An improved protocol for demonstrating possession of discrete logarithms and some generalizations

  • Authors:
  • David Chaum;Jan-Hendrik Evertse;Jeroen Van De Graaf

  • Affiliations:
  • Centre for Mathematics and Computer Science, Amsterdam, The Netherlands;Centre for Mathematics and Computer Science, Amsterdam, The Netherlands;Centre for Mathematics and Computer Science, Amsterdam, The Netherlands

  • Venue:
  • EUROCRYPT'87 Proceedings of the 6th annual international conference on Theory and application of cryptographic techniques
  • Year:
  • 1987

Quantified Score

Hi-index 0.00

Visualization

Abstract

A new protocol is presented that allows A to convince B that she knows a solution to the Discrete Log Problem--i.e. that she knows an x such that αx ≡ β (mod N) holds-- without revealing anything about x to B. Protocols are given both for N prime and for N composite. We also give protocols for extensions of the Discrete Log problem allowing A to show possession of: - multiple discrete logarithms to the same base at the same time, i.e. knowing x1,....,xK such that αx1 ≡ β1,..., αxK βK - several discrete logarithms to different bases at the same time, i.e. knowing x1,..., xK such that the product α1x1 α2x2... αKxk ≡ β - a discrete logarithm that is the simultaneous solution of several different instances, i.e. knowing x such that α1x ≡ β1,..., αKx ≡ βK. We can prove that the sequential versions of these protocols do not reveal any "knowledge" about the discrete logarithm(s) in a well-defined sense, provided that A knows (a multiple of) the order of α.