Knowledge proof
A signature verification, challenger technology, applied in the field of knowledge proof
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0504] Example 1: Separate line promises
[0505] This section describes key disclosure when the verifier has a separate commitment to each wire in the circuit (i.e. follows the Σ protocol for arithmetic circuit satisfiability, see above).
[0506] 1. Each line i (i=1,...,n) in the circuit has a Pedersen commitment:
[0507] W i =Com(w i ,ρ i )
[0508] in:
[0509] Com(w,r)=w×G+ρ×F
[0510] 2. For the circuit line l that needs the corresponding public key proof (key statement proof), the prover also sends the key public:
[0511] the ko l = ρ l ×F
[0512] 3. If circuit line j needs to be revealed publicly (a fully disclosed line), the prover sends a "fully disclosed" tuple:
[0513] (w j ,ρ j )
[0514] 4. Then, use the above Sigma protocol to prove with zero knowledge that each gate of the circuit satisfies the requirement 4 .
[0515] where, using the above Sigma protocol, it is proved with zero knowledge that each gate of the...
Embodiment 2
[0520] Example 2: Batching vector promises
[0521] In the case of compressed proof systems of circuit satisfiability involving batched vector commitments [Bootle 2016, Groth 2009], the method described below can be used to extract key statement proofs from batched circuit commitments. The full proof protocol will not be described, but only the generation of batch-line commitments and the proof that a specified public key is contained.
[0522] Batch commitments are generated as described below, where line 1 will be provided with a key public. In a vector commit, m lines are batched together.
[0523] 1. The prover generates m-1 random numbers
[0524] 2. The prover calculates the elliptic curve point K i = ξ i ×G (for i=1,...,m-1). These values plus K m =G constitutes the proof key PrK sent to the verifier.
[0525] 3. The prover generates a random value:
[0526] 4. The prover calculates the alignment value w i Commitments (for i=1,...,m) of...
no. 1 example ;
[0572] 1B. A second example of verifying an arithmetic circuit based on E1'-E5';
[0573] 2A. Verify π 1 The preimage requires:
[0574] a) extract ko 1 = ρ 1 F;
[0575] b) calculate
[0576] c) check
[0577] d) Check the equation W m =w m ·G+ρ m F;
[0578] 2B. Verify π 2 The preimage requires:
[0579] a) Extract ko' 1 = ρ' 1 F;
[0580] b) calculate
[0581] c) check
[0582] d) Check the equation W' m =w' m ·G+ρ′ m F;
[0583] 3. Verify the equation of the preimage:
[0584] a)w m =w' m
[0585] It should be noted that, as evident from 3a), although in Figure 16 h in and π in proof transaction 1604 1 and π 2 shown separately, but it doesn't actually need to be a separate element, and can be accessed via w m =w' m implicitly defined.
[0586] Keep the input line w 1 、w 1 ’, and these values are not available from the input line w 1 、w 1 ' public key provided on ko 1 、ko'...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More 


