Designated verifier proofs and their applications

For many proofs of knowledge it is important that only the verifier designated by the confirmer can obtain any conviction of the cor- rectness of the proof. A good example of such a situation is for undeniable signatures, where the confirmer of a signature wants to make sure that only the intended verifier(s) in fact can be convinced about the validity or invalidity of the signature. Generally, authentication of messages and off-the-record messages are in conflict with each other. We show how, using designation of verifiers, these notions can be combined, allowing authenticated but privat con- versations to take place. Our solution guarantees that only the specified verifier can be convinced by the proof, even if he shares all his secret information with entities that want to get convinced. Our solution is based on trap-door commitments [4], allowing the desig- nated verifier to open up commitments in any way he wants. We demon- strate how a trap-door commitment scheme can be used to construct designated verifier proofs, both interactive and non-interactive. We ex- amplify the verifier designation method for the confirmation protocol for undeniable signatures.