Sigma Proofs for Linear Relations
draft-irtf-cfrg-sigma-protocols-03
This document is an Internet-Draft (I-D) that has been submitted to the Internet Research Task Force (IRTF) stream.
This I-D is not endorsed by the IETF and has no formal standing in the
IETF standards process.
| Document | Type | Active Internet-Draft (cfrg RG) | |
|---|---|---|---|
| Authors | Michele Orrù , Cathie Yun | ||
| Last updated | 2026-08-16 | ||
| Replaces | draft-orru-zkproof-sigma-protocols | ||
| RFC stream | Internet Research Task Force (IRTF) | ||
| Intended RFC status | Informational | ||
| Formats | |||
| Additional resources | Mailing list discussion | ||
| Stream | IRTF state | Active RG Document | |
| Consensus boilerplate | Unknown | ||
| Document shepherd | (None) | ||
| IESG | IESG state | I-D Exists | |
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-irtf-cfrg-sigma-protocols-03
Crypto Forum M. Orrù
Internet-Draft CNRS
Intended status: Informational C. Yun
Expires: 18 February 2027 Apple, Inc.
17 August 2026
Sigma Proofs for Linear Relations
draft-irtf-cfrg-sigma-protocols-03
Abstract
This document describes Sigma Protocols for proving knowledge of
preimages of linear maps in prime-order elliptic curve groups. These
are sometimes also called _Maurer Proofs_, or _proofs of knowledge of
a preimage of a group homomorphism_.
Examples include zero-knowledge proofs for discrete logarithm
relations, ElGamal encryptions, Pedersen commitments, and range
proofs.
About This Document
This note is to be removed before publishing as an RFC.
The latest revision of this draft can be found at
https://mmaker.github.io/draft-irtf-cfrg-sigma-protocols/draft-irtf-
cfrg-sigma-protocols.html. Status information for this document may
be found at https://datatracker.ietf.org/doc/draft-irtf-cfrg-sigma-
protocols/.
Discussion of this document takes place on the Crypto Forum Research
Group mailing list (mailto:cfrg@ietf.org), which is archived at
https://mailarchive.ietf.org/arch/browse/cfrg. Subscribe at
https://www.ietf.org/mailman/listinfo/cfrg/.
Source for this draft and an issue tracker can be found at
https://github.com/mmaker/draft-irtf-cfrg-sigma-protocols.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Orrù & Yun Expires 18 February 2027 [Page 1]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 18 February 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Terminology and conventions in this document . . . . . . . . 5
2.1. Bytes and integers . . . . . . . . . . . . . . . . . . . 5
2.2. Randomized algorithms . . . . . . . . . . . . . . . . . . 6
2.3. Group abstraction . . . . . . . . . . . . . . . . . . . . 6
2.3.1. Group elements . . . . . . . . . . . . . . . . . . . 6
2.3.2. Scalars . . . . . . . . . . . . . . . . . . . . . . . 6
3. Linear relations . . . . . . . . . . . . . . . . . . . . . . 7
3.1. Linear map . . . . . . . . . . . . . . . . . . . . . . . 7
3.2. Representation . . . . . . . . . . . . . . . . . . . . . 8
3.3. Map evaluation . . . . . . . . . . . . . . . . . . . . . 10
3.4. Specifying the relation . . . . . . . . . . . . . . . . . 10
3.5. Instance validation . . . . . . . . . . . . . . . . . . . 13
3.6. Serialization . . . . . . . . . . . . . . . . . . . . . . 14
4. The Sigma Protocol . . . . . . . . . . . . . . . . . . . . . 16
4.1. Interface . . . . . . . . . . . . . . . . . . . . . . . . 16
4.2. Prover . . . . . . . . . . . . . . . . . . . . . . . . . 16
4.2.1. Prover commitment . . . . . . . . . . . . . . . . . . 17
4.2.2. Prover response . . . . . . . . . . . . . . . . . . . 17
4.3. Verifier . . . . . . . . . . . . . . . . . . . . . . . . 18
4.4. Simulator . . . . . . . . . . . . . . . . . . . . . . . . 18
5. Non-interactive Sigma Protocols . . . . . . . . . . . . . . . 19
5.1. Tag and session identifier . . . . . . . . . . . . . . . 19
5.2. Challenge derivation . . . . . . . . . . . . . . . . . . 20
5.3. Non-interactive argument string serialization . . . . . . 20
5.4. Batchable NARG strings . . . . . . . . . . . . . . . . . 21
5.5. Compact NARG strings . . . . . . . . . . . . . . . . . . 21
5.6. Batch verification . . . . . . . . . . . . . . . . . . . 23
Orrù & Yun Expires 18 February 2027 [Page 2]
Internet-Draft Sigma Proofs for Linear Relations August 2026
6. Efficiency Considerations . . . . . . . . . . . . . . . . . . 25
7. Security Considerations . . . . . . . . . . . . . . . . . . . 26
7.1. Interactive security properties . . . . . . . . . . . . . 26
7.2. Fiat-Shamir transformation . . . . . . . . . . . . . . . 26
7.3. NARG string validation . . . . . . . . . . . . . . . . . 27
7.4. Instance security . . . . . . . . . . . . . . . . . . . . 28
7.5. Privacy Considerations . . . . . . . . . . . . . . . . . 28
7.6. Constant-Time Requirements . . . . . . . . . . . . . . . 29
7.7. Post-Quantum Considerations . . . . . . . . . . . . . . . 30
8. Ciphersuites . . . . . . . . . . . . . . . . . . . . . . . . 30
8.1. P-256 (secp256r1) . . . . . . . . . . . . . . . . . . . . 31
8.1.1. Elliptic curve group of P-256 (secp256r1)
NIST-SP-800-186 . . . . . . . . . . . . . . . . . . . 31
8.1.2. Scalar Field of P-256 . . . . . . . . . . . . . . . . 32
8.2. BLS12-381 (G1) . . . . . . . . . . . . . . . . . . . . . 32
8.2.1. Elliptic curve group of BLS12-381 (G1) RFC9380 . . . 32
8.2.2. Scalar Field of BLS12-381 . . . . . . . . . . . . . . 32
9. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 33
Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 33
References . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Normative References . . . . . . . . . . . . . . . . . . . . . 33
Informative References . . . . . . . . . . . . . . . . . . . . 34
Appendix A. Test Vectors . . . . . . . . . . . . . . . . . . . . 38
A.1. Seeded PRNG . . . . . . . . . . . . . . . . . . . . . . . 39
A.2. sigma-proofs_Shake128_P256 . . . . . . . . . . . . . . . 40
A.2.1. Valid proofs . . . . . . . . . . . . . . . . . . . . 40
A.2.2. Adversarial vectors . . . . . . . . . . . . . . . . . 52
A.3. sigma-proofs_Shake128_BLS12381 . . . . . . . . . . . . . 68
A.3.1. Valid proofs . . . . . . . . . . . . . . . . . . . . 68
A.3.2. Adversarial vectors . . . . . . . . . . . . . . . . . 81
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 97
1. Introduction
Zero-knowledge proofs of knowledge allow a prover to convince a
verifier that a statement is true, without revealing anything other
than what is already revealed by the statement itself.
Orrù & Yun Expires 18 February 2027 [Page 3]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Sigma Protocols are an essential component of a number of
cryptographic constructions, such as anonymous credentials [ARC]
[BBS], verifiable random functions [RFC9381], anonymous tokens
[RFC9497], blind signatures [BBSBlind], and proofs of knowledge of
the opening of a Pedersen commitment [Pedersen91]. This document
specifies a single Sigma Protocol for proving knowledge of a preimage
of a linear map over a prime-order group [Cramer97] [Maurer09]. A
_linear relation_ is a system of equations among group elements that
is linear in the secret scalars; affine relations with constant terms
(e.g. verifiable encryption) and quadratic equations (e.g. range
proofs) can also be expressed as the preimage of a linear map
(Section 3.1).
A Sigma Protocol is an interactive proof with the following three-
message flow:
+----------------------+ +----------------------+
| Prover | | Verifier |
| witness, instance | | instance |
+----------------------+ +----------------------+
| |
| ProverCommitment(instance, witness, rng) |
| commitment |
|---------------------------------------------------->|
| |
| challenge |
|<----------------------------------------------------|
| |
| ProverResponse(prover_state, challenge) |
| response |
|---------------------------------------------------->|
| |
| Verifier(instance, commitment, challenge, response) |
| accept or reject |
Figure 1: Flow of an interactive sigma protocol.
The messages are respectively called *commitment* (computed by the
prover), *challenge* (randomly sampled by the verifier), and
*response* (computed by the prover). The prover is stateful and
maintains a single-use private state between the first and third
messages. The *transcript* (commitment, challenge, response) is
checked by the verifier.
Sigma Protocols can compose: several statements can be proven
simultaneously (AND composition), disjunctively (OR composition
[CramerDS94]), or thresholded. AND composition of linear relations
is immediate in this document (Section 3.4); OR and threshold
Orrù & Yun Expires 18 February 2027 [Page 4]
Internet-Draft Sigma Proofs for Linear Relations August 2026
composition, and composition across heterogeneous proof systems, are
not part of this document, but possible via the Sigma Protocol
interface. Composition carries soundness and zero-knowledge caveats;
see Section 7 and Section 7.5.
2. Terminology and conventions in this document
The key words "*MUST*", "*MUST NOT*", "*REQUIRED*", "*SHALL*",
"*SHALL NOT*", "*SHOULD*", "*SHOULD NOT*", "*RECOMMENDED*", "*NOT
RECOMMENDED*", "*MAY*", and "*OPTIONAL*" in this document are to be
interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only
when, they appear in all capitals, as shown here.
The algorithms and procedures in this document are specified using
Python-like pseudocode. Each function accepts defined inputs and
parameters and returns one or more output values. Once a protocol
variant and ciphersuite are selected, all associated parameters are
treated as constants.
The following notation is used throughout this document.
2.1. Bytes and integers
A byte is an 8-bit unsigned integer (an octet), and a _byte string_
is a finite sequence of bytes. The empty byte string is written "",
and x || y is the concatenation of the byte strings x and y. For any
finite sequence x, len(x) is the number of elements in x; for a byte
string, this is its length in bytes. Byte strings are indexed from
zero: for integers 0 <= i <= j <= len(x), x[i : j] denotes the (j -
i)-byte substring of x at positions i, i+1, ..., j-1, so that x[0 :
N] is the first N bytes of x and x[i : i] is "".
I2OSP(n, w) and OS2IP(x) are the integer/byte-string conversion
primitives used throughout this document, in big-endian byte order,
as defined in Section 4 of [RFC8017]. I2OSP(n, w) converts a non-
negative integer n with 0 <= n < 256^w into a w-byte, big-endian byte
string, and fails if n >= 256^w; OS2IP(x) is its inverse, mapping a
w-byte string to the integer in [0, 256^w) that it represents. LE(n,
w) is the little-endian counterpart defined in [fiat-shamir].
LE2IP(x), also defined in [fiat-shamir], converts a little-endian
byte string back into a non-negative integer. Byte order and length
of the scalar and group-element encodings are fixed by each
ciphersuite (Section 8).
Orrù & Yun Expires 18 February 2027 [Page 5]
Internet-Draft Sigma Proofs for Linear Relations August 2026
2.2. Randomized algorithms
The prover commitment algorithm requires fresh, single-use randomness
to ensure privacy of the witness. This document denotes with rng a
cryptographically secure random number generator (CSPRNG), and uses
Group.random_scalar(rng) to denote sampling a uniformly random
element of the scalar field, similarly to RandomScalar() of
Section 2.1 of [RFC9497].
2.3. Group abstraction
Elliptic curves are presented using additive notation.
Group elements are upper-case (G, X, M) and scalars lower-case (x,
s). The name G denotes the group generator Group.generator()
(Section 2.3.1). Pseudocode and interface names are descriptive
(e.g. commitment, image, witness) and do not follow this rule.
2.3.1. Group elements
identity() is the neutral element, generator() returns the canonical
generator of the prime-order subgroup (Section 8), and order()
returns its order p. Addition, negation, equality, and scalar
multiplication by a Scalar are written +, -, ==, and *.
serialize(elements: list[Group]) and deserialize(buffer) convert N
non-neutral group elements into a fixed-length Ne * N-byte encoding,
where Ne is fixed per ciphersuite (Section 8).
Both serialize and deserialize are defined only on non-neutral
elements. Serialization *MUST* fail on the identity element, and
deserialization *MUST* fail for invalid encodings, including on the
encoding of the identity. An honest prover statistically hits this
event only with negligible probability. See Section 10.1 of
[RFC9380], Appendix C of [PAIRING], Section 2.1 of [RFC9497], [ARC].
2.3.2. Scalars
A Scalar is an element of the group's _scalar field_, the prime field
of integers modulo the group order p. Addition and multiplication
are written + and * via operator overloading.
serialize(scalars: list[Scalar]) and deserialize(buffer) batch
convert between N scalars and their canonical, fixed-length Ns *
N-byte encoding.
Orrù & Yun Expires 18 February 2027 [Page 6]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Sampling a random scalar takes two steps: obtaining high-quality
entropy via a CSPRNG (e.g., getrandom(); see [RFC4086] for randomness
requirements), and reducing the resulting bytes to a scalar. It is
*RECOMMENDED* that the latter be done via DecodeField as in
[fiat-shamir]. Different sampling mechanisms, such as the wide
reduction of hash_to_field (Section 5.2 of [RFC9380]) and the integer
conversion of Appendix A.4.1 of [FIPS186-5] do not affect
interoperability of proofs. The "discard method" of Appendix A.4.2
of [FIPS186-5] *SHOULD NOT* be used Section 7.6.
3. Linear relations
This section specifies the statement being proven: the preimage of a
linear map over a group, also known as the preimage of a group
homomorphism. The Sigma Protocol proving knowledge of a preimage is
specified in Section 4.
3.1. Linear map
A linear map is a matrix-vector product image = M * witness, where M
is a matrix of group elements and witness is a vector of scalars.
M and image together form the statement (the _instance_), while
witness is the secret. The _relation_ (the set of instance-witness
pairs of which knowledge is proven) is:
R := { ((M, image), witness) : image = M * witness }
image is the result of the multi-scalar multiplication of each matrix
row with the witness. For i in 0, ..., num_equations - 1
image[i] = sum(witness[j] * M[i][j] for j in 0, ..., num_scalars - 1)
num_scalars is the length of witness (the width of M), and
num_equations is the number of group elements in image (the height of
M).
As an example, Schnorr's identification protocol has num_scalars =
num_equations = 1 and M = [[G]], where G is the group generator,
proving knowledge of the scalar x such that the group element X
satisfies X = x * G [RFC8235].
Another example is the Chaum-Pedersen relation [ChaumP92]: given the
group generator G and group elements H, X, Y, the prover shows
knowledge of a single scalar x such that X = x * G and Y = x * H.
Here num_scalars = 1, num_equations = 2, and:
Orrù & Yun Expires 18 February 2027 [Page 7]
Internet-Draft Sigma Proofs for Linear Relations August 2026
M = [[G],
[H]]
Variants of the Chaum-Pedersen relation are widely used for VRFs
[RFC9381] and anonymous tokens [RFC9497]. Proofs of knowledge of the
opening (m, r) of a Pedersen commitment [Pedersen91] C = m * G + r *
H are Okamoto-Schnorr proofs [Okamoto92].
Affine equations with constant terms can be expressed directly
through image terms and coefficients (Section 3.2); more elaborate
relations, such as quadratic equations, reduce to this same form by
letting instance elements themselves serve as bases (Section 3.4).
The group Group, and its generator, are provided by the ciphersuite
Section 8. The statement author has the responsibility to select the
appropriate M, and this requires care. Computationally-independent
bases, sometimes also called _auxiliary generators_, or _nothing up
my sleeve (NUMS) generators_, may be computed via hash to the curve
(Section 3 of [RFC9380]).
3.2. Representation
The linear relations proven with Sigma Protocols are typically
sparse: most entries of M are zero. This document handles and
serializes them in a sparse, symbolic form rather than as a
2-dimensional vector of group elements.
A LinearRelation is the instance for the Sigma Protocol. It fixes
the linear map M and the image, that is, the instance (M, image) of
the relation R (Section 3.1). There might be multiple witnesses for
the same (M, image), or no valid witness. The word _relation_ is
used here in the linear-algebra sense: a system of linear equations
among group elements. A LinearRelation is held and evaluated by both
prover and verifier (Section 3.3).
class LinearRelation:
elements: list[Group]
# non-empty; elements[0] is fixed to Group.generator()
equations: list[Equation] # non-empty
class Equation:
image: list[(int, Scalar)]
# non-empty, (element_index, coeff)
terms: list[(int, int, Scalar)]
# non-empty, (scalar_index, element_index, coeff)
Orrù & Yun Expires 18 February 2027 [Page 8]
Internet-Draft Sigma Proofs for Linear Relations August 2026
A LinearRelation holds a set of group elements (each corresponding to
an element_index) and a list of equations. Each row of M is called
an Equation, and consists of two lists of terms.
The image terms (the left-hand side) are pairs (element_index,
coeff). The image is the sum of coeff * elements[element_index].
The terms (the right-hand side) are triplets (scalar_index,
element_index, coeff). Each coeff is a scalar (Section 2.3.2) fixed
by the instance.
A LinearRelation *MUST* have at least one equation, and every
equation's image and terms *MUST* be non-empty. A constant of the
statement (an element carrying no witness scalar) is encoded as an
image term (Section 3.4). It *MUST NOT* be encoded as a right-hand
side term whose witness scalar is "fixed" to 1. A coefficient *MAY*
be zero.
The instance *MUST* contain, as individually-indexed elements, every
group element on which the statement depends. In particular, all
group elements processed by the verifier *MUST* appear in the
statement, else the resulting argument is malleable across its
preimages (Section 7.2).
For instance, the verifiable-decryption statement M + E1 = x * E0 is
encoded with the two image terms (M, 1), (E1, 1), never as the single
element F = M + E1. Otherwise, the same proof will verify for any F
= M' + E1', even when M' != M. As another example, a statement
multiplying a scalar by a sum of elements, such as Y = x * (E0 + E1),
is expressed by repeating the scalar index across terms, as terms =
[(0, 1, 1), (0, 2, 1)], never as the single element K = E0 + E1. An
element may appear multiple times in the same equation, even with the
same coefficient and scalar.
Every group element index *MUST* have an associated group element.
