1. One-out-of-Many Proofs: Or How to Leak a Secret and Spend a Coin Jens Groth University College London Markulf Kohlweiss Microsoft Research TexPoint fonts used in EMF. Read the TexPoint manual before you delete this box.: AAAAAAAAAAAAA

2. One-out-of-many statement One of them holds gold! But I will not tell you which one! ProverVerifier

3. One-out-of-many proof ProverVerifier Argument Zero-knowledge Remains secret which one of them holds gold Soundness Only accept if one of them holds gold

4. Ring signature Ring signature One of them signed, but secret who it was Construction Non-interactive one-of- many argument of knowledge of a secret key corresponding to one of their public keys

5. Zerocoin Coin spending Serial number 1001101 Anonymity Each coin has unique secret serial number known only to owner Use one-of-many proof to demonstrate one of the coins has this serial number

6. Membership proof 2

7. One-out-of-many proof for commitment to 0 ProverVerifier  Soundness Statement is true, there is a commitment to 0 Zero-knowledge Remains secret which commitment contains 0

8. Pedersen commitments

9. Sigma-protocols ProverVerifier 

10. Main result: one-out-of-many proof RoundsProverVerifierCommunication 3

11. Binary tree 0 1

12. Commit to path 0 1

13. Check

15. One-out-of-many proofs RoundsProverVerifierCommunication 3 RoundsProverVerifierCommunication 3

16. Membership proof RoundsProverVerifierCommunication 3

17. Fiat-Shamir heuristic Non-interactive argument

18. Ring signatures

19. Zerocoin

20. Summary RoundsProverVerifierCommunication 3