# Questions tagged [zero-knowledge-proofs]

Zero-knowledge proofs are an interactive method for one party to prove to another that a statement is true, without revealing anything other than the veracity of the statement.

1,079 questions
Filter by
Sorted by
Tagged with
55 views

### Can we pad witness of bulletproof and dory to be exponential size?

Bulletproof and dory reduce the witness size by a half during each interaction, until the witness is compressed to be only one element. But what about the witness is not precisely exponential size? ...
• 61
1 vote
61 views

### ZKP vs disposable addresses [closed]

In other words, what does ZKP brings on top of the practice of not reusing addresses? From my research, ZCash is currently a state of the art example of ZKP application, but what extra benefits does ...
• 111
97 views

### How do I construct a recursive polynomial as required in PLONK?

I am going through Dan Boneh's video on PLONK - https://www.youtube.com/watch?v=LbpPCN-f_XA&t=952s At around 19 minutes, he gets to the Prod Check Gadget. Background: $\omega \in F_p$ is the ...
• 2,200
1 vote
61 views

• 2,200
107 views

### Make sure of Quadratic Arithmetic Program validity

In the process of learning zk-SNARKs, I'm faced with this problem: I understand why if the prover sends a polynomial $P$ that can be divided by $T$, the target polynomial, the prover knows a valid ...
• 91
1 vote
49 views

### In Zcash, how does a recipient look up which transactions belong to him/her?

For Monero, the scheme for stealth addresses is pretty straightforward. (For example: https://monero.stackexchange.com/questions/1500/what-is-a-stealth-address) However, I haven't found any details on ...
• 23
51 views

### What is this parameter? in Lyubashevsky's ID-scheme

I am studying Lybashevsky's ID-scheme from the article Fiat-Shamir With Aborts: Applications to Lattice and Factoring-Based Signatures(https://www.iacr.org/archive/asiacrypt2009/59120596/59120596.pdf) ...
• 335
1 vote
59 views

### Public seed expansion for uniform reference strings

Many cryptographic protocols are parameterized by a uniformly random reference string (e.g. the commitment key for Pedersen commitments). Our goal is to publicly generate the random values of this ...
1 vote
46 views

### Checksum algorithm using system of multivariate polynomials

I'm working on a protocol that uses zero-knowledge proofs. I'm looking at systems of polynomial equations as cheap solutions for checksumming data. Note, I'm not looking for trapdoor functionality ...
• 139
197 views

### Real-world instantiation of NIZK protocol from Fiat-Shamir

So I understand how one can use Fiat-Shamir to turn a HVZK sigma protocol into a non-interactive zk protocol in the random oracle model. My problem though is I don't understand why is this useful. If ...
78 views

### Arithmetic Circuit to Square Arithmetic Program (SAP)

I'm trying to figure out how to convert a circuit into a Square Arithmetic Program (SAP). This is to eventually use it for zk-SNARKs such as Groth16. I do however understand how to convert arithmetic ...
54 views

### Zero knowledge proof to validate/invalidate a claim

Have a look at the Twitter conversation below in the screenshots. @theveveshow asks if @trader1sz has sent ETH to the girl in question? @trader1sz responds that the girl in question has indeed sent ...
• 11
140 views

### If SNARKs generally work in finite fields, how are non integer values handled - say fixed point decimal numbers?

In Vitalik Buterin's write-up on SNARKs Quadratic Arithmetic Programs: from Zero to Hero, he writes Note that the above is a simplification; “in the real world”, the addition, multiplication, ...
• 2,200
1 vote
31 views

### Honest verifier zero knowledge property for this protocol

This is zero-knowledge proof that show x is not a quadratic residue. I am trying to verify Honest verifier zero knowledge property. My steps were these: Let S be a simulator that does not know how to ...
• 173
1 vote
58 views

### What is a reasonable statistical distance bound in a SZK construction?

Many works, such as [YCX21] cite that $2^{-40}$ is a reasonable statistical distance for zero-knowledge proof based signatures, even when the security level is $\lambda = 128$.. I was wondering if ...
• 468
428 views

### In the Kate/KZG Polynomial Commitment Scheme, in which Polynomial Ring should the polynomial to be committed be?

In the Kate Polynomial Commitment scheme, a commitment of a Polynomial $f(x)$ at $x=s$ is defined as $Com_f = f(s).G$ where $G$ is the generator of the Elliptic Curve of prime order which is used. So ...
• 2,200
23 views

### Set value of SMT leaf proof

I would like to make a zk proof that would set the leaf of an SMT tree at an index that is an eth address to 1. The SMT is built offchain. I already have the SMT and the root of the tree onchain. I ...
• 21
740 views

### Arithmetic Circuits to R1CS. Do we consider addition gates or not?

Here is Ariel Gabizon's Blog for the process of converting Arithmetic Circuits into R1CS - https://electriccoin.co/blog/snark-explain5/ Here, he writes We assume multiplication gates have exactly two ...
• 2,200
69 views

### Is a non-correlating signed identity proof possible?

Is it possible to receive from a party $I$ a signed message $M$ that can be presented to two independent other parties $V_1$ and $V_2$ as $M'_1$ and $M'_2$ in such a way that they cannot establish a ...
• 31
1 vote
59 views

### Is it possible to make a (zero-knowledge) proof about the content of an asymmetric encrypted message?

I’m trying to understand the proposal presented in this papger zkKYC - A solution concept for KYC without knowing your customer, leveraging self-sovereign identity and zero-knowledge proofs. The ...
• 31
1 vote
228 views

### What is a practical application of evaluating at a point in the Kate Polynomial Commitment Scheme?

I understand how the Kate Polynomial Commitment Scheme Evaluation Proof works however, I don't understand what is the purpose of it? In general, in a commitment scheme, Peggy commits to message & ...
• 2,200
89 views

### Efficient Zero Knowledge Proof for proving a reencryption shuffling for an arbitrary table

I have a problem where I have a table of various reencryptable/rerandomizable ciphertexts (Paillier, Elgamal, EC Additive Elgamal). Each row on a given table has the same structure, but each column ...
• 313
113 views

• 111
1 vote
115 views

### zk-SNARK: Encrypted Polynomial

I've read through, and roughly understand, Maksym Petkus' zk-SNARK paper (http://www.petkus.info/papers/WhyAndHowZkSnarkWorks.pdf). I'm re-reading it, and trying to code up the examples as I go along ...
• 13
150 views

### What good elliptic curve uses a scalar field the size of the Ristretto255 group?

I am implementing Bulletproofs over Ristretto255. (I am using libsodium, so can't switch to another Elliptic Curve implementation.) I need to implement zero knowledge verification of elliptic curve ...
• 31
258 views

### How to proof Two CipherTexts holding same value with Zero Knowledge Proof?

I am a beginner in cryptography. I wonder is it possible to create by Zero Knowledge Proof, to prove Two cipherTexts that are encrypted by same Public Key with Paillier Encryption have the same value ...