Every element *MUST* appear in the terms or image terms of at least
one equation, except for the generator (index 0), which is present in
every instance whether or not an equation uses it. Every scalar
index *MUST* appear in at least one term, else the corresponding
response is accepted unchecked.
For a valid instance, let:
num_elements(instance) = len(instance.elements)
num_equations(instance) = len(instance.equations)
num_scalars(instance) = 1 + max(s for eq in instance.equations
for (s, _, _) in eq.terms)
Orrù & Yun Expires 18 February 2027 [Page 9]
Internet-Draft Sigma Proofs for Linear Relations August 2026
The number of group elements is independent of the number of
equations. For instance, Chaum-Pedersen has num_elements = 4,
num_equations = 2.
3.3. Map evaluation
This document writes map(instance, scalars) for the function that
evaluates M at scalars:
map(instance, scalars) -> list[Group]
1. out = []
2. for equation in instance.equations:
3. acc = Group.identity()
4. for (scalar_index, element_index, coeff) in equation.terms:
5. acc = acc + (coeff * scalars[scalar_index]) \
* instance.elements[element_index]
6. out.append(acc)
7. return out
image(instance) denotes the evaluation of each equation's left-hand
side: the list of num_equations(instance) group elements whose i-th
entry is the sum of coeff * instance.elements[element_index] over the
image terms of the i-th equation.
3.4. Specifying the relation
This section defines a symbolic notation in the spirit of
[CamenischS97] for declaring scalars, elements, and equations.
The notation is a specification convention, not a wire format.
Prover and verifier must agree on the compiled LinearRelation
(Section 3.2) and its serialization (Section 3.6). The notation of
this section is the *RECOMMENDED* way to present a relation.
A linear relation is declared as a US-ASCII block:
Relation NAME(P[0], ..., P[n-1]):
Witness: s[0], ..., s[k-1]
Equations:
<linear combination> = <linear combination>
...
As a first example, the Chaum-Pedersen relation of Section 3.1 is:
Orrù & Yun Expires 18 February 2027 [Page 10]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Relation ChaumPedersen(H, X, Y):
Witness: x
Equations:
X = x * G
Y = x * H
The relation parameters are the public values of the statement. A
parameter whose name begins with an upper-case letter is a group
element, and one whose name begins with a lower-case letter is a
public scalar (following Section 2.3); the names under Witness: are
the secret scalars. G denotes the group generator at element index
0, and *MUST NOT* appear among the relation parameters. Every other
name used in Equations: is declared exactly once, as a parameter or
under Witness:. A declaration *MUST* compile to a valid instance
(Section 3.5). All elements and witness scalars *MUST* be used
(Section 3.2).
Each equation is an equality between two linear combinations. Each
term is the product of an optional _coefficient_, an optional witness
scalar, and exactly one element name. Every equation *MUST* be
linear in the witness. A coefficient is a public constant of the
statement evaluated in the scalar field before compilation. An
omitted coefficient is 1, and a leading - on a term negates its
coefficient. Expressions in parentheses distribute before the term
rules apply: 2 * r * (X1 - X2) denotes 2 * r * X1 - 2 * r * X2.
As an example with two witness scalars in a single equation, the
Okamoto-Schnorr proof proves knowledge of the opening of a Pedersen
commitment [Pedersen91]:
Relation PedersenOpening(H, C):
Witness: m, r
Equations:
C = m * G + r * H
ChaumPedersen compiles to elements = [G, H, X, Y] and equations =
[Equation(image=[(2, 1)], terms=[(0, 0, 1)]), Equation(image=[(3,
1)], terms=[(0, 1, 1)])], while PedersenOpening is compiled to a
LinearRelation with elements = [G, H, C] and equations =
[Equation(image=[(2, 1)], terms=[(0, 0, 1), (1, 1, 1)])].
The compiled LinearRelation assigns indices in declaration order.
Vectors of names (for example, C_0, ..., C_{n-1}) and families of
equations stated over an index range unroll, in index order, to names
and equations of the ordinary form.
Orrù & Yun Expires 18 February 2027 [Page 11]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Terms compile to the two lists of Section 3.2. A term carrying a
witness scalar compiles to the right-hand side term (homomorphism)
(scalar_index, element_index, coeff); a term without one (a _constant
term_) compiles to the left-hand side term (image) (element_index,
coeff), with its coefficient negated when the term is written on the
right-hand side. Terms appear in the order written, left-hand side
first; equations compile in the order they are written under
Equations:. Indices attach to names: every occurrence of a name,
within or across equations, denotes the same scalar or element index,
and every occurrence of a scalar parameter denotes the same public
value.
As an example with a public scalar parameter, below is the relation
stating that C opens to the _public_ value m, that is, C - m * G = r
* H:
Relation OpensTo(m, H, C):
Witness: r
Equations:
C = m * G + r * H
m is now a scalar parameter, so m * G is a constant term. The
relation compiles to elements = [G, H, C] and equations =
[Equation(image=[(2, 1), (0, -m)], terms=[(0, 1, 1)])].
As an example with a constant term crossing sides, correct ElGamal
decryption states that the ciphertext (E0, E1), with E1 = r * X - M,
decrypts to M under the decryption key x of X:
Relation ElGamalDecryption(X, E0, E1, M):
Witness: x
Equations:
X = x * G
M = x * E0 - E1
The constant term - E1 crosses to the image with its coefficient
negated: the second equation compiles to Equation(image=[(4, 1), (3,
1)], terms=[(0, 2, 1)]), identically to the spelling M + E1 = x * E0,
and both M and E1 are bound individually by the serialization of
Section 3.6.
As yet another example with a distributed scalar, the following
proves correct encryption of a public message M under the aggregate
key X1 + X2, as arises in threshold decryption: the ciphertext is
(E0, E1), with E0 = r * G and E1 = r * (X1 + X2) - M:
Orrù & Yun Expires 18 February 2027 [Page 12]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Relation AggregateEncryption(X1, X2, M, E0, E1):
Witness: r
Equations:
E0 = r * G
M + E1 = r * (X1 + X2)
The scalar r distributes over the parenthesized sum, so the second
equation compiles to Equation(image=[(3, 1), (5, 1)], terms=[(0, 1,
1), (0, 2, 1)]).
As a last example, the following proves that the value committed by C
is a bit, the building block of range proofs:
Relation Bit(H, C):
Witness: b, r, s
Equations:
C = b * G + r * H
C = b * C + s * H
Bit compiles to elements = [G, H, C] and equations =
[Equation(image=[(2, 1)], terms=[(0, 0, 1), (1, 1, 1)]),
Equation(image=[(2, 1)], terms=[(0, 2, 1), (2, 1, 1)])]: the element
index 2 (the commitment C) appears both in each equation's image and
among the bases of the second equation.
AND composition comes for free for this relation family. To do so,
concatenate the parameter lists, Witness:, and Equations: of each
sub-relation. Under concatenation, a name kept in common should
denote the same scalar or element in every sub-relation, and is
declared exactly once in the combined declaration. Names not
intended to be shared *MUST* be renamed apart before concatenating.
3.5. Instance validation
For an instance to be valid, it *MUST* satisfy all below conditions:
1. The instance has at least one equation: num_equations(instance)
> 0.
2. Every equation in instance.equations has a non-empty terms list
and a non-empty image list.
3. Every scalar_index and every element_index is a non-negative
integer less than 2^32; so are num_equations(instance), and each
equation's term count and image-term count.
4. Every element index is less than num_elements(instance). In
other words, every index references a group element.
Orrù & Yun Expires 18 February 2027 [Page 13]
Internet-Draft Sigma Proofs for Linear Relations August 2026
5. Every element index other than 0 appears in the terms or image
terms of at least one equation; the generator (index 0) is
present in every instance whether or not an equation uses it
(Section 3.2). Together with check 4, this ensures
num_elements(instance)-1 is the largest referenced element
index.
6. Every scalar index appears in the terms of at least one
equation.
7. num_elements(instance) > 0, and instance.elements[0] is the
group generator Group.generator() (Section 3.2).
8. No element of instance.elements is the identity element.
9. No element of image(instance) is the identity element: an
equation whose image evaluates to the identity is satisfied by
the all-zero witness, so a proof of it attests nothing.
10. No column of the matrix M is the identity. That is, for every
scalar index, there is at least one equation for which the sum
of coeff * elements[element_index] over the terms carrying that
scalar index is not the identity.
The prover *SHOULD* reject an invalid instance, and *MAY*
additionally check that image == map(instance, witness) before
proving; Section 7.5 and Section 7.4 state when this check, or a
stronger precaution, is required. The verifier *MUST* fail on an
invalid instance (Section 4.3, Section 5), either when the instance
is constructed or during verification itself.
ValidateInstance(instance) denotes the function returning true if all
above predicates are met. Instance validation won't flag all
violations of Section 3.2 (for instance, a registered element
obtained as a precomputed linear combination from one obtained
independently) because the instance generation can't know how a group
element is obtained. A structurally valid instance may still yield
an unsound argument.
3.6. Serialization
A LinearRelation is serialized as a sparse matrix encoded in row-
major order: each equation's image terms, then its right-hand side
terms, each list preceded by its count (Section 3.2), followed by the
group elements at indices 1 onwards. Counts and indices are encoded
in 4 bytes via LE (Section 2.1). Coefficients are encoded with the
scalar serialization function (Ns bytes each, Section 8). The
encoding is unambiguous and prefix-free.
Orrù & Yun Expires 18 February 2027 [Page 14]
Internet-Draft Sigma Proofs for Linear Relations August 2026
SerializeLinearRelation(instance)
Input:
- instance, a LinearRelation.
Output:
- a byte string
Procedure:
1. out = ""
2. out = out || LE(num_equations(instance), 4)
3. for i in 0, ..., num_equations(instance) - 1:
4. image_terms = instance.equations[i].image
5. out = out || LE(len(image_terms), 4)
6. for (element_index, coeff) in image_terms:
7. out = out || LE(element_index, 4) || Scalar.serialize([coeff])
8. terms = instance.equations[i].terms
9. out = out || LE(len(terms), 4)
10. for (scalar_index, element_index, coeff) in terms:
11. out = out || LE(scalar_index, 4)
12. out = out || LE(element_index, 4) || Scalar.serialize([coeff])
13. return out || Group.serialize(
instance.elements[1 : num_elements(instance)])
For example, the compiled ChaumPedersen relation of Section 3.4
serializes to
LE(2, 4) # 2 equations
LE(1, 4) || LE(2, 4) || Scalar.serialize([1]) # image: X
LE(1, 4) || LE(0, 4) || LE(0, 4)
|| Scalar.serialize([1]) # term: x * G
LE(1, 4) || LE(3, 4) || Scalar.serialize([1]) # image: Y
LE(1, 4) || LE(0, 4) || LE(1, 4)
|| Scalar.serialize([1]) # term: x * H
Group.serialize([H, X, Y]) # statement elements
SerializeLinearRelation operates on a LinearRelation as compiled from
its declaration, following its equation and term order (Section 3.4).
The same relation expressed in two different ways (for example,
swapping two rows of M) will yield different serializations.
Orrù & Yun Expires 18 February 2027 [Page 15]
Internet-Draft Sigma Proofs for Linear Relations August 2026
4. The Sigma Protocol
This section specifies the proof of knowledge for the preimage of a
linear map (Section 3). These proofs are sometimes also called
_Maurer proofs_ [Maurer09] [Cramer97].
4.1. Interface
A Sigma Protocol provides the following interface:
* ProverCommitment(instance, witness, rng): produces a pair
(commitment, prover_state) consisting of the *commitment* message,
and a private prover_state. The prover state *MUST* be used at
most once. The random number generator rng is defined in
Section 2.2.
* ProverResponse(prover_state, challenge) produces the *response*.
* Verifier(instance, commitment, challenge, response), the
verification algorithm.
These are the _interactive_ protocol's building blocks.
Implementations *MAY* also provide the *zero-knowledge simulator*:
* SimulateResponse(instance, rng) -> (response, state), which
returns a simulated response, and a simulator state.
* SimulateCommitment(state, response, challenge) ->
simulated_commitment, which returns the simulated_commitment such
that Verifier(instance, simulated_commitment, challenge, response)
accepts.
Both are specified concretely for the linear-map Sigma Protocol in
Section 4.4. The simulator is useful for proof composition (e.g. OR-
composition [CramerDS94]) and for compact serialization Section 5.5.
This interface allows for composition, and *SHOULD NOT* be exposed
directly to consumers of the non-interactive argument. In
particular, ProverResponse *MUST NOT* be invoked with a challenge
that was not either sent by an honest interactive verifier or derived
from the instance and commitment via the Fiat-Shamir transformation
(Section 5). Supplying an invalid challenge or an arbitrary prover
state will compromise soundness and zero-knowledge.
4.2. Prover
The prover of a Sigma Protocol is stateful and will send two
messages, described below.
Orrù & Yun Expires 18 February 2027 [Page 16]
Internet-Draft Sigma Proofs for Linear Relations August 2026
4.2.1. Prover commitment
ProverCommitment(instance, witness, rng)
Inputs:
- instance, the LinearRelation being proven
- witness, an array of scalars satisfying the linear relation
- rng, a cryptographically secure random number generator
Outputs:
- A commitment message (a vector of group elements)
- A (private) prover state
Procedure:
1. fail if len(witness) != num_scalars(instance)
2. nonces = [Group.random_scalar(rng)
for j in 0, ..., num_scalars(instance) - 1]
3. commitment = map(instance, nonces)
4. return (commitment, prover_state := (witness, nonces))
The prover *MAY* produce an output (and not fail) if the witness is
not valid for the instance provided. The prover *MUST* fail if the
witness length does not match num_scalars(instance): a mismatch
cannot yield a valid proof.
4.2.2. Prover response
ProverResponse(prover_state, challenge)
Inputs:
- prover_state, the current state of the prover
- challenge, the verifier challenge scalar
Output: the response message, an array of scalars
Procedure:
1. witness, nonces = prover_state
2. fail if len(witness) != len(nonces)
3. return [nonces[i] + witness[i] * challenge
for i in 0, ..., len(nonces) - 1]
The prover *MUST* fail if the lengths of witness and nonces mismatch.
Orrù & Yun Expires 18 February 2027 [Page 17]
Internet-Draft Sigma Proofs for Linear Relations August 2026
4.3. Verifier
The *challenge* is a scalar drawn uniformly at random from the scalar
field. Non-interactive Sigma Protocols derive the challenge via the
Fiat-Shamir transformation (Section 5).
The verification equation is as follows:
Verifier(instance, commitment, challenge, response)
Inputs:
- instance, the LinearRelation being verified
- commitment, the commitment generated by the prover
- challenge, the challenge generated by the verifier
- response, the response generated by the prover
Output: a boolean indicating whether the verification succeeded
Procedure:
1. fail if ValidateInstance(instance) fails
2. fail if len(commitment) != num_equations(instance) or \
len(response) != num_scalars(instance)
3. expected = map(instance, response)
4. got = [commitment[i] + challenge * image(instance)[i]
for i in 0, ..., num_equations(instance) - 1]
5. fail if got != expected
The verifier *MUST* enforce instance validity (Step 1, see
Section 3.5), and that the shape of the transcript matches that of
the instance.
4.4. Simulator
Implementations that expose the zero-knowledge simulator
(Section 4.1) provide the two algorithms below; they are also what
the compact verifier (Section 5) relies on to recover the prover's
commitment from (challenge, response).
SimulateResponse(instance, rng) returns as simulated response a
vector of num_scalars(instance) uniformly random scalars, and as
simulator state the instance itself.
SimulateCommitment(state, response, challenge) solves the
verification equation (Section 4.3) for the commitment, returning the
vector of num_equations(state) group elements
Orrù & Yun Expires 18 February 2027 [Page 18]
Internet-Draft Sigma Proofs for Linear Relations August 2026
simulated_commitment[i] = map(state, response)[i]
- challenge * image(state)[i]
Drawing response uniformly at random with SimulateResponse and then
computing commitment with SimulateCommitment yields a transcript
(commitment, challenge, response) with the same distribution as an
honest one. This is the honest-verifier zero-knowledge property
(Section 7).
5. Non-interactive Sigma Protocols
The Fiat-Shamir transformation applied to Sigma Protocols yields a
non-interactive zero-knowledge argument of knowledge.
[fiat-shamir] describes how to instantiate the transformation, for
the group and field codecs given. This section specifies the session
identifier binding a proof to its application (Section 5.1), the
challenge derivation shared by prover and verifier (Section 5.2), the
two non-interactive argument (NARG) string serializations
(Section 5.3), and batch verification (Section 5.6).
5.1. Tag and session identifier
The session identifier session_id is a 32-byte string. It *SHOULD*
be derived from a string tag using DeriveSessionID of [fiat-shamir].
The prover and verifier initialize their duplex sponge state from it
(Section 5.2).
The tag is a byte string following the security requirements on the
session identifier in [fiat-shamir]. It *MUST* contain, verbatim,
the _flavor_ (DSFS for batchable NARG strings, CMPT for compact NARG
strings), and the ciphersuite identifier (Section 8). Following the
domain-separation conventions of Section 3.1 of [RFC9380], an
application concatenates its own name, version, and epoch with these
two components. As an example, a reasonable choice of tag for a
fictional application named Foo is:
FOO-V{xx}-{tttt}-{flavor}-with-{ciphersuiteID}
where xx is the two-digit number indicating the version, tttt is the
four-digit number identifying the epoch, flavor is the serialization
flavor marker, and ciphersuiteID is the ciphersuite identifier of
Section 8. For instance, for batchable NARG strings:
FOO-V01-0001-DSFS-with-sigma-proofs_Shake128_P256
The corresponding tag for compact NARG strings replaces the flavor
marker DSFS (duplex sponge Fiat-Shamir) with CMPT.
Orrù & Yun Expires 18 February 2027 [Page 19]
Internet-Draft Sigma Proofs for Linear Relations August 2026
The prover and the verifier each construct the tag (or session
identifier). Neither should accept a session identifier supplied by
a third party. An adversary who controls the entire session
identifier can cause a proof to be accepted where it was never
intended.
