Slow Motion Zero Knowledge Identifying with Colliding Commitments

Discrete-logarithm authentication protocols are known to present two interesting features: The first is that the prover's commitment, $$x=g^r$$x=gr, claims most of the prover's computational effort. The second is that x does not depend on the challenge and can hence be computed in advance. Provers exploit this feature by pre-loading or pre-computing ready to use commitment pairs $$r_i,x_i$$ri,xi. The $$r_i$$ri can be derived from a common seed but storing each $$x_i$$xi still requires 160 to 256 bits when implementing DSA or Schnorr. This paper proposes a new concept called slow motion zero-knowledge SM-ZK. SM-ZK allows the prover to slash commitment size by a factor of 4 to 6 by combining classical zero-knowledge and a timing channel. We pay the conceptual price of requiring the ability to measure time but, in exchange, obtain communication-efficient protocols.