J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe prime. In Advances in Cryptology --- EUROCRYPT'99, LNCS 1592, pages 107--122, 1999.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....1 ; g 1 ; g m ) and (n 2 ; h 1 ; hm ) and the values C 1 2 QR n1 and C 2 2 QR n 2 , the prover proves knowledge of values 1 ; m such that C 1 = i mod n 1 . and C 2 = i=1 h i mod n 2 . Proof that a committed value is the product of two other committed values [CM99a] That is to say, a protocol with common inputs (1) a commitment key (n; g; h) as described in Section 4.5.1; and (2) values C a , C b , C ab in QR n , where the prover proves knowledge of the integers , 1 , 2 , 3 such that C a = g 1 mod n, C b = g 2 mod n, and C ab = g ....

....at random, the proof of security for the protocol in Figure 4 2 goes through so long as just one of the commitment keys was chosen in this fashion. The other one may be chosen in an arbitrary way, with various parameters known to the adversary. This observation is due to Camenisch and Michels [CM99a] 4.5.5 Proof That a Committed Value Lies in an Interval The last proof of knowledge protocol we will need in this section is a proof that a committed value lies in an interval. This is due to Lipmaa [Lip01] using earlier work 70 of Boudot[Bou00] and of Chan, Frankel and Tsiounis [CFT98] ....

[Article contains additional citation context not shown here]

Jan Camenisch and Markus Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In Jacques Stern, editor, Notes in Computer Science, pages 107-122. Springer Verlag, 1999.

No context found.

Jan Camenisch and Markus Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In Jacques Stern, editor, Advances in Cryptology --- EUROCRYPT '99, volume 1592 of LNCS, pages 107--122. Springer Verlag, 1999.

No context found.

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In J. Stern, editor, Advances in Cryptology --- EUROCRYPT '99, volume 1592 of LNCS, pages 107--122. Springer Verlag, 1999.

No context found.

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In J. Stern, editor, Advances in Cryptology --- EUROCRYPT '99, volume 1592 of LNCS, pages 107--122. Springer Verlag, 1999.

No context found.

J. Camenisch and M. Michels, Proving in zero-knowledge that a number n is the product of two safe primes, Advances in Cryptology --- EUROCRYPT '99 (J. Stern, ed.), LNCS, vol. 1592, Springer Verlag, 1999, pp. 107--122.

....O i , q O i ) as its secret key and publishes PKO i : n O i , aO i , b O i , dO i , g O i , hO i ) as its public key. In the public key model, we assume that there is a special entity that verifies, through a zero knowledge protocol with O i , that nO i is the 8 product of two safe primes (see [CM99a] for how this can be done e#ciently) and that the elements aO i , b O i , dO i , g O i , hO i are indeed in QR (see, for example, Goldwasser et al. GMR85] Alternatively, this can be carried out in the random oracle model using the Fiat Shamir heuristic [FS87] The parameter # # should be ....

Jan Camenisch and Markus Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In Jacques Stern, editor, Advances in Cryptology --- EUROCRYPT '99, volume 1592 of Lecture Notes in Computer Science, pages 107--122. Springer Verlag, 1999.

....1 , g 1 , g m ) and (n 2 , h 1 , hm ) and the values C 1 QR n1 and C 2 QR n2 , the prover proves knowledge of values # 1 , #m such that C 1 = i mod n 1 and C 2 = i mod n 2 . Proof that a committed value is the product of two other committed values [8]. That is to say, a protocol with common inputs (1) a commitment key (n, g, h) as described in Section 5.1; and (2) values C a , C b , C ab in QR n , where the prover proves knowledge of the integers #, #, # 1 , # 2 , # 3 such that C a = g #1 mod n, C b = g #2 mod n, and C ab = g #3 ....

....to the protocols above give us protocols for signing blocks of committed values, and to prove knowledge of a signature on blocks of committed values. We also note that, using any protocol for proving relations among components of a discrete logarithm representations of a group element [11, 8, 5], can be used to demonstrate relations among components of a signed block of messages. We highlight this point by showing a protocol that allows an o# line double spending test. In order to enable an o# line double spending test, a credential is a signature on a tuple (SK, N 1 , N 2 ) and in a ....