5.2. Challenge derivation
The prover derives the challenge from the tag (Section 5.1), the
instance being proven, and the serialized commitment message; the
verifier re-derives it from the same values, exactly as the prover
does. Both compute DeriveChallenge, which outputs the challenge, a
scalar:
DeriveChallenge(tag, instance, commitment_bytes)
Inputs:
- tag, a byte string uniquely identifying the session
- instance, the LinearRelation being proven
- commitment_bytes, the serialized commitment message
Output: the challenge, a scalar
1. session_id = DeriveSessionID(tag)
2. duplex_sponge = DS.Init(session_id)
3. duplex_sponge.Absorb(SerializeLinearRelation(instance))
4. duplex_sponge.Absorb(commitment_bytes)
5. return DecodeField(duplex_sponge.Squeeze(Ns + 16), p, 1)
DS, DeriveSessionID, and DecodeField are defined in [fiat-shamir]; Ns
+ 16 is the input length DecodeField requires over a prime field, and
the choices of DecodeField for the ciphersuites of this document are
discussed in Section 8. The challenge is drawn from the full scalar
field (Section 7.2).
5.3. Non-interactive argument string serialization
Two serialization flavors are possible:
* A *batchable* NARG string serializes the prover messages
(commitment, response), as in [fiat-shamir], and it permits
amortized verification costs (Section 5.6).
* A *compact* NARG string serializes (challenge, response). It is
preferable in the common case, whenever the commitment
(num_equations group elements) is larger than a single challenge
scalar.
Orrù & Yun Expires 18 February 2027 [Page 20]
Internet-Draft Sigma Proofs for Linear Relations August 2026
A batchable NARG string is a (Ne * num_equations + Ns * num_scalars)-
byte string, while a compact NARG string is a (Ns * (num_scalars +
1))-byte string. A NARG string verifies only under the flavor it was
produced for: the flavor marker is a mandatory tag component
(Section 5.1). Both flavors have the same soundness guarantees.
NARG strings are not deterministic, and so applications *MUST NOT*
rely on the uniqueness of the NARG string for replay protection or as
a nullifier.
5.4. Batchable NARG strings
A *batchable* NARG string is the NARG string of [fiat-shamir],
consisting of the concatenation of the serialized prover messages
using their respective serialization functions:
Group.serialize(commitment) || Scalar.serialize(response)
ProveBatchable and VerifyBatchable are the NARG prover and verifier
of [fiat-shamir] instantiated with the Sigma Protocol of Section 4.
* ProveBatchable(tag, instance, witness, rng) computes the
commitment message with ProverCommitment, derives the challenge as
DeriveChallenge(tag, instance, Group.serialize(commitment))
(Section 5.2), computes the response with
ProverResponse(prover_state, challenge), and outputs the NARG
string above.
* VerifyBatchable(tag, instance, narg_string) checks:
1. len(narg_string) is exactly Ne * num_equations(instance) + Ns
* num_scalars(instance)
2. deserialization succeeds
3. Verifier(instance, commitment, challenge, response) accepts.
5.5. Compact NARG strings
A *compact* NARG string serializes serialize(challenge) ||
serialize(response). The Sigma Protocol transcript is recovered by
invoking the simulator.
Orrù & Yun Expires 18 February 2027 [Page 21]
Internet-Draft Sigma Proofs for Linear Relations August 2026
ProveCompact(tag, instance, witness, rng)
Inputs:
- tag, a byte string uniquely identifying the session
- instance, the LinearRelation to be proven
- witness, the prover's secret witness
- rng, a cryptographically secure random number generator
Output: the compact NARG string
Procedure:
1. (commitment, prover_state) = ProverCommitment(instance, witness, rng)
2. commitment_bytes = Group.serialize(commitment)
3. challenge = DeriveChallenge(tag, instance, commitment_bytes)
4. response = ProverResponse(prover_state, challenge)
5. return Scalar.serialize([challenge]) || Scalar.serialize(response)
The verifier recomputes the commitment from the challenge and
response via SimulateCommitment (Section 4.4), then recomputes the
challenge from that commitment and accepts only if it matches the one
in the NARG string.
VerifyCompact(tag, instance, narg_string)
Inputs:
- tag, a byte string uniquely identifying the session
- instance, the LinearRelation to be proven
- narg_string, the compact NARG string
Output: a boolean indicating whether the NARG string is valid
Procedure:
1. fail if ValidateInstance(instance) fails
2. Nr = num_scalars(instance) * Ns
3. fail if len(narg_string) != Ns + Nr
4. challenge = Scalar.deserialize(narg_string[0 : Ns])[0]
5. response = Scalar.deserialize(narg_string[Ns : Ns + Nr])
6. commitment = SimulateCommitment(instance, response, challenge)
7. fail if any element of commitment is the identity element
8. expected_challenge = DeriveChallenge(tag, instance,
Group.serialize(commitment))
9. return challenge == expected_challenge
Orrù & Yun Expires 18 February 2027 [Page 22]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Step 7 maintains consistency with Group.deserialize, which rejects
the identity element. Since the simulator always outputs accepting
transcripts, there is no need to run Verifier in this case.
5.6. Batch verification
Verification of multiple batchable NARG strings *MAY* be done more
efficiently than verifying each NARG string on its own, via batch
verification. Batch verification can be more efficient even in the
presence of a single instance, provided the instance has at least a
few equations. Batch verification is a local verifier-side
optimization, which affects neither the prover nor the NARG string.
Batch verification is done by re-computing the verifier challenge of
each NARG string individually (Section 5.2), and then checking a
single random linear combination of the verification equations of the
whole batch. See Section 8.2 of [RFC8032], [BDLSY11], and
[BellareGR98].
The verification equation for Nt transcripts (commitment, challenge,
response) of preimages of linear relations is:
commitment[i][j] + challenge[i] * image(instances[i])[j]
== map(instances[i], response[i])[j]
for each transcript index i and each equation index j. Batch
verification consists of sampling uniformly random scalars
batching_randomness[i][j] (for i = 0, ..., Nt - 1 and j = 0, ...,
num_equations(instances[i]) - 1) and checking the single equation:
sum(
batching_randomness[i][j] * commitment[i][j]
+ batching_randomness[i][j] * challenge[i] * image(instances[i])[j]
- batching_randomness[i][j] * map(instances[i], response[i])[j]
for i in 0, ..., Nt - 1
for j in 0, ..., num_equations(instances[i]) - 1
) == Group.identity()
Similarly to batch verification of Ed25519 signatures [BDLSY11], a
false NARG string will be accepted with probability at most 2^-128,
which is negligible. In general, for batching_randomness elements
drawn uniformly from a set of 2^t scalars, a false NARG string will
be accepted with probability at most 2^-t.
Orrù & Yun Expires 18 February 2027 [Page 23]
Internet-Draft Sigma Proofs for Linear Relations August 2026
It is *RECOMMENDED* that the batching randomness be generated
deterministically, with the duplex sponge of [fiat-shamir] as
follows; it *MAY* instead be freshly sampled from a cryptographically
secure random number generator. Below, session_ids[i] is the 32-byte
session identifier of the i-th NARG string being verified
(Section 5.1).
1. batching_sid = DeriveSessionID(
"irtf-cfrg-sigma-protocols/batch-verify")
2. duplex_sponge = DS.Init(batching_sid)
3. for i in 0, ..., Nt - 1:
4. duplex_sponge.Absorb(session_ids[i])
5. duplex_sponge.Absorb(SerializeLinearRelation(instances[i]))
6. duplex_sponge.Absorb(narg_strings[i])
7. batching_randomness_bytes = duplex_sponge.Squeeze(
16 * sum(num_equations(instances[i]) for i in 0, ..., Nt - 1))
The session identifier has fixed length, and the length of each NARG
string is determined by the respective instance.
The squeezed output is read in row-major order (for example, the
second batching randomness corresponds to the second equation of the
first transcript). Each 16-byte chunk is interpreted as a little-
endian integer via LE2IP (Section 2.1). The batching randomness
elements are uniform in [0, 2^128) and are used as scalars without
further reduction.
8. k = 0
9. for i in 0, ..., Nt - 1:
10. for j in 0, ..., num_equations(instances[i]) - 1:
11. batching_randomness[i][j] =
LE2IP(batching_randomness_bytes[16*k : 16*(k+1)])
12. k = k + 1
The batch verifier *MUST* perform instance validation for each
instance, and *MUST* compute each of the verifier challenges with
DeriveChallenge (Section 5.2). Empty batches are accepted as valid;
the batch size *MUST* be less than 2^32. Upon failure, batch
verification does not identify the offending NARG string; an
application may fall back to verifying the NARG strings individually.
Batch verification is sound only if the prover(s) cannot choose their
messages as a function of the batching randomness. When derived
deterministically, the batching randomness *MUST* therefore absorb
every value in the batched equation before squeezing. In particular,
this includes the response message. Omitting prover messages from
the derivation will compromise soundness of batch verification
[SOLANA-ZK] [SOLANA-PHANTOM]. When sampled, the batching randomness
Orrù & Yun Expires 18 February 2027 [Page 24]
Internet-Draft Sigma Proofs for Linear Relations August 2026
*MUST* be drawn only after every NARG string in the batch is
received, and *MUST NOT* be reused across batches. The batch
verification procedure *MUST NOT* reuse the duplex sponge of a NARG
verifier.
The batching randomness elements *MAY* be replaced by the successive
powers 1, mu, mu^2, ... of a single uniformly random scalar mu,
assigned in row-major order (transcripts, then equations) to the
pairs (i, j) and computed in the scalar field. In this case, step 7
squeezes 16 bytes instead of 16 * K, where K =
sum(num_equations(instances[i]) for i in 0, ..., Nt - 1) is the total
number of batched equations, and mu is the little-endian integer they
encode, read via LE2IP (Section 2.1), uniformly distributed in [0,
2^128). In this case, an invalid batch is accepted with probability
at most (K - 1)/2^128, rather than the 2^-128 achieved by independent
sampling.
6. Efficiency Considerations
Constant arithmetic operations *MAY* be preprocessed, provided the
security requirements of Section 3.2 hold: evaluation-time
precomputation, such as fixed-base multiplication tables, is safe;
registering a precomputed linear combination as a new instance
element is not.
Multi-scalar multiplication (MSM) algorithms can help evaluate
map(instance, scalars) (Section 3.3) and the verification equation.
For example, the verifier of Section 4.3 is specified as the equality
map(instance, response) == commitment + challenge * image(instance),
evaluated as two separate vectors for clarity. Implementations *MAY*
instead verify each equation i by checking that commitment[i] +
challenge * image(instance)[i] - sum(response[j] * M[i][j] for j in
0, ..., num_scalars(instance) - 1) is identity(), accumulating all
terms in a single MSM per equation. Prioritizing field operations,
by evaluating expressions over terms and scalar coefficients, will be
faster than computing and summing each term individually.
The fastest MSM algorithms, such as Pippenger's bucket method or
windowed non-adjacent forms, run in time that depends on the scalars.
This is safe, for instance, in the verification equation above, for
image computation image(instance), and in SimulateCommitment
(Section 4.4): there, every scalar is public.
Orrù & Yun Expires 18 February 2027 [Page 25]
Internet-Draft Sigma Proofs for Linear Relations August 2026
The efficiency considerations of [fiat-shamir] apply here too.
Implementations that produce or verify many proofs for the same
instance can precompute and reuse the duplex sponge state after the
instance is absorbed (steps 1-3 of DeriveChallenge, Section 5.2)
across proofs. ValidateInstance (Section 3.5) likewise depends only
on the instance, and can be checked once per instance rather than
once per proof.
7. Security Considerations
A Sigma Protocol run interactively provides the guarantees of
Section 7.1. In practice, however, Sigma Protocols are almost always
deployed non-interactively via the Fiat-Shamir transformation
(Section 5); Section 7.2 describes how these guarantees carry over
and what additional care the non-interactive setting requires. In
either setting, every guarantee is relative to the instance:
Section 7.4 collects the obligations on how prover and verifier
construct it and agree on it.
7.1. Interactive security properties
The interactive Sigma Protocol of Section 4 has special soundness
[Cramer97] [Maurer09]: two accepting transcripts with the same
commitment and distinct challenges yield a witness, so a prover that
convinces the verifier must know a witness satisfying the proof
statement. Knowledge of a witness is meaningful only when the
relation is computationally hard: if witnesses are easy to find, the
proof conveys nothing.
The interactive Sigma Protocol of Section 4 is honest-verifier zero
knowledge: the prover messages do not reveal any information beyond
what can be directly inferred from the statement itself, so an honest
verifier gains no knowledge about the witness [Cramer97].
Because interactive Sigma Protocols do not have transferable message
authenticity, a third party (neither the prover nor the verifier)
cannot be convinced that the prover made the proof. The interaction
is thus not transferable as evidence to a third party [JakobssonSI96]
[Pass03].
7.2. Fiat-Shamir transformation
The security considerations of [fiat-shamir] apply here as well.
Soundness holds only if the encoded instance contains the entire
statement being proven (Section 3.6). Omitting any statement element
will compromise knowledge soundness of the resulting non-interactive
argument [CVE-2022-29566]. For example, consider the verifiable-
Orrù & Yun Expires 18 February 2027 [Page 26]
Internet-Draft Sigma Proofs for Linear Relations August 2026
decryption statement M + E1 = x * E0. If encoded with the single
image element F = M + E1, then M and E1 never enter the instance
encoding function, and the resulting NARG string is malleable across
statements: it verifies (unchanged) for every pair (M', E1') with M'
+ E1' = F. An attacker can thus present a NARG string generated for
one plaintext-ciphertext pair as valid for a different one. Another
example: encoding Y = x * (E0 + E1) with the single element K = E0 +
E1 as base instead of the two terms x * E0 + x * E1 verifies
unchanged for every pair (E0', E1') with E0' + E1' = K. Section 3.2
requires the instance to contain, individually, every group element
on which the application's acceptance depends; both examples above
violate that requirement while remaining structurally valid
(Section 3.5).
The challenge is drawn uniformly at random from the scalar field
(Section 4.3), and the non-interactive instantiations of Section 5
always derive full-field challenges. Writing C for the set the
challenge is drawn from, 1/|C| < 2^-250 for the ciphersuites of
Section 8. Compositions of Sigma Protocols (out of scope for this
document) *MAY* restrict the challenge to a smaller _challenge set_
C.
Knowledge extraction in the random oracle model requires rewinding
the adversary: by the Forking Lemma [PointchevalS00], an adversary
that outputs an accepting proof with probability epsilon after q hash
queries yields a witness with probability about epsilon^2/q, a
quadratic loss. In the algebraic group model (with a random oracle),
extraction is instead straight-line (when, for each row of M, finding
a non-trivial linear relation among its elements is computationally
hard) with total extraction error on the order of q/|C| (Section 9 of
[Orru24]).
7.3. NARG string validation
The security considerations of [fiat-shamir] apply here too.
In particular, for group elements, deserialization *MUST* verify that
each point is valid, lies on the curve, and in the prime-order
(sub-)group suited for cryptographic use. Uncompressed or hybrid
forms of [SEC1] *MUST* be rejected [ChalkiasGN20]. Skipping the on-
curve or subgroup check enables invalid-curve attacks [JagerSS15].
Accepting non-canonical field elements will compromise soundness
[CVE-2022-23806]. The identity element *MUST* be rejected in any
deserialized prover messages and instance elements (Section 2.3).
For scalars, deserialization *MUST* reject any value that is not the
canonical representative in [0, p) [CVE-2023-33252] [CVE-2025-57801].
Orrù & Yun Expires 18 February 2027 [Page 27]
Internet-Draft Sigma Proofs for Linear Relations August 2026
For compact NARG strings, the verifier *MUST* recompute the challenge
and compare it before accepting.
7.4. Instance security
The prover and verifier construct the instance from values they
independently hold and trust, such as the group generator. Often,
one party will supply elements or scalars to the other (Section 3.4).
These are untrusted input, and *MUST* be checked (Section 7.3). For
the verifier, those checks are part of verification. The prover
*MUST NOT* produce a proof over an instance without validating well-
formedness of all group elements and scalars first.
Some equations pin down no specific scalars. For example, the
equation X = x * G + 5 * y * G collapses to X = (x + 5 * y) * G, and
has p distinct witnesses [x, y], each trivial to derive from any
other. Similarly, the pair of terms x * H - x * H cancels for every
value of x, and constrains nothing. It is the responsibility of the
caller to provide non-trivial relations. Some effort in this
direction is made in Section 3.5 (such as rejection of trivial
images), however this will not cover all cases. Applications *MUST*
handle degenerate equations before calling the prover and verifier.
7.5. Privacy Considerations
The NARG string discloses nothing beyond the truth of the statement
the instance encodes. However, if the instance is chosen by the
adversary the privacy guarantee might be vacuous. Untrusted inputs
to the instance need to be validated by the caller. Instance
validation (Section 3.5) checks only the structure of the result; a
well-formed instance may encode an attacker-chosen linear map.
The entropy source of ProverCommitment *MUST* provide different
scalars for every different input. A re-used nonce reveals the
witness [PS3]. (This is the extractor: given different challenges c1
!= c2, the witness is (s1 - s2) / (c1 - c2), where s1, s2 are the
corresponding responses).
The Verifier procedure *SHOULD NOT* be used interactively with an
untrusted verifier: interactive Sigma Protocols only guarantee zero-
knowledge against honest verifiers (Section 7).
For verification, VerifyBatchable and VerifyCompact *SHOULD* be used.
The non-interactive Fiat-Shamir transformation yields statistically
zero-knowledge arguments of knowledge.
Orrù & Yun Expires 18 February 2027 [Page 28]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Implementations *SHOULD* securely delete prover state as soon as it
is no longer needed (witness and instance), and put in place
safeguards to prevent re-use of the prover state. Private witness
information should not be part of crash dumps and diagnostic logging.
7.6. Constant-Time Requirements
The secret values of this document are the witness, the nonces, and
the prover state that carries them. The instance and the NARG string
are public. All group and field operations whose inputs include
secret values *SHOULD* be constant-time in those values, and
randomness *SHOULD* be derived with straight-line code, avoiding
rejection sampling and other methods whose iteration count depends on
the entropy drawn (Section 2.2). Implementations *MAY* skip
multiplications by coefficient 1, or test instance coefficients for
zero in variable time.
The dominant secret-dependent operation is the multi-scalar
multiplication map(instance, nonces) in ProverCommitment, whose
scalars are secret and whose bases are public instance elements: it
*SHOULD* be constant-time with respect to the scalars, a guarantee
group libraries typically offer as an interface separate from their
variable-time MSM. The variable-time algorithms of Section 6 leak
scalar bits through window sizes and iteration counts, and partial
knowledge of the nonces will compromise the witness
[HowgraveGrahamS01] [JancarSSS20].
