Security authentication method based on matrix commitment zero-knowledge range proof

Abstract

A secure authentication method based on zero-knowledge range proof using matrix commitment is proposed. The prover decomposes the vector to be proved into a binary expansion matrix by bit width and makes an algebraic commitment. Using an initialized structured reference string (SRS), the prover performs an algebraic commitment on the binary expansion matrix to obtain the matrix commitment value corresponding to the vector and generates a range proof containing several group elements. The matrix commitment value and range proof are then sent to the verifier. The verifier performs bilinear pairwise verification on the range proof based on the structured reference string to confirm that the hidden vector satisfies the preset range constraints, thus achieving authentication. This invention can reduce the computational complexity of proof generation and verification, and reduce the size of proof data while ensuring zero-knowledge proof, thereby improving the execution efficiency of zero-knowledge proof.

Description

Technical Field

[0001] This invention relates to a technology in the field of information security, specifically a security authentication method based on matrix commitment zero-knowledge scope proof. Background Technology

[0002] In privacy-preserving computing and secure data processing systems, participants often need to verify certain data attributes without disclosing the original data. Range proofs are a common problem in zero-knowledge proof research, aiming to prove that a hidden value lies within a given range without revealing the specific value. Existing zero-knowledge range proof techniques require multiple interactive processes of commitments, challenges, and responses between the prover and verifier. This involves numerous communication round trips and high requirements for online synchronization, hindering on-chain or batch asynchronous one-time submissions and rapid unilateral verification. Zero-knowledge range proof techniques based on weighted norm linear relationships require pre-generating and maintaining a bit decomposition table. The table construction involves complex solutions such as exponential cones and integer programming, resulting in high system initialization and parameter preparation costs. Furthermore, the bit decomposition results need to be concatenated into an arithmetic circuit for reciprocal proofs and reduced to a weighted norm linear relationship through multiple steps. The proof and verification recursively unfold along a binary class and involve multiple rounds of challenge interactions, which is inconsistent with the constant verification structure where the verifier receives a commitment and proof once and completes batch range verification with a fixed number of bilinear pairings. Summary of the Invention

[0003] This invention addresses the problems of high proof complexity, large verification computational overhead, and large proof size in existing scope proof schemes. It proposes a secure authentication method based on matrix commitment zero-knowledge scope proof. While ensuring zero-knowledge nature, it can reduce the computational complexity of proof generation and verification, reduce the size of proof data, and thus improve the execution efficiency of zero-knowledge proof.

[0004] This invention is achieved through the following technical solution:

[0005] This invention relates to a secure authentication method based on zero-knowledge range proof using matrix commitment. The prover decomposes the vector to be proved into a binary expansion matrix by bit width and makes an algebraic commitment. Using the initialized structured reference string (SRS), the prover makes an algebraic commitment to the binary expansion matrix to obtain the matrix commitment value corresponding to the vector and generates a range proof containing several group elements. The prover then sends the matrix commitment value and the range proof to the verifier. The verifier performs a bilinear pairwise verification operation on the range proof based on the structured reference string to confirm that the hidden vector satisfies the preset range constraint conditions, thus achieving authentication.

[0006] The matrix commitment value is obtained as follows: the prover obtains the vector to be proved and the corresponding range constraints, and converts them into a binary expansion matrix. ; Use the structured reference string (SRS) generated during initialization to process the matrix Perform algebraic commitments and calculate the matrix commitment value.

[0007] The binary expansion matrix It is obtained in the following way:

[0008] 1) Decompose the vector into binary components according to the given bit width to obtain the corresponding binary sequence;

[0009] 2) Map the binary sequence to a binary expansion matrix with a fixed row and column structure. elements Each element in the matrix satisfies a Boolean property, meaning it takes the value 0 or 1.

[0010] 3) Based on this binary expansion matrix Construct the corresponding set of characteristic polynomials to provide input data for subsequent algebraic commitments and constraint proofs.

