One-out-of-Many Proofs: Or How to Leak a Secret and Spend a Coin Jens Groth University College London Markulf Kohlweiss Microsoft Research TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAAAAAAAAAAA

One-out-of-many statement One of them holds gold! But I will not tell you which one! ProverVerifier

One-out-of-many proof ProverVerifier Argument Zero-knowledge Remains secret which one of them holds gold Soundness Only accept if one of them holds gold

Ring signature Ring signature One of them signed, but secret who it was Construction Non-interactive one-of- many argument of knowledge of a secret key corresponding to one of their public keys

Zerocoin Coin spending Serial number Anonymity Each coin has unique secret serial number known only to owner Use one-of-many proof to demonstrate one of the coins has this serial number

Membership proof 2

One-out-of-many proof for commitment to 0 ProverVerifier  Soundness Statement is true, there is a commitment to 0 Zero-knowledge Remains secret which commitment contains 0

Pedersen commitments

Sigma-protocols ProverVerifier 

Main result: one-out-of-many proof RoundsProverVerifierCommunication 3

Binary tree 0 1

Commit to path 0 1

Check

One-out-of-many proofs RoundsProverVerifierCommunication 3 RoundsProverVerifierCommunication 3

Membership proof RoundsProverVerifierCommunication 3

Fiat-Shamir heuristic Non-interactive argument

Ring signatures

Zerocoin

Summary RoundsProverVerifierCommunication 3