[curves] Non-interactive zero knowledge proofs of discrete log equivalence
bascule at gmail.com
Fri Feb 24 20:45:13 PST 2017
On Thu, Feb 23, 2017 at 5:31 PM, isis agora lovecruft <
isis at patternsinthevoid.net> wrote:
> Schnorr notes in his original paper that "the protocol is not zero
> because the tripel" (W',R,C) "may be a particular solution to the equation"
> W' = g R + h C, however, with randomly chosen basepoints each time the
> protocol is run (i.e. the prover chooses a new g and h each time and sends
> these along with the proof), I don't see the issue. (I might just be
> something obvious.)
> Another paper worth reading is (1988) "Zero Knowledge Proofs of Identity"
> Feige, Fiat, and Shamir. 
> Hopefully that helps!
Awesome, thanks for the pointers, Iris!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Curves