Implementations Based on the Factoring Assumption

There are two classes of such schemes. The main difference is that one has a small set of really good prekeys and the other a larger set of prekeys that are not 

Apart from that, this section is structured like Section 9.3. 

However, in the scheme with zero-knowledge proof, GoodFam is replaced by GoodFam where Good = (n, 1 I n e GeneralBlum a t1 2 2k) this is possible by Remark 8.38a. 

In the scheme with zero-knowledge proof Local verification that Tis correct and M2 2k, and the zero-knowledge proof scheme from [GrPe88] with the modifications sketched in Section 8.1.3, Recognizing Generalized Blum Integers , are combined. 

In the scheme with local verifiability As GoodFam = AllFam in the given family BundFam, the good keys are locally verifiable, too, i.e., the zero-knowledge proof scheme is derived from alljtest with Lemma 7.28. (Of course, this algorithm only needs to be carried out once in A and res) 

---