Anonymous NIZK Proofs of Knowledge with Preprocessing：（匿名NIZK证明知识的预处理）.pdfVIP

Anonymous NIZK Proofs of Knowledge with Preprocessing Stefan0 DAmiano and Giovanni Di CrescenzoW Abstract. In this extended abstract we present an unpublished result in [6] which extends a result in [4]. We give a non-interactive zero-knowledge proof system of knowledge with preprocessing, whose main property is that, after executing two preprocessing phases and given a transcript of a proof phase, the verifier is not able to relate the transcript to any of the two preprocessing phases significantly better than random guessing. The technique used has motivated the cash scheme in [ 3 ] . Because of this result, only mentioned b u t used in [3], the main observation of Pfitzmann et al. in [8] against the cash scheme in [3] doesnt hold. We also discuss the other observations of Pfitzmann et al. in [8] against the cash schemes in [3, 51 and show that all of them dont hold. As a conclusion, the cash schemes in [3, 51 are not broken a t all. 1 The result A non-interactive zero-knowledge (nizk) proof system of knowledge with prepro- cessing is a pair of protocols (preprocessing,proof) between two parties P and V in which, after an int,era.ctivepreprocessing, P can send with a single message to V a zero-knowledge proof that P knows a witness to the truth of a certain statement. Such a system can be used in an electronic cash system by a spender to prove to a shop the knowledge of a signature of a coin released by the bank. Informally, we will say that a nizk proof system with preprocessing is anonymous if any verifier V, after running a pair of preprocessing protocols, and given the transcript of any proof protoc