[0011] The range proof is obtained by: based on a randomly generated challenge factor, respectively, for the binary expansion matrix The linear combination constraints and Boolean constraints are used to calculate the corresponding quotient polynomials and generate a range proof containing multiple group elements, specifically including:

[0012] i) Introduce a random blinding factor during the commitment phase for the binary expansion matrix. Generate randomized matrix commitments with zero-knowledge properties to hide underlying numerical information;

[0013] ii) Calculate the stochastic linear combination proof corresponding to the matrix commitment based on the validator or the globally stochastic challenge factor generated by the Fiat-Shamir transformation. ;

[0014] iii) For each algebraic relation corresponding to the range constraint, generate a proof of the linear constraint quotient polynomial used to prove the numerical linear relation. And the Boolean constraint quotient polynomial proof used to prove the Boolean properties of matrix elements. .

[0015] In step ii), the proof of random linear combination is as follows. As an intermediate proof quantity based on a global challenge, it is subject to Boolean constraint quotient polynomial proof in the final verification equation. The joint constraints. Therefore, in constructing There is no need to introduce additional independent blinding factors, thus avoiding the generation of unavoidable cross terms in cross-group pairing calculations.

[0016] The structured reference string (SRS) is generated through a one-time multi-party secure computation in a system environment where a trusted setup has been performed, and is shared between the prover and the verifier.

[0017] The aforementioned bilinear pairing verification operation refers to the verifier extracting a fixed number of group elements from the range proof and substituting them into a preset verification equation for calculation. This verification operation only involves a fixed number of bilinear pairing operations, and its computational complexity is constant. That is, the verifier only needs to perform 5 bilinear pairing operations and does not need to perform linear scale group exponent operations related to the numerical bit width.

[0018] The initialization mentioned above specifically refers to: Among them: input security parameters Batch size of the data to be proven and the limited range of bit width That is, the range of values ​​for each element is Output proof key With verification key .

[0019] The matrix commitment value is obtained in the following way: Where: the input vector to be proved , and the binary expansion matrix of the vector and proof key Output commitment tuple .

[0020] The aforementioned range proof is obtained in the following manner: Where: the input vector to be proved With binary expansion matrix Publicly committed tuples and proof key Generate and output the proof tuple. .

[0021] The bilinear pairing verification operation is obtained in the following way: , where: input commitment The proof submitted by the certifier and verification key If the proof is valid and all constraints are satisfied, then output the result. (Pass), otherwise output (Not approved)

[0022] This invention relates to a secure authentication system based on matrix commitment zero-knowledge scope proof for implementing the above method, comprising: an initialization unit, a commitment unit, a challenge unit, and a verification unit, wherein: the initialization unit determines the security parameters based on the security parameters. Batch size Bit width The trusted setup process input information is used to generate bilinear group parameters, sample trapdoor parameters, and generate the proof key. With verification key The construction and safe disposal of the trapdoors have been publicly released. and The commitment unit is based on the vector to be proved. Bit width and the initialization unit release The information is expanded into a binary matrix. Blinded random number sampling and in the group The commitment calculation process yields the publicly committed tuple. The challenge unit is based on the output of the commitment unit. The above The above and Information is used to generate challenges and prove stochastic linear combinations. Linear and Boolean quotient polynomial proofs and blinded aggregation processing are used to obtain range-proven tuples. The verification unit, based on the information released by the initialization unit, And the commitment and challenge units provided and The information is subjected to constant-time bilinear paired-validation equation verification to obtain the output result of whether the verification passed or failed.

[0023] Technical effect

[0024] Compared with existing technologies, this invention represents the range constraint of the batch vector as a binary expansion matrix obtained by bit width, and generates a range proof based on this by combining matrix commitment with quotient polynomial proofs of linear and Boolean constraints. This makes the proof generation independent of the route of compiling the range relationship into a large-scale general arithmetic circuit and then executing it according to a typical concise non-interactive knowledge proof. Second, in the verification stage, two bilinear pairing equations are used to verify the consistency between the vector commitment and the matrix commitment, as well as the Boolean properties of the matrix elements. The verifier only needs to perform a fixed number of bilinear pairing operations to complete the verification, and the number of pairings does not increase with the increase of bit width. Third, the range proof consists of a small number of elliptic curve group elements and is transmitted along with the commitment to control the amount of proof data and reduce storage and transmission overhead. Fourth, zero knowledge is achieved by the blinding of the matrix commitment and the blinding aggregation of the two types of quotient proofs; the proof component used for row-oriented random linear combination is constrained by the Boolean side quotient proof in the verification formula, and there is no need to set an additional blinding factor for this component separately. Fifth, after the proof key and verification key are issued in a one-time trusted setup, the number of pairings for each verification still remains the same, which is suitable for privacy computing and data verification scenarios with high-frequency verification. Attached Figure Description

