New answers tagged

3

This is a valid paradigm for building a signature scheme, although a secure commitment scheme should be used to commit to $k$ instead of just using $H(k)$ as the public key. This type of construction was published by Bellare and Goldwasser at CRYPTO'89; see New Paradigms for Digital Signatures and Message Authentication Based on Non-Interactive Zero ...


1

In the original Pinocchio [GGPR13], the authors didn't use R1CS at all. As a ZKP friendly computational representation, R1CS was proposed later that year in [BCGTV13] Appendix E. The reduction from an arithmetic circuit to R1CS is quite straightforward, which I guess is the reason why there's no dedicated papers introducing such a computation model. Soon ...


1

In Crypto 94, Cramer, Damgård and Schoenmakers proposed Proofs of Partial Knowledge and Simplified Design of Witness Hiding Protocols with abstract below: Suppose we are given a proof of knowledge $P$ in which a prover demonstrates that he knows a solution to a given problem instance. Suppose also that we have a secret sharing scheme $S$ on $n$ participants. ...


3

The philosophy behind the extractor and knowledge is that if the prover can generate the proof, then it could itself run the extractor. Therefore, if it can prove, then it knows the witness. If the extractor runs in super polynomial time, then the prover itself cannot run the extractor. Note that if you took this to an extreme, then in exponential time it is ...


0

"Can we say 𝜋 satifies SHVZK?. My doubt is In SHVZK, simulator produces accepting transcript where as in ZK property there is no condition about acceptance of transcript generated by simulator." Your doubt is correct but it does depend on how the property is formalised. ZK quantifies over all x in the language, whereas normally SHVZK requires that ...


3

For the discrete case, you can just use any zk-SNARK that generalizes over arithmetic circuits. There is no direct way to do a zero-knowledge proof over the reals. However, you can map linear operations over real numbers to operations in the field you are working in by first proving an upper bound on your inputs. Since the circuit is public the verifier can ...


3

A Polynomial Commitment is a cryptographic object that binds a party, typically the prover, to a single polynomial. This object could be an elliptic curve point, such as in KZG or Bulletproofs en element of a group of unknown order, such as in DARK the root of a Merkle tree of a Reed-Solomon codeword, such as in FRI. The point is that underlying this ...


Top 50 recent answers are included