Questions tagged [zero-knowledge-proofs]

Zero-knowledge proofs are an interactive method for one party to prove to another that a statement is true, without revealing anything other than the veracity of the statement.

178 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7
votes
0answers
446 views

What's the difference among Vector Commitment, Zero-knowledge Set, Zero-knowledge Accumulator, and Zero-knowledge Elementary Database?

Vector commitment allows one to commit to an ordered sequence of $q$ value ($m_1,\cdots,m_q$) in such a way that one can later open the commitment at specific positions(e.g., prove that $m_i$ is the $...
6
votes
0answers
78 views

Understanding anonymous credentials. Does someone understand how it works?

After reading a series of papers CL01 CL02 CL04, I feel like I understand the intuition behind the anonymous credential framework but I don't understand some details the mathematics behind it. I ...
6
votes
1answer
481 views

Zero knowledge proof for Paillier addition under multiple keys

Suppose $m_0, m_1, m_2 \in \mathbb{N}$ such that $m_0 = m_1 + m_2$, $m_i > 0$ (none of them can be 0 or lower) Under a Paillier cryptosystem, set $e_0 = E(m_0, r_0)$ for a public key $(g_0, n_0)$ ...
5
votes
0answers
253 views

How do they avoid Zero Knowledge Proofs in the paper Priced Oblivious Transfer: How to sell Digital Goods?

I don't understand a part of the paper Priced Oblivious Transfer - How to Sell Digital Goods. Particularly, the authors avoid using zero knowledge proofs and in section 3.3 they explain how they do ...
5
votes
0answers
384 views

Additively homomorphic cryptosystem with non-interactive zero-knowledge proof of non-negativity

I need a cryptosystem that is additively homomorphic. Paillier preferably, but not neccessarily. Also, for every ciphertext the private key holder must be able to prove non-interactively that the ...
5
votes
0answers
792 views

How to prove that a commitment hides the decryption of an ElGamal ciphertext?

I've decided to remove a previous unanswered question of mine and break it down into smaller pieces so it's not such a loaded question. For this question I need to prove that I've committed to a ...
4
votes
0answers
63 views

2 different definitions of Special Soundness

There are 2 different definitions of special soundness in the literature: (1) can be found in Damgard: We say that a Sigma-protocol $\Pi$ satisfies special soundness, if there exists a PPT extractor $\...
4
votes
0answers
81 views

Can zero-knowledge proof be used to determine if another person knows a certain movie with a twist ending?

Suppose I want to talk with a co-worker about a movie called "The Twist Movie". I know the movie contains an interesting twist, and bringing up the movie in a discussion about twists in movies might ...
4
votes
0answers
130 views

Transferable zero-knowledge proofs

Many interactive ZK-proofs satisfy non-transferability; that is, the prover performs a series of actions to convince the verifier of a certain fact, and this verifier can't use this proof to convince ...
4
votes
1answer
801 views

In zkSNARKS, does R1CS require every step of the calculation, or just statements which confirm the calculation was performed correctly?

I was attempting to figure out a way to implement the modulo operation as a set of gates in an Rank-1 Constraint System, detailed by Vitalik Buterin here However, it occurred to me that maybe we don'...
4
votes
0answers
281 views

How to modify the Socialist Millionaire Protocol to be symmetric.

In the Socialist Millionaire Protocol, the roles of Alice and Bob are almost symmetric. By this I mean they do almost the same thing, until the very last step. In the final step, both parties check a ...
4
votes
0answers
209 views

understanding the proof of knowledge

Recently I've been reading the paper “A New Family of Implicitly Authenticated Diffie-Hellman Protocols”. It's very hard for me to go further. Especially when it comes to the proof of knowledge. ...
3
votes
0answers
60 views

Zero knowledge proof for verifying a machine learning model

Imagine Alice has trained a machine learning model. Bob wants to verify that whether Alice actually trained the model or not, but Alice does not want to reveal her model (because the model is personal ...
3
votes
0answers
46 views

Applications of Shuffle Proofs

Shuffle proofs enable a prover to show that a vector of commitments or encryptions $(c_1, \dots, c_n)$ is permuted into a vector of commitments $(c'_1, \dots, c'_n)$ without revealing the permutation ...
3
votes
0answers
94 views

Is it possible to verify attributes of encrypted content?

