1

I need to design a Σ-protocol ZKP using Pedersen commitment scheme that proves knowledge of a, y such that statement A = h^y * g^a only holds for even y (y=2x).

Of course, the protocol needs to be sound, special-sound, and honest-verifier zero-knowledge.

Any suggestions?

JayDew
  • 13
  • 3

1 Answers1

1

A standard Pedersen commitment range proof will demonstrate that $y$ is constructed from the addition of a series of powers of 2.

All you have to do is slightly modify the range proof so that you do not include $2^0=1$ as one of the powers of 2.

See this answer for an explanation of how to construct a simple range proof.

knaccc
  • 4,880
  • 1
  • 18
  • 33