New answers tagged

1

Special Honest Verifier Zero-Knowledge is a particular case of Honest Verifier Zero-Knowledge; that is, if a protocol satisfies SHVZK, it satisfies HVZK. SHVZK has been introduced to simplify discussions about $\Sigma$-protocols. In $\Sigma$-protocols, HVZK is typically proven as follows: fix an arbitrary challenge $e$, and show that it is possible to ...


1

I've always used it as #1. Hyperledger Ursa has an implementation in Rust (see https://github.com/hyperledger/ursa/tree/master/libzmix/bbs). However, it is a type of group signature which allows the type of signing of multiple messages. When someone says to me group signature I immediately think your #2. If we look at a paper written by David Chaum (https://...


2

Here's a recent doctoral thesis with a decent literature review. https://discovery.ucl.ac.uk/id/eprint/10073525/


0

I think it is possible to skip Q' and R' computation. The idea is practically the same as in István András Seres answer. To prove that $P = g_1^ah_1^{r_1}$ and $Q=g_2^b h_2^{r_2}$ combined commit to the same value as $R = g_3^{a+b}h_3^{r_3}$ prover has to compute the following: $z_1, z_2, z_3, z_4, z_5 \leftarrow Z^*$ $t_1 = g_1^{z_1}h_1^{z_2}$ $t_2 = g_3^{...


1

It seems that in order to compare a variable a and a constant c, all we need is to compare them bitwise. Since c is a constant, we do not need to introduce any new witness variables to get its unpacking. We can just directly use the bits of c as constants without specifying anywhere that those bits come from the c constant. We'll use the convention that the ...


4

Yes, and in fact, Schnorr's signature scheme was originally described as a non-interactive protocol. I think the confusion around interactivity comes from the fact that the same paper first described a interactive identification scheme, which can be viewed as a specialization of the signature scheme for empty messages. In both schemes, challenges can be ...


3

If you're using the syntax $<a, b>$ to mean dot-product, then the assumption that you make: a binary vector is the only vector where $<a,a>=<a,1>$ is incorrect. It is correct in the ring $\mathbb{Z}$, however we're not in the integers, we're in a finite field. Counterexamples in finite fields are easy to find; for example, in $GF(11)$ (...


1

This is certainly possible using only standard Sigma-protocols and compose them together. But first, let's introduce the used standard Sigma-protocol building blocks: Equality of committed values in two Pedersen commitments Given Pedersen commitments $P=g_1^a h_1^{r_1} $ and $P'=g_2^{a'} h_2^{r_2} $, one can show in zero-knowledge using a Sigma-protocol ...


Top 50 recent answers are included