{"id":21260157,"url":"https://github.com/sdiehl/schnorr-nizk","last_synced_at":"2025-06-11T07:09:49.801Z","repository":{"id":137839066,"uuid":"125843373","full_name":"sdiehl/schnorr-nizk","owner":"sdiehl","description":"Schnorr Protocol for Non-interactive Zero-Knowledge Proofs","archived":false,"fork":false,"pushed_at":"2020-02-10T12:12:14.000Z","size":176,"stargazers_count":75,"open_issues_count":0,"forks_count":15,"subscribers_count":11,"default_branch":"master","last_synced_at":"2025-06-01T14:01:38.164Z","etag":null,"topics":["commitment","cryptography","elliptic-curves","proof-of-knowledge","schnorr-protocol","sigma","zero-knowledge"],"latest_commit_sha":null,"homepage":"http://www.adjoint.io","language":"Haskell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sdiehl.png","metadata":{"files":{"readme":"README.md","changelog":"ChangeLog.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2018-03-19T10:51:38.000Z","updated_at":"2025-02-25T01:52:31.000Z","dependencies_parsed_at":"2023-04-17T05:32:04.060Z","dependency_job_id":null,"html_url":"https://github.com/sdiehl/schnorr-nizk","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fschnorr-nizk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fschnorr-nizk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fschnorr-nizk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fschnorr-nizk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sdiehl","download_url":"https://codeload.github.com/sdiehl/schnorr-nizk/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sdiehl%2Fschnorr-nizk/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259219712,"owners_count":22823577,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["commitment","cryptography","elliptic-curves","proof-of-knowledge","schnorr-protocol","sigma","zero-knowledge"],"created_at":"2024-11-21T04:17:10.212Z","updated_at":"2025-06-11T07:09:49.788Z","avatar_url":"https://github.com/sdiehl.png","language":"Haskell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\n\u003ca href=\"https://www.adjoint.io\"\u003e\n  \u003cimg width=\"250\" src=\"./.assets/adjoint.png\" alt=\"Adjoint Logo\" /\u003e\n\u003c/a\u003e\n\u003c/p\u003e\n\n[![CircleCI](https://circleci.com/gh/adjoint-io/schnorr-nizk.svg?style=svg)](https://circleci.com/gh/adjoint-io/schnorr-nizk)\n\nThe purpose of the Schnorr protocol is to allow one to prove the knowledge of a discrete logarithm without revealing its value.\n\n## Schnorr Identification Scheme\n\nThe Schnorr protocol is an example of a Sigma protocol (\u003cimg src=\"/tex/813cd865c037c89fcdc609b25c465a05.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=11.87217899999999pt height=22.465723500000017pt/\u003e-protocol).  A\nSigma protocol is a three-step protocol in which communication between prover\nand verifier goes forwards once, then backwards, then forwards again.  In\ngeneral terms:\n\n- \u003cimg src=\"/tex/ea9c178cb3769c43630d811b78f1ed05.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=51.64940879999999pt height=22.465723500000017pt/\u003e:  commitment\n- \u003cimg src=\"/tex/de16f2f1965b4e18fbb4e0789817fa67.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=51.649405499999986pt height=22.465723500000017pt/\u003e:  challenge\n- \u003cimg src=\"/tex/ea9c178cb3769c43630d811b78f1ed05.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=51.64940879999999pt height=22.465723500000017pt/\u003e:  response (proof)\n\nThe protocol is defined for a cyclic group of order \u003cimg src=\"/tex/55a049b8f161ae7cfeb0197d75aff967.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.86687624999999pt height=14.15524440000002pt/\u003e.\n\nThe prover aims to convince the verifier that he knows some private value \u003cimg src=\"/tex/44bc9d542a92714cac84e01cbbb7fd61.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=8.68915409999999pt height=14.15524440000002pt/\u003e.\nTherefore, \u003cimg src=\"/tex/e9038b8ddce37b94004bf4faad6e7264.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=77.37262994999999pt height=24.65753399999998pt/\u003e (see [1]) will be her public key. In order to prove\nknowledge of it, the prover interacts with the verifier in three passes:\n\n- The prover commits to a random private value \u003cimg src=\"/tex/6c4adbc36120d62b98deef2a20d5d303.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=8.55786029999999pt height=14.15524440000002pt/\u003e, chosen in the range \u003cimg src=\"/tex/7e0d17922ebb7f7727c61c114a4a6e86.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=62.83481819999999pt height=24.65753399999998pt/\u003e. This is the first message commitment \u003cimg src=\"/tex/4995c46ed6c126a9e551683efedeb34a.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=71.51835075pt height=24.65753399999998pt/\u003e.\n\n- The verifier replies with a `challenge` chosen at random from \u003cimg src=\"/tex/8a1f3cd6b928ebf50788855d5a539172.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=66.97483814999998pt height=26.085962100000025pt/\u003e.\n\n- After receiving the `challenge`, the prover sends the third and last message\n  (the response) \u003cimg src=\"/tex/ef26fb18eebe8a0219cbc89c6bbf5a31.