[0025] Figure 1 This is a flowchart of the present invention;

[0026] Figure 2 This is a schematic diagram of the security authentication protocol structure of the present invention;

[0027] Figure 3 This is a schematic diagram comparing the performance of the present invention. Detailed Implementation

[0028] like Figure 1 As shown, this embodiment relates to a secure authentication method based on matrix commitment zero-knowledge scope proof, including:

[0029] Step S100: A trusted third party or through secure multi-party computation based on security parameters. Batch size of the data to be proven and the limited range of bit width Initialization is performed, specifically including:

[0030] S101, Generating Bilinear Group Parameters: Run the probabilistic polynomial-time bilinear group generation algorithm, outputting asymmetric bilinear paired parameter tuples. . and The generators are respectively And the order is a large prime number. cyclic group It is a bilinear mapping function.

[0031] S102, Sampling Trapdoor Parameters and Blinded Basis: In a Finite Domain Four sets of scalars were uniformly and randomly sampled within the system as trapdoor parameters: used to construct variable trapdoors for polynomial commitments. Trapdoors used for quotient polynomial verification And blinding trapdoors used to achieve zero-knowledge After that, the computation group Blinding generators on ,in: Indicates self The sample is randomly selected evenly from the middle.

[0032] S103, Calculate and construct the proof key Calculate the following based on trapdoor parameters and The basis elements of the group constitute the proof key. Specifically, it includes:

[0033] 1) Commitment and Proof Basis: This basis is used to commit to vectors and matrices and construct proofs, specifically: ,in: This base is used in the group The vector to be proved and its corresponding binary expansion matrix elements are encoded and committed using bivariate polynomial encoding. The base is located in the group Above, possessing with A perfectly symmetric negative exponential structure. Its core function is to enable validators to directly achieve cross-group algebraic cancellation through bilinear pairing. This is the quotient polynomial evaluation basis, used by provers to construct proofs of the validity of linear and Boolean constraints. Its exponential coordinate range deliberately excludes a specific set of points (i.e., With all This acts as a trapdoor constraint in algebraic design, forcing the prover's secret data to strictly satisfy the consistency equation for the final verification equation to hold.

[0034] 2) Blinding Basis: This part of the basis is specifically used to introduce random blinding factors to ensure the zero-knowledge nature of the protocol. Specifically, it consists of: basic blinding terms. This is used to counteract noise introduced by global random variables when the prover generates a quotient polynomial proof. Blinded basis of matrix elements. The base and and blinding generator Working collaboratively, it is used in the bilinear pairing equation during the verification phase to algebraically cancel the random blinding component in the commitment value. The output proof key is specifically: The key It will be publicly released for the prover to use repeatedly in the subsequent commitment and proof generation stages.

[0035] S104, Calculate and construct the verification key: Based on the above trapdoor parameters, the system calculates and constructs the verification key in the group. and The following public elements are calculated to form the verification key. Specifically, it includes:

[0036] 1) Linear aggregation verification basis The base contains embedded binary expansion weights ( In the verification phase, it is used to compute matrix columns in the bilinear paired exponential space.

[0037] 2) Trapdoor verification key The key contains a trapdoor. The inverse of is used to cancel out the legitimate cross terms of the quotient polynomial and blinding noise in the pairing equation.

[0038] 3) Boolean auxiliary verification basis This basis is algebraically equivalent to the whole The unblinding commitment of the matrix. Used in the verification phase for construction. The mapping enables Boolean constraint verification without expanding the matrix. The output verification key is as follows: The key It will be publicly released for validators to use in subsequent verification phases.

[0039] S105, Destroy Trapdoor Parameters: After successfully generating and publicly revealing the proof key... With verification key Subsequently, trusted third parties or participants in the secure multi-party computation protocol must securely destroy all underlying trapdoor parameters sampled during the initialization phase (S102).

