# Is there a practical zero-knowledge proof for this special discrete log equation?

We have a multiplicative cyclic group $G$ with generators $g$ and $h$, as in El Gamal. Assume $G$ is a subgroup of $(\mathbb{Z}/n\mathbb{Z})^*$. There are two parties, Alice and Bob:

• Alice knows: $g$, $h$, $x_1$, $x_2$ and $(a,b,c)$,
• Bob knows: $g$, $h$ and $(a,b,c)$.

Can Alice prove to Bob in zero knowledge that she knows $x_1$ and $x_2$ such that $(a,b,c) = (g^{x_1} , x_2·(h^{x_1}), h^{x_2})$?

This proof must be practical and non-interactive.

-
Do you have a specific setup in mind? $\:$ – Ricky Demer Oct 31 '12 at 19:38
Could you post that commitment format you're proposing? Maybe I can change it and still keep the remaining desired properties of the system. Thanks. – SDL Oct 31 '12 at 20:12

1
@SDL, I was thinking of $\textrm{commit}(x_2) = (g^{x_3}, x_2 h^{x_3})$, but I just now realized this might be problematic: this is binding for everyone, but not concealing against the person who holds the private key (the person who knows the discrete log of $h$ to base $g$ can infer what value was committed to without permission), which I suspect might not meet your needs. So, I withdraw my previous comment. Sorry for my error. – D.W. Oct 31 '12 at 20:27

1
wait a minute: $\;\;$ How do you make sense of $\: x_2 \cdot \left(h^{x_1}\right) \:$ in a cyclic group? $\hspace{1.05 in}$ – Ricky Demer Oct 31 '12 at 20:37
ElGamal is defined over a multiplicative cyclic group of order q. – SDL Nov 1 '12 at 13:32
show 4 more comments
{"extraction_info": {"found_math": true, "script_math_tex": 0, "script_math_asciimath": 0, "math_annotations": 0, "math_alttext": 0, "mathml": 0, "mathjax_tag": 0, "mathjax_inline_tex": 23, "mathjax_display_tex": 0, "mathjax_asciimath": 0, "img_math": 0, "codecogs_latex": 0, "wp_latex": 0, "mimetex.cgi": 0, "/images/math/codecogs": 0, "mathtex.cgi": 0}, "config": {"markdown_headings": true, "markdown_code": true, "boilerplate_config": {"ratio_threshold": 0.18, "absolute_threshold": 10, "end_threshold": 15, "enable": true}, "remove_buttons": true, "remove_image_figures": true, "remove_link_clusters": true, "table_config": {"min_rows": 2, "min_cols": 3, "format": "github"}, "remove_chinese": true, "remove_edit_buttons": true, "extract_latex": true}, "english_confidence": 0.9373661875724792, "perplexity_flag": "middle"}