Chaum, D., Evertse, J.-H., and van de Graaf, J. An Improved Protocol for Demonstrating Possession of Discrete Logarithms and some Generalizations. In Advances in Cryptology EUROCRYPT '87 (1987), D. Chaum and W. L. Price, Eds., no. 304 in Lecture Notes in Computer Science, SpringerVerlag.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....execute PK (#) y instead of PK (#) y = g . The quantity # is defined as log g , which is the same as log g y in case y is in QR n . Other proofs in a fixed group. A proof of knowledge of a representation of an element y with respect to several bases z 1 , z v G [CEvdG88] is denoted PK (# 1 , # v ) y = z . #v . A proof of equality of discrete logarithms of two group elements y 1 , y 2 G to the bases g and h G, respectively, Cha91, CP93] is denoted PK (#) y 1 = g y 2 = h . Generalizations to prove equalities among ....

David Chaum, Jan-Hendrik Evertse, and Jeroen van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In David Chaum and Wyn L. Price, editors, Advances in Cryptology --- EUROCRYPT '87, volume 304 of Lecture Notes in Computer Science, pages 127--141. SpringerVerlag, 1988.

....of knowledge. 1 Introduction Many complex cryptographic systems, such as payment systems (e.g. see [1, 2, 4] and voting schemes [11] are based on the diculty of the discrete logarithm problem. These systems make use of various minimum disclosure proofs of statements about discrete logarithms [13, 7, 6, 10]. Typical examples are ecient proofs of knowledge of a discrete logarithm which are based on Schnorr s digital signature scheme [18] and systems for proving the equality of two discrete logarithms, as used in [8] The goal of this paper is to identify the basic techniques for proving statements ....

.... proofs of knowledge if they do not meet the strong requirements of [13] It has been shown that proofs of knowledge exist for a large class of problems [14, 3] However, ecient proofs have been found only for some number theoretic problems such as RSA inversion and computing discrete logarithms [15, 7, 6, 18]. Particularly, proofs of knowledge of discrete logarithms and of representations are important ingredients of many cryptographic systems, from simple identi cation and signature schemes up to complex electronic voting and digital payment systems. In the rst example we will present a simple ....

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Advances in cryptology | EUROCRYPT '87, volume 304 of Lecture Notes in Computer Science, pages 127-141. Springer-Verlag, 1988.

.... Milwaukee P.O. Box 784 WI .53201 Milwaukee U.S.A. Michael Walker RacM Reseaxch Ltd. Worton Grange IndustriM Estate Reading, Berks RG2 OSB U.K. Extended Abstract Abstract There is a great similarity between the Fiat Shamir zero knowledge scheme [8] the Chaum Evertse van de Graaf [4], the Beth [1] and the Guillou Quisquater [12 I schemes. The Feige Fiat harnir [7] and the Desmedt [6] proofs of knowledge also look alike. This suggests that a generalization is overdue. We present a general zero knowledge proof which encompasses all these schemes. I. Introduction An ....

....of protocols are zero knowledge, thereby establishing a straightforward set of criteria to determine whether or not a given protocol is zero knowledge. In this paper we consider an algebraic framework which includes the systems of Fiat Shamir [8] Feige Fiat Shamir [7] Chaum Evertse van de Graaf [4], Beth [1] Desmedt [6] and Guillou Quisquater [12] We shall not discuss non interactive zero knowledge protocols [2] To start with we briefly describe the set up of the Fiat Shamir scheme [8] This will help the reader to appreciate the setting for our scheme and to understand the details. ....

[Article contains additional citation context not shown here]

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Advances in Cryptology -- Eurocrypt'87 (Lecture Notes in Computer Science 303), pp. 127-141. Springer-Verlag, Berlin, 1988.

.... cation procedure for S as a (polynomial size) Boolean circuit, and use the protocol from [BrChCr] with the bit commitment scheme just constructed m 24 As an example of a protocol satisfying our conditions, consider the following protocol for proving possession of a discrete log, first found by [ChGr]: We are given a prime p, a generator # of Z; and y 6 Z; The prover claims to know x, such that g = y rood p. She convinces V as follows: 1. P chooses z at random, and sends c = # to V. 2. V chooses a bit b, and sends it to P. 3. If b = 1, P sends z to V, otherwise he sends z rood (p 1) ....

