For a paillier cryptosystem how can I perform a zero-knowledge proof?

Given a set of values:

  • 0001
  • 0010
  • 0100
  • 1000

This would be for use in a voting system where we want to ensure we where given a value from the set of acceptable ballots without knowing which if the values where selected.

I have found some information suggesting it is possible but I can't find a succinct set of steps or explanation for how this could be accomplished.

  • 1
    $\begingroup$ The keywords you should use in your research are "proof of set membership" and "range proof", but I am not sure if you can find a construction for Paillier - if you choose the cryptosystem first, you are bound to what is possible there - you can't just add some random property. $\endgroup$ – tylo Apr 18 '17 at 14:00

Found an implementation here: https://paillier.daylightingsociety.org/Paillier_Zero_Knowledge_Proof.pdf

  • $\begingroup$ Link only answers are highly discouraged here, so -1. I suggest you edit to answer your question. Then we can upvote. $\endgroup$ – mikeazo May 9 '17 at 13:45

Your Answer

