OneoutofMany Proofs Or How to Leak a Secret

One-out-of-Many Proofs: Or How to Leak a Secret and Spend a Coin Jens Groth University College London Markulf Kohlweiss Microsoft Research

One-out-of-many statement One of them holds gold! But I will not tell you which one! Prover Verifier

One-out-of-many proof Zero-knowledge Remains secret which one of them holds gold Soundness Only accept if one of them holds gold Argument Prover Verifier

Ring signature One of them signed, but secret who it was Construction Non-interactive one-ofmany argument of knowledge of a secret key corresponding to one of their public keys

Zerocoin Coin spending Serial number 1001101 Anonymity Each coin has unique secret serial number known only to owner Use one-of-many proof to demonstrate one of the coins has this serial number

Membership proof 2

One-out-of-many proof for commitment to 0 Zero-knowledge Remains secret which commitment contains 0 Soundness Statement is true, there is a commitment to 0 Prover Verifier

Pedersen commitments •

Sigma-protocols Prover • Verifier

Main result: one-out-of-many proof • Rounds Prover Verifier Communication 3

Binary tree 0 1 •

Commit to path 0 1 •

• Check

One-out-of-many proofs • Rounds Prover Verifier Communication 3 Rounds 3

Membership proof • Rounds 3 Prover Verifier Communication

Fiat-Shamir heuristic Non-interactive argument •

Ring signatures •

Zerocoin •

Summary • Rounds 3 Prover Verifier Communication