An Extension of the Groth-Sahai Proof System

Non-interactive zero-knowledge proofs, particularly those constructed on top of bilinear groups, have been significantly studied in cryptography and used in a wide variety of applications in recent years. One very powerful suite of techniques for proofs over bilinear groups is the Groth-Sahai proof system, which provides efficient non-interactive witnessindistinguishable and zero-knowledge proofs without relying on any one assumption or language. The Groth-Sahai suite of proofs has already been used in a number of applications, including group signature schemes, anonymous voting, and anonymous credentials. In this paper, we describe a technique that allows us to prove that two GS commitments open to the same value. We then use this technique to create a non-interactive zero-knowledge protocol that satisfies a stronger version of zero-knowledge than the original GS protocol. Finally, we use both these techniques to provide a new extension of the proof system that makes it into a non-interactive zero-knowledge proof of knowledge of an exponent. We then outline new building blocks based on this technique that can be used in a variety of applications. The main application of our technique will involve using it to construct a fully unforgeable non-interactive anonymous credentials scheme.