Module short_group_sig::bb_sig_pok

source ·
Expand description

Proof of knowledge of BB signature. Adapted from the construction in section 4.2 of the paper Proof-of-Knowledge of Representation of Committed Value and Its Applications Specifically the adaptation is of SPK_1 of construction pi_m in section 4.2 as following: For BB signature, secret key = (x, y), public key = (w1=g2*x, w2=g2*y), message = m and signature = (A = g*{1/{m + x + e*y}}, e) As part of setup params, generators u, v and h og group G1 exist.

  1. Pick random alpha and beta from Z_p.
  2. Create delta_1 = -m * alpha, delta_2 = -m * beta, delta_3 = -e * alpha, delta_4 = -e * beta, T1 = u * alpha, T2 = v * alpha, T3 = A * alpha + h * (alpha + beta).
  3. Now the prover proves the following 5 relations a. T1*m + u*delta_1 = 0 b. T2*m + v*delta_2 = 0 c. T1*e + u*delta_3 = 0 d. T2*e + v*delta_4 = 0 e. e(T3, g2)*m + e(T3, w2)*e + e(h, w1)*{alpha + beta} + e(h, g2)*{delta_1 + delta_2} + e(h, w2)*{delta_3 + delta_4} = e(g1, g2) - e(T3, w1)

Structs§