In some applications, such as keyed-verification credentials,
constant-time implementations are required for the verifier too:
there, the instance itself depends on the issuer's secret key. The
secret then enters the verification equation through the group
elements rather than the scalars, and an MSM that is constant-time
only with respect to the scalars is not sufficient: the point
arithmetic must not branch on exceptional cases, and the comparison
of the two sides of the verification equation must be constant-time.
The constant-time requirements of [fiat-shamir] apply here, and
extend to the encoding of the instance during challenge derivation.
Implementations that expose the simulator (Section 4.1) for OR
composition should note that which clause is simulated is itself
determined by the witness. Real and simulated clauses *SHOULD*
follow the same code path, with constant-time selection of the
desired transcript.
Orrù & Yun Expires 18 February 2027 [Page 29]
Internet-Draft Sigma Proofs for Linear Relations August 2026
7.7. Post-Quantum Considerations
Sigma Protocols are unconditionally sound and honest-verifier zero-
knowledge. What breaks in the post-quantum setting are the
statements themselves. They are preimages of linear maps in groups
where the discrete logarithm problem is assumed hard, and they are
meaningful only while computing discrete logarithms remains
infeasible. Therefore, relations of Section 3.1 *SHOULD NOT* be used
in the presence of quantum adversaries.
For instance, in the statement C = m * G + r * H, R = r * G, the
witness m is only computationally hidden. The NARG string does not
leak the witness. Yet, a quantum adversary may recover r from R and
then m from C - r * H, with two discrete logarithm computations.
As another example, the statement C = m * G + r * H, D = m * G + s *
H, asserting that two commitments open to the same value, is
meaningless to a quantum adversary: the commitments bind m only
computationally, and an adversary that computes the discrete
logarithm of H to the base G can open either of them to any value of
its choice.
The quantum random-oracle model (QROM) [BDFLSZ11], where the
adversary may query the hash function in superposition, is not
considered in this document. An analysis of the Fiat-Shamir
transformation in the QROM can be found in [DFMS19].
Other families of Sigma Protocols, e.g. MPC-in-the-Head [IKOS07],
lattice-based [AttemaCK21], or code-based [Stern93] approaches, can
provide post-quantum guarantees, but are not specified in this
document. The generic AND composition with a post-quantum-sound
Sigma Protocol does not upgrade security. For example, the binding
of a Pedersen commitment fails against a quantum adversary regardless
of the strength of the conjunct statement, so the combined statement
is meaningful only while *both* underlying problems remain hard. See
[BonehS23].
8. Ciphersuites
A ciphersuite for the non-interactive Sigma Protocol (Section 5) is
composed of the following parameters:
* an elliptic curve group, over which the Sigma Protocol of
Section 4 is run,
* a duplex sponge [fiat-shamir].
Orrù & Yun Expires 18 February 2027 [Page 30]
Internet-Draft Sigma Proofs for Linear Relations August 2026
The ciphersuites defined by this document, and the identifiers used
by the test vectors, are:
+==========================+=============+==+==+========+==========+
| Identifier | Group |Ne|Ns|Duplex | Security |
| | | | |Sponge | |
+==========================+=============+==+==+========+==========+
| sigma- | P-256 |33|32|SHAKE128| 128-bit |
| proofs_Shake128_P256 | (secp256r1) | | | | pre- |
| | | | | | quantum |
+--------------------------+-------------+--+--+--------+----------+
| sigma- | BLS12-381 |48|32|SHAKE128| about |
| proofs_Shake128_BLS12381 | (G1) | | | | 120-bit |
| | | | | | pre- |
| | | | | | quantum |
+--------------------------+-------------+--+--+--------+----------+
Table 1: Non-interactive Sigma Protocol ciphersuites
Each row uses the Sigma Protocol of Section 4 over the named group.
Ne and Ns are the element and scalar byte lengths of that group. The
ciphersuite identifier fixes the group, the codecs, and the hash
instantiation, and is included verbatim in the tag (Section 5.1).
For every ciphersuite in this document, the verifier challenge is
derived with DecodeField(buf, p, 1) exactly as specified in
[fiat-shamir]: the scalar field is prime, and its serialization
length Ns = 32 equals the smallest integer such that 256^Ns >= p, so
provers and verifiers squeeze exactly Ns + 16 = 48 bytes per
challenge (Section 5.2). Note that DecodeField interprets the
squeezed bytes as a little-endian integer.
The groups are prime-order elliptic curve groups, defined as follows.
8.1. P-256 (secp256r1)
This ciphersuite uses P-256 [NIST-SP-800-186] for the Group.
8.1.1. Elliptic curve group of P-256 (secp256r1) [NIST-SP-800-186]
* order():
115792089210356248762697446949407573529996955224135760342422259061068512044369.
* generator(): the base point G specified in [NIST-SP-800-186]; its
compressed serialization is
036b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296.
It is the group element at index 0 of every instance
(Section 3.2).
Orrù & Yun Expires 18 February 2027 [Page 31]
Internet-Draft Sigma Proofs for Linear Relations August 2026
* serialize([A]): the compressed Elliptic-Curve-Point-to-Octet-
String conversion of [SEC1] (Ne = 33).
* deserialize(buf): inverts the conversion above; only the
compressed form is a valid encoding (each Ne-byte slice begins
with 0x02 or 0x03). It *MUST* perform partial public-key
validation as defined in Section 5.6.2.3.4 of [NIST-SP-800-56A]
and *MUST* fail otherwise.
8.1.2. Scalar Field of P-256
* serialize(s): the big-endian fixed-length integer encoding I2OSP
(Section 2.1) (Ns = 32).
* deserialize(buf): OS2IP (Section 2.1); it *MUST* fail unless the
result is in [0, order()).
8.2. BLS12-381 (G1)
This ciphersuite uses the prime-order subgroup G1 of the BLS12-381
elliptic curve [RFC9380] for the Group.
8.2.1. Elliptic curve group of BLS12-381 (G1) [RFC9380]
* order():
52435875175126190479447740508185965837690552500527637822603658699938581184513.
* generator(): the generator of G1 specified in Section 4.2.1 of
[PAIRING]; its compressed serialization is
97f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb.
It is the group element at index 0 of every instance
(Section 3.2).
* serialize([A]): the compressed G1 serialization of Appendix C of
[PAIRING] (Ne = 48). The point-at-infinity encoding of that
format (I_bit set) is neither produced (Section 2.3) nor accepted.
* deserialize(buf): inverts the serialization above. It *MUST*
perform full point validation and *MUST* reject the point at
infinity.
8.2.2. Scalar Field of BLS12-381
* serialize(s): the big-endian fixed-length integer encoding I2OSP
(Section 2.1) (Ns = 32).
* deserialize(buf): OS2IP (Section 2.1); it *MUST* fail unless the
result is in [0, order()).
Orrù & Yun Expires 18 February 2027 [Page 32]
Internet-Draft Sigma Proofs for Linear Relations August 2026
9. IANA Considerations
This document has no IANA actions. The ciphersuite identifiers of
Section 8 are defined by this document and enter the protocol only as
components of the tag (Section 5.1); no registry is established.
Acknowledgments
The authors thank Jan Bobolz, Vishruti Ganesh, Stephan Krenn, Mary
Maller, Ivan Visconti, and Yuwen Zhang for reviewing a previous
edition of this specification.
The authors thank Giap Vu and David Wong (zkSecurity) for their help
and contributions.
References
Normative References
[fiat-shamir]
Orrù, M., "Fiat-Shamir Transformation", Work in Progress,
Internet-Draft, draft-irtf-cfrg-fiat-shamir-02, 2 March
2026, <https://datatracker.ietf.org/doc/html/draft-irtf-
cfrg-fiat-shamir-02>.
[NIST-SP-800-56A]
Barker, E., Chen, L., Roginsky, A., Vassilev, A., and R.
Davis, "Recommendation for pair-wise key-establishment
schemes using discrete logarithm cryptography", National
Institute of Standards and Technology,
DOI 10.6028/nist.sp.800-56ar3, April 2018,
<https://doi.org/10.6028/nist.sp.800-56ar3>.
[NIST-SP-800-186]
National Institute of Standards and Technology (NIST),
"Recommendations for Discrete Logarithm-based
Cryptography: Elliptic Curve Domain Parameters", NIST
SP 800-186, 2023,
<https://nvlpubs.nist.gov/nistpubs/SpecialPublications/
NIST.SP.800-186.pdf>.
[PAIRING] Sakemi, Y., Kanno, S., and R. S. Wahby, "Pairing-Friendly
Curves", Work in Progress, Internet-Draft, draft-irtf-
cfrg-pairing-friendly-curves-13, 6 July 2026,
<https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-
pairing-friendly-curves-13>.
Orrù & Yun Expires 18 February 2027 [Page 33]
Internet-Draft Sigma Proofs for Linear Relations August 2026
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/rfc/rfc2119>.
[RFC8017] Moriarty, K., Ed., Kaliski, B., Jonsson, J., and A. Rusch,
"PKCS #1: RSA Cryptography Specifications Version 2.2",
RFC 8017, DOI 10.17487/RFC8017, November 2016,
<https://www.rfc-editor.org/rfc/rfc8017>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/rfc/rfc8174>.
[RFC9380] Faz-Hernandez, A., Scott, S., Sullivan, N., Wahby, R. S.,
and C. A. Wood, "Hashing to Elliptic Curves", RFC 9380,
DOI 10.17487/RFC9380, August 2023,
<https://www.rfc-editor.org/rfc/rfc9380>.
[SEC1] Standards for Efficient Cryptography Group (SECG), "SEC 1:
Elliptic Curve Cryptography, Version 2.0", 2009,
<https://www.secg.org/sec1-v2.pdf>.
Informative References
[ARC] Yun, C., Wood, C. A., and A. F. Faz-Hernandez, "Anonymous
Rate-Limited Credentials Cryptography", Work in Progress,
Internet-Draft, draft-ietf-privacypass-arc-crypto-01, 2
March 2026, <https://datatracker.ietf.org/doc/html/draft-
ietf-privacypass-arc-crypto-01>.
[AttemaCK21]
Attema, T., Cramer, R., and L. Kohl, "A Compressed Sigma-
Protocol Theory for Lattices",
<https://doi.org/10.1007/978-3-030-84245-1_19>.
[BBS] Looker, T., Kalos, V., Whitehead, A., and M. Lodder, "The
BBS Signature Scheme", Work in Progress, Internet-Draft,
draft-irtf-cfrg-bbs-signatures-10, 8 January 2026,
<https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-
bbs-signatures-10>.
[BBSBlind] Kalos, V. and G. M. Bernstein, "Blind BBS Signatures",
Work in Progress, Internet-Draft, draft-irtf-cfrg-bbs-
blind-signatures-03, 26 June 2026,
<https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-
bbs-blind-signatures-03>.
Orrù & Yun Expires 18 February 2027 [Page 34]
Internet-Draft Sigma Proofs for Linear Relations August 2026
[BDFLSZ11] Boneh, D., Dagdelen, Ö., Fischlin, M., Lehmann, A.,
Schaffner, C., and M. Zhandry, "Random Oracles in a
Quantum World", <https://eprint.iacr.org/2010/428.pdf>.
[BDLSY11] Bernstein, D. J., Duif, N., Lange, T., Schwabe, P., and B.
Yang, "High-speed high-security signatures", 2011,
<https://doi.org/10.1007/978-3-642-23951-9_9>.
[BellareGR98]
Bellare, M., Garay, J. A., and T. Rabin, "Fast Batch
Verification for Modular Exponentiation and Digital
Signatures", 1998, <https://doi.org/10.1007/BFb0054130>.
[BonehS23] Boneh, D. and V. Shoup, "A Graduate Course in Applied
Cryptography", 2023, <https://toc.cryptobook.us/>.
[CamenischS97]
Camenisch, J. and M. Stadler, "Efficient Group Signature
Schemes for Large Groups", 1997,
<https://doi.org/10.1007/BFb0052252>.
[ChalkiasGN20]
Chalkias, K., Garillot, F., and V. Nikolaenko, "Taming the
Many EdDSAs", 2020,
<https://eprint.iacr.org/2020/1244.pdf>.
[ChaumP92] Chaum, D. and T. P. Pedersen, "Wallet Databases with
Observers", 1992,
<https://doi.org/10.1007/3-540-48071-4_7>.
[Cramer97] Cramer, R., "Modular Design of Secure yet Practical
Cryptographic Protocols", 1997,
<https://ir.cwi.nl/pub/21438>.
[CramerDS94]
Cramer, R., Damgård, I., and B. Schoenmakers, "Proofs of
Partial Knowledge and Simplified Design of Witness Hiding
Protocols", 1994, <https://ir.cwi.nl/pub/1456/1456D.pdf>.
[CVE-2022-23806]
"CVE-2022-23806: crypto/elliptic Curve.IsOnCurve returns
true for non-canonical field elements in Go", 2022,
<https://nvd.nist.gov/vuln/detail/CVE-2022-23806>.
Orrù & Yun Expires 18 February 2027 [Page 35]
Internet-Draft Sigma Proofs for Linear Relations August 2026
[CVE-2022-29566]
"CVE-2022-29566: Fiat-Shamir hashing omits public values
from the statement and the proof in Bulletproofs (Frozen
Heart)", 2022,
<https://nvd.nist.gov/vuln/detail/CVE-2022-29566>.
[CVE-2023-33252]
"CVE-2023-33252: snarkjs accepts public signals not
reduced modulo the field order", 2023,
<https://nvd.nist.gov/vuln/detail/CVE-2023-33252>.
[CVE-2025-57801]
"CVE-2025-57801: gnark in-circuit ECDSA/EdDSA verification
accepts out-of-range S (signature malleability)", 2025,
<https://nvd.nist.gov/vuln/detail/CVE-2025-57801>.
[DFMS19] Don, J., Fehr, S., Majenz, C., and C. Schaffner, "Security
of the Fiat-Shamir Transformation in the Quantum Random-
Oracle Model", <https://eprint.iacr.org/2019/190.pdf>.
[FIPS186-5]
National Institute of Standards and Technology (NIST),
"Digital Signature Standard (DSS)", FIPS 186-5, 2023,
<https://nvlpubs.nist.gov/nistpubs/FIPS/
NIST.FIPS.186-5.pdf>.
[HowgraveGrahamS01]
Howgrave-Graham, N. and N. P. Smart, "Lattice Attacks on
Digital Signature Schemes", 2001,
<https://doi.org/10.1023/A:1011214926272>.
[IKOS07] Ishai, Y., Kushilevitz, E., Ostrovsky, R., and A. Sahai,
"Zero-Knowledge from Secure Multiparty Computation", 2007,
<https://doi.org/10.1145/1250790.1250794>.
[JagerSS15]
Jager, T., Schwenk, J., and J. Somorovsky, "Practical
Invalid Curve Attacks on TLS-ECDH", 2015,
<https://doi.org/10.1007/978-3-319-24174-6_21>.
[JakobssonSI96]
Jakobsson, M., Sako, K., and R. Impagliazzo, "Designated
Verifier Proofs and Their Applications", 1996,
<https://doi.org/10.1007/3-540-68339-9_13>.
Orrù & Yun Expires 18 February 2027 [Page 36]
Internet-Draft Sigma Proofs for Linear Relations August 2026
[JancarSSS20]
Jancar, J., Sedlacek, V., Svenda, P., and M. Sys,
"Minerva: The curse of ECDSA nonces", 2020,
<https://doi.org/10.46586/tches.v2020.i4.281-308>.
[Maurer09] Maurer, U. M., "Unifying Zero-Knowledge Proofs of
Knowledge", 2009,
<https://doi.org/10.1007/978-3-642-02384-2_17>.
[Okamoto92]
Okamoto, T., "Provably Secure and Practical Identification
Schemes and Corresponding Signature Schemes", 1992,
<https://doi.org/10.1007/3-540-48071-4_3>.
[Orru24] Orrù, M., "Revisiting Keyed-Verification Anonymous
Credentials", 2024, <https://eprint.iacr.org/2024/1552>.
[Pass03] Pass, R., "On Deniability in the Common Reference String
and Random Oracle Model", 2003,
<https://doi.org/10.1007/978-3-540-45146-4_19>.
[Pedersen91]
Pedersen, T. P., "Non-Interactive and Information-
Theoretic Secure Verifiable Secret Sharing", 1991,
<https://doi.org/10.1007/3-540-46766-1_9>.
[PointchevalS00]
Pointcheval, D. and J. Stern, "Security Arguments for
Digital Signatures and Blind Signatures", 2000,
<https://doi.org/10.1007/s001450010003>.
[PS3] fail0verflow, "Console Hacking 2010: PS3 Epic Fail",
In 27th Chaos Communication Congress (27C3), 2010,
<https://fahrplan.events.ccc.de/congress/2010/Fahrplan/
attachments/1780_27c3_console_hacking_2010.pdf>.
[RFC4086] Eastlake 3rd, D., Schiller, J., and S. Crocker,
"Randomness Requirements for Security", BCP 106, RFC 4086,
DOI 10.17487/RFC4086, June 2005,
<https://www.rfc-editor.org/rfc/rfc4086>.
[RFC8032] Josefsson, S. and I. Liusvaara, "Edwards-Curve Digital
Signature Algorithm (EdDSA)", RFC 8032,
DOI 10.17487/RFC8032, January 2017,
<https://www.rfc-editor.org/rfc/rfc8032>.
Orrù & Yun Expires 18 February 2027 [Page 37]
Internet-Draft Sigma Proofs for Linear Relations August 2026
[RFC8235] Hao, F., Ed., "Schnorr Non-interactive Zero-Knowledge
Proof", RFC 8235, DOI 10.17487/RFC8235, September 2017,
<https://www.rfc-editor.org/rfc/rfc8235>.
[RFC9381] Goldberg, S., Reyzin, L., Papadopoulos, D., and J. Včelák,
"Verifiable Random Functions (VRFs)", RFC 9381,
DOI 10.17487/RFC9381, August 2023,
<https://www.rfc-editor.org/rfc/rfc9381>.
[RFC9497] Davidson, A., Faz-Hernandez, A., Sullivan, N., and C. A.
Wood, "Oblivious Pseudorandom Functions (OPRFs) Using
Prime-Order Groups", RFC 9497, DOI 10.17487/RFC9497,
December 2023, <https://www.rfc-editor.org/rfc/rfc9497>.
[Schnorr91]
Schnorr, C., "Efficient Signature Generation by Smart
Cards", 1991, <https://doi.org/10.1007/BF00196725>.
