# Questions tagged [zero-knowledge-proofs]

Zero-knowledge proofs are an interactive method for one party to prove to another that a statement is true, without revealing anything other than the veracity of the statement.

178 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
116 views

### Non-interactive zero-knowledge proof system for a language undecidable in polynomial time

I am studying through some material in an online course, and there is an exercise which I could not figure out. The problem is this: Let $L$ be a language that is not decidable in polynomial time (...
25 views

### Zero knowledge proof of symmetric keys and encrypted texts resulting in the same text, if the symmetric keys are encrypted with asymmetric ones

Suppose I have: text T, symmetric keys X, Y encrypted text T with symmetric keys X, Y = TX, TY accordingly asymmetric key Z, used to encrypt X, Y to transmit them to a person. Let the encrypted ...
22 views

### Universal Computation “measurement” using SNARKs?

If SNARKs are able to prove computations of arbitrary complexity and difficulty were executed correctly, would it be possible to use them to create a Proof of Work consensus system where ANY ...
52 views

### Zero knowledge proof of Paillier cryptosystem

I have read the paper recently and I am curious about part 3. According to part 3, Bob sends a zero-knowledge proof such that $c_B=b\times_{E}c_A+_E E_A(\beta')$. Then Alice should first decrypt the ...
98 views

### Zero Knowledge Set Membership proof

ZK set membership: I am trying to create my own zero knowledge set membership proof for a commitment to an element in the set for small sets. I am a beginner in such works, so can someone help me find ...
64 views

### Can I use zero-knowledge proofs on pre-image of symmetric encryption?

Let $e_x$ be a symmetric encryption function in regards to key $x$. Let $y_1 = e_1(x_1), y_2 = e_2(x_2)$. My goal is to prove that: $$x_1 = x_2$$ Is there a way of proving this using ZKP? I can't seem ...
34 views

### How to prove properties of pre-image of random oracle in zero-knowledge proof?

A signature Sig is given as input to random oracle H, such that y = H(Sig) and Sig should be hidden from the verifier. How to prove in zero-knowledge to the verifier that y is the correct output from ...
79 views

### Does Schnorr identification protocol using commitment scheme?

In schnorr identification protocol, a prover needs to choose a random,let's say $r$ at the beginning, then commit to this randomness as $g^r\bmod p$. When we say "commit", does it really mean we are ...
43 views

### Proving anonymous credential presentation

In a CL-based or CKS-based anonymous credential system, how can a verifier $V$ prove that a credential holder $H$ has presented it a credential that has been issued by an issuer $I$ without ...
55 views

### Discrete log zero knowledge proof lying case

I read the Wikipedia page on a discrete log zkp, but I don't understand how $$C' = g^{r'} \cdot (g^x)^{-1} \bmod p$$ would be calculated. Would it be $$C' = g^{r} \cdot \frac{1}{y} \bmod p$$ ...
83 views

### Prove knowledge of signature on committed value

Assume that a prover $P$, has previously obtained a signature $\sigma$ on a value $x$ from a verifier $V$. At a later stage, $P$ produces a Pedersen commitment $C$, to this value: $C = g^x h^r$ I'm ...
79 views

### Practicality of zero-knowledge proofs

I have on more than one instance come across statements which suggest that zero-knowledge proofs are not practical. One example is: "Our theoretical constructions use zero-knowledge proofs, and ...
28 views

### Zero knowledge token for communicating files one has

Is there a method for individuals to publish a token which indicates having a file in their local set of files without revealing exactly what they have? For these purposes we will consider a file to ...
61 views

### Simple proof of knowledge

It seems to me that signing the hash of the public key with ECDSA should be a sufficient non-interactive proof of knowledge. In my use case, I only need the guarantee that "someone even had ...
69 views

### Can we build a zero knowledge mapping using public-key encryption?

I'm trying to understand if this design is possible. I want to build a mapping that is zero-knowledge, between a (pubkey, proposalId) => bytes form, without ...
89 views

### Helios voting system voting verification

In the decryption step in helios, why do we need Chaum-Pedersen to prove that a certain plaintext $m$ corresponds to a given ciphertext $c$? Why can we just encrypt $m$ and see if it's equal to $c$?
150 views

### Could any one suggest alternative Zero knowledge proof protocol to Schnorr protocol ZKP?

I read that Schnorr protocol cannot be proved zero knowledge on that link: Perfect zero knowledge for the Schnorr protocol? Could any one suggest alternative Zero knowledge proof protocol so a prover ...
306 views

### Difference between Zero Knowledge Range Proof (ZKRP), Zero Knowledge Set Membership (ZKSM) protocols and ZKP

Like to know the difference between Zero Knowledge Range Proof (ZKRP), Zero Knowledge Set Membership (ZKSM) protocols and ZKP? Nathan Aw
139 views

### Verification of data on an untrusted remote storage server

I was looking at tahoe-lafs which accepts a file, encrypts it, does erasure coding on it which generates n shares and then distributes it over the storage servers. The distribution is Share 1 = Server ...
74 views

### Information sharing using interactive zero-knowledge system

I am trying to build a system that would allow information sharing in a kind of zero-knowledge way. Here is the set up: Let's say there is a trusted third party that has Alice's sensitive info M (e.g....
120 views

### Given non-interactive zero-knowledge proofs as a primitive, wouldn't signatures be easily implemented with hashes?

Assume a working non-interactive zero-knowledge proof implementation. Would a public key signature scheme implemented as this work: Bob picks a random a, his ...
143 views

### Why do we always prove cryptographic protocols via completeness and soundness?

Most of the proofs that I have seen for cryptographic protocol include completeness and soundness. Why do we always prove completeness and soundness? Why do we not also see other propertes such as "...
399 views

### Zero-Knowledge Proof of Subgraph Isomorphism

I'm trying to find a Zero-Knowledge proof of subgraph isomorphism in the following scenario: Alice and Bob both know about graphs G1 and ...
64 views

### Role of trusted party in the Ideal model in Malicious case

Imagine there is a protocol supporting outosurced multi party computation. There are three parties involved in the protocol: client $A$, client $B$ and a server. Client $A$ and $B$ send their private ...
248 views

### arithmetic calculation problem to quadratic arithmetic program

I am reading the Pinocchio paper (verifiable computation): http://research.microsoft.com/pubs/180286/pinocchio.pdf The paper is rather hard for me. I am considering this calculation problem: \$(c_1*...
58 views

### Verification of the NI-ZK Proof

I'm currently learning about ZKP and Non-interactive zero knowledge (NI-ZK) but I'm confused in the process of NI-ZK verification. I have taken the following example to learn about NI-ZK from this ...