On Thu, Feb 23, 2017 at 5:31 PM, isis agora lovecruft < i...@patternsinthevoid.net> wrote:
> Schnorr notes in his original paper that "the protocol is not zero > knowledge > because the tripel" (W',R,C) "may be a particular solution to the equation" > W' = g R + h C, however, with randomly chosen basepoints each time the > protocol is run (i.e. the prover chooses a new g and h each time and sends > these along with the proof), I don't see the issue. (I might just be > missing > something obvious.) > > Another paper worth reading is (1988) "Zero Knowledge Proofs of Identity" > by > Feige, Fiat, and Shamir. [1] > > Hopefully that helps! Awesome, thanks for the pointers, Iris! -- Tony Arcieri
_______________________________________________ Curves mailing list Curves@moderncrypto.org https://moderncrypto.org/mailman/listinfo/curves
