@@ -82,6 +82,55 @@ \subsection{Whisk}\label{subsec:related-work-whisk}
82
82
83
83
Curdleproofs is a zero-knowledge proof system that allows a prover to prove knowledge of a shuffle without revealing how it shuffled the elements.
84
84
It does so by using three different zero-knowledge proofs, with one of them relying on two more zero-knowledge proofs.
85
+ The overview can be seen in~\autoref {fig:curdleproof-protocol }.
86
+
87
+ \begin {figure }[!ht]
88
+ \centering
89
+ \begin {circuitikz }[scale = 0.8, transform shape]
90
+ \tikzstyle {every node}=[font=\normalsize ]
91
+ \draw [rounded corners] (4,11.75) rectangle (7.75,10.75);
92
+ \node at (5.75,11.25) {$ \mathbf {R}$ , $ \mathbf {S}$ , $ \mathbf {T}$ , $ \mathbf {U}$ , $ M$ };
93
+ \node at (3.2,11.25) {Input};
94
+ \draw [->, >=Stealth] (5.75,10.75) -- (5.75,10.25);
95
+ \draw [rounded corners] (4,10.25) rectangle (7.75,9.25);
96
+ \node at (5.875,9.75) {$ T=\sigma (k\mathbf {R})$ , $ U=\sigma (k\mathbf {S})$ };
97
+ \node at (2.875,9.75) {Statement};
98
+ \draw [->, >=Stealth] (5.75,9.25) -- (5.75,8.75);
99
+ \draw [rounded corners] (4,8.75) rectangle (7.75,7.75);
100
+ \node at (5.75,8.25) {$ \mathbf {a\leftarrow }$ Fiat-Shamir};
101
+ \draw [->, >=Stealth] (5.75,7.75) -- (5.75,7.25);
102
+ \draw [rounded corners] (3.75,7.25) rectangle (8,5.75);
103
+ \node at (5.75,6.75) {A=$ \sigma (\mathbf {a})\times \mathbf {g}$ };
104
+ \node at (5.875,6.25) {$ T=\mathbf {a}\times k\mathbf {R}$ , $ U=\mathbf {a}\times k\mathbf {S}$ };
105
+ \draw [->, >=Stealth] (5.75,5.75) -- (2.75,5);
106
+ \draw [->, >=Stealth] (5.75,5.75) -- (5.75,5);
107
+ \draw [->, >=Stealth] (5.75,5.75) -- (8.75,5);
108
+ \draw [fill=red, fill opacity=0.3, rounded corners] (0.6,5) rectangle (4.25,2.75);
109
+ \draw [fill=green, fill opacity=0.3, rounded corners] (7.25,5) rectangle (9.75,2.75);
110
+ \draw [fill=blue, fill opacity=0.3, rounded corners] (4.5,5) rectangle (7,2.75);
111
+ \node [font=\large ] at (2.4,4.5) {SamePerm};
112
+ \node at (2.4,4) {A=$ \sigma (\mathbf {a})\times \mathbf {g}$ };
113
+ \node at (2.4,3.5) {$ M=\sigma (1 ,2 ,\dots ,\ell )\times \mathbf {g}$ };
114
+ \node [font=\large ] at (5.75,4.5) {SameMSM};
115
+ \node at (5.75,4) {$ A=\mathbf {c}\times \mathbf {g}$ };
116
+ \node at (5.75,3.5) {$ T=\mathbf {c}\times \mathbf {T}$ };
117
+ \node at (5.75,3) {$ U=\mathbf {c}\times \mathbf {U}$ };
118
+ \node [font=\large ] at (8.5,4.5) {SameScalar};
119
+ \node at (8.5,4) {$ T=k(\mathbf {a}\times \mathbf {R})$ };
120
+ \node at (8.5,3.5) {$ U=k(\mathbf {a}\times \mathbf {S})$ };
121
+ \draw [->, >=Stealth] (2.4,2.75) -- (2.4,2.5);
122
+ \draw [fill=red, fill opacity=0.3, rounded corners] (0.6,2.5) rectangle (4.25,1);
123
+ \node [font=\large ] at (2.4,2) {GrandProd};
124
+ \node at (2.4,1.5) {$ p=\Pi _{i=1}^\ell b_i$ };
125
+ \draw [->, >=Stealth] (4.25,1.75) -- (4.5,1.75);
126
+ \draw [fill=red, fill opacity=0.3, rounded corners] (4.5,2.5) rectangle (7,1);
127
+ \node [font=\large ] at (5.75,2) {DL IPA};
128
+ \node at (5.75,1.5) {$ z=\mathbf {c}\times \mathbf {d}$ };
129
+ \end {circuitikz }
130
+
131
+ \caption {Overall structure of the Curdleproofs protocol. Modified figure from~\cite {Curdleproofs }.}
132
+ \label {fig:curdleproof-protocol }
133
+ \end {figure }
85
134
86
135
The first proof is the~\gls {sameperm} proof.
87
136
The prover first constructs a commitment to the permutation, $ \sigma ()$ , by saying $ M=\sigma (1 ,2 ,\dots ,\ell )\times \mathbf {g}$ .
0 commit comments