[SOLANA-PHANTOM]
Gong, S., "Uncovering the Phantom Challenge Soundness Bug
in Solana's ZK ElGamal Proof Program", 2025,
<https://blog.zksecurity.xyz/posts/solana-phantom-
challenge-bug/>.
[SOLANA-ZK]
Solana Foundation, "Post Mortem: ZK ElGamal Proof Program
Bug", 2025,
<https://solana.com/news/post-mortem-may-2-2025>.
[Stern93] Stern, J., "A New Identification Scheme Based on Syndrome
Decoding", 1993,
<https://doi.org/10.1007/3-540-48329-2_2>.
Appendix A. Test Vectors
This appendix contains test vectors for the non-interactive Sigma
Protocols specified in this document, one section per ciphersuite
(Appendix A.2, Appendix A.3). Each ciphersuite section has two
subsections: valid proofs, and adversarial vectors. Appendix A.1
pins the randomness used, so that the vectors are reproducible from
this document alone.
The vectors follow the format specified in the Test Vectors appendix
of [fiat-shamir]: a block of Key = Value lines, no key repeated,
values inline or indented under their key, and sequences written one
- item per line. Every vector carries Id, its stable name, and
Function, which is SigmaProof throughout this document. Where
[fiat-shamir] identifies the hash suite with Hash, these vectors
Orrù & Yun Expires 18 February 2027 [Page 38]
Internet-Draft Sigma Proofs for Linear Relations August 2026
carry Ciphersuite, which fixes the group and the hash together
(Section 8). Every vector also carries Expected, which is accept or
reject: unlike the functional vectors of [fiat-shamir], each vector
here is a verifier decision.
The remaining keys are those of the protocol. Relation names the
relation of Section 3.4 and Flavor is batchable or compact; one
vector covers one flavor, so Tag, SessionId and NargString are
unambiguous. The Witness field, which never appears on the wire, is
encoded as the concatenation of Scalar.serialize of the witness
scalars, in the order given by each relation.
Every adversarial vector carries BaseId, naming the valid vector it
is derived from: it re-verifies that transcript under a different
tag, statement, or encoding, and a conformant verifier *MUST* reject
it while accepting its baseline. Testing only that the adversarial
vectors are rejected is therefore not sufficient; an implementation
that rejects every input passes no accept/reject pair. The prose
accompanying each vector states which check fails; where the
rejection step depends on the implementation's check order, any of
the stated rejection points is conformant.
Batch verification (Section 5.6) can be tested on any subset of these
vectors: a batch of valid batchable proofs *MUST* verify, and a batch
containing any invalid batchable proof *MUST* be rejected.
A.1. Seeded PRNG
The randomness for these vectors is drawn from a seeded PRNG,
instantiated via a duplex sponge [fiat-shamir] initialized with the
session identifier DeriveSessionID(prng_tag).
The US-ASCII tag:
TestDRNG-SIGMA-PROOFS-{Ciphersuite}-{Relation}
Yields the scalars that build the instance and witness, in the order
given by each relation.
The tag:
TestDRNG-SIGMA-PROOFS-DSFS-{Ciphersuite}-{Relation}
Provides the randomness for the prover in the batchable NARG string.
That is, it is used to sample num_scalars(instance) commitment nonces
of the batchable proof.
Finally, the tag:
Orrù & Yun Expires 18 February 2027 [Page 39]
Internet-Draft Sigma Proofs for Linear Relations August 2026
TestDRNG-SIGMA-PROOFS-CMPT-{Ciphersuite}-{Relation}
Provides the randomness for the prover in the compact NARG strings.
Applications *MUST NOT* use this deterministic pseudorandom
generator. The prover's randomness *MUST* be seeded from operating-
system entropy (Section 2.3.2).
A.2. sigma-proofs_Shake128_P256
This section contains vectors for the ciphersuite identified as
sigma-proofs_Shake128_P256.
A.2.1. Valid proofs
Knowledge of a discrete logarithm, X = x * G: the Schnorr relation
given as example in Section 3.1.
Id = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = discrete_logarithm
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
SessionId =
72eeaaf4b2af14a6020b59d9b0501f7263bdbb16a403d93d7af1635546dcc503
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
Witness =
9b7b9af133b35ea96e662c4662956909fe465084fe929506980e025022d750be
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = accept
Knowledge of a discrete logarithm, X = x * G: the Schnorr relation
given as example in Section 3.1.
Orrù & Yun Expires 18 February 2027 [Page 40]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = discrete_logarithm
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
SessionId =
2934314b80877ce535bf39bb9074bc541c98e171b563b74dff82a63a921c6858
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
Witness =
9b7b9af133b35ea96e662c4662956909fe465084fe929506980e025022d750be
NargString =
3f29987a13e3ea094f2f7ee8f1ccc37ef3239bd303535a9959ca3aacca1f216c
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c28
Expected = accept
Discrete-logarithm equality, X = x * G and Y = x * H (Section 3.4).
Id = sigma-protocols/p256/dleq/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = dleq
Flavor = batchable
Tag = dleq-DSFS-with-sigma-proofs_Shake128_P256
SessionId =
322adf7cff2aca1c08e9c7053b1d1d75016d22f1903f1b109f0267034645478c
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000103a0d262ccb556df026581adf2ea6ea52cf69ca3
9f0644b89e43471cb40d921b0503dc308f6d1c515121d2334015b95254336a60
8a78031809b31099aadadcb566350241d6b25cf581b93fb4f769f1d88aa571df
e9d3f2e451b2f779e8da710ae0015b
Witness =
b4fbb257ea2f224915a82a630ff348069e2b25bafdcf6255322c9fa0dfb6340a
NargString =
0203ed31e0d73b821eba236b903f83ddd6e60e59a77249462be32fc43ab4d5dd
7e038ad4a96b49f6e29ea0afcb6a329632b5e3cdea70137e965515219da19be4
497655ca705567b987c6f9c5dd5bd866d069dfdcbc415b2036dab9ec63a821d4
c045
Expected = accept
Orrù & Yun Expires 18 February 2027 [Page 41]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Discrete-logarithm equality, X = x * G and Y = x * H (Section 3.4).
Id = sigma-protocols/p256/dleq/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = dleq
Flavor = compact
Tag = dleq-CMPT-with-sigma-proofs_Shake128_P256
SessionId =
6f3abd4c1daaa824fce769441e9f5c724021ee723174190745be999dbfeca92f
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000103a0d262ccb556df026581adf2ea6ea52cf69ca3
9f0644b89e43471cb40d921b0503dc308f6d1c515121d2334015b95254336a60
8a78031809b31099aadadcb566350241d6b25cf581b93fb4f769f1d88aa571df
e9d3f2e451b2f779e8da710ae0015b
Witness =
b4fbb257ea2f224915a82a630ff348069e2b25bafdcf6255322c9fa0dfb6340a
NargString =
5351e8969b72d4bdc0f2688ff68c69bb36154dc9074e534d954c8899b6c813b5
284cb4905860f4b1db7edc4473f5ee2b4ab178c5c2a8cbe57056ac330fc71d37
Expected = accept
Knowledge of the opening of a Pedersen commitment, C = m * G + r * H
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 42]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/pedersen_commitment/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = pedersen_commitment
Flavor = batchable
Tag = pedersen_commitment-DSFS-with-sigma-proofs_Shake128_P256
SessionId =
6d12e90fc2e3d74d9496ff609cd49f1013c6319da01b7aba5383f6b46789985e
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
0206c16fcf4c4017adb8908fb2ec0aba8ea9edd683ae38eac52d59f040956be8
f803e8372937cb2d0d9d0d48263ecd0a1d4b96207bceb3806739757fcad774f9
2642
Witness =
25c9fd63403d0da31081857537ade64b637c80ed2338639148a9938b3562ea06
afc354c8985ee3cb61b83af2f7a5bb2abeb7d510db5168b6ede21b4910594a2b
NargString =
03491976f248dcde9ecf9c4536754cb2e81b61be73999efd8e82d061cabf3a49
439eaa3fd376be7bb7a599b5bd03397d967174f61b27c514e4541a05cfaea37b
2d05c8c392bcc53462ce9b997cec950c02f6d023537137b3586e2ec277a3c328
80
Expected = accept
Knowledge of the opening of a Pedersen commitment, C = m * G + r * H
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 43]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/pedersen_commitment/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = pedersen_commitment
Flavor = compact
Tag = pedersen_commitment-CMPT-with-sigma-proofs_Shake128_P256
SessionId =
4d241bd0f43a3a162d0671aa263a8285f51d22d848d08b0f9e2e747f20b19d89
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
0206c16fcf4c4017adb8908fb2ec0aba8ea9edd683ae38eac52d59f040956be8
f803e8372937cb2d0d9d0d48263ecd0a1d4b96207bceb3806739757fcad774f9
2642
Witness =
25c9fd63403d0da31081857537ade64b637c80ed2338639148a9938b3562ea06
afc354c8985ee3cb61b83af2f7a5bb2abeb7d510db5168b6ede21b4910594a2b
NargString =
9e11b127fa8984da359687ba95ce5b1bb4e82ea252e0df9562d62e8c60acc013
ecfcd356f2476e287e3f043f7cf11d1fb3a3dce9a190ce605819d1a05bbd23c5
5630f834648c294b6f39d23e9f0f507119ecdf8691ee3ac5dcfd4b669bbdf3f7
Expected = accept
Two Pedersen-form equations sharing both witness scalars, X = x0 * G0
+ x1 * G1 and Y = x0 * G2 + x1 * G3 (Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 44]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/pedersen_commitment_dleq/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = pedersen_commitment_dleq
Flavor = batchable
Tag = pedersen_commitment_dleq-DSFS-with-sigma-proofs_Shake128_P256
SessionId =
688476139ac68ba996cc86d0331830b18fe2b5c8ab87038d4cf622d7c897c1cf
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0100000006000000000000000000000000000000000000000000000000000000
0000000000000001020000000000000004000000000000000000000000000000
0000000000000000000000000000000000000001010000000500000000000000
0000000000000000000000000000000000000000000000000000000102120b29
125003d5d494503fd47fa4057e761c1cb1632e8965233b8f8dfadd9d2503dc92
fe87397abd7e0beded9099032d680f46280672afeb1682e46b45e046d5b302a2
8a33dc8792cb198a9d7942eb1a34909373a5f382e8e68983a54f6fba75875502
76d70754e0a8f249a41695d5db16f8765d27a46a19dfcd8c1fdc7ac5896f46f5
03ccdb0adda1a852cac38054215e298b8d4b19823e3a66b9a80e44d063935de4
09028ef1cfa2468871b4b5116a6709c8df1f722180fc4fc1ad6e5db991660be7
8915
Witness =
1242ef15dea6fafe29b8d3e9ba859d0489744d46cc8b52563c445dcd0ee62854
b80c18e412222e458decdfbecd398b8036df12500008fac1a8f16eecb517bf54
NargString =
03e2aa1a7e5b705690b8fc4859dc9353a8ca262c6f11016306a9a84664e55f48
fc0268b6aeff56dbd1517e0721f62a59fe09fa2f523972ad06f3a6ccd75d82f8
6e95febeaa429522ab5e7bc356178a08cf50442e991f4a70db479f650903104a
92fa26e56545c5957e6e0ec86adbe6ca1675d8a713f39abeef120c72edeae7bf
a9ad
Expected = accept
Two Pedersen-form equations sharing both witness scalars, X = x0 * G0
+ x1 * G1 and Y = x0 * G2 + x1 * G3 (Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 45]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/pedersen_commitment_dleq/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = pedersen_commitment_dleq
Flavor = compact
Tag = pedersen_commitment_dleq-CMPT-with-sigma-proofs_Shake128_P256
SessionId =
ef423a52be5ad7d7d8e499aa870634f5ac3fc424b89fdc96aa72d8c5361e79d1
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0100000006000000000000000000000000000000000000000000000000000000
0000000000000001020000000000000004000000000000000000000000000000
0000000000000000000000000000000000000001010000000500000000000000
0000000000000000000000000000000000000000000000000000000102120b29
125003d5d494503fd47fa4057e761c1cb1632e8965233b8f8dfadd9d2503dc92
fe87397abd7e0beded9099032d680f46280672afeb1682e46b45e046d5b302a2
8a33dc8792cb198a9d7942eb1a34909373a5f382e8e68983a54f6fba75875502
76d70754e0a8f249a41695d5db16f8765d27a46a19dfcd8c1fdc7ac5896f46f5
03ccdb0adda1a852cac38054215e298b8d4b19823e3a66b9a80e44d063935de4
09028ef1cfa2468871b4b5116a6709c8df1f722180fc4fc1ad6e5db991660be7
8915
Witness =
1242ef15dea6fafe29b8d3e9ba859d0489744d46cc8b52563c445dcd0ee62854
b80c18e412222e458decdfbecd398b8036df12500008fac1a8f16eecb517bf54
NargString =
6cb7a0e88a0aa524c402339e9891851ed483bbe2f2ac4c2cea87999d33bef283
3c4bfd5c2a8de1abcd9a7134fd13391680dc7c9321b7e517b7bacf3755a6b177
48c11272f913bb15744d25f97e1f21885a948c952567463f289d6e382866314b
Expected = accept
The blind commitment computation of [BBSBlind], C = blind * Q2 +
msg_1 * J1 + msg_2 * J2 + msg_3 * J3.
Orrù & Yun Expires 18 February 2027 [Page 46]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/bbs_blind_commitment_computation/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = bbs_blind_commitment_computation
Flavor = batchable
Tag =
bbs_blind_commitment_computation-DSFS-with-sigma-proofs_Shake128_P256
SessionId =
72af721d175eb7b0c975ab01d37b8770077ce6bf9e81779188f59cb51a31bcbc
Instance =
0100000001000000050000000000000000000000000000000000000000000000
0000000000000000000000010400000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0200000003000000000000000000000000000000000000000000000000000000
0000000000000001030000000400000000000000000000000000000000000000
000000000000000000000000000000010202eaa274def05ab048396033e7f2d7
638851a60131af9759a016e3eff592941c02b4f47e54f51d447c160ecf71c456
a8e0d513d593c07bfaac23a373a4b51ca868034f75a59df8f7f10f97fcd9bdaf
24a3b0c5ea403167929f4fcab9d4e3f483747c02f86566f754588d585264dac4
f3650cf8ff53ec716ed21dfd07213058d8fc78020390ef88459ded35acdbe56d
986dad595f45a8b6f190bbce3ddb5908308f6115b5
Witness =
af35a44a86ed7403467f49203e8c79501e70f039b113cd1753993f84977d95ac
13cadbba0e76ff85edd77b7340ba0396e45671dff7229dc424faa180dba435ba
334d189229fa64202a6182e85d80497f21f250fa467ded4cf8152154af76c241
0a3c8706d1a6d4623d89b5b9213c59e1163975d6ef7abc8311682ddfe6d7390b
NargString =
03206f70cc509ce8660cca8caa1f3b403f143c006705fe72daf4cb083be82495
8499b37f26362a50c596ec4885b97e8deeae5b3da96329e3e715ceee04b9f32b
026945804d8d0f3594587be911a9809a61bb200b23b30cc94f246f8250be4882
df8128a391c9deefda6d96daa4c5977f902d137a0b4130e7e2fe3f14f3e0106c
3052e00a1c9b9607a5d7a502ac0d419fc87b0636289fdabd05824091e07140e0
1d
Expected = accept
The blind commitment computation of [BBSBlind], C = blind * Q2 +
msg_1 * J1 + msg_2 * J2 + msg_3 * J3.
Orrù & Yun Expires 18 February 2027 [Page 47]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/bbs_blind_commitment_computation/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = bbs_blind_commitment_computation
Flavor = compact
Tag =
bbs_blind_commitment_computation-CMPT-with-sigma-proofs_Shake128_P256
SessionId =
079c5d8e65618f746d72d2881bbb630155565d95375eb27619581b1e937a697d
Instance =
0100000001000000050000000000000000000000000000000000000000000000
0000000000000000000000010400000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0200000003000000000000000000000000000000000000000000000000000000
0000000000000001030000000400000000000000000000000000000000000000
000000000000000000000000000000010202eaa274def05ab048396033e7f2d7
638851a60131af9759a016e3eff592941c02b4f47e54f51d447c160ecf71c456
a8e0d513d593c07bfaac23a373a4b51ca868034f75a59df8f7f10f97fcd9bdaf
24a3b0c5ea403167929f4fcab9d4e3f483747c02f86566f754588d585264dac4
f3650cf8ff53ec716ed21dfd07213058d8fc78020390ef88459ded35acdbe56d
986dad595f45a8b6f190bbce3ddb5908308f6115b5
Witness =
af35a44a86ed7403467f49203e8c79501e70f039b113cd1753993f84977d95ac
13cadbba0e76ff85edd77b7340ba0396e45671dff7229dc424faa180dba435ba
334d189229fa64202a6182e85d80497f21f250fa467ded4cf8152154af76c241
0a3c8706d1a6d4623d89b5b9213c59e1163975d6ef7abc8311682ddfe6d7390b
NargString =
431c50915e63bb13e4c89556d736cea30703c6235711c62aa3a3fde58e250526
93c3b5716f935f1052bb9fb97dd5635a7f14b3254ccdeeffc8fad01f2f4fed36
db0324e47ffdf5218646411ca9ccbcdde13001686a63997ea358f88c956524db
a190b324f47d021fc6b4373414e99aa68e673eb517e04fb169923418dec5d44b
fb208ece8117954283043ab111babce94b9d5716ef75f696f8c4492e2def66e7
Expected = accept
Correct ElGamal decryption, X = x * G and M = x * E0 - E1
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 48]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/elgamal_decryption/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = elgamal_decryption
Flavor = batchable
Tag = elgamal_decryption-DSFS-with-sigma-proofs_Shake128_P256
SessionId =
b9125fe73ce90119db10799a9669a1ee47f6bc7b1dc7e0e8ab00296df6159657
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000004000000
0000000000000000000000000000000000000000000000000000000000000001
0300000000000000000000000000000000000000000000000000000000000000
0000000101000000000000000200000000000000000000000000000000000000
000000000000000000000000000000010372462b86837aaadb6ec2348fc4a602
9f7ae77e9aea238017bebbbe469dd299be039f3ab1733887055e7f18884bc8d6
66d2461925888f366009aeefcaaffd94900e02597c2dd8b7bd7c2c9864efa356
ed285103582e75c001fbd8400aaf618790fa93036d21e24e585051080212d7ee
b3884dcb28017e91d50967bcd432bbd9a8cf4986
Witness =
14375a0f9d92dd6fd4b67cb11de6f81b54c101f6e846cd8817dce6db7b30fb4c
NargString =
02f2de68f98653dc53ef1832f363b62fd68837f7b5d17080e068e4450ef35bc5
2f036ae8948f8836f4c38bf16298de1179a4641f6a11e2222457160ff4f8963b
72868c2b3964e4fc66374f635bb8a497d34592420c5b2ebd653ed30f80fe56bb
3776
Expected = accept
Correct ElGamal decryption, X = x * G and M = x * E0 - E1
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 49]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/elgamal_decryption/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = elgamal_decryption
Flavor = compact
Tag = elgamal_decryption-CMPT-with-sigma-proofs_Shake128_P256
SessionId =
cf4b3a76432ab31da160eb35049dde5afea29635eaadc9a79c59a04771b0908f
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000004000000
0000000000000000000000000000000000000000000000000000000000000001
0300000000000000000000000000000000000000000000000000000000000000
0000000101000000000000000200000000000000000000000000000000000000
000000000000000000000000000000010372462b86837aaadb6ec2348fc4a602
9f7ae77e9aea238017bebbbe469dd299be039f3ab1733887055e7f18884bc8d6
66d2461925888f366009aeefcaaffd94900e02597c2dd8b7bd7c2c9864efa356
ed285103582e75c001fbd8400aaf618790fa93036d21e24e585051080212d7ee
b3884dcb28017e91d50967bcd432bbd9a8cf4986
Witness =
14375a0f9d92dd6fd4b67cb11de6f81b54c101f6e846cd8817dce6db7b30fb4c
NargString =
827f88105d6a14c364c070fcdc5a53f0208b42ec6d8a6e397eea1d24382676bb
7af67b61c733281b12822892a29da92326df8fd6921802462909ace20d42e632
Expected = accept
The ChaumPedersen relation of Section 3.4 again, with Y = x * H
derived by the prover from its witness rather than received: the
compiled instance matches dleq, and only the tag (hence the proof
bytes) differs.
