ and we don't know the DL between them. Is there any sigma protocol or zkp that can prove ...
1
vote
0answers
16 views

How to prove in zero-knowledge that the attributes of Pointcheval Sanders signature is the opening of a commitment?

In anonymous credentials schemes, it is possible to anonymously prove knowledge of a signature. Proposals for anonymous credentials with attributes also include a method for proving statements about ...
2
votes
1answer
71 views

Converting common reference string to common random string

I listened to a talk on NIZK a while ago and vaguely remembered the speaker mentioned something like - A scheme that is statistically sound and computationally ZK in common reference string model ...
3
votes
2answers
55 views

How to show that Cx is a commitment to a integer of length lm

With reference to Jan Camenisch and Anna Lysyanskaya's paper A Signature Scheme with Efficient Protocols, in proceedings of SCN 2002, I need some help to understand How to verify that $C_x$ is a ...
0
votes
2answers
84 views

How to prove that I am part of a list without revealing my identity?

Let's suppose and scenario like a secret voting scheme, at the ID verification step. Considerations: There is a public list of identities of people who are able to vote (ex, people who live in a ...
0
votes
1answer
43 views

zkSnark Circuit

In practice, the circuit need to be proved always has a large size, maybe nearly billion gates, when turns such circuit to QAP, it will generate a large polynomial, which is a high cost to use zkSNARK....
2
votes
1answer
34 views

Difference between SHVZK and HVZK?

What is the difference between Special Honest Verifier Zero-Knowledge (SHVZK) and Honest Verifier Zero-Knowledge (HVZK)? Sometimes I see one term being used, other times the other. Do they mean the ...
0
votes
1answer
53 views

Is BBS+ 1. a multi-messages signing protocol or 2. a group signature signed by a member of a group anonymously?

There's no doubt that the BBS Signature was born from this classic Short Group Signature paper in 2004. It's capable of Zero-knowledge. In the paper, section 5, it describes how a member of a group, ...
2
votes
1answer
59 views

survey on zero knowledge proof

Is there a recent and comprehensive survey on zero knowledge proofs? I'm trying to find one which provide more details than the two chapters (19/20) in Boneh and Shoup's book (a grad course in applied ...
3
votes
1answer
69 views

libsnark generator toxic waste

I'm looking through the test and examples of libsnark, let's take for example here: https://github.com/christianlundkvist/libsnark-tutorial/blob/master/src/test-gadget.cpp at line 19 there's: ...
0
votes
0answers
73 views

Zero Knowledge Set Membership proof

ZK set membership: I am trying to create my own zero knowledge set membership proof for a commitment to an element in the set for small sets. I am a beginner in such works, so can someone help me find ...
5
votes
1answer
104 views

Is Schnorr's digital signature a non-interactive zero-knowledge proof?

If yes, is there any paper that proves it? Unifying Zero-Knowledge Proofs of Knowledge, by Ueli Maurer, argues that Schnorr's interactive protocol is zero-knowledge. If this is true, using the Fiat-...
1
vote
1answer
58 views

is this range proof i made sound?

so to prouve a value $v$ is in range $[0,2n−1]$ we convince the verifier that $v$ is represented by a binary vector $a∈\{0,1\}^n$ so that $<a,2n>=v$ $//$ $2n∈Zn$ is the vector of powers of $2$ ...
1
vote
1answer
70 views

Zero-knowledge proof or zero-knowledge proof of knowledge?

It has always been a question surrounding in my mind whether a zero-knowledge proof ($\mathrm{ZKP}$) is the same as zero-knowledge proof of knowledge ($\mathrm{ZKPoK}$), but it was not since today ...
0
votes
0answers
32 views

sequential composition of honest verifier zero knowledge proof

Is honest verifier zero knowledge closed under sequential composition? My guess is that since the verifier has to throw random challenges, they cannot adapt their challenge from the transcripts of a ...
1
vote
0answers
35 views

How is a non-interactive zero-knowlege proof constructed using homomorphic encryption?

I've been reading too much, and I still haven't found the explaination I so crave. I'm looking specifically at zk-SNARKs, as implemented by ZCash. They say they use homomorphic encryption in their non-...
3
votes
0answers
36 views

Applications of Shuffle Proofs

Shuffle proofs enable a prover to show that a vector of commitments or encryptions $(c_1, \dots, c_n)$ is permuted into a vector of commitments $(c'_1, \dots, c'_n)$ without revealing the permutation ...
1
vote
0answers
15 views

Is this a zero knowledge password proof? [duplicate]

Client and Server both know the Client's password. Client wants to login. Server sends Client a random string. Client concatenates the string with their password. Clients sends the HASH of this to ...
3
votes
1answer
93 views

How to achieve identity authentication without revealing credentials

I am looking at a scenario where I would like to claim to an authority (call it A) that I am indeed me without revealing my identity documents. I am guessing some zero knowledge protocol has to be ...
0
votes
0answers
43 views

Can I use zero-knowledge proofs on pre-image of symmetric encryption?

Let $e_x$ be a symmetric encryption function in regards to key $x$. Let $y_1 = e_1(x_1), y_2 = e_2(x_2)$. My goal is to prove that: $$x_1 = x_2$$ Is there a way of proving this using ZKP? I can't seem ...
1
vote
0answers
70 views

zero knowledge proof of a number greater than zero

Is there a way to prove in zero knowledge that an element (h) of a group is less than (or greater than) another element from the group? In other words, can we prove that the difference of elements is ...
0
votes
0answers
36 views

two-to-one hash in libsnark, what is it “exactly”?