[0040] Step S200: The prover, based on the vector to be proved... Based on the proof key Generate commitments, specifically including:

[0041] S201, Data Preparation and Binary Expansion: The prover presents the vectors he possesses. Perform a bitwise expansion to construct its corresponding binary expansion matrix. , where: the first of the matrix Row represents numerical value of Bit-bin representation, which strictly satisfies the linear consistency constraint, specifically: ;

[0042] S202, Sampling Random Blinding Factor: To achieve zero-knowledge in the protocol, the prover uniformly randomizes the blinding factor within a finite field. .

[0043] S203, Computation of matrix polynomial commitment: The prover uses the proof key. Commitment Basis With blind generator In the group Calculate vectors Vector commitment With binary expansion matrix Matrix commitment Specifically: , The prover will calculate the resulting commitment tuple. As a public output, and retained Used for subsequent proof generation.

[0044] Step S300: After outputting the commitment tuple, the prover further generates the zero-knowledge proof tuple. Specifically, it includes:

[0045] S301, Generating a Random Challenge: The prover uses the Fiat-Shamir heuristic, taking the publicly available commitment tuple as input, and calls a hash function to calculate the challenge value. Specifically: ;

[0046] S302, Proof of a random linear combination: The prover extracts the key from the proof key. Group basis, based on challenges For matrix Calculate line proof Specifically: ;

[0047] S303, Calculate the linear proof: The prover needs to calculate the coefficient matrix of the quotient polynomial cross term corresponding to the linear constraint. The prover uses the following linear recursive formula, line by line (for each...) Calculate the offset index The polynomial coefficients specifically include:

[0048] 1) For positive number field indexes The initial boundary conditions are: ,from Decrease to The backward recursion is: ;

[0049] 2) For negative field indexes Specifically: Order The initial boundary conditions are: ,from Decrease to The backward recursion is: After obtaining all coefficients, the prover extracted... The group basis in the group Exclude constant points With boundary points Proof of linear quotient calculation Specifically: ;

[0050] S304, Calculate and aggregate the linear blinding proof: to offset the stochastic blinding factor introduced in the commitment phase. To ensure the zero-knowledge nature of the protocol, the prover computes blinded terms in the business space. Specifically: Then, the prover performs algebraic multiplication to combine the blinded term with the linear proof, outputting a complete linear quotient proof with zero-knowledge properties. Specifically: ;

[0051] S305, Computational Boolean Proof: The prover first proves the challenge... , matrix The states are dynamically aggregated by column, and the difference vector is calculated. ,in, Since this operation has algebraically folded the Boolean constraints along the row dimension, the subsequent polynomial cross term coefficients... Window iteration is performed only along the column dimension. For matrices... each line The prover directly calculated the offset by iterative summation as follows. The coefficients specifically include:

[0052] 1) For positive offset Specifically: ;

[0053] 2) For negative offset ( Specifically: Extract the full matrix Then, the prover combines the proof key. In the group Proof of Boolean Quotient Calculation ;

[0054] S306, Calculate the Boolean blinding proof and aggregate: for offsetting the commitment matrix Random blinding factor in When pairing across groups The generated redundant algebraic noise is used by the prover to extract the proof key. Blinded substrate in Calculate the Boolean blinding term The prover then performs an algebraic multiplication with the underlying Boolean proof, outputting a zero-knowledge complete Boolean constraint proof. ;

[0055] S307, Output the final zero-knowledge proof tuple: After the prover completes the evaluation of all the above quotient polynomials, the output zero-knowledge proof tuple is as follows: This proof tuple, along with the public commitment, They are sent together to the verifier for bilinear pairing verification during the verification phase.

[0056] Step S400: The verifier receives a public commitment from the prover. With proof tuple Then, extract the publicly available verification key. Then, through bilinear pairing operations, linearity consistency and Boolean constraints are independently verified, specifically including:

[0057] S401, Verifying Linear Consistency: The verifier checks the vector commitment. Is it committed by a matrix? according to The binary weights are correctly expanded. The verifier calculates and verifies the following pairwise equations: ;

[0058] S402, Verifying Boolean Constraints: The verifier checks the underlying matrix. Does each element strictly satisfy...? ,Right now The verifier extracts a random linear combination to prove... Calculate and verify the following paired equations: ;

[0059] S403, Output verification result: The verifier outputs 1 (accept) if and only if both equations S401 and S402 above are true, otherwise outputs 0 (reject).