Orrù & Yun Expires 18 February 2027 [Page 50]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/dleq_derived_element/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = dleq_derived_element
Flavor = batchable
Tag = dleq_derived_element-DSFS-with-sigma-proofs_Shake128_P256
SessionId =
c14c1f05e26976121b0842e9a64270893d4d7ca1b24e09c7d6b4147e74e9af0d
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000103f56baee56b8f80b4bae59bb48c615a7b34ab47
c8f0de3fe6bc23706511a90a0d037100a881faf4f73982c7e3113810c6e56a69
c42c98562a121c15ad1951c8eafa031def6155fd67b1be8e4fd49c7227e576c1
abe0886e5d6a928a015f5d8f08e436
Witness =
45d78f1fff7555932001aa84fb525f9caa8a0949bb8406aaacdd9ce9f06dfdea
NargString =
029e903a7f21e67b403658a8b55c2097d0b5ec918a10b4ac965dbbddca20d216
d50374b96946905242651598a20721cce60aaa1a1d84f4f4644ad1abb2ea61eb
435f785e12da6947bdcaa0b49176170df8a65f54f828e03412df5b31744433be
5e7c
Expected = accept
The ChaumPedersen relation of Section 3.4 again, with Y = x * H
derived by the prover from its witness rather than received: the
compiled instance matches dleq, and only the tag (hence the proof
bytes) differs.
Orrù & Yun Expires 18 February 2027 [Page 51]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/dleq_derived_element/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Relation = dleq_derived_element
Flavor = compact
Tag = dleq_derived_element-CMPT-with-sigma-proofs_Shake128_P256
SessionId =
5ed1c6effe868eaf259136b7702a342c2bd7aee2028e29dcee0364f8cbe88e2d
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000103f56baee56b8f80b4bae59bb48c615a7b34ab47
c8f0de3fe6bc23706511a90a0d037100a881faf4f73982c7e3113810c6e56a69
c42c98562a121c15ad1951c8eafa031def6155fd67b1be8e4fd49c7227e576c1
abe0886e5d6a928a015f5d8f08e436
Witness =
45d78f1fff7555932001aa84fb525f9caa8a0949bb8406aaacdd9ce9f06dfdea
NargString =
e8c65a06a08e5573f7b29c56246dc4efe5bd9d834ed12aa32e62a427875b852c
ffb5e51026648606a6f78a935c334c86c1a930c515e852db06e010f7418e8871
Expected = accept
A.2.2. Adversarial vectors
Deserialization fails on the SEC1 uncompressed prefix 0x04.
Id = sigma-protocols/p256/discrete_logarithm/batchable/A1
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
047e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Deserialization fails on the SEC1 hybrid prefix 0x06.
Orrù & Yun Expires 18 February 2027 [Page 52]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/A2
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
067e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Deserialization fails on the SEC1 hybrid prefix 0x07.
Id = sigma-protocols/p256/discrete_logarithm/batchable/A2b
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
077e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Deserialization fails if the x-coordinate is lifted by the field
characteristic (x = 5, encoded as x + p): the coordinate is non-
canonical.
Orrù & Yun Expires 18 February 2027 [Page 53]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/A3
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
02ffffffff000000010000000000000000000000010000000000000000000000
049dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Deserialization fails on 0x00 padded to Ne bytes.
Id = sigma-protocols/p256/discrete_logarithm/batchable/A4
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
0000000000000000000000000000000000000000000000000000000000000000
009dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Deserialization fails on x = 1, which has no square root for y.
Orrù & Yun Expires 18 February 2027 [Page 54]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/A6
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
0200000000000000000000000000000000000000000000000000000000000000
019dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Deserialization fails if response[0] is set to order + 1.
Id = sigma-protocols/p256/discrete_logarithm/batchable/B1
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
19ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc6325
52
Expected = reject
Deserialization fails if challenge is set to order + 1.
Orrù & Yun Expires 18 February 2027 [Page 55]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/compact/B2
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632552
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c28
Expected = reject
Verification fails if one trailing 0x00 byte is appended to a valid
proof.
Id = sigma-protocols/p256/discrete_logarithm/batchable/C1
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b00
Expected = reject
Verification fails if a valid proof is truncated by one byte.
Orrù & Yun Expires 18 February 2027 [Page 56]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/C2
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
Expected = reject
Verification fails if one trailing 0x00 byte is appended to a valid
proof.
Id = sigma-protocols/p256/discrete_logarithm/compact/C1
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
3f29987a13e3ea094f2f7ee8f1ccc37ef3239bd303535a9959ca3aacca1f216c
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c28
00
Expected = reject
Verification fails if a valid proof is truncated by one byte.
Orrù & Yun Expires 18 February 2027 [Page 57]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/compact/C2
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
3f29987a13e3ea094f2f7ee8f1ccc37ef3239bd303535a9959ca3aacca1f216c
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c
Expected = reject
Verification fails on the all-zero compact proof: challenge and
response are zero.
Id = sigma-protocols/p256/discrete_logarithm/compact/D1
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
Expected = reject
Instance validation fails if scalar index 1 appears in no equation
(check 6); the proof satisfies the verification equations, so
rejection must come from instance validation.
Orrù & Yun Expires 18 February 2027 [Page 58]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/E1
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = instance_unconstrained_scalar-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000001000000
0000000000000000000000000000000000000000000000000000000000000001
031ac02e1fd7d885b1e5eb1811abd9c4d03eee8eada37d9c1a860ca3c649b8e2
a302ccab62b6a53592a5bc088188532faa9eee974c21150d6276da6c6d924b6e
2dc1
NargString =
033d85fedbddfd463f0392eeea57107720404fbce572e420fe54fba77bad18b4
b94358208ea29237036630d19ee48191bf7626c37730249a3951083345b19ed4
e6c2e07d1d92976e9398c5cc356ce644df48ecb1362ccf31d97166a3e40048c7
76e4555c95e4b42275076c8523f4ee48be8835478f8b0262fce9279e2bcb8c7a
94
Expected = reject
Instance validation fails on the same instance, here with the
unconstrained response[1] perturbed.
Id = sigma-protocols/p256/discrete_logarithm/batchable/E1b
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = instance_unconstrained_scalar-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000001000000
0000000000000000000000000000000000000000000000000000000000000001
031ac02e1fd7d885b1e5eb1811abd9c4d03eee8eada37d9c1a860ca3c649b8e2
a302ccab62b6a53592a5bc088188532faa9eee974c21150d6276da6c6d924b6e
2dc1
NargString =
033d85fedbddfd463f0392eeea57107720404fbce572e420fe54fba77bad18b4
b94358208ea29237036630d19ee48191bf7626c37730249a3951083345b19ed4
e6c2e07d1d92976e9398c5cc356ce644df48ecb1362ccf31d97166a3e40048c7
77e4555c95e4b42275076c8523f4ee48be8835478f8b0262fce9279e2bcb8c7a
94
Expected = reject
Orrù & Yun Expires 18 February 2027 [Page 59]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Instance validation fails if the image terms X + (-X) sum to the
identity (check 9).
Id = sigma-protocols/p256/discrete_logarithm/batchable/E2
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = instance_trivial_equation-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000002000000010000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000101000000000000000000000000000000
00000000000000000000000000000000000000000000000000000001031db20b
c00c5012329627c85174b00ade13788636ce3ce3842e0fc1dde4179ca5021db2
0bc00c5012329627c85174b00ade13788636ce3ce3842e0fc1dde4179ca5
NargString =
022fb88456a6a7f8d974b129ec99f3745ffd9e3dcbae9771815571d4c4087a12
088aa155e5f5e22708f62eec3e7425026489340ed065e835229f1a5010637696
d9
Expected = reject
Instance validation fails if a statement element is the identity
(check 8), here at index 1, encoded as stand-in bytes (P-256 has no
identity encoding); parsers may instead reject at group
deserialization.
Id = sigma-protocols/p256/discrete_logarithm/batchable/E3
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = instance_identity_element-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
0000000000000000000000000000000000000000000000000000000000000000
0003871d14718441e23004e5c432427775bde2e9244f75550e839d210556bde1
cad0
NargString =
02b9d1353c5f3bf39418f2ea4bb8f8ba63cef1e8cc7eb14f51242c31ec17765a
5fa919d7f15f2e14c494b5e199eaf0b70735118e7ae2b7a278edee4b27a0135f
fb2cb0ed2a76d9c583db0758976f24bc3eb65764691a2a51779f84acca97e161
bc
Expected = reject
Orrù & Yun Expires 18 February 2027 [Page 60]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Instance validation fails if a term references element index 2 while
a single element follows; parsers may instead reject on length.
Id = sigma-protocols/p256/discrete_logarithm/batchable/E4
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = instance_index_out_of_bounds-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000020000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
A valid NARG string verifies under the tag it was produced for.
Id = sigma-protocols/p256/discrete_logarithm/batchable/F1
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = accept
Verification fails under a different tag.
Orrù & Yun Expires 18 February 2027 [Page 61]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/F1b
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag =
discrete_logarithm/wrong-session-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
A valid NARG string verifies under the tag it was produced for.
Id = sigma-protocols/p256/discrete_logarithm/compact/F1
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
3f29987a13e3ea094f2f7ee8f1ccc37ef3239bd303535a9959ca3aacca1f216c
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c28
Expected = accept
Verification fails under a different tag.
Orrù & Yun Expires 18 February 2027 [Page 62]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/compact/F1b
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag =
discrete_logarithm/wrong-session-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
3f29987a13e3ea094f2f7ee8f1ccc37ef3239bd303535a9959ca3aacca1f216c
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c28
Expected = reject
A valid NARG string verifies against the statement it was produced
for.
Id = sigma-protocols/p256/discrete_logarithm/batchable/F2
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = dleq-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000103a0d262ccb556df026581adf2ea6ea52cf69ca3
9f0644b89e43471cb40d921b0503dc308f6d1c515121d2334015b95254336a60
8a78031809b31099aadadcb566350241d6b25cf581b93fb4f769f1d88aa571df
e9d3f2e451b2f779e8da710ae0015b
NargString =
0203ed31e0d73b821eba236b903f83ddd6e60e59a77249462be32fc43ab4d5dd
7e038ad4a96b49f6e29ea0afcb6a329632b5e3cdea70137e965515219da19be4
497655ca705567b987c6f9c5dd5bd866d069dfdcbc415b2036dab9ec63a821d4
c045
Expected = accept
Verification fails if the statement's two equations are swapped.
Orrù & Yun Expires 18 February 2027 [Page 63]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/F2b
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = dleq-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000020000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000000000000000000000000000000000000000000000000000
00000000000000000000000103a0d262ccb556df026581adf2ea6ea52cf69ca3
9f0644b89e43471cb40d921b0503dc308f6d1c515121d2334015b95254336a60
8a78031809b31099aadadcb566350241d6b25cf581b93fb4f769f1d88aa571df
e9d3f2e451b2f779e8da710ae0015b
NargString =
0203ed31e0d73b821eba236b903f83ddd6e60e59a77249462be32fc43ab4d5dd
7e038ad4a96b49f6e29ea0afcb6a329632b5e3cdea70137e965515219da19be4
497655ca705567b987c6f9c5dd5bd866d069dfdcbc415b2036dab9ec63a821d4
c045
Expected = reject
A valid NARG string verifies against the statement it was produced
for.
Id = sigma-protocols/p256/discrete_logarithm/compact/F2
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = dleq-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000103a0d262ccb556df026581adf2ea6ea52cf69ca3
9f0644b89e43471cb40d921b0503dc308f6d1c515121d2334015b95254336a60
8a78031809b31099aadadcb566350241d6b25cf581b93fb4f769f1d88aa571df
e9d3f2e451b2f779e8da710ae0015b
NargString =
5351e8969b72d4bdc0f2688ff68c69bb36154dc9074e534d954c8899b6c813b5
284cb4905860f4b1db7edc4473f5ee2b4ab178c5c2a8cbe57056ac330fc71d37
Expected = accept
Verification fails if the statement's two equations are swapped.
Orrù & Yun Expires 18 February 2027 [Page 64]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/compact/F2b
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = dleq-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000020000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000000000000000000000000000000000000000000000000000
00000000000000000000000103a0d262ccb556df026581adf2ea6ea52cf69ca3
9f0644b89e43471cb40d921b0503dc308f6d1c515121d2334015b95254336a60
8a78031809b31099aadadcb566350241d6b25cf581b93fb4f769f1d88aa571df
e9d3f2e451b2f779e8da710ae0015b
NargString =
5351e8969b72d4bdc0f2688ff68c69bb36154dc9074e534d954c8899b6c813b5
284cb4905860f4b1db7edc4473f5ee2b4ab178c5c2a8cbe57056ac330fc71d37
Expected = reject
Verification fails if a statement element is changed after proving.
Id = sigma-protocols/p256/discrete_logarithm/batchable/F3
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001039db6eb62700691
c3580fbda8fc7ee33f6cfdd5b43203507c1b0533b15d0d1b7e
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Verification fails if a statement element is changed after proving.
Orrù & Yun Expires 18 February 2027 [Page 65]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/compact/F3
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001039db6eb62700691
c3580fbda8fc7ee33f6cfdd5b43203507c1b0533b15d0d1b7e
NargString =
3f29987a13e3ea094f2f7ee8f1ccc37ef3239bd303535a9959ca3aacca1f216c
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c28
Expected = reject
Verification fails if the batchable proof's transcript is re-encoded
as a compact NARG string.
Id = sigma-protocols/p256/discrete_logarithm/compact/F4
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
e44d6cb80e7b099d06525dbb3567fc05ebfc9b7d3da0624e5cf643163d7a51e3
9dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e1713b
Expected = reject
Verification fails if the compact proof's transcript is re-encoded as
a batchable NARG string: the challenge derived under the batchable
tag differs.
Orrù & Yun Expires 18 February 2027 [Page 66]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/F4b
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
0221f8d84da0727022bf043b23de7c67590535109a3a6c24f4fba9c8732190c6
eacfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c
28
Expected = reject
Verification fails if response[0] is increased by 1.
Id = sigma-protocols/p256/discrete_logarithm/batchable/H1
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
037e00143a98c515388e00397c050c46729f010e30752f00172c2e9444cd323e
199dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3c
Expected = reject
Verification fails if commitment[0] is replaced by a different valid
group element.
Orrù & Yun Expires 18 February 2027 [Page 67]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/p256/discrete_logarithm/batchable/H2
BaseId = sigma-protocols/p256/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
036b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c2
969dda433231690cefaaaceb1bf372b37ca060a6a3a87b40dafea0a8d2f5e171
3b
Expected = reject
Verification fails if challenge is replaced by a different scalar.
Id = sigma-protocols/p256/discrete_logarithm/compact/H3
BaseId = sigma-protocols/p256/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_P256
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_P256
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
00000000000000000000000000000000000000000000000103f0f109368d010f
5adf85ad7ce620a87291f3d4cabcf72fd8d2b91bc50f541fa8
NargString =
3f29987a13e3ea094f2f7ee8f1ccc37ef3239bd303535a9959ca3aacca1f216d
cfa4f6e2f3a7a88a485fc90cc1eba4019f4d66756cd8b3df83a6a43044ab1c28
Expected = reject
A.3. sigma-proofs_Shake128_BLS12381
This section contains vectors for the ciphersuite identified as
sigma-proofs_Shake128_BLS12381.
A.3.1. Valid proofs
Knowledge of a discrete logarithm, X = x * G: the Schnorr relation
given as example in Section 3.1.
Orrù & Yun Expires 18 February 2027 [Page 68]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = discrete_logarithm
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
SessionId =
b9a184f47a2038072177099bdfe75e6663e86f0cb6790b7b618102b3f3b2d787
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
Witness =
641c3cdcc72c9b3a84b85df5808de5f37cf4489ca15f1cffdfd105b780ec0682
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = accept
Knowledge of a discrete logarithm, X = x * G: the Schnorr relation
given as example in Section 3.1.
