Paper 2014/764

One-out-of-Many Proofs: Or How to Leak a Secret and Spend a Coin

Jens Groth and Markulf Kohlweiss


We construct a 3-move public coin special honest verifier zero-knowledge proof, a so-called Sigma-protocol, for a list of commitments having at least one commitment that opens to 0. It is not required for the prover to know openings of the other commitments. The proof system is efficient, in particular in terms of communication requiring only the transmission of a logarithmic number of commitments. We use our proof system to instantiate both ring signatures and zerocoin, a novel mechanism for bitcoin privacy. We use our Sigma-protocol as a (linkable) ad-hoc group identification scheme where the users have public keys that are commitments and demonstrate knowledge of an opening for one of the commitments to unlinkably identify themselves (once) as belonging to the group. Applying the Fiat-Shamir transform on the group identification scheme gives rise to ring signatures, applying it to the linkable group identification scheme gives rise to zerocoin. Our ring signatures are very small compared to other ring signature schemes and we only assume the users' secret keys to be the discrete logarithms of single group elements so the setup is quite realistic. Similarly, compared with the original zerocoin protocol we rely on a weak cryptographic assumption and do not require a trusted setup. A third application of our Sigma protocol is an efficient proof of membership of a secret committed value belonging to a public list.

Available format(s)
Cryptographic protocols
Publication info
Preprint. MINOR revision.
Sigma-protocolzero-knowledgedisjunctive proofring signaturezerocoinmembership proof
Contact author(s)
j groth @ ucl ac uk
2014-09-30: received
Short URL
Creative Commons Attribution


      author = {Jens Groth and Markulf Kohlweiss},
      title = {One-out-of-Many Proofs: Or How to Leak a Secret and Spend a Coin},
      howpublished = {Cryptology ePrint Archive, Paper 2014/764},
      year = {2014},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.