Let's say that Alice has this information about her, { "name": "Alice", "age": 25, "eyes": "brown" } which she encrypts with a key pair so that no one access ...
3
votes
0answers
89 views

Doubt in computing $g^\frac{1}{\delta+x}$ where $x \in \mathbb{Z}$

I was going through Zero Knowledge Set Membership and came across the following: Given $x \in \mathbb{Z}$ and $g$ is the generator of a multiplicative group $\mathbb{G}$ how do we compute $g^\frac{1}{...
3
votes
0answers
113 views

Proof of knowledge of exponentiations

I am reading a paper of Furukawa and Sako, "An efficient scheme for proving a shuffle" from 2001. This paper writes a protocol for verifiable shuffling in mixnets. Their protocol make use of ...
3
votes
0answers
185 views

Weak Challenge Generation - Fiat-Shamir Heuristic

The Fiat-Shamir heuristic may be applied to transform a Sigma-Protocol on R(x,w) into a ZKPoK. Let's call the prover's first message ...
3
votes
0answers
269 views

Shared-secret authentication with implicit session keys?

Consider a system with producers (P), consumers (C) and a server (S) with two TCP ports open where a consumer connects on one port and a producer on the other. The server is just a TCP relay which ...
3
votes
0answers
256 views

Question about proof of knowledge definition

I am just reading the "soundness" definition for proofs of knowledge by Bellare / Goldreich. A proof of knowledge is a proof between a prover $P$ and a verifier $V$. $P$ convinces $V$ of his knowledge ...
3
votes
0answers
326 views

Transforming simplest protocol into a Sigma-protocol

I have some questions from previous years exams, I hope you could help me with them. :) Suppose that a protocol satisfies the properties of a $\Sigma$-protocol, except that it is only (plain) ...
3
votes
2answers
181 views

Why does the prover in an interactive proof run in exponential time with the space of the computation?

I'm currently trying to gain an understanding of verifiable computation and the strengths and weaknesses of past approaches. In particular, I've been watching the following YouTube video which talks ...
2
votes
0answers
47 views

Verifiable execution of a program

I would like to know what cryptographic primitives could be used for Alice to prove to Bob that she actually executed a program. The goal is to make a Proof-of-useful work, where Alice proves she ...
2
votes
0answers
49 views

Trade-offs for more parties in PICNIC multi-computation

In the PICNIC post-quantum signature scheme, a zero-knowledge proof of the secret key for a symmetric encryption is produced by implementing the encryption as a Yao garbled circuit of a three-party ...
2
votes
0answers
53 views

How does the rejection sampling lemma work in the proof of HVZK?

In this protocol, Q1: how does the commitment work? What if the prover sends $\textbf{t}$ directly, and then sends $s_m,s_r,s_{\textbf{e}}$? Q2: How does the rejection sampling lemma work? refer to ...
2
votes
0answers
93 views

Efficiently prove the correctness of Paillier encryption in or "outside" a zk-SNARK

I'm working with a zk-SNARK library [1] that allows me to prove the correctness of arbitrary arithmetic circuits, and I now want to use these zk-SNARKs to prove that some Paillier [2] ciphertext $c$ ...
2
votes
0answers
55 views

Demo a Proprietary Signal Processing Algorithm Without Cheating

I have a proprietary signal processing algorithm, $F(s)$, which I would like to demo to my customers. The demo starts with the customer uploading a binary signal $S_0$ to my website. I then generate a ...
2
votes
0answers
44 views

Predicting with a machine learning model while preserving the privacy

Imagine Alice has trained a machine learning model. She wants to store her model in a blockchain so that everyone can use it; however, she wants her model to be private so that no one can steal her ...
2
votes
0answers
39 views

Non-interactive proof of friendship

Alice would like to make public a proof that she is friends with Bob that has the following characteristics: Creation of the proof requires the agreement of both Alice and Bob Anyone who is also ...
2
votes
0answers
38 views

Sakumoto 3-pass MQ IDS Zero-Knowledge proof

In this paper: Public-Key Identification Schemes Based on Multivariate Quadratic Polynomials it is explained in Theorem 2 that the 3-pass protocol is statistically zero knowledge when the commitment ...
2
votes
0answers
63 views

How to construct a set in which the elements in $\mathbb{Z}[x]/(x^n+1)$ and their differences are invertible and with coefficients in $\{-1,0,1\}$?

I know that in IACR - Better Zero-Knowledge Proofs for Lattice Encryption and Their Application to Group Signatures it constructs such a challenge set: {$ x^i $}. But the inverse of the difference of ...
2
votes
0answers
59 views

Groth-Sahai Proof of multi-exponentiation

I want to create a NIZK proof of a multi-exponentiation via Groth-Sahai proofs. In the lectures of Jens Groth in a winter school of Bar-Ilan University, he shows a way to transform multi-...
2
votes
1answer
170 views

Can I prove in zero knowledge that the public key corresponding to a secret that I committed is in the Accumulator?

