3

Alice sends to Bob a value $B$ in $\mathbb{G}$ a group of high order. There are distinct elements $h_1$ and $h_2$ of high order of $\mathbb{G}$, and Alice wants to prove to Bob that she knows some values $b_1, b_2 \in \mathbb{Z}_q$ such that $B=h_1^{b_1}h_2^{b_2}$.

I have found the following related post (quite old and without answer), but I could not find any information about the mentioned Okamoto protocol.

1/ Is this kind of proof possible and what are the techniques used in the literature to construct such a zero knowledge proof of knowledge?

2/ Is the Okamoto protocol in the related post correct? Where can we find information about it?

Adam54
  • 283
  • 1
  • 7

1 Answers1

2

Search "Okamoto protocol" in google(quotation involved), you can find the lecture notes and some other slides.

So the Okamoto protocol is a WI and WH protocol, but not ZK. Besides, it's also HVZK, but not ZK. You can also have a reference here.

Yang
  • 78
  • 5