[0060] Through simulation experiments, under a hardware and software environment with an Intel Core i5-10210U processor (base frequency 1.60GHz), approximately 16GB of memory, and a Microsoft Windows 11 operating system (version 10.0.22631), the asymmetric bilinear pairing parameter correlation operation described in step S101 was repeatedly iterated and measured using the Go language and the golang.org / x / crypto / bn256 library to obtain the first cyclic group. Second Cyclic Group Scalar multiplication and bilinear pairing mapping The average time per attempt. Based on this, with a fixed bit width. The number of components (batch size) of the vector to be proven. Under the conditions of 64, 256, 1024, 4096, and 16384 respectively, the measured atomic consumption is input into the algorithm complexity model of this invention and prior art 1 and prior art 2 to estimate the total time consumption of the proof generation stage, the total time consumption of the bilinear pairing verification operation, and the commitment tuple. With range proof tuple Total data volume and structured reference string storage size (megabytes).

[0061] In this invention, when the verifier performs bilinear pairing verification operations, the number of pairing operations is fixed at 5 and included in the model. The above simulation process and detailed comparison data are shown in Table 1. The curve of change is as follows Figure 3 As shown.

[0062] Table 1

[0063] In Table 1, the unit for the amount of data to be proven is KB, the unit for the time taken to generate and verify the proof is s, and the unit for the size of the public parameters is MB.

[0064] The aforementioned prior art employs the technique described in "A Succinct Range Proof for Polynomial-based Vector Commitment".

[0065] The aforementioned prior art 2 employs the techniques described in "Dekart Proof: Efficient Vector Range Proofs and Their Applications".

[0066] Compared with the prior art, the present invention has advantages in batch size. When the number of samples increased from 64 to 16384, the verification time of this invention remained constant at 0.060s, which is not only better than the 0.081s of the prior art, but also significantly better than the 0.077s of the prior art, which showed a logarithmic increase. When the verifier of this invention performs bilinear pairing verification operations, the number of bilinear pairing operations is fixed at 5 times as stated in the specification

[0020] , depending on the batch size. Irrelevant, therefore in the listed items The verification time remains constant.

[0067] In the above Under the given value, the commitment tuple With range proof tuple The total size is 0.375KB, lower than the 0.875KB of prior art one, and lower than the 6.000~8.250KB of prior art two, and it does not follow... Increases as it grows. The commitment tuple in this invention... With range proof tuple The encoding length is determined by the fixed structure under the selected commitment and range proof scheme. The verification and transmission sides rely on the aforementioned fixed-length tuples, which do not change with the batch size. Increase the number of fields by adding them or expanding proportionally, so in the above... The sum of the two is always 0.375KB.

[0068] In the above Under the given conditions, the time required for proof generation and the size of the disclosed parameters corresponding to the structured reference strings in this invention are higher than those in prior art 2, and in some aspects, they are also higher than those in prior art 1. During initialization, the disclosed basis increases with the batch size, and the disclosed parameters increase accordingly. Proof generation requires multiplication and recursion on the entire binary expansion matrix; the larger the batch, the more computations are performed, and the longer the time required. Prior art implementations have lighter paths in the comparisons, and therefore their numerical values ​​are often lower than those of this invention.

[0069] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.

Claims

1. A secure authentication method based on matrix commitment zero-knowledge scope proof, characterized in that, The prover decomposes the vector to be proved into a binary expansion matrix by bit width and makes an algebraic commitment. Using the structured reference string (SRS) generated during initialization, the prover makes an algebraic commitment to the binary expansion matrix, obtains the matrix commitment value corresponding to the vector, and generates a range proof containing several group elements. The prover then sends the matrix commitment value and the range proof to the verifier. The verifier performs a bilinear pairing verification operation on the range proof based on the structured reference string, confirms that the hidden vector satisfies the preset range constraint conditions, and achieves authentication.

2. The secure authentication method based on matrix commitment zero-knowledge scope proof according to claim 1, characterized in that, The matrix commitment value is obtained as follows: the prover obtains the vector to be proved and the corresponding range constraints, and converts them into a binary expansion matrix. ; Use the structured reference string (SRS) generated during initialization to process the matrix Perform algebraic commitments and calculate the matrix commitment value.