I have a set of users in my system, each having a private/public keypair of a digital signature scheme. I also have an accumulator in my system, where all the public keys of the users are accumulated. ...
2
votes
0answers
108 views

ZK Proof that a blinded message (for a blind signature) contains a certain value

I am toying with eCash systems and blind signatures, and I started with Chaum's original formulation. In particular, I'm using this formulation from this link: User ...
2
votes
0answers
105 views

Verify commitment C commits to the same value that E encrypts

Given the following (using additive notation): $G$ - generator of an elliptic curve group of order $q$ $s$ - secret drawn uniformly from the distribution $1..q$ $k$ and $K$ - a private public keypair ...
2
votes
0answers
86 views

Adaptation of Stern Zero-Knowledge protocol from coding to lattices

I'm currently working on Zero-Knowledge-proofs in lattice context, for which there exist two major frameworks. One of those two is the adaptation of Stern protocol from code-based-crypto. There is in ...
2
votes
0answers
58 views

What is the relation between honest verifier zero-knowledge and non-interactive zero-knowledge?

I'm not clear about the relation between the following definitions: zero-knowledge protocols; honest verifier zero-knowledge; non-interactive zero-knowledge. To my best understanding, zero-knowledge ...
2
votes
0answers
32 views

Strategies for fast integrity attestation over multi party computation for large messages

I am looking for ways to efficiently perform integrity attestation over large messages using multi party computation. While, hashing (SHA1, 256...) is one alternative but it's painfully slow and grows ...
2
votes
0answers
109 views

The theory of transformation of arithmetic expressions into boolean circuits in zkboo

I've read the sources of ZKBoo where they transformed arithmetic operations of the SHA hash functions into a bunch of boolean ones. Where does this transformation arise from? How do you construct such ...
2
votes
0answers
41 views

ZK-proof of usage in a seed of CSPRNG

Assume a Player chooses a seed $s$ and he wants to prove that he uses it as a seed to CSPRNG function, where the seed is not public. How can he prove it? Thanks.
2
votes
0answers
29 views

Avoiding multiple use of sIgned identities while not learning anything about them

There is an authority A with an associated public/private key pair (A.priv, A.pub). A can issue new "identities" by signing data (numbers or bytestrings). Each number associated with a signature by A ...
2
votes
0answers
217 views

What's the difference between non-interactive zero knowledge proof of knowledge and proof of membership?

I'm trying to study the difference between non-interactive zero knowledge (NIZK) proof of knowledge and proof of membership. I have known that in NIZK proof of knowledge the prover wants to convince ...
2
votes
0answers
150 views

Is there any way to prove two numbers that are equal after Paillier encryptions?

I have two numbers $x_1$ and $x_2$, and there are two Paillier homomorphic encryption (public, private) key pairs $(p_1,r_1)$ and $(p_2, r_2)$. I only know $p_1, r_1$ and $p_2$. Suppose $C_1=E_{p_1}(...
2
votes
0answers
91 views

Can proofs be relayed to derived keys?

I am aiming to find out if this problem/puzzle can be solved with cryptography at all. Say there are these two parties: Subject S which has a master private/public key pair (MPriv, MPub) and a set of ...
2
votes
0answers
183 views

Rewinding techniques with some examples

I'm aware of these posts: What is a "rewinding argument"? Random oracle model proofs and programmability But I think, some concrete examples are missing. I need to know how exactly ...
2
votes
0answers
192 views

Post quantum zkSNARK?

Do there exist any zkSNARK constructions that are based on post quantum cryptography? The encryption scheme used in the zkSNARK that is employed in Zcash for instance uses an encryption scheme of the ...
2
votes
0answers
106 views

Are zkSTARKs simulation sound extractable in the random oracle model?

I've recently become interested in simulation sound extractable zero-knowledge proofs for use in UC-secure protocols. I've also become interested in the recent instantiation of PCIPs called zkSTARKs. ...
2
votes
0answers
57 views

Unanimity for three (or more) players

The article Cryptographic Protocols with Everyday Objects by James Heather, Steve Schneider, and Vanessa Teague describes the following unanimity protocol for three players: Three players want to ...
2
votes
0answers
77 views

What is a discrete logarithmic assumption? How does it set up trustless proofs?

A pending proposal of bulletproofs as a ZK proof for confidential transactions relies on Fiat-Shamir heuristic to be non-interactive by creating a digital signature on interactive proof of knowledge. ...
2
votes
0answers
494 views

Functional signatures with ECDSA Verifier

Functional signatures use some master key to create a functional signature key. The functional key can be used to sign messages, but only if the message is accepted by some predicate function. For ...