An Improved Protocol for Demonstrating Possession of Discrete Logarithms and Some Generalizations

Chaum, David; Evertse, Jan–Hendrik; Graaf, Jeroen van de

doi:10.1007/3-540-39118-5_13

Cited by 168 publications

(103 citation statements)

References 9 publications

(3 reference statements)

Supporting

Mentioning

103

Contrasting

Order By: Relevance

“…This protocol is derived from proofs of equality of two discrete logarithms from [6,12,1], combined with a proof of knowledge of a discrete logarithm modulo n [16]. , r 2 )).…”

Section: Proof That Two Commitments Hide the Same Secretmentioning

confidence: 99%

Efficient Proofs that a Committed Number Lies in an Interval

Boudot

2000

Advances in Cryptology — EUROCRYPT 2000

350

337

View full text Add to dashboard Cite

Abstract. Alice wants to prove that she is young enough to borrow money from her bank, without revealing her age. She therefore needs a tool for proving that a committed number lies in a specific interval. Up to now, such tools were either inefficient (too many bits to compute and to transmit) or inexact (i.e. proved membership to a much larger interval). This paper presents a new proof, which is both efficient and exact. Here, "efficient" means that there are less than 20 exponentiations to perform and less than 2 Kbytes to transmit. The potential areas of application of this proof are numerous (electronic cash, group signatures, publicly verifiable secret encryption, etc . . . ).

show abstract

“…This protocol is derived from proofs of equality of two discrete logarithms from [6,12,1], combined with a proof of knowledge of a discrete logarithm modulo n [16]. , r 2 )).…”

Section: Proof That Two Commitments Hide the Same Secretmentioning

confidence: 99%

Efficient Proofs that a Committed Number Lies in an Interval

Boudot

2000

Advances in Cryptology — EUROCRYPT 2000

350

337

View full text Add to dashboard Cite

show abstract

“…The construction combines the qTMC scheme of section 3 with a programmable hash function H G : T → G and techniques that were introduced in [3]. Programmable hash functions, as formalized by Hofheinz and Kiltz [17], are designed in such a way that a trapdoor information makes it possible to relate the output H G (M ), which lies in a group The number theoretic hash function used in [11,25] is an example of such a (1, )-programmable hash function, for some polynomial . …”

Section: Definition 2 [15] a Zk-edb Protocol Is Strongly Independentmentioning

confidence: 99%

Concise Mercurial Vector Commitments and Independent Zero-Knowledge Sets with Short Proofs

Libert

Yung

2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Introduced by Micali, Rabin and Kilian (MRK), the basic primitive of zero-knowledge sets (ZKS) allows a prover to commit to a secret set S so as to be able to prove statements such as x ∈ S or x ∈ S. Chase et al. showed that ZKS protocols are underlain by a cryptographic primitive termed mercurial commitment. A (trapdoor) mercurial commitment has two commitment procedures. At committing time, the committer can choose not to commit to a specific message and rather generate a dummy value which it will be able to softly open to any message without being able to completely open it. Hard commitments, on the other hand, can be hardly or softly opened to only one specific message. At Eurocrypt 2008, Catalano, Fiore and Messina (CFM) introduced an extension called trapdoor q-mercurial commitment (qTMC), which allows committing to a vector of q messages. These qTMC schemes are interesting since their openings w.r.t. specific vector positions can be short (ideally, the opening length should not depend on q), which provides zero-knowledge sets with much shorter proofs when such a commitment is combined with a Merkle tree of arity q. The CFM construction notably features short proofs of non-membership as it makes use of a qTMC scheme with short soft openings. A problem left open is that hard openings still have size O(q), which prevents proofs of membership from being as compact as those of non-membership. In this paper, we solve this open problem and describe a new qTMC scheme where hard and short position-wise openings, both, have constant size. We then show how our scheme is amenable to constructing independent zero-knowledge sets (i.e., ZKS's that prevent adversaries from correlating their set to the sets of honest provers, as defined by Gennaro and Micali). Our solution retains the short proof property for this important primitive as well.

show abstract

“…The proposed protocol is efficient because each step can be completed in one round. During the registration step, as shown in Figure 1, by providing y 1 (which is used for achieving anonymity), B convinces RC of possession of x B1 via a zero-knowledge proof [6]. We omit the copyright violator identification step as it is straightforward and irrelevant to our attacks and discussions in this paper.…”

Section: − −−−−−−−−−−−−−−−−−−−−−−−−−−− →mentioning

confidence: 99%

Cryptanalysis of a Generalized Anonymous Buyer-Seller Watermarking Protocol of IWDW 2004

Goi

Phan

Siddiqi

2005

Embedded and Ubiquitous Computing – EUC 2005 Workshops

View full text Add to dashboard Cite

Abstract.In this paper, we analyze the security of a generalized anonymous buyer-seller watermarking protocol recently proposed by Choi and Park at IWDW 2004. We prove that it has not met the designers' intended security criteria by showing that an attacker can actually: (1) discover the unique buyer's watermark which was chosen by the watermark certificate center (W CC), and (2) decrypt the encrypted watermarked digital content without any extra cost. Also, it is surprising to note that when designing their protocol, the designers did not take into consideration the conspiracy attacks.

show abstract

An Improved Protocol for Demonstrating Possession of Discrete Logarithms and Some Generalizations

Cited by 168 publications

References 9 publications

Efficient Proofs that a Committed Number Lies in an Interval

Efficient Proofs that a Committed Number Lies in an Interval

Concise Mercurial Vector Commitments and Independent Zero-Knowledge Sets with Short Proofs

Cryptanalysis of a Generalized Anonymous Buyer-Seller Watermarking Protocol of IWDW 2004

Contact Info

Product

Resources

About