[CFRG] Re: Incorporating OR Proofs in Sigma Protocol Draft

[Michele Orrù <[e-mail]>]

hah, thanks Jonathan and Nirvan for correcting me! Reading back Ivan's
paper, he wrote literally the opposite of what I said:

> It is interesting to note that even though POR is WH, this does not have
to be the case for the protocol P we start from. Thus the OR construction
is a very economic way of producing extra security: the complexity is only
about twice that of P.

I’m not sure whether we’re still considering adding an OR proof spec, but I
hope this is useful regardless—thanks!

On Fri, Sep 12, 2025 at 6:57 PM Jonathan Katz <[e-mail]> wrote:

> Yes, if the original protocols are each HVZK then the OR-protocol obtained
> by combining the two is also HVZK.
>
> On Fri, Sep 12, 2025 at 12:52 PM Nirvan Tyagi <[e-mail]>
> wrote:
>
>> I believe the  "standard" OR composition that I'm aware of also provides
>> special HVZK. The Boneh-Shoup book is a reference  (
>> https://toc.cryptobook.us/book.pdf , Sec 19.7.2, Theorem 19.19).
>>
>> Best,
>> Nirvan
>>
>> On Fri, Sep 12, 2025 at 9:39 AM Michele Orrù <[e-mail]> wrote:
>>
>>> Hi Jonathan,
>>>
>>> My knowledge of OR composition comes mostly from Damgård, in
>>> https://www.cs.au.dk/~ivan/Sigma.pdf
>>> There, OR composition seems to guarantee only witness
>>> indistinguishability, and if the relation is hard witness hiding.
>>> What I meant in my message is: right now we can talk only about a
>>> special honest-verifier zero-knoweldge protocol; would we have to talk
>>> about witness indistinguishability in the case of OR proofs?
>>>
>>> On a separate note, thank you so much for your feedback on the spec,
>>> I'll go over it soon!
>>> _______________________________________________
>>> CFRG mailing list -- [e-mail]
>>> To unsubscribe send an email to [e-mail]
>>>
>>