I'm reviewing this test which prepares a zero knowledge proof of the preimage of an hash: https://github.com/mariogemoll/libsnark-tutorial/blob/sha256/src/test-knowledge-of-preimage.cpp In my (wrong) ...
4
votes
1answer
96 views

Constructing division gate in R1CS

One thing I don't quite understand is how to naively handle division operation in rank-1 constraint systems (R1CS). supposedly A.s * B.s - C.s = 0 allows you to ...
2
votes
0answers
36 views

Non-interactive proof of friendship

Alice would like to make public a proof that she is friends with Bob that has the following characteristics: Creation of the proof requires the agreement of both Alice and Bob Anyone who is also ...
1
vote
0answers
39 views

An aggregate signature scheme for transactions

Suppose A and B communicates where A makes B some payments by sending signatures as the following, $$ \sigma_1 \leftarrow Sign(v_1, sk_A), \sigma_2 \leftarrow Sign(v_2, sk_A), \dots \sigma_n\...
1
vote
1answer
47 views

Verification of NIZK proof with algebraic MACs

The paper Algebraic MACs and Keyed-Verification Anonymous Credentials, includes a way to instantiate a NIZK proof with algebraic MAC. This is given in Appendix E where this NIZK is a part of the ...
4
votes
2answers
68 views

Sigma proofs for Pedersen commitments arithmetic under different bases

I was wondering if it's possible to prove an equality of openings between $3$ Pedersen commitments $P\cdot Q$ and $R$ when $P, Q, R$ have different commitment keys. Suppose that commitment $R$ commits ...
0
votes
0answers
14 views

Sigma-Protocol to prove a commitment to a commitment

Let $Com$ be a pedersen commitment function with publicly known $g$, $h$, and $p$ values s.t. $Com(x,r)$ is a commitment on $x$ with random number $r$. Is there a $\Sigma$-protocol to prove $ZKPoK\{ (...
2
votes
0answers
33 views

Sakumoto 3-pass MQ IDS Zero-Knowledge proof

In this paper: Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials it is explained in Theorem 2 that the 3-pass protocol is statistically zero knowledge when the commitment ...
1
vote
1answer
46 views

Could PAKE via smooth projective hash function protect agaist replay attacks?

I came across some password-based authenticated key exchange (PAKE) protocols that are based on the smooth projective hash function (SPHF) in the standard model. And I checked some related works, and ...
2
votes
1answer
43 views

Is there a way to prove knowledge of a limited resource like a phone number just to the people who already know about it?

For instance, let's say Bob's phone number is X and Alice has somehow identified that Bob's phone number is X. Now she doesn't have a direct way to contact Bob, so she wants to post in a public forum ...
0
votes
0answers
21 views

A zero knowledge protocol with a deterministic verifier

Given a language $L$ and $ZKP$ between $v$ and $p$, when $v$ is deterministic polynomial time algorithm, I wish to obtain a probabilistic-polynomial algorithm which solves $L$. Which, if I am not ...
0
votes
0answers
24 views

How to prove properties of pre-image of random oracle in zero-knowledge proof?

A signature Sig is given as input to random oracle H, such that y = H(Sig) and Sig should be hidden from the verifier. How to prove in zero-knowledge to the verifier that y is the correct output from ...
1
vote
1answer
72 views

Proving equality of two Schnorr Signatures

Given two Schnorr Signatures that were made from the same $x$, where each $x$ is private. Is there a way to prove that they came from the same $x$ without revealing $x$? I heard about Chaum-Pedersen ...
1
vote
0answers
42 views

Is using Fiat-shamir Heuristic safe?

What I'd like to do is to have the Prover store a value x where x remains hidden. From x, I'...
2
votes
0answers
60 views

How to construct a set in which the elements in $\mathbb{Z}[x]/(x^n+1)$ and their differences are invertible and with coefficients in $\{-1,0,1\}$?

I know that in IACR - Better Zero-Knowledge Proofs for Lattice Encryption and Their Application to Group Signatures it constructs such a challenge set: {$ x^i $}. But the inverse of the difference of ...
1
vote
0answers
31 views

Fixed variable in Groth16

In the paper On the Size of Pairing-based Non-interactive Arguments by Jens Groth, it is always referred in the equations to satisfy that $a_0 = 1$ and the others $a_1, ..., a_m \in \mathbb{F}$. I am ...
1
vote
0answers
40 views

Range Proof without trusted set-up

If verifiers are public blockchain nodes, which might leak information. Does this imply that range proofs such as Boudot's and Lipmma's (squaring based) approach could not be applied, unless a trusted ...
0
votes
1answer
68 views

ZKP for product of two primes

I'm struggling to understand the intuition of the zero knowledge-ness of this proof from the following paper. The proof is a 2 round where the verifier asks the prover to extract square roots of ...
0
votes
0answers
36 views

How to determine if a protocol is a Zero knowledge proof

If the given protocol is non interactive then how can one prove that the modified protocol is complete and determine whether it is zero-knowledge? Let $N = p q$ as in an RSA algorithm, with $\text{gcd}...
0
votes
1answer
56 views

why people don't use the same generators?

i want to make many pederson commitments $C=g^s h^r$ for a long time , do i have to change the generators $g$ and $h$ or its ok if i always used the same ones
1
vote
1answer
42 views

Why does the verifier have to send a challenge in Shnorr protocol?

In the Shnorr protocol where the prover wants to prove he has a witness $w$ for $g^w$ the following interactions happen: the prover chooses a random $r$, calculates $y=g^r$ and sends $y$ the ...

1
2 3 4 5
13