New answers tagged zero-knowledge-proofs
1
If I understand it right, you want a way to prove, given a list $\{A, B, C, D, \cdots\}$ of public keys, that some given key $K$ is "the tag" corresponding to a pair of key from this list, without revealing which one. Let me call this a "valid tag".
For simplicity, suppose that $K$ is the tag of Alice and Bob. Either Alice or Bob can ...
0
I never know the practical case for ECDH to be used for a group of key pairs like that. There are formal ways to split secrete for a group of people more than 2. e.g. https://en.wikipedia.org/wiki/Secret_sharing
AFAIK, ECDH should be used to create shared secrete between exactly 2 parties.
From the computational DH assumption, K is meaningless for the other ...
0
Consider an interactive argument $(P,V)$ for witness relation $R\subseteq X\times W$. A argument is honest verifier zero knowledge if there exists a probabilistic polytime simulator $S$ such that for all $(x,w)\in R$, the following probability distributions (on the randomness of $P$ and $V$) are close:
$$S(x)\approx\text{View}_V(P(x,w),V(w))$$
For $t$-...
0
For many hash functions, the best known quantum attacks are based on Grover Search. This speeds up an $O(N)$ operation to $O(\sqrt{N})$, so is a speedup, but only by a "polynomial" factor (it does not speed up an $O(2^N)$ operation to $O(N)$, or something like that).
My understanding though is that there can never be a perfectly collision-...
2
Zero-knowledge was initially defined with respect to arbitrary (possibly unbounded) provers. However, when we use or discuss zero-knowledge in cryptography, we almost always implicitly assume ZK for NP where the prover runs in polynomial time given a witness for the statement. This is the type of zero-knowledge proof the paper was referring to, and this is ...
Top 50 recent answers are included