Towards zero knowledge argument for double discrete logarithm with constant cost

Abstract

Given that the Schnorr's protocol for Discrete Logarithm (DLOG) exchanges three messages, it is an interesting problem whether a constant round zero-knowledge protocol exists for the Double Discrete Logarithm problem (DDLOG), i.e., to demonstrate the knowledge of a secret witness x in $g^{h^x}$. In this paper, we show that it exists for a fragment of DDLOG with two restrictions: (1) The outer group of DDLOG supports bilinear pairing, and it needs a trusted set-up for common reference string (CRS). (2) $x<t$ where t is the size of KZG commitment key in CRS. The protocol is zero knowledge and constant round, with $O\left(1\right)$ complexity for prover and verifier, regardless of the desired security strength. The contributions of the work are mainly theoretical due to its restrictions and concrete performance.