Rename spk -> proof #122
Rename spk -> proof #122
Conversation
|
|
||
| The BBS proof, as returned by spkGen, is a zero-knowledge proof-of-knowledge [@CDL16]. This guarantees that no information will be revealed about the signature itself or the undisclosed messages, from the output of spkGen. Note that the security proofs in [@CDL16] work on type 3 pairing setting. This means that G1 should be different from G2 and with no efficient isomorphism between them. | ||
| The proof, as returned by ProofGen, is a zero-knowledge proof-of-knowledge [@CDL16]. This guarantees that no information will be revealed about the signature itself or the undisclosed messages, from the output of ProofGen. Note that the security proofs in [@CDL16] work on type 3 pairing setting. This means that G1 should be different from G2 and with no efficient isomorphism between them. |
There was a problem hiding this comment.
Minor nit: Many crypto papers use unrevealed instead of undisclosed. Should align with the literature?
There was a problem hiding this comment.
"Selective disclosure" is a common expression for this feature, which naturally leads to "undisclosed" messages; I'd prefer keeping this as is.
There was a problem hiding this comment.
I agree with @christianpaquin in most contexts I've seen the term selective disclosure is now quite well understood I'd prefer we stay aligned to this consensus
| @@ -1135,7 +1132,7 @@ Let the prover be in possession of a BBS signature `(A, e, s)` with `A = B * (1/ | |||
| 4. r3 = r1 ^ -1 mod q | |||
| 5. s' = s + r2 * r3. | |||
|
|
|||
| The values `(A', Abar, d)` will be part of the spk and are used to prove possession of a BBS signature, without revealing the signature itself. Note that; `e(A', Pk) = e(Abar, P2)` where `Pk` the signer's public key and P2 the base element in G2 (used to create the signer’s `Pk`, see [SkToPk](#sktopk)). This also serves to bind the spk to the signer's `Pk`. | |||
| The values `(A', Abar, d)` will be part of the proof and are used to prove possession of a BBS signature, without revealing the signature itself. Note that; `e(A', Pk) = e(Abar, P2)` where `Pk` the signer's public key and P2 the base element in G2 (used to create the signer’s `Pk`, see [SkToPk](#sktopk)). This also serves to bind the proof to the signer's `Pk`. | |||
There was a problem hiding this comment.
D should be a capital since our syntax says points are capitalized.
There was a problem hiding this comment.
Agreed. This whole section needs updating though. I just haven't gotten to it yet. I suggest we leave it for another PR (hopefully one that i will make very soon).
There was a problem hiding this comment.
Yeap thanks @mikelodder7 I think if we apply the rules that @BasileiosKal has suggested in #114 via a seperate PR then we can resolve these nits
|
Multiple approvals discussed on WG call, minor nits responded to with one of them to be addressed in a subsequent PR for #114, merging |
Fixes #121, this PR renames spk to proof for the two spk based operations