Chaum, van de GraM: "An Improved Protocol for Demonstrating possession of a Discrete Log", Proc. of EuroCrypt 87. IDa] Damgrd: "The Application of Claw Free Functions in Cryptography", PhD- Thesis, Aarhus University, Denmark, May 1988.

.... does not reveal ff, but instead proves to the receiver that log g g = log uK K = log K 1 ( ff) i.e. that the new time line is correctly derived from the mirrored time line, using a (statistical) zero knowledge proof of equality of two discrete logs modulo the same number (N) [CEvdG87, CP92, Bao98]. Call this type of proof EQLOG 1(ff; N ) For conciseness, we will sometimes use [ Delta ] to refer to these zero knowledge proofs. 3. Exchange phase. Now the gradual exchange starts, with Alice and Bob taking turns in revealing their respective v s in ascending order (i.e. halving the ....

D. Chaum, J. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In Advances in Cryptology---EUROCRYPT 87, volume 304 of Lecture Notes in Computer Science, pages 127--141. Springer-Verlag, 1988, 13-- 15 April 1987.

....proof where the prover s probability of cheating is at most 1 q. This condition is su#cient because if x = DL g (y) is not equal to x # = DL h (z) then the prover can pass only if the public coin c is (k x) where k = DL g (u) and k # = DL h (v) This proof system was first proposed [CEvdG87] in a slightly di#erent variant of zero knowledge against any verifier and only 1 2 soundness. This proof system can also be viewed as an extension of Schnorr s public coin proof of knowledge of discrete logarithm [Sch89] and it is indeed also a proof of knowledge. However, we do not use the ....

David Chaum, Jan-Hendrik Evertse, and Jeroen van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In David Chaum and Wyn Price, editors, Proceedings of Eurocrypt 87, volume 0304 of LNCS, pages 127--142. Springer-Verlag, May 1987.

....following hold: m The receiver computes r = ru v mod q, then ends up with the message m blindly signed by the signer with corresponding signature (z , a , b , r ) which may be verified by others. 2. 2 Representation problem The representation problem, introduced by Chaum et al. [4], underpins the protocols of Brands cash system. Simply put, the representation problem is: given a value h and the pair (g 1 , g 2 ) find a pair (x 1 , x 2 ) such that h = g 1 . In fact any number of g i values can be used, and it can be seen that the representation problem is a ....

D. Chaum, E. Evertse, J. Graaf, "An improved protocol for demonstrating possession of discrete logarithms and some generalisations", Eurocrypt `87, LNCS, Springer-Verlag, Vol 304, pp127-141, 87.

.... are authentication, identi cation [5, 20, 21] digital signatures [21] and group signatures [10, 18] From a more general point of view, the idea of satisfying boolean statements (predicates) without leaking any information has been rst introduced by Chaum et al. 13, 15, 22] Numerous schemes [14] allow to combine several proofs to prove more elaborated statements about discrete logarithms; the very rst only covered the case of a single equations connected by AND statement. In 1994, De Santis et al. 25] and Cramer et al. 19] independently discovered a general method to deal with the ....

D. Chaum, J. H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Proc. of Eurocrypt '87, volume 304 of LNCS, pages 127{

.... scheme is known to be honest verifier zero knowledge but we do not know how to prove the zero knowledge property if the verifier can bias the distribution of the challenges when they are large enough, i.e. Order of the multiplicative group KNOWN UNKNOWN Chaum Everste van de Graaf Peralta [7, 6] Order of g Beth [al Girault [12] KNOWN Schnorr [27] Biham Shulnmn [4] Okamoto [24] Order of g Girault Poupard Stern [13, 25] Brickell McCurley 5] UNKNOWN Poupard Stern [26] Fig. 1. Discrete log related schemes when B is non polynomial. As a consequence, we can only prove the security of ....

D. Chaum, J. Evertse, and J. van de Graaf. An Improved Protocol for Demonstrating Possession of Discrete Logarithms and sonhe Generalizations. In Eurocrypt '87, LNCS 304, pages 127 141. SpringerVerlag, 1988.

....holds for all other protocols described in this section (when not mentioned otherwise) Adopting the notation in [7] we denote this protocol by PKf( y = g g, where PK stands for proof of knowledge . Proving the knowledge of a representation of the element y to the bases g 1 ; g l [4, 10], i.e. proving the knowledge of integers x 1 ; x l such that y = x i i . This protocol is an extension of the previous one to multiple bases. The prover chooses random r 1 ; r l 2R Z Q , computes t : i=1 g r i i , and sends t to the verifier. The verifier picks a random ....

