New answers tagged zero-knowledge-proofs
1
And I checked some related works, and most of them only considered the dictionary attack and forward security.
Actually, a PAKE has two security goals:
That someone cannot recover the password from a number of exchanges (with any greater advantage than being able to test $N$ potential passwords using $N$ active attacks).
That someone will not be ...
1
As you mention, phone numbers have low entropy. Someone who "doesn't know" a phone number at the time of the proof can easily obtain the phone number later. You won't be able to find a non-interactive solution to this problem -- an attacker can always run a dictionary attack and use your "proof" as a test for whether they've found the ...
1
I don't think that works with keeping the message private - unless you break the signature scheme by reusing the nonce.
Your variables $c_1$ and $c_2$ are the results of the hash function. And those can not be the same by the definition of $r$ being a nonce. Moreover: the hash function does not retain any algebraic structure. By the definition of hash ...
0
I'm guessing:
"HVZK" stands for "honest-verifier zero knowledge", right? Your objection is that a dishonest verifier can choose a random $x_i$, compute $\rho_i\equiv x_i^2\mod N$, and then when they get $\sigma_i$ from the prover, there is a $1/4$ chance that $gcd(\sigma_i-x_i,N)$ is a non-trivial factor. But an honest verifier should ...
0
In a zero-knowledge proof system, there are three main properties to be satisfied: completeness, soundness (knowledge soundness for zkpok), and zero-knowledge (or weaker notion such as witness indistinguishability).
one of soundness and zero-knowledge is computationally error-bounded, i.e. you can either than a (computational soundness + statistical zk) ...
1
You can use the same $g$. However, if the discrete log of $h$ relative to $g$ is known, then Pedersen is no longer binding. Thus, you cannot use an $h$ if there is any possibility of someone else knowing that discrete log.
3
my question is why the verifier sends a challenge, would he be convinced if the prover just sends $t=r+x$ and the verifier tests if $g^t=g^w \cdot y$ ?
That is, why doesn't the prover just send $t$ and $y$? Well, anyone can pick a random $t$ and compute $y = g^t \cdot (g^w)^{-1}$. Because $g^w$ is public, this can be computed by anyone, and so wouldn't ...
0
There're different approaches to build ZKP for different statements.
E.g., there'e ad-hoc protocols: Schnorr protocol allows you to build a proof of knowledge of discrete logarithm of some group element.
There're also universal ZKP protocols, which allows you to build a proof for any statement, formulated as a computational circuit. This is a relatively new ...
Top 50 recent answers are included