3. The secure authentication method based on matrix commitment zero-knowledge scope proof according to claim 1 or 2, characterized in that, The binary expansion matrix It is obtained in the following way: 1) Decompose the vector into binary components according to the given bit width to obtain the corresponding binary sequence; 2) Map the binary sequence to a binary expansion matrix with a fixed row and column structure. elements Each element in the matrix satisfies a Boolean property, meaning it takes the value 0 or 1. 3) Based on this binary expansion matrix Construct the corresponding set of characteristic polynomials to provide input data for subsequent algebraic commitments and constraint proofs.

4. The secure authentication method based on matrix commitment zero-knowledge scope proof according to any one of claims 1-3, characterized in that, The range proof is obtained by: based on a randomly generated challenge factor, respectively, for the binary expansion matrix The linear combination constraints and Boolean constraints are used to calculate the corresponding quotient polynomials and generate a range proof containing multiple group elements, specifically including: i) Introduce a random blinding factor during the commitment phase for the binary expansion matrix. Generate randomized matrix commitments with zero-knowledge properties to hide underlying numerical information; ii) Calculate the stochastic linear combination proof corresponding to the matrix commitment based on the validator or the globally stochastic challenge factor generated by the Fiat-Shamir transformation. ; iii) For each algebraic relation corresponding to the range constraint, generate a proof of the linear constraint quotient polynomial used to prove the numerical linear relation. And the Boolean constraint quotient polynomial proof used to prove the Boolean properties of matrix elements. .

5. The secure authentication method based on matrix commitment zero-knowledge scope proof according to claim 4, characterized in that, In step ii), the proof of random linear combination is as follows. As an intermediate proof quantity based on a global challenge, it is subject to Boolean constraint quotient polynomial proof in the final verification equation. Joint constraints.

6. The secure authentication method based on matrix commitment zero-knowledge scope proof according to claim 1 or 2, characterized in that, The structured reference string is generated through a one-time multi-party secure computation in a system environment where trusted settings have been implemented, and is shared between the prover and the verifier.

7. The secure authentication method based on matrix commitment zero-knowledge scope proof according to claim 1, characterized in that, The aforementioned bilinear pairing verification operation refers to the verifier extracting a fixed number of group elements from the range proof and substituting them into a preset verification equation for calculation. This verification operation only involves a fixed number of bilinear pairing operations, and its computational complexity is constant. That is, the verifier only needs to perform 5 bilinear pairing operations and does not need to perform linear scale group exponent operations related to the numerical bit width.

8. The secure authentication method based on matrix commitment zero-knowledge scope proof according to claim 1 or 2, characterized in that, The initialization mentioned above specifically refers to: Among them: input security parameters Batch size of the data to be proven and the limited range of bit width That is, the range of values ​​for each element is Output proof key With verification key ; The matrix commitment value is obtained in the following way: Where: the input vector to be proved , and the binary expansion matrix of the vector and proof key Output commitment tuple ; The aforementioned range proof is obtained in the following manner: Where: the input vector to be proved With binary expansion matrix Publicly committed tuples and proof key Generate and output the proof tuple. ; The bilinear pairing verification operation is obtained in the following way: , where: input commitment The proof submitted by the certifier and verification key If the proof is valid and all constraints are satisfied, then output... (Pass), otherwise output (Not approved) 9. A secure authentication system based on matrix commitment zero-knowledge scope proof that implements the method of any one of claims 1-8, characterized in that, include: The system comprises an initialization unit, a commitment unit, a challenge unit, and a verification unit, wherein the initialization unit is based on security parameters. Batch size Bit width The trusted setup process input information is used to generate bilinear group parameters, sample trapdoor parameters, and generate the proof key. With verification key The construction and safe disposal of the trapdoors have been publicly released. and The commitment unit is based on the vector to be proved. Bit width and the initialization unit release The information is expanded into a binary matrix. Blinded random number sampling and in the group The commitment calculation process yields the publicly committed tuple. The challenge unit is based on the output of the commitment unit. , , and Information is used to generate challenges and prove stochastic linear combinations. Linear and Boolean quotient polynomial proofs and blinded aggregation processing are used to obtain range-proven tuples. The verification unit, based on the information released by the initialization unit, And the commitment and challenge units provided and The information is subjected to constant-time bilinear paired verification equality testing to obtain the output result of whether the verification passed or failed.

Images