Paper 2015/195

Zero-knowledge Argument for Polynomial Evaluation with Application to Blacklists

Stephanie Bayer and Jens Groth


Verification of a polynomial’s evaluation in a secret committed value plays a role in cryptographic applications such as non-membership or membership proofs. We construct a novel special honest verifier zero-knowledge argument for correct polynomial evaluation. The argument has logarithmic communication cost in the degree of the polynomial, which is a significant improvement over the state of the art with cubic root complexity at best. The argument is relatively efficient to generate and very fast to verify compared to previous work. The argument has a simple public-coin 3-move structure and only relies on the discrete logarithm assumption. The polynomial evaluation argument can be used as a building block to construct zero-knowledge membership and non-membership arguments with communication that is logarithmic in the size of the blacklist. Non-membership proofs can be used to design anonymous blacklisting schemes allowing online services to block misbehaving users without learning the identity of the user. They also allow the blocking of single users of anonymization networks without blocking the whole network.

Available format(s)
Cryptographic protocols
Publication info
Published by the IACR in EUROCRYPT 2013
Zero-knowledge argumentdiscrete logarithmpolynomial evaluationanonymous blacklistingmembership and non-membership proofs
Contact author(s)
j groth @ ucl ac uk
2015-03-04: received
Short URL
Creative Commons Attribution


      author = {Stephanie Bayer and Jens Groth},
      title = {Zero-knowledge Argument for Polynomial Evaluation with Application to Blacklists},
      howpublished = {Cryptology ePrint Archive, Paper 2015/195},
      year = {2015},
      doi = {10.1007/978-3-642-38348-9_38},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.