密码算法与协议5_Zero-Knowledge Proofs.pptVIP

* * * * * * Binary: 二元联系 * * Example Exercise: Prove that the protocol of Figure 5.5 is a ?-protocol for relation {(g1, h1, g2, h2; x1, x2) | h1 = g1x1∨h2 = g2x2}. Solution Solution: To show completeness, consider the case that the prover uses x1. Then we have (modulo n): c1 + c2 = c - c2 + c2 = c, and also, by inspection of the protocol, g1r = g1u+c1x1 = g1u (g1x)c1 = a1h1c1 , g2r = a2h2c2 Of course, completeness also holds if the prover uses x2. * * Example (cont.) Next, we show that special soundness holds. Let (a1, a2, c, c1, c2, r1, r2) and (a1, a2, c’, c1’, c2’, r1’, r2’) be two accepting conversations with c ? c’. Since c = c1 + c2 ? c1’ + c2’ = c’, it follows that c1 ? c1’ or c2 ? c2’ (or, possibly, both). We also have: gr1 = a1h1c1, gr2 = a2h2c2, gr1’ = a1h1c1’ , gr2’ = a2h2c2’ ?gr1-r1’ = h1c1-c1’ , gr2-r2’ = h2c2-c2’ ? h1 = g1(r1-r1’)/(c1-c1’) , h2 = g2(r2-r2’)/(c2-c2’). So, if c1 ? c1’ , we obtain witness x1 = (r1-r1’)/(c1-c1’) satisfying h1 = gx1 . Otherwise c2 ? c2’ and we obtain witness x2 = (r2-r2’)/(c2-c2’) satisfying h2 = gx2. * * Example (cont.) Finally, we show that special honest-verifier zero-knowledge holds. The honest-verifier distribution and simulated distribution are, respectively (considering the case of a prover using x1): {(a1, a2, c, c1, c2, r1, r2) | u1, r2, c2, c ?R Zn; a1 ? gu1; a2 ? gr2h2-c2; c1 ?n c - c2; r1 ?n u1 + c1x1 } {(a1, a2, c, c1, c2, r1, r2) | c, c1, r1, r2 ?R Zn; c2 ?n c – c1; a1 ? gr1h1-c1 ; a2 ? gr2h2-c2} These distributions are identical. For special honest-verifier zero-knowledge, note that c can be chosen freely. * * Example As a slight optimization of the protocol of Figure 5.5, note that the prover may omit sending the value of c2, in which case the verifier must replace the test c1 + c2 =n c ? by the assignment c2 ?n c - c1. Thus, the prover omits sending c2 independent of whether it knows x1 and/or x2. Prove that the resulting protocol is a ?-protoc