Id = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = discrete_logarithm
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
SessionId =
8651b5e07aef46852f93102b9e9432370b671d4bd84fbfcfd1e224a06e7ae182
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
Witness =
641c3cdcc72c9b3a84b85df5808de5f37cf4489ca15f1cffdfd105b780ec0682
NargString =
2b2af194b74fff452d74060e514e36a43f4b7405bff46781a78f42bc7696c7ee
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad94
Expected = accept
Discrete-logarithm equality, X = x * G and Y = x * H (Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 69]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/dleq/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = dleq
Flavor = batchable
Tag = dleq-DSFS-with-sigma-proofs_Shake128_BLS12381
SessionId =
8a5c790e1a988d7ad14e5eecdfbd2fc1ce87e01e788c38e3c2487f8d8898c9cc
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
000000000000000000000001b8a52d4f929a5fc9a27b16941d102b632bac0b06
61265ed04ec9e59d35480f93d4ebefc5af6a06090964444a5ed9abfdac2a3348
158e801ab8f31490543b66ddf04a103dd0bc7f41194f72b575b62d08900aaf6e
7ba8f3672c1b7064b19ecf968f3af22d60210b724fc400f8b8e8547a3f82ba01
7d24199087b0bd1941c21f4c6afa8e1d636914790ee4b80e44908926
Witness =
4a27c7be9fb7612efe553eb66c7120b978433c35625c00c9c530da6e7214db08
NargString =
b13432cd2a44f3287e1ee64986f77cfd30bc6e27cb5bb245e5e0d5cd74d7ea59
d64b17f3e612b0a5790bad93d77ea46291f38f62b25f78dae74200765604f560
b5b0459b45404eb953e498497a94757841739571c4fa83ba5b27fb2cd9c01c20
53843da83608b616cb57c042f0d21160317095e5ab1706e02299dfd47f67b453
Expected = accept
Discrete-logarithm equality, X = x * G and Y = x * H (Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 70]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/dleq/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = dleq
Flavor = compact
Tag = dleq-CMPT-with-sigma-proofs_Shake128_BLS12381
SessionId =
244120cf7e64e64f0230270461e2011b7e7a37a4ddd1f10613c5a9ea3d69afb5
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
000000000000000000000001b8a52d4f929a5fc9a27b16941d102b632bac0b06
61265ed04ec9e59d35480f93d4ebefc5af6a06090964444a5ed9abfdac2a3348
158e801ab8f31490543b66ddf04a103dd0bc7f41194f72b575b62d08900aaf6e
7ba8f3672c1b7064b19ecf968f3af22d60210b724fc400f8b8e8547a3f82ba01
7d24199087b0bd1941c21f4c6afa8e1d636914790ee4b80e44908926
Witness =
4a27c7be9fb7612efe553eb66c7120b978433c35625c00c9c530da6e7214db08
NargString =
6756a6afe70dc8b509ece61173992cd9970d6219332d289fecf58e240f1497ca
1712fb2963a360c4bc783fa9764bb115b7162e014c5f6c8859fbcd71fbc58844
Expected = accept
Knowledge of the opening of a Pedersen commitment, C = m * G + r * H
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 71]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/pedersen_commitment/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = pedersen_commitment
Flavor = batchable
Tag = pedersen_commitment-DSFS-with-sigma-proofs_Shake128_BLS12381
SessionId =
e029c091ebd8fea4edbd7025de04170104768f284ab9693ede56a0a6ffb299fc
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
98a75ce3f191eebaed9f6a49b445f423ac6ba6dd2caad41ff2d5a05db9531f35
0d9125914ddacd670af9e851d44c05239482122220076c1aa251a964e649aec8
3af91fb2660b1e1dd1932353a88020c3ef09a805be4d8af09a094eaf2263695f
Witness =
513794634e24e09f9eb668c0c1f4dfd6857e303b6b8bc5d08bae5a19e3961ed3
27b79d17769ee1f8c1d774380a3acdb8d70c96f4869fa17fdcaf7a5729804a12
NargString =
a35cdeff7ecb8c09e2527e98c6da38d23d8f9ac25affe1be3fec9976428f0b83
7b8b9c62b8726f4ee3522e59a64e6b402e26ba8823477689798c38ba703692f5
156f5d39febaa33eacf1a0ecbc2973a813e0e02d5c72770b6397cfab9315e5cf
3c2402516220b2ac1ec139c9bfdc020f
Expected = accept
Knowledge of the opening of a Pedersen commitment, C = m * G + r * H
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 72]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/pedersen_commitment/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = pedersen_commitment
Flavor = compact
Tag = pedersen_commitment-CMPT-with-sigma-proofs_Shake128_BLS12381
SessionId =
0d54417e1f7bbbb652a9230e7e47701d1654bee35c8ae86235864576c86521a4
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
98a75ce3f191eebaed9f6a49b445f423ac6ba6dd2caad41ff2d5a05db9531f35
0d9125914ddacd670af9e851d44c05239482122220076c1aa251a964e649aec8
3af91fb2660b1e1dd1932353a88020c3ef09a805be4d8af09a094eaf2263695f
Witness =
513794634e24e09f9eb668c0c1f4dfd6857e303b6b8bc5d08bae5a19e3961ed3
27b79d17769ee1f8c1d774380a3acdb8d70c96f4869fa17fdcaf7a5729804a12
NargString =
0af9ef56a2968b32d07654a7de630732e9cad9625c51f7b7975cd3056ef71021
1be5f52ee640769f3fd276008102aa8ee5041f859aa509d2bf8bc35224eb2841
36a8475ab594387b75de3af7e2ff51464c6b518172604308ede2dac3fc97f9bc
Expected = accept
Two Pedersen-form equations sharing both witness scalars, X = x0 * G0
+ x1 * G1 and Y = x0 * G2 + x1 * G3 (Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 73]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/pedersen_commitment_dleq/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = pedersen_commitment_dleq
Flavor = batchable
Tag = pedersen_commitment_dleq-DSFS-with-sigma-proofs_Shake128_BLS12381
SessionId =
ce017f3f5b3462089c1b374cdd47271a0d0d3bae7381eb3435830eeaf9c48879
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0100000006000000000000000000000000000000000000000000000000000000
0000000000000001020000000000000004000000000000000000000000000000
0000000000000000000000000000000000000001010000000500000000000000
0000000000000000000000000000000000000000000000000000000192e906e9
85c25121c422faf4c618bd1a1b9a31a563997e0300fc79a90752ec3423b0b607
7a8f1efbf89c4feee7e6f55b85fe8aa4926c2c83d53466c50d7e61f51b071708
e0886e493aec496695ca47ec167c232c892c4dbfb5ab7f62208af10489f0a331
1573d65bc23cb94ff627e7e5855348e476b5d6a2b7fa4daa31d77c20f7a6f44b
059d3fe72dde06ec2b3e29f4973cf3101e95d7c046d2984c5bde86e5ca114357
ef165d2d15018d420aa35a96c109631357d5c2f61997cb3004b5a0d49785c04c
35f1feccfe251efff48c5dcedfaffbab72620d295c0fce75698a7d07ae46d5f4
b2f44602f8cb21af77c53e07b3134ce7555cb8088050c52848913e400eb19141
6af4356dadc545c7e12333ebe29658ab0c3a01d890f9ff0a250bc926
Witness =
6633fad945a9da933660070571afb1deb184bb2d24f542bdee864493dcb30027
05f1a4f40164cbbe8b8a33038ad8458afb6b262c0691f7442b1fb2ad253b60c3
NargString =
93a9baa8ac481ad40ffb0c046c03cc8d05f698c9cce9f24aa004f86d8f2b1756
304a4c9e213c36b95628c1e606d2f448b5f0c6903de76e160f034500b499cb05
ea59240e4e616206e444b2f3842a30a78a50ee8551dda8fb532d07b3f9411895
1e6c7803723853a5a5b655ec96bf793dbac487d93804573544d9b16a43cf9fa1
4bc77e8961c638fa11f7eb0a9623f1e665272e2b9140a989b3638b896217e015
Expected = accept
Two Pedersen-form equations sharing both witness scalars, X = x0 * G0
+ x1 * G1 and Y = x0 * G2 + x1 * G3 (Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 74]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/pedersen_commitment_dleq/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = pedersen_commitment_dleq
Flavor = compact
Tag = pedersen_commitment_dleq-CMPT-with-sigma-proofs_Shake128_BLS12381
SessionId =
9be697e93cbf8dc535caadba2629113c6c63bb12b6f46a86668e28fb2c9e09ef
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0100000006000000000000000000000000000000000000000000000000000000
0000000000000001020000000000000004000000000000000000000000000000
0000000000000000000000000000000000000001010000000500000000000000
0000000000000000000000000000000000000000000000000000000192e906e9
85c25121c422faf4c618bd1a1b9a31a563997e0300fc79a90752ec3423b0b607
7a8f1efbf89c4feee7e6f55b85fe8aa4926c2c83d53466c50d7e61f51b071708
e0886e493aec496695ca47ec167c232c892c4dbfb5ab7f62208af10489f0a331
1573d65bc23cb94ff627e7e5855348e476b5d6a2b7fa4daa31d77c20f7a6f44b
059d3fe72dde06ec2b3e29f4973cf3101e95d7c046d2984c5bde86e5ca114357
ef165d2d15018d420aa35a96c109631357d5c2f61997cb3004b5a0d49785c04c
35f1feccfe251efff48c5dcedfaffbab72620d295c0fce75698a7d07ae46d5f4
b2f44602f8cb21af77c53e07b3134ce7555cb8088050c52848913e400eb19141
6af4356dadc545c7e12333ebe29658ab0c3a01d890f9ff0a250bc926
Witness =
6633fad945a9da933660070571afb1deb184bb2d24f542bdee864493dcb30027
05f1a4f40164cbbe8b8a33038ad8458afb6b262c0691f7442b1fb2ad253b60c3
NargString =
543dd59971ee254384ae6fef1d36c0dcdbfc1b3ce47ad97d33599e4b6d27f17e
607cf3588579214c206fbd389eab0e45fd6b72ae79100468e12ed5e7a866c177
01c611bb833a1518f0588deb29d04dbc3e43f2adfdaa378fda3c0489fbb1c4cf
Expected = accept
The blind commitment computation of [BBSBlind], C = blind * Q2 +
msg_1 * J1 + msg_2 * J2 + msg_3 * J3.
Orrù & Yun Expires 18 February 2027 [Page 75]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/bbs_blind_commitment_computation/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = bbs_blind_commitment_computation
Flavor = batchable
Tag =
bbs_blind_commitment_computation-DSFS-with-sigma-proofs_Shake128_BLS12
381
SessionId =
2a5805ac1b5454c5ee85c1d1dd9edcd417a992a718de963f24b188c962457877
Instance =
0100000001000000050000000000000000000000000000000000000000000000
0000000000000000000000010400000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0200000003000000000000000000000000000000000000000000000000000000
0000000000000001030000000400000000000000000000000000000000000000
00000000000000000000000000000001a1d2f5b67fab08902ded92336405309c
6b37f32b3e435ed7b0213555f58fa1f55394ddf070c7b2c1ffeb9a4e72043ce3
a6c3922e0802086d57687391066cf25827154b05982bc17b585272d98ba7a3be
222acb845fef67fc29ae0e9aae085c7ab40ee516a7d08c3a178c5ff6818c598b
ed05176adcd57e5ef03fca4d7f3db3a457b47529cd2af4a47845b38e0de2df1d
b2c01bd2aa2ff4b0cbe41e8b04de59ce28d60849621b7409a19d51c7ef83ca68
f1d6b1f78665c9735477bb4f354880a0a81862f2e43f3c01765ce2104b0f1f22
8bc890da4a3ae973d7a14a7584af797b9526062591b1735f4bd01396beaad8ea
Witness =
28288611c102591a64e5d092e2ce83cc10f8d15f094f1342e7d74bd13b85da56
148a573a14e1c0c340ed3b0505ef72f3e308410156ed657b6690662bf22b73c6
393c117132d5a600b63968dfd4b03480b89cf5aff74ec52749a6086b50878c62
1e6ea7c86713a9e429396b2be43a403ed1d435367f157b9c8370e9f223ba479a
NargString =
977956f7bad0c7473dfffc0fc9c83e6a875dc84944c8d7e6d43e37111f26b4ce
1e34dc254886cf4560b5ca988c8b4a1116fae4c649c9c45aa1d18b91befafa3e
c3c5d33d696b08668651de18abcb0f2f146d2ddade6629b540783e11e180b8e4
9bacef2d6ff14d1ec1c10153b0c277321d2df04da792deb0e7be13e9c754a418
0b8706446d986ee791f8523a1f5125c8027de941da6d6f6f20de5ef10271cb01
57408dad73376457ed50efa9fb07f996
Expected = accept
The blind commitment computation of [BBSBlind], C = blind * Q2 +
msg_1 * J1 + msg_2 * J2 + msg_3 * J3.
Orrù & Yun Expires 18 February 2027 [Page 76]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/bbs_blind_commitment_computation/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = bbs_blind_commitment_computation
Flavor = compact
Tag =
bbs_blind_commitment_computation-CMPT-with-sigma-proofs_Shake128_BLS12
381
SessionId =
d44869a3b7c697750425649f4ff70570a192a6afc76d86f233d1d11c6f88e996
Instance =
0100000001000000050000000000000000000000000000000000000000000000
0000000000000000000000010400000000000000010000000000000000000000
0000000000000000000000000000000000000000000000010100000002000000
0000000000000000000000000000000000000000000000000000000000000001
0200000003000000000000000000000000000000000000000000000000000000
0000000000000001030000000400000000000000000000000000000000000000
00000000000000000000000000000001a1d2f5b67fab08902ded92336405309c
6b37f32b3e435ed7b0213555f58fa1f55394ddf070c7b2c1ffeb9a4e72043ce3
a6c3922e0802086d57687391066cf25827154b05982bc17b585272d98ba7a3be
222acb845fef67fc29ae0e9aae085c7ab40ee516a7d08c3a178c5ff6818c598b
ed05176adcd57e5ef03fca4d7f3db3a457b47529cd2af4a47845b38e0de2df1d
b2c01bd2aa2ff4b0cbe41e8b04de59ce28d60849621b7409a19d51c7ef83ca68
f1d6b1f78665c9735477bb4f354880a0a81862f2e43f3c01765ce2104b0f1f22
8bc890da4a3ae973d7a14a7584af797b9526062591b1735f4bd01396beaad8ea
Witness =
28288611c102591a64e5d092e2ce83cc10f8d15f094f1342e7d74bd13b85da56
148a573a14e1c0c340ed3b0505ef72f3e308410156ed657b6690662bf22b73c6
393c117132d5a600b63968dfd4b03480b89cf5aff74ec52749a6086b50878c62
1e6ea7c86713a9e429396b2be43a403ed1d435367f157b9c8370e9f223ba479a
NargString =
3b32ef1ba00ed483b5494e33305df9a260dac8ae87e95eed9de83617de093b71
4955e5e99e066b6bc828c6ab6f282d38e3f11f5edbdf8857d6ddad0c8788bfb5
68f2d25c344c5f27226941d199e5a25f129544cccfa5c0e751c9622752d19ac9
3314321c51a7c2853483e7239b3e567f6785f863ef4a8bf558fbf228e2c0bd4d
4056b35bfa8f6868d298d50d76c640c67a59fa67c35793b4123c49fa03a88198
Expected = accept
Correct ElGamal decryption, X = x * G and M = x * E0 - E1
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 77]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/elgamal_decryption/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = elgamal_decryption
Flavor = batchable
Tag = elgamal_decryption-DSFS-with-sigma-proofs_Shake128_BLS12381
SessionId =
f3606306ba6a9e7497185a0dd337bee9364dd4b4cd889704fc40ce74412dffeb
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000004000000
0000000000000000000000000000000000000000000000000000000000000001
0300000000000000000000000000000000000000000000000000000000000000
0000000101000000000000000200000000000000000000000000000000000000
00000000000000000000000000000001a73aa2551fd1f24865adb5b9a84f63ef
b8d2cab44fcf21dfa9e587dcabff2a0ffa36a93a82df2027ec32288160f0ebd3
835f420c8a573cde22b41e8b427fda9427e9ab5d6bca17cdc4d045c8dd37091a
a7315f499646c01861faf1a96f863776a002ade8d4092fd89a457856e9b7afd6
cbe26135981799f75042353f6e9a3eabf205e3788417e21d67741f16b69837c5
86309903b1709ca1b7aca43326415b5bf7e9eb8f259c631913fc55b3a78021cc
bdfde509aa8168b3d949ef129247cfd9
Witness =
6f92d7965b9cb245c7656316af218d42c5625f5234bbbd3eba630c9d6f058a76
NargString =
abc0eca21b6faea727caf039722661724aa0ffa84df6cff0540292c4b339b2cb
d8a06d8b64846bd48d9f194be457a14785c969bc6583aea3aa84fb9a1be42b90
3a9de7be864d9f50f3ab7cf4c1fa4465ac65ee456fb7c652048ba4a0658d3ef8
03c8f8cba745239dc02dac475278009f48a4c3b4e8c77b698d7403396b684f5d
Expected = accept
Correct ElGamal decryption, X = x * G and M = x * E0 - E1
(Section 3.4).
Orrù & Yun Expires 18 February 2027 [Page 78]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/elgamal_decryption/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = elgamal_decryption
Flavor = compact
Tag = elgamal_decryption-CMPT-with-sigma-proofs_Shake128_BLS12381
SessionId =
7e4a5e42b1686205633d27701ae29f682fb2c748e21c0a8a87d021486652c899
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000004000000
0000000000000000000000000000000000000000000000000000000000000001
0300000000000000000000000000000000000000000000000000000000000000
0000000101000000000000000200000000000000000000000000000000000000
00000000000000000000000000000001a73aa2551fd1f24865adb5b9a84f63ef
b8d2cab44fcf21dfa9e587dcabff2a0ffa36a93a82df2027ec32288160f0ebd3
835f420c8a573cde22b41e8b427fda9427e9ab5d6bca17cdc4d045c8dd37091a
a7315f499646c01861faf1a96f863776a002ade8d4092fd89a457856e9b7afd6
cbe26135981799f75042353f6e9a3eabf205e3788417e21d67741f16b69837c5
86309903b1709ca1b7aca43326415b5bf7e9eb8f259c631913fc55b3a78021cc
bdfde509aa8168b3d949ef129247cfd9
Witness =
6f92d7965b9cb245c7656316af218d42c5625f5234bbbd3eba630c9d6f058a76
NargString =
69a11eea4a1ee7d995219a7b0f5df7bf18ee156b4b4e66b95147b090c07cb8cb
26816cc9aac1a2b14e5adbebbf973a42e2826591392787fddca9e13b8443b904
Expected = accept
The ChaumPedersen relation of Section 3.4 again, with Y = x * H
derived by the prover from its witness rather than received: the
compiled instance matches dleq, and only the tag (hence the proof
bytes) differs.
Orrù & Yun Expires 18 February 2027 [Page 79]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/dleq_derived_element/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = dleq_derived_element
Flavor = batchable
Tag = dleq_derived_element-DSFS-with-sigma-proofs_Shake128_BLS12381
SessionId =
54bbba96ccae65df6e806d77e8869cd48afdbc785038d6f90fa905a14f7d53bf
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000199dab5463df27b0f83b0608d830294a57f53d279
fd3c5b719bd25ca5bb9a25a57787f6c92bb933ccaa421588ee4554ff8673f08e
10bee9fe8e7eb4f6a1ef0b60571e84c26710a2d4b0bacf0a49033dc814b2c0c9
3d1e83025f0d9fde75835ac4b1aa95d5868f12734c8183e2222f3c321bd19403
802e635dd2c12731e366be9e5e37af51c283afb582fa8a153f494b1c
Witness =
48775faa1051b0df070268dee5c4163b9635ebecb049f9016f3538423a7d227c
NargString =
abc30c203650564c3318f34ca0a4140728631799358f1004bff7708e2e0e1c80
e5d3550cf546bd78734f35c50a0ef599b3f2f83ece52e1d93bdaff1f9344b03f
c5b0f324f0a397f4ba8d10d7bb954e9ae884eaa07dd11d942f925f14ebdd3e29
1b5757ca9c1cf7f34a3fe51c5803c9996f9ae0092d24059aecaf12352268d1d6
Expected = accept
The ChaumPedersen relation of Section 3.4 again, with Y = x * H
derived by the prover from its witness rather than received: the
compiled instance matches dleq, and only the tag (hence the proof
bytes) differs.
Orrù & Yun Expires 18 February 2027 [Page 80]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/dleq_derived_element/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Relation = dleq_derived_element
Flavor = compact
Tag = dleq_derived_element-CMPT-with-sigma-proofs_Shake128_BLS12381
SessionId =
f284a4d31c70b703930a48a8f420606f8997f3b52ce41458ed8c827257f01a08
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
00000000000000000000000199dab5463df27b0f83b0608d830294a57f53d279
fd3c5b719bd25ca5bb9a25a57787f6c92bb933ccaa421588ee4554ff8673f08e
10bee9fe8e7eb4f6a1ef0b60571e84c26710a2d4b0bacf0a49033dc814b2c0c9
3d1e83025f0d9fde75835ac4b1aa95d5868f12734c8183e2222f3c321bd19403
802e635dd2c12731e366be9e5e37af51c283afb582fa8a153f494b1c
Witness =
48775faa1051b0df070268dee5c4163b9635ebecb049f9016f3538423a7d227c
NargString =
57a809847f916a14f39d848a26d1f17fb0158b2b88aaa3263d44750e10a27583
5f9a4abeedd6c411defe5803910725b117fd1eee92ea9b38ae576fb83177f457
Expected = accept
A.3.2. Adversarial vectors
Deserialization fails if the compression bit is cleared.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/A1
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
221df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Orrù & Yun Expires 18 February 2027 [Page 81]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Deserialization fails if the x-coordinate is lifted by the field
characteristic (x = 4, encoded as x + p).
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/A3
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
9a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f624
1eabfffeb153ffffb9feffffffffaaaf56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Deserialization fails on the canonical compressed encoding of the
point at infinity: the identity is invalid in prover messages.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/A4
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
c000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000056b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Deserialization fails on a point (x = 0) on the curve but outside the
prime-order subgroup G1.
Orrù & Yun Expires 18 February 2027 [Page 82]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/A5
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
8000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000056b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Deserialization fails on x = 1, which is not on the curve (x^3 + 4 is
a non-residue).
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/A6
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
8000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000156b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Deserialization fails if response[0] is re-encoded as s + order: same
value mod p, non-canonical bytes. Reducing instead of rejecting
yields malleability.
Orrù & Yun Expires 18 February 2027 [Page 83]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/B1
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcbcaa396b96915e9ea45449ee848e72694
09cdf63ba2b25a8150042aeb5bd1b642
Expected = reject
Deserialization fails if challenge is re-encoded as c + order (non-
canonical bytes).
Id = sigma-protocols/bls12381/discrete_logarithm/compact/B2
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
9f1898e7e0ed7c8d60adde165af00ea993091808bff2c380a78f42bb7696c7ef
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad94
Expected = reject
Verification fails if one trailing 0x00 byte is appended to a valid
proof.
Orrù & Yun Expires 18 February 2027 [Page 84]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/C1
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b64100
Expected = reject
Verification fails if a valid proof is truncated by one byte.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/C2
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b6
Expected = reject
Verification fails if one trailing 0x00 byte is appended to a valid
proof.
Orrù & Yun Expires 18 February 2027 [Page 85]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/compact/C1
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
2b2af194b74fff452d74060e514e36a43f4b7405bff46781a78f42bc7696c7ee
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad94
00
Expected = reject
Verification fails if a valid proof is truncated by one byte.
Id = sigma-protocols/bls12381/discrete_logarithm/compact/C2
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
2b2af194b74fff452d74060e514e36a43f4b7405bff46781a78f42bc7696c7ee
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad
Expected = reject
Verification fails on the all-zero compact proof: challenge and
response are zero.
Orrù & Yun Expires 18 February 2027 [Page 86]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/compact/D1
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000
Expected = reject
Instance validation fails if scalar index 1 appears in no equation
(check 6); the proof satisfies the verification equations, so
rejection must come from instance validation.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/E1
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag =
instance_unconstrained_scalar-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000001000000
0000000000000000000000000000000000000000000000000000000000000001
a52f63244810b5e28b235f33df487fce15bc509eac539e19275e1a0c1ae36de1
79fa412292007a1d6df975de5b8ca0a6a62b428f90a014557c5744b69c6303d0
db7a9c876dd15743738b432a9dd1cfad79790d101eedee3bb441bccd262db1c0
NargString =
8a31aa9ace6268707d6a0213fdf4bd9a4231fc4fec35338998a38b5334723d84
f3c46d55c6ff9104aba7bde3e38b46cd3b5d6d79ba363cb1f75f304c0af27b3c
717d6c2048126fb60147c58ce188a5bc0c18c708366e5b159dc527ef76ac46f5
fb5f58bd1acdc8a9e425c7f99d7f4b4a45a360ed659e5b5db089c8f07cf725b1
4d7aaf71cb6a55bc1e41ac4fb4ab03b2
Expected = reject
Instance validation fails on the same instance, here with the
unconstrained response[1] perturbed.
Orrù & Yun Expires 18 February 2027 [Page 87]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/E1b
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag =
instance_unconstrained_scalar-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010200000001000000
0000000000000000000000000000000000000000000000000000000000000001
a52f63244810b5e28b235f33df487fce15bc509eac539e19275e1a0c1ae36de1
79fa412292007a1d6df975de5b8ca0a6a62b428f90a014557c5744b69c6303d0
db7a9c876dd15743738b432a9dd1cfad79790d101eedee3bb441bccd262db1c0
NargString =
8a31aa9ace6268707d6a0213fdf4bd9a4231fc4fec35338998a38b5334723d84
f3c46d55c6ff9104aba7bde3e38b46cd3b5d6d79ba363cb1f75f304c0af27b3c
717d6c2048126fb60147c58ce188a5bc0c18c708366e5b159dc527ef76ac46f5
fb5f58bd1acdc8a9e425c7f99d7f4b4b45a360ed659e5b5db089c8f07cf725b1
4d7aaf71cb6a55bc1e41ac4fb4ab03b2
Expected = reject
Instance validation fails if the image terms X + (-X) sum to the
identity (check 9).
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/E2
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = instance_trivial_equation-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000002000000010000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000101000000000000000000000000000000
00000000000000000000000000000000000000000000000000000001b8d20484
960f1741eabb4d0dd0c43e72931d646c09440bf1880a1720daaa3308e7634661
77aa88c313f8a9ad1e406c0e98d20484960f1741eabb4d0dd0c43e72931d646c
09440bf1880a1720daaa3308e763466177aa88c313f8a9ad1e406c0e
NargString =
8bf4a4e7cca2a2f88859d0b012289500a49db0b5e4e5df3d778248435ed8b51d
0fb3ca489c9f45e8811bb4cc8d0096f96ad6f36b97912382f39758d4e9f591a8
c1d24c1f3d42a2535161c7b7a9c556a3
Expected = reject
Orrù & Yun Expires 18 February 2027 [Page 88]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Instance validation fails if a statement element is the identity
(check 8), here at index 1, encoded as the canonical compressed
encoding of infinity; parsers may instead reject at group
deserialization.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/E3
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = instance_identity_element-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000020000000000000000000000000000000000000000000000
0000000000000000000000010200000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
c000000000000000000000000000000000000000000000000000000000000000
00000000000000000000000000000000b8722b4b2a3cc66976d848739df2bfb6
6ae371da496a1e239add4646c35c8b8758409ad4b6312b74d4a98bb83284cb87
NargString =
adc1c8943d8bfa5ab165ff1ed2c0f45f71567a404849da3e0b9fbd37266681c1
089d6d9b33116aebdab2972d0cb6db1343a4376149f6584e69ef48dac314f448
ec00ac5b96fa50ce5a369327bb6649775a460213642cf7055af8c4bb0bcbc6b6
122f563a9163c3d3f74876f8b25b0298
Expected = reject
Instance validation fails if a term references element index 2 while
a single element follows; parsers may instead reject on length.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/E4
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag =
instance_index_out_of_bounds-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000020000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Orrù & Yun Expires 18 February 2027 [Page 89]
Internet-Draft Sigma Proofs for Linear Relations August 2026
A valid NARG string verifies under the tag it was produced for.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/F1
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = accept
Verification fails under a different tag.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/F1b
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag =
discrete_logarithm/wrong-session-DSFS-with-sigma-proofs_Shake128_BLS12
381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
A valid NARG string verifies under the tag it was produced for.
Orrù & Yun Expires 18 February 2027 [Page 90]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/compact/F1
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
2b2af194b74fff452d74060e514e36a43f4b7405bff46781a78f42bc7696c7ee
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad94
Expected = accept
Verification fails under a different tag.
Id = sigma-protocols/bls12381/discrete_logarithm/compact/F1b
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag =
discrete_logarithm/wrong-session-CMPT-with-sigma-proofs_Shake128_BLS12
381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
2b2af194b74fff452d74060e514e36a43f4b7405bff46781a78f42bc7696c7ee
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad94
Expected = reject
A valid NARG string verifies against the statement it was produced
for.
Orrù & Yun Expires 18 February 2027 [Page 91]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/F2
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = dleq-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
000000000000000000000001b8a52d4f929a5fc9a27b16941d102b632bac0b06
61265ed04ec9e59d35480f93d4ebefc5af6a06090964444a5ed9abfdac2a3348
158e801ab8f31490543b66ddf04a103dd0bc7f41194f72b575b62d08900aaf6e
7ba8f3672c1b7064b19ecf968f3af22d60210b724fc400f8b8e8547a3f82ba01
7d24199087b0bd1941c21f4c6afa8e1d636914790ee4b80e44908926
NargString =
b13432cd2a44f3287e1ee64986f77cfd30bc6e27cb5bb245e5e0d5cd74d7ea59
d64b17f3e612b0a5790bad93d77ea46291f38f62b25f78dae74200765604f560
b5b0459b45404eb953e498497a94757841739571c4fa83ba5b27fb2cd9c01c20
53843da83608b616cb57c042f0d21160317095e5ab1706e02299dfd47f67b453
Expected = accept
Verification fails if the statement's two equations are swapped.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/F2b
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = dleq-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000020000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000000000000000000000000000000000000000000000000000
000000000000000000000001b8a52d4f929a5fc9a27b16941d102b632bac0b06
61265ed04ec9e59d35480f93d4ebefc5af6a06090964444a5ed9abfdac2a3348
158e801ab8f31490543b66ddf04a103dd0bc7f41194f72b575b62d08900aaf6e
7ba8f3672c1b7064b19ecf968f3af22d60210b724fc400f8b8e8547a3f82ba01
7d24199087b0bd1941c21f4c6afa8e1d636914790ee4b80e44908926
NargString =
b13432cd2a44f3287e1ee64986f77cfd30bc6e27cb5bb245e5e0d5cd74d7ea59
d64b17f3e612b0a5790bad93d77ea46291f38f62b25f78dae74200765604f560
b5b0459b45404eb953e498497a94757841739571c4fa83ba5b27fb2cd9c01c20
53843da83608b616cb57c042f0d21160317095e5ab1706e02299dfd47f67b453
Expected = reject
Orrù & Yun Expires 18 February 2027 [Page 92]
Internet-Draft Sigma Proofs for Linear Relations August 2026
A valid NARG string verifies against the statement it was produced
for.
Id = sigma-protocols/bls12381/discrete_logarithm/compact/F2
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = dleq-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0200000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
0000000000000000000000000000000000000000000000010100000003000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000020000000000000000000000000000000000000000000000
000000000000000000000001b8a52d4f929a5fc9a27b16941d102b632bac0b06
61265ed04ec9e59d35480f93d4ebefc5af6a06090964444a5ed9abfdac2a3348
158e801ab8f31490543b66ddf04a103dd0bc7f41194f72b575b62d08900aaf6e
7ba8f3672c1b7064b19ecf968f3af22d60210b724fc400f8b8e8547a3f82ba01
7d24199087b0bd1941c21f4c6afa8e1d636914790ee4b80e44908926
NargString =
6756a6afe70dc8b509ece61173992cd9970d6219332d289fecf58e240f1497ca
1712fb2963a360c4bc783fa9764bb115b7162e014c5f6c8859fbcd71fbc58844
Expected = accept
Verification fails if the statement's two equations are swapped.
Id = sigma-protocols/bls12381/discrete_logarithm/compact/F2b
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = dleq-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0200000001000000030000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000020000000000000000000000
0000000000000000000000000000000000000000000000010100000001000000
0000000000000000000000000000000000000000000000000000000000000001
0100000000000000000000000000000000000000000000000000000000000000
000000000000000000000001b8a52d4f929a5fc9a27b16941d102b632bac0b06
61265ed04ec9e59d35480f93d4ebefc5af6a06090964444a5ed9abfdac2a3348
158e801ab8f31490543b66ddf04a103dd0bc7f41194f72b575b62d08900aaf6e
7ba8f3672c1b7064b19ecf968f3af22d60210b724fc400f8b8e8547a3f82ba01
7d24199087b0bd1941c21f4c6afa8e1d636914790ee4b80e44908926
NargString =
6756a6afe70dc8b509ece61173992cd9970d6219332d289fecf58e240f1497ca
1712fb2963a360c4bc783fa9764bb115b7162e014c5f6c8859fbcd71fbc58844
Expected = reject
Orrù & Yun Expires 18 February 2027 [Page 93]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Verification fails if a statement element is changed after proving.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/F3
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001b94ba65546846b43
9edbfc9da84c1c2d2af3d0ede8c88ec50fce2e1c3f782e932205982683f0802a
4dce313610bbb2db
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Verification fails if a statement element is changed after proving.
Id = sigma-protocols/bls12381/discrete_logarithm/compact/F3
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001b94ba65546846b43
9edbfc9da84c1c2d2af3d0ede8c88ec50fce2e1c3f782e932205982683f0802a
4dce313610bbb2db
NargString =
2b2af194b74fff452d74060e514e36a43f4b7405bff46781a78f42bc7696c7ee
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad94
Expected = reject
Verification fails if the batchable proof's transcript is re-encoded
as a compact NARG string.
Orrù & Yun Expires 18 February 2027 [Page 94]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/compact/F4
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
0bfd67330803e2f88ba4d8f54723e95c53a032c2aa976b0f7e54099ec42d461c
56b5ef663f786ca2120ac6e03f454e8eb6105238a2b3fe8250042aec5bd1b641
Expected = reject
Verification fails if the compact proof's transcript is re-encoded as
a batchable NARG string: the challenge derived under the batchable
tag differs.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/F4b
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
b87d072b8238866651b08da8276e9ea30125617a5ac1b7fcb6934f43bdfed513
4624ffe8040caccc46560bd101c648885bc2ffa13e32b693d76be6e548a3d6c3
9929b9d21f10e5ba1df2b44071f7ad94
Expected = reject
Verification fails if response[0] is increased by 1.
Orrù & Yun Expires 18 February 2027 [Page 95]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/H1
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
a21df433ede15a7e0bb0d8501e24c6c41ba6c36f387bd9961bcbc1acddda5ece
0abe8338bef0293d96d924dafd80ddcb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b642
Expected = reject
Verification fails if commitment[0] is replaced by a different valid
group element.
Id = sigma-protocols/bls12381/discrete_logarithm/batchable/H2
BaseId = sigma-protocols/bls12381/discrete_logarithm/batchable
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = batchable
Tag = discrete_logarithm-DSFS-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
97f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac58
6c55e83ff97a1aeffb3af00adb22c6bb56b5ef663f786ca2120ac6e03f454e8e
b6105238a2b3fe8250042aec5bd1b641
Expected = reject
Verification fails if challenge is replaced by a different scalar.
Orrù & Yun Expires 18 February 2027 [Page 96]
Internet-Draft Sigma Proofs for Linear Relations August 2026
Id = sigma-protocols/bls12381/discrete_logarithm/compact/H3
BaseId = sigma-protocols/bls12381/discrete_logarithm/compact
Function = SigmaProof
Ciphersuite = sigma-proofs_Shake128_BLS12381
Flavor = compact
Tag = discrete_logarithm-CMPT-with-sigma-proofs_Shake128_BLS12381
Instance =
0100000001000000010000000000000000000000000000000000000000000000
0000000000000000000000010100000000000000000000000000000000000000
000000000000000000000000000000000000000000000001ac2de2d5ca1310a4
3b8c5adee4632e69c117edbc6c0e9a259efbefd6e5aedc86a4185f06e74a63bf
a648c1c4e8b4b444
NargString =
2b2af194b74fff452d74060e514e36a43f4b7405bff46781a78f42bc7696c7ef
5bc2ffa13e32b693d76be6e548a3d6c39929b9d21f10e5ba1df2b44071f7ad94
Expected = reject
Authors' Addresses
Michele Orrù
CNRS
Email: m@orru.net
Cathie Yun
Apple, Inc.
Email: cathieyun@gmail.com
Orrù & Yun Expires 18 February 2027 [Page 97]