# Tag Info

Accepted

### Understanding the "rewinding argument"

As far as I know, you got the point. "Rewinding" is just the "look-ahead" strategy made possible by oracle access of the simulator to the verifier It's usually referred to as "...
• 448

### Understanding the "rewinding argument"

Rewinding a program is common in computing. One way to call it is taking a snapshot, then re-running it, as virtual execution environments allow. One application is finishing a classic arcade game ...
• 122k
1 vote

### Σ-protocol that proves an even number was committed using Pedersen commitment scheme

A standard Pedersen commitment range proof will demonstrate that $y$ is constructed from the addition of a series of powers of 2. All you have to do is slightly modify the range proof so that you do ...
• 2,523
1 vote

### Zero Knowledge proof of correct ElGamal encryption

The proof doesn't work (even if you fix it up by having the prover initially send $R_1, R_2$, rather than $q_1, q_2$, which you likely intended); the holder of the private key can generate a valid ...
• 131k
1 vote
Accepted

### Authenticated Diffie-Hellman with no proofs that each one keys are the right keys. Is it possible?

If what you are describing were possible, then we wouldn't need certificate authorities. The paper you've linked to uses a technique that only works if Alice and Bob already know each other's long-...
• 2,523
1 vote

### Why are zk-STARK quantum secure?

The only cryptographic primitive required for a zk-STARK is a cryptographically secure hash function, which we will denote $H$. Known quantum vulnerable forms of cryptography all depend on some other ...
• 9,576

Only top scored, non community-wiki answers of a minimum length are eligible