Why does the prover send a nonce to the verifier

mikelodder7 / accumulator-rs

Cryptographic Accumulators in Rust

Apache License 2.0

64 stars 11 forks source link

Why does the prover send a nonce to the verifier #6

Closed arthurgreef closed 3 years ago

arthurgreef commented 3 years ago

Hi - I'm looking at the POKE protocol here https://www.gakonst.com/deep-dive-rsa-accumulators and there i no mention of a nonce sent from the prover to the verifier or of using a nonce in the hash functions. Can you tell me why you API's require a nonce? Thanks.

mikelodder7 commented 3 years ago

In non-interactiveve zero-knowledge proofs, the verifier sends a challenge such that it shows the proof is fresh and the prover is not cheating. The link you provided describes that requirement. The eprint paper talks about sending a generator as well. In my case I'm computing the generator from public values and the nonce. Both methods should be secure.