<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Ah, I see.<div class=""><br class=""></div><div class="">For that objective, your construction looks reasonable if m’ is a one-time challenge from the verifier. But you would need a proof of security to be sure.</div><div class=""><br class=""></div><div class="">— Mike</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 17, 2016, at 11:50 AM, Jan Moritz Lindemann <<a href="mailto:panda@panda.cat" class="">panda@panda.cat</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Probably I was a little bit wrong in my formulation. The objective is to prove that I know a signature without that the receiver of the proof can be capable of pretending that he knows it.<br class="">Do you think that the design is suitable and safe for such an use case?<br class=""></div><div class="gmail_extra"><br class=""><div class="gmail_quote">2016-02-17 14:39 GMT-05:00 Mike Hamburg <span dir="ltr" class=""><<a href="mailto:mike@shiftleft.org" target="_blank" class="">mike@shiftleft.org</a>></span>:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word" class=""><div class="">It seems to me that the StackExchange comments on this are correct. That is, your technique doesn’t reveal s, but it is not zero-knowledge with respect to (r,s). Instead, it reveals r and sR, which provide nonzero “knowledge” about (r,s).</div><div class=""><br class=""></div><div class="">This is important, because someone who wants a zkp for these signatures probably doesn’t want the proofs to be linkable. That is, they don’t want there to be an efficient algorithm which sees only the zkp’s to be able to tell if they came from the same starting signature (r,s). Since your technique reveals (r,sR), it is linkable.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">— Mike</div><br class=""><div class=""><blockquote type="cite" class=""><div class=""><div class="h5"><div class="">On Feb 17, 2016, at 11:14 AM, Jan Moritz Lindemann <<a href="mailto:panda@panda.cat" target="_blank" class="">panda@panda.cat</a>> wrote:</div><br class=""></div></div><div class=""><div class=""><div class="h5"><div dir="ltr" class=""><span style="font-size:12.8px" class="">Some days ago I posted a design for a zkp on ECDSA signatures and I would like it to be peer reviewed.</span><div style="font-size:12.8px" class="">Zkp proposal can be seen here: <a href="http://crypto.stackexchange.com/a/32608" target="_blank" class="">http://crypto.stackexchange.com/a/32608</a></div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">Jan Moritz,</div><div style="font-size:12.8px" class=""><br class=""></div><div style="font-size:12.8px" class="">PS: Do you know any other zkp on ECDSA sigantures?</div></div></div></div>
_______________________________________________<br class="">Curves mailing list<br class=""><a href="mailto:Curves@moderncrypto.org" target="_blank" class="">Curves@moderncrypto.org</a><br class=""><a href="https://moderncrypto.org/mailman/listinfo/curves" target="_blank" class="">https://moderncrypto.org/mailman/listinfo/curves</a><br class=""></div></blockquote></div><br class=""></div></blockquote></div><br class=""></div>
</div></blockquote></div><br class=""></div></body></html>