Designated Verifier Proofs and Their Applications

For many proofs of knowledge it is important that only the verifier designated by the confirmer can obtain any conviction of the correctness of the proof. A good example of such a situation is for undeniable signatures, where the confirmer of a signature wants t o make sure that only the intended verifier(s) in fact can be convinced about the validity or inva1idit)y of the signature. Generally, authentication of messages and off-the-record messages are in conflict with each other. We show how, using designation of verifiers, these notions can be combined, allowing authenticated but private conversations to take place. Our solution guarantees that only the specified verifier can be convinced by t,he proof, even if he shares all his secret information wit,h entities that want to get convinced. Our solution is based on trup-door conim.itments [4], allowing the designated verifier t,o open up commitments in any way he wants. We demonstrate how a t rapdoor commitment scheme can be uscd to construct designated verifier proofs, both interactive and non-interactive. We examplify the verifier designation method for the confirmation protocol for undeniable signahires.