Zero-Knowledge Proof Demo - Problem

Implement a simplified zero-knowledge proof protocol to demonstrate the concept where a prover can convince a verifier that they know a secret without revealing the secret itself.

For this problem, we'll implement a basic discrete logarithm zero-knowledge proof protocol:

1. Setup Phase: Given a prime p, generator g, and public key y = g^x mod p where x is the secret

2. Proof Phase: The prover generates a random r, computes commitment t = g^r mod p

3. Challenge Phase: The verifier sends a random challenge c

4. Response Phase: The prover computes response s = (r + c*x) mod (p-1)

5. Verification: The verifier checks if g^s ≡ t * y^c (mod p)

Given the protocol parameters, simulate one round of this zero-knowledge proof and return whether the verification succeeds.

Input & Output

Example 1 — Basic Zero-Knowledge Proof

$ Input: p = 23, g = 2, y = 4, x = 7, r = 5, c = 3

› Output: true

💡 Note: Step by step: t = 2^5 mod 23 = 9, s = (5 + 3×7) mod 22 = 4, verify: 2^4 mod 23 = 16 and (9 × 4^3) mod 23 = 16. Since 16 = 16, verification succeeds.

Example 2 — Failed Verification

$ Input: p = 17, g = 3, y = 5, x = 4, r = 6, c = 2

› Output: false

💡 Note: t = 3^6 mod 17 = 15, s = (6 + 2×4) mod 16 = 14, verify: 3^14 mod 17 = 16 but (15 × 5^2) mod 17 = 1. Since 16 ≠ 1, verification fails.

Example 3 — Small Prime Case

$ Input: p = 11, g = 2, y = 3, x = 8, r = 1, c = 1

› Output: true

💡 Note: t = 2^1 mod 11 = 2, s = (1 + 1×8) mod 10 = 9, verify: 2^9 mod 11 = 6 and (2 × 3^1) mod 11 = 6. Since 6 = 6, proof is valid.

Constraints

2 ≤ p ≤ 10⁹ (p is prime)
1 ≤ g < p (g is generator)
1 ≤ y < p (y = g^x mod p)
1 ≤ x < p-1 (secret key)
0 ≤ r < p-1 (random nonce)
1 ≤ c < p-1 (challenge)

Visualization

Tap to expand

Asked in

M Meta 15 C Coinbase 12 ⛓ Chainlink 8

The key insight is implementing the three-step discrete logarithm zero-knowledge proof protocol: commitment (t = g^r mod p), response (s = (r + c×x) mod (p-1)), and verification (g^s ≡ t × y^c mod p). Best approach uses optimized modular arithmetic with binary exponentiation. Time: O(log n), Space: O(1)

Common Approaches

✓ Direct Calculation

⏱️ Time: O(log n) Space: O(1)

Calculate the commitment t = g^r mod p, then compute the response s = (r + c*x) mod (p-1), and finally verify that g^s ≡ t * y^c (mod p) using straightforward modular exponentiation.

Optimized Modular Arithmetic

⏱️ Time: O(log n) Space: O(1)

Implement the same zero-knowledge proof protocol but with optimized modular exponentiation using binary exponentiation and careful handling of large number multiplication to prevent overflow.

Direct Calculation — Algorithm Steps

Calculate commitment: t = g^r mod p
Compute response: s = (r + c*x) mod (p-1)
Calculate left side: g^s mod p
Calculate right side: (t * y^c) mod p
Check if left equals right for verification

Visualization

Tap to expand

Step-by-Step Walkthrough

Commitment

Calculate t = g^r mod p

Response

Compute s = (r + c*x) mod (p-1)

Verification

Check if g^s ≡ t * y^c (mod p)

Code -

solution.c — C

#include <stdio.h>
#include <stdbool.h>

long long modPow(long long base, long long exp, long long mod) {
    long long result = 1;
    base = base % mod;
    while (exp > 0) {
        if (exp % 2 == 1) {
            result = (result * base) % mod;
        }
        exp = exp / 2;
        base = (base * base) % mod;
    }
    return result;
}

bool solution(long long p, long long g, long long y, long long x, long long r, long long c) {
    // Step 1: Prover computes commitment t = g^r mod p
    long long t = modPow(g, r, p);
    
    // Step 2: Prover computes response s = (r + c*x) mod (p-1)
    long long s = (r + c * x) % (p - 1);
    
    // Step 3: Verifier checks if g^s ≡ t * y^c (mod p)
    long long leftSide = modPow(g, s, p);
    long long rightSide = (t * modPow(y, c, p)) % p;
    
    // Verification succeeds if both sides are equal
    return leftSide == rightSide;
}

int main() {
    long long p, g, y, x, r, c;
    scanf("%lld %lld %lld %lld %lld %lld", &p, &g, &y, &x, &r, &c);
    
    bool result = solution(p, g, y, x, r, c);
    printf(result ? "true\n" : "false\n");
    
    return 0;
}

Time & Space Complexity

Time Complexity

⏱️

O(log n)

Modular exponentiation using repeated squaring takes O(log n) time for each computation

⚡ Linearithmic

Space Complexity

O(1)

Only stores a few integer variables for intermediate calculations

✓ Linear Space

34.7K Views

Medium Frequency

~35 min Avg. Time

890 Likes

Ln 1, Col 1

Smart Actions

💡 Explanation

AI Ready

💡 Suggestion Tab to accept Esc to dismiss

// Output will appear here after running code

Code Editor Closed

Click the red button to reopen

Zero-Knowledge Proof Demo - Problem

Input & Output

Constraints

Visualization

Related Problems

Common Approaches

Direct Calculation — Algorithm Steps

Visualization

Code -

Time & Space Complexity

Select Compiler