Demonstrating possession of a discrete logarithm without revealing it

Abstract

Techniques are presented that allow A to convince B that she knows a solution to the Discrete Log Problem—i.e. that she knows an x such that α x ≡ β (mod N) holds—without revealing anything about x to B. Protocols are given both for N prime and for N composite. We prove these protocols secure under a formal model which is of interest in its own right. We also show how A can convince B that two elements α and β generate the same subgroup in Z*N without revealing how to express either as a power of the other.