Module short_group_sig::bb_sig_pok
source · Expand description
Proof of knowledge of BB signature. Adapted from the construction in section 4.2 of the paper Proof-of-Knowledge of Representation of Committed Value and Its Applications
Specifically the adaptation is of SPK_1
of construction pi_m
in section 4.2 as following:
For BB signature, secret key = (x, y)
, public key = (w1=g2*x, w2=g2*y)
, message = m
and signature = (A = g*{1/{m + x + e*y}}, e)
As part of setup params, generators u
, v
and h
og group G1 exist.
- Pick random
alpha
andbeta
fromZ_p
. - Create
delta_1 = -m * alpha, delta_2 = -m * beta, delta_3 = -e * alpha, delta_4 = -e * beta, T1 = u * alpha, T2 = v * alpha, T3 = A * alpha + h * (alpha + beta)
. - Now the prover proves the following 5 relations
a.
T1*m + u*delta_1 = 0
b.T2*m + v*delta_2 = 0
c.T1*e + u*delta_3 = 0
d.T2*e + v*delta_4 = 0
e.e(T3, g2)*m + e(T3, w2)*e + e(h, w1)*{alpha + beta} + e(h, g2)*{delta_1 + delta_2} + e(h, w2)*{delta_3 + delta_4} = e(g1, g2) - e(T3, w1)
Structs§
- Proof of knowledge of a BB signature in group G1
- Protocol to prove knowledge of a BB signature in group G1