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=151.2327135pt height=24.65753399999998pt/\u003e.\n\nThe verifier accepts, if:\n\n- The prover's public key, \u003cimg src=\"/tex/df5a289587a2f0247a5b97c1e8ac58ca.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.83677559999999pt height=22.465723500000017pt/\u003e, is a valid public key. It means that it must be\n  a valid point on the curve and \u003cimg src=\"/tex/44503004471f3ac6ef45826b069d0fa8.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=43.31231684999999pt height=24.65753399999998pt/\u003e is not a point at infinity, where\n  \u003cimg src=\"/tex/2ad9d098b937e46f9f58968551adac57.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.47111549999999pt height=22.831056599999986pt/\u003e is the cofactor of the curve.\n- The prover's commitment value is equal to \u003cimg src=\"/tex/082bdfdbb1bf27bb2ca138de799dfa4c.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=102.84822569999999pt height=24.65753399999998pt/\u003e\n\n## Zero Knowledge Proofs\n\nZero knowledge proofs are a way by which one party succeeds in convincing\nanother party that she knows a private value \u003cimg src=\"/tex/332cc365a4987aacce0ead01b8bdcc0b.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.39498779999999pt height=14.15524440000002pt/\u003e without exposing any information\napart from the fact that she knows the value \u003cimg src=\"/tex/332cc365a4987aacce0ead01b8bdcc0b.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.39498779999999pt height=14.15524440000002pt/\u003e.\n\nAll proof systems have two requirements:\n\n- **Completeness**: An honest verifier will be convinced of this fact by an\n  untrusted prover.\n\n- **Soundness**: No prover, even if it doesn't follow the protocol, can convince\n  the honest verifier that it is true, except with some small probability.\n\nIt is assumed that the verifier is always honest.\n\n## Schnorr NIZK proof\n\nThe original Schnorr identification scheme is made non-interactive through a\nFiat-Shamir transformation, assuming that there exists a secure cryptographic\nhash function (i.e., the so-called random oracle model).\n\nAn oracle is considered to be a black box that outputs unpredictable but\ndeterministic random values in response to a certain input. That means that,\ngiven the same input, the oracle will give back the same random output. The\ninput to the random oracle, in the Fiat-Shamir heuristic, is specifically the\ntranscript of the interaction up to that point. The challenge is then redefined\nas \u003cimg src=\"/tex/5f5e107456684cb7b813d5d45237d144.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=125.5208361pt height=24.65753399999998pt/\u003e, where \u003cimg src=\"/tex/7b9a0316a2fcd7f01cfd556eedf72e96.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=14.99998994999999pt height=22.465723500000017pt/\u003e is a secure cryptographic hash\nfunction like SHA-256. The bit length of the hash output should be at least\nequal to that of the order \u003cimg src=\"/tex/55a049b8f161ae7cfeb0197d75aff967.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=9.86687624999999pt height=14.15524440000002pt/\u003e of the considered subgroup.\n\nAn example of the Schnorr protocol for Non-Interactive Zero-Knowledge Proofs\nlooks as follows.\n\n```haskell\ntestSchnorrNIZK :: IO Bool\ntestSchnorrNIZK = do\n  -- Setup\n  let curveName = Curve25519\n      basePoint = Curve.g curveName\n  keyPair@(pk, sk) \u003c- genKeys curveName basePoint\n\n  -- Prover\n  proof \u003c- Schnorr.prove curveName basePoint keyPair\n\n  -- Verifier\n  pure (Schnorr.verify curveName basePoint pk proof)\n```\n\n## Curves\n\nThis Schnorr implementation offers support for both SECP256k1 and Curve25519\ncurves, which are Koblitz and Montgomery curves, respectively.\n\n* SECP256k1\n* Curve25519\n\n**References**:\n\n1.  Hao, F. \"Schnorr Non-interactive Zero-Knowledge Proof.\" Newcastle University, UK, 2017\n2. Schnorr Non-interactive Zero-Knowledge Proof [https://tools.ietf.org/html/rfc8235](https://tools.ietf.org/html/rfc8235)\n\n**Notation**:\n\n1. \u003cimg src=\"/tex/b38c1f3a84b4eb88f169638e34cb23b0.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=40.89599744999999pt height=24.65753399999998pt/\u003e : multiplication of a point \u003cimg src=\"/tex/df5a289587a2f0247a5b97c1e8ac58ca.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=12.83677559999999pt height=22.465723500000017pt/\u003e with a scalar \u003cimg src=\"/tex/4bdc8d9bcfb35e1c9bfb51fc69687dfc.svg?invert_in_darkmode\u0026sanitize=true\" align=middle width=7.054796099999991pt height=22.831056599999986pt/\u003e over an elliptic\n   curve defined over a finite field modulo a prime number\n\n## Disclaimer\n\nThis is experimental code meant for research-grade projects only. Please do not\nuse this code in production until it has matured significantly.\n\n## License\n\n```\nCopyright 2018-2020 Adjoint Inc\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsdiehl%2Fschnorr-nizk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsdiehl%2Fschnorr-nizk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsdiehl%2Fschnorr-nizk/lists"}