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In J. Stern, editor, Advances in Cryptology --- EUROCRYPT '99, volume 1592 of Lecture Notes in Computer Science, pages 107--

.... (n 1 ; g 1 ; g m ) and (n 2 ; h 1 ; hm ) and the values C 1 2 QR n 1 and C 2 2 QR n 2 , the prover proves knowledge of values 1 ; m such that C 1 = i mod n 1 and C 2 = i mod n 2 : Proof that a committed value is the product of two other committed values [8]. That is to say, a protocol with common inputs (1) a commitment key (n; g; h) as described in Section 5.1; and (2) values C a , C b , C ab in QR n , where the prover proves knowledge of the integers , 1 , 2 , 3 such that C a = g 1 mod n, C b = g 2 mod n, and C ab = g ....

....cations to the protocols above give us protocols for signing blocks of committed values, and to prove knowledge of a signature on blocks of committed values. We also note that, using any protocol for proving relations among components of a discrete logarithm representations of a group element [11, 8, 5], can be used to demonstrate relations among components of a signed block of messages. We highlight this point by showing a protocol that allows an o line double spending test. In order to enable an o line double spending test, a credential is a signature on a tuple (SK; N 1 ; N 2 ) and in a ....

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In J. Stern, editor, Advances in Cryptology | EUROCRYPT '99, volume 1592 of Lecture Notes in Computer Science, pages 107-122. Springer Verlag, 1999.

....(p O i ; q O i ) as its secret key and publishes PKO i : n O i ; aO i ; b O i ; dO i ; g O i ; hO i ) as its public key. In the public key model, we assume that there is a special entity that veri es, through a zero knowledge protocol with O i , that nO i is the product of two safe primes (see [CM99a] for how this can be done eciently) and that the elements aO i ; b O i ; dO i ; g O i ; hO i are indeed in QR nO i (see, for example, Goldwasser et al. GMR85] Alternatively, this can be carried out in the random oracle model using the Fiat Shamir heuristic [FS87] The parameter should be ....

Jan Camenisch and Markus Michels. Proving in zero-knowledge that a number n is the product of two safe primes. In Jacques Stern, editor, Advances in Cryptology | EUROCRYPT '99, volume 1592 of Lecture Notes in Computer Science, pages 107-122. Springer Verlag, 1999.

.... 2 ffl 2 2 110 J. Camenisch and M. Michels holds [11] We denote this protocol by PKf(ff) y = g ff 2 1 Gamma 2 2 ff 2 1 2 2 g; where 2 denotes ffl 2 2 (we will stick to that notation for the rest of the paper) For more details on this protocol we refer to [6, 11]. Finally, the restriction to binary challenges can be dropped if the order of the group is not known to the prover (e.g. if a subgroup of an RSA ring is used) and when believing in the non standard strong RSA assumption 2 [18, 19] Although we describe our protocols in the following in the ....

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe primes. Technical Report RS-98-29, BRICS, Departement of Computer Science, University of Aarhus, Nov. 1998.

....p and q ( 2 g=2 ) of form p = 2p 0 1 and q = 2q 0 1, where p 0 and q 0 are primes as well, such that p; q 6 1 (mod 8) and p 6 q (mod 8) holds. He keeps p and q secret and publishes n : pq. For proving that n if indeed the product of two safe primes the method described in [7] could be used. Verifying that an element a has (large) order at least p 0 q 0 in Z n and Jacobi symbol 1 can done by anyone: one needs only to test whether a 6 1 (mod n) and gcd(a 1; n) 1 holds. An alternative choice of G is a suitable elliptic curve (e.g. see [27] 5.2 The ....

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe primes. Manuscript, submitted for publication.

No context found.

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe prime. In Advances in Cryptology --- EUROCRYPT'99, LNCS 1592, pages 107--122, 1999.

No context found.

J. Camenisch and M. Michels. Proving in zero-knowledge that a number n is the product of two safe prime. In Advances in Cryptology --- EUROCRYPT'99, LNCS 1592, pages 107--122, 1999.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC