4 votes
Accepted

Understanding the "rewinding argument"

As far as I know, you got the point. "Rewinding" is just the "look-ahead" strategy made possible by oracle access of the simulator to the verifier It's usually referred to as "...
user avatar
  • 448
2 votes

Understanding the "rewinding argument"

Rewinding a program is common in computing. One way to call it is taking a snapshot, then re-running it, as virtual execution environments allow. One application is finishing a classic arcade game ...
user avatar
  • 122k
1 vote

Σ-protocol that proves an even number was committed using Pedersen commitment scheme

A standard Pedersen commitment range proof will demonstrate that $y$ is constructed from the addition of a series of powers of 2. All you have to do is slightly modify the range proof so that you do ...
user avatar
  • 2,523
1 vote

Zero Knowledge proof of correct ElGamal encryption

The proof doesn't work (even if you fix it up by having the prover initially send $R_1, R_2$, rather than $q_1, q_2$, which you likely intended); the holder of the private key can generate a valid ...
user avatar
  • 131k
1 vote
Accepted

Authenticated Diffie-Hellman with no proofs that each one keys are the right keys. Is it possible?

If what you are describing were possible, then we wouldn't need certificate authorities. The paper you've linked to uses a technique that only works if Alice and Bob already know each other's long-...
user avatar
  • 2,523
1 vote

Why are zk-STARK quantum secure?

The only cryptographic primitive required for a zk-STARK is a cryptographically secure hash function, which we will denote $H$. Known quantum vulnerable forms of cryptography all depend on some other ...
user avatar
  • 9,576

Only top scored, non community-wiki answers of a minimum length are eligible