Home > Resources > papers > COPZ22-DLEQ-Across-Groups

Proofs of discrete logarithm equality across groups (Chase, Orrù, Perrin, Zaverucha 2022)

Last modified: 2026-10-27

URL: https://eprint.iacr.org/2022/1593

Summary

Gives sigma-protocol based proofs that the same secret exponent underlies discrete logarithms in two different groups of different (prime) orders, e.g. a P-256 key and a key on a pairing-friendly or other curve. Analyzes soundness carefully with bit-decomposition / range-proof techniques, and gives concrete parameters. Key building block for e-ID holder binding: it lets a credential system on one curve prove possession of a device key (e.g. ECDSA P-256 in a secure element) living on another.

Related resources

• Beyond the Circuit: How to Minimize Foreign Arithmetic in ZKP Circuits (Orrù, Kadianakis, Maller, Zaverucha 2025) (paper, 2025)
• CDLS: Proving Knowledge of Committed Discrete Logarithms with Soundness (Celi, Levin, Rowell 2023) (paper, 2023)
• Device Binding for Anonymous Credentials on Legacy Phones (Lehmann, Zacharakis 2026) (paper, 2026)
• Proof Systems for General Statements about Discrete Logarithms (Camenisch-Stadler 1997) (paper, 1997)
• ZKAttest: Ring and Group Signatures for Existing ECDSA Keys (Faz-Hernández, Ladd, Maram 2022) (paper, 2022)