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Advances in Cryptology --- EUROCRYPT '87,

....We refer to [BN00] for further details. Equality of discrete logs. Our constructions will be using (statistical) proofs of knowledge (PK) of equality of two discrete logs modulo the same number (say, n) or in di erent moduli. Proofs for equality modulo the same number have been considered in [CEvdG87, CP92, Bao98]. We will use EQLOG 1(x;n) to refer to these proofs. Proofs for equality of two (or more) discrete logs (alternatively, a discrete log and a committed number, or two committed numbers) in di erent moduli have been considered in [BT99, CM99] Speci cally, and following [BT99] let t, l and s be ....

David Chaum, Jan-Hendrik Evertse, and Jeroen van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In Advances in Cryptology|EUROCRYPT 87, volume 304 of Lecture Notes in Computer Science, pages 127{ 141. Springer-Verlag,

No context found.

Chaum, D., Evertse, J.-H., and van de Graaf, J. An Improved Protocol for Demonstrating Possession of Discrete Logarithms and some Generalizations. In Advances in Cryptology EUROCRYPT '87 (1987), D. Chaum and W. L. Price, Eds., no. 304 in Lecture Notes in Computer Science, SpringerVerlag.

No context found.

Chaum, D., Evertse, J.-H., and van de Graaf, J. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In Advances in Cryptology EUROCRYPT '87 (1987), D. Chaum and W. L. Price, Eds., no. 304 in Lecture Notes in Computer Science, SpringerVerlag.

No context found.

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In Advances in Cryptology -- Eurocrypt'87, number 304 in Lecture Notes in Computer Science, pages pp. 127--141, 1988.

No context found.

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Advances in Cryptology --- EUROCRYPT '87, volume 304 of LNCS, pages 127--141. Springer-Verlag, 1988.

No context found.

D. Chaum, J.-H. Evertse and J. van de Graaf, "An improved protocol for demonstrating possession of discrete logarithms and some generalizations", in Advances in Cryptology- EUROCRYPT'87, LNCS 304. Berlin: SpringerVerlag, 1988, pp. 127-141.

No context found.

D. Chaum, J.H. Evertse, and J van de Graaf, An improved protocol for demonstrating possession of discrete logarithms and some generalizations, Advances in Crypto-EUROCRYPT'87, (1988)127-141.

No context found.

D. Chaum, J. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In Advances in Cryptology|EUROCRYPT 87, volume 304 of Lecture Notes in Computer Science, pages 127-141. Springer-Verlag, 1988, 13{ 15 April 1987.

No context found.

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Advances in Cryptology --- EUROCRYPT '87, volume 304 of LNCS, pages 127--141. Springer-Verlag, 1988.

No context found.

David Chaum, Jan-Hendrik Evertse, and Jeroen van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In David Chaum and Wyn L. Price, editors, Advances in CryptologyEUROCRYPT 87, volume 304, pages 127141. SpringerVerlag, 1988, 1315 April 1987.

No context found.

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Advances in Cryptology---EUROCRYPT 87, volume 304 of Lecture Notes in Computer Science, pages 127--141. IACR, Springer-Verlag, 1988.

No context found.

D. Chaum, J.-H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Advances in Lecture Notes in Computer Science, pages 127--141. International Association for Cryptologic Research, Springer-Verlag, Berlin Germany, 1988.

No context found.

D Chaum, J.E Evertse, and J van de Graaf, An improved protocol for demonstrating possession of discrete logarithms and some generalizations, Advances in Cryptology-EUROCRYPT'87, pp 127-141, Berlin: Springer, 1988.

No context found.

D Chaum, J.E Evertse, and J van de Graaf, An improved protocol for demonstrating possession of discrete logarithms and some generalizations, Advances in Cryptology-EUROCRYPT'87, pp 127-141, Berlin: Springer, 1988.

No context found.

D. Chaum, J. H. Evertse, and J. van de Graaf. An improved protocol for demonstrating possession of discrete logarithms and some generalizations. In D. Chaum and W. L. Price, editors, Proc. of Eurocrypt '87, volume 304 of LNCS, pages 127--

First 50 documents  Next 50

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC