A proving apparatus communicably connected with a verification apparatus, comprising:
- said proving apparatus being communicably connected with a first proof commitment generation apparatus which generates a proof commitment for a special honest verifier zero-knowledge interactive proof with respect to a pre-determined first relationship, based on a common input, an evidence and a random tape which respectively satisfy the pre-determined first relationship;
- said proving apparatus being communicably connected with a first response generation apparatus which generates a response to a special honest verifier zero-knowledge interactive proof with respect to the pre-determined first relationship, based on the common input, the evidence, the random tape and a challenge value all with respect to the pre-determined first relationship;
- said proving apparatus being communicably connected with a second interactive proof verification apparatus which outputs a signal indicating acceptance or non-acceptance of a special honest verifier zero-knowledge interactive proof with respect to a second relationship, based on a common input, a proof commitment, a challenge value and a response all with respect to the second relationship;
- said proving apparatus being communicably connected with a simulation apparatus which generates the proof commitment and the response with respect to the second relationship, based on the common input, the challenge value and a random tape all with respect to the second relationship:
- being communicably connected with a hash function calculation apparatus which calculates a hash function;
- said proving apparatus comprising:
- a microprocessor;
- and
- a memory;
- wherein said microprocessor is programmed to execute:
- a common input reception unit into which the common input and the evidence that respectively satisfy the pre-determined first relationship are inputted;
- a random tape input unit into which the first random tape and the second random tape are inputted;
- a non-interactive proof reception unit which receives from said verification apparatus the common input with respect to the second relationship and a non-interactive knowledge proof for an evidence that corresponds to the common input of the second relationship;
- a non-interactive proof acceptance/non-acceptance determination unit which determines whether to accept or not accept said non-interactive proof, based on the result of communicating with said hash function calculation apparatus and said second interactive proof verification apparatus by using said non-interactive proof;
- an evidence knowledge non-interactive proof generation unit which generates a non-interactive proof that proves knowledge of either the evidence for the common input with respect to the pre-determined first relationship or the evidence for the common input with respect to the second relationship, by communicating with said simulation apparatus, said first proof commitment generation apparatus, said hash function calculation apparatus and the first response generation apparatus and by using during the communications the first random tape, the second random tape, the common input and the evidence that respectively satisfy the pre-determined first relationship and the common input that is contained in said non-interactive proof;
- and
- a non-interactive proof transmission unit which transmits the non-interactive knowledge proof generated by said evidence knowledge non-interactive proof generation unit to said verification apparatus.