International Conference on the Theory and Application of Cryptology and Information Security

ASIACRYPT 2008: Advances in Cryptology - ASIACRYPT 2008 pp 234-252

Efficient Protocols for Set Membership and Range Proofs

  • Jan Camenisch
  • Rafik Chaabouni
  • abhi shelat
Conference paper

DOI: 10.1007/978-3-540-89255-7_15

Volume 5350 of the book series Lecture Notes in Computer Science (LNCS)


We consider the following problem: Given a commitment to a value σ, prove in zero-knowledge that σ belongs to some discrete set Φ. The set Φ can perhaps be a list of cities or clubs; often Φ can be a numerical range such as [1,220]. This problem arises in e-cash systems, anonymous credential systems, and various other practical uses of zero-knowledge protocols.

When using commitment schemes relying on RSA-like assumptions, there are solutions to this problem which require only a constant number of RSA-group elements to be exchanged between the prover and verifier [5, 15, 16]. However, for many commitment schemes based on bilinear group assumptions, these techniques do not work, and the best known protocols require O(k) group elements to be exchanged where k is a security parameter.

In this paper, we present two new approaches to building set-membership proofs. The first is based on bilinear group assumptions. When applied to the case where Φ is a range of integers, our protocols require \(O(\frac{k}{\log k - \log\log k})\) group elements to be exchanged. Not only is this result asymptotically better, but the constants are small enough to provide significant improvements even for small ranges. Indeed, for a discrete logarithm based setting, our new protocol is an order of magnitude more efficient than previously known ones.

We also discuss alternative implementations of our membership proof based on the strong RSA assumption. Depending on the application, e.g., when Φ is a published set of values such a frequent flyer clubs, cities, or other ad hoc collections, these alternative also outperform prior solutions.


Range proofsset membership proofsproofs of knowledgebi-linear maps
Download to read the full conference paper text

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Jan Camenisch
    • 1
  • Rafik Chaabouni
    • 1
    • 2
  • abhi shelat
    • 3
  1. 1.IBM Research 
  2. 2.EPFL 
  3. 3.U. of Virginia