New answers tagged zero-knowledge-proofs
1
Special Honest Verifier Zero-Knowledge is a particular case of Honest Verifier Zero-Knowledge; that is, if a protocol satisfies SHVZK, it satisfies HVZK. SHVZK has been introduced to simplify discussions about $\Sigma$-protocols. In $\Sigma$-protocols, HVZK is typically proven as follows: fix an arbitrary challenge $e$, and show that it is possible to ...
1
I've always used it as #1. Hyperledger Ursa has an implementation in Rust
(see https://github.com/hyperledger/ursa/tree/master/libzmix/bbs).
However, it is a type of group signature which allows the type of signing of multiple messages.
When someone says to me group signature I immediately think your #2. If we look at a paper written by David Chaum (https://...
2
Here's a recent doctoral thesis with a decent literature review.
https://discovery.ucl.ac.uk/id/eprint/10073525/
0
I think it is possible to skip Q' and R' computation. The idea is practically the same as in István András Seres answer.
To prove that $P = g_1^ah_1^{r_1}$ and $Q=g_2^b h_2^{r_2}$ combined commit to the same value as $R = g_3^{a+b}h_3^{r_3}$ prover has to compute the following:
$z_1, z_2, z_3, z_4, z_5 \leftarrow Z^*$
$t_1 = g_1^{z_1}h_1^{z_2}$
$t_2 = g_3^{...
1
It seems that in order to compare a variable a and a constant c, all we need is to compare them bitwise. Since c is a constant, we do not need to introduce any new witness variables to get its unpacking. We can just directly use the bits of c as constants without specifying anywhere that those bits come from the c constant.
We'll use the convention that the ...
4
Yes, and in fact, Schnorr's signature scheme was originally described as a non-interactive protocol. I think the confusion around interactivity comes from the fact that the same paper first described a interactive identification scheme, which can be viewed as a specialization of the signature scheme for empty messages.
In both schemes, challenges can be ...
3
If you're using the syntax $<a, b>$ to mean dot-product, then the assumption that you make:
a binary vector is the only vector where $<a,a>=<a,1>$
is incorrect. It is correct in the ring $\mathbb{Z}$, however we're not in the integers, we're in a finite field.
Counterexamples in finite fields are easy to find; for example, in $GF(11)$ (...
1
This is certainly possible using only standard Sigma-protocols and compose them together. But first, let's introduce the used standard Sigma-protocol building blocks:
Equality of committed values in two Pedersen commitments
Given Pedersen commitments $P=g_1^a h_1^{r_1} $ and $P'=g_2^{a'} h_2^{r_2} $, one can show in zero-knowledge using a Sigma-protocol ...
Top 50 recent answers are included
