New answers tagged

1

And I checked some related works, and most of them only considered the dictionary attack and forward security. Actually, a PAKE has two security goals: That someone cannot recover the password from a number of exchanges (with any greater advantage than being able to test $N$ potential passwords using $N$ active attacks). That someone will not be ...


1

As you mention, phone numbers have low entropy. Someone who "doesn't know" a phone number at the time of the proof can easily obtain the phone number later. You won't be able to find a non-interactive solution to this problem -- an attacker can always run a dictionary attack and use your "proof" as a test for whether they've found the ...


1

I don't think that works with keeping the message private - unless you break the signature scheme by reusing the nonce. Your variables $c_1$ and $c_2$ are the results of the hash function. And those can not be the same by the definition of $r$ being a nonce. Moreover: the hash function does not retain any algebraic structure. By the definition of hash ...


0

I'm guessing: "HVZK" stands for "honest-verifier zero knowledge", right? Your objection is that a dishonest verifier can choose a random $x_i$, compute $\rho_i\equiv x_i^2\mod N$, and then when they get $\sigma_i$ from the prover, there is a $1/4$ chance that $gcd(\sigma_i-x_i,N)$ is a non-trivial factor. But an honest verifier should ...


0

In a zero-knowledge proof system, there are three main properties to be satisfied: completeness, soundness (knowledge soundness for zkpok), and zero-knowledge (or weaker notion such as witness indistinguishability). one of soundness and zero-knowledge is computationally error-bounded, i.e. you can either than a (computational soundness + statistical zk) ...


1

You can use the same $g$. However, if the discrete log of $h$ relative to $g$ is known, then Pedersen is no longer binding. Thus, you cannot use an $h$ if there is any possibility of someone else knowing that discrete log.


3

my question is why the verifier sends a challenge, would he be convinced if the prover just sends $t=r+x$ and the verifier tests if $g^t=g^w \cdot y$ ? That is, why doesn't the prover just send $t$ and $y$? Well, anyone can pick a random $t$ and compute $y = g^t \cdot (g^w)^{-1}$. Because $g^w$ is public, this can be computed by anyone, and so wouldn't ...


0

There're different approaches to build ZKP for different statements. E.g., there'e ad-hoc protocols: Schnorr protocol allows you to build a proof of knowledge of discrete logarithm of some group element. There're also universal ZKP protocols, which allows you to build a proof for any statement, formulated as a computational circuit. This is a relatively new ...


Top 50 recent answers are included