A method for polynomial processing based on zero-knowledge proof

Abstract

The application discloses a polynomial processing method and device based on zero-knowledge proof. In the embodiment of the application, coefficients of a first polynomial are divided into multiple groups, independent finite field data processors are used to perform parallel processing on the coefficients in the groups, and coefficients used for constituting a second polynomial are calculated, so that the processing on the polynomial is quickly realized.

Description

TECHNICAL FIELD

[0001] The present application relates to, but is not limited to, information security technology, and in particular to a polynomial processing method based on zero-knowledge proof. BACKGROUND

[0002] Zero-knowledge proof (Zero—Knowledge Proof) was proposed by S. Goldwasser, S. Micali and C. Rackoff in the early 1980s. Zero-knowledge proof means that the prover can make the verifier believe that a certain proposition is correct without providing any useful information to the verifier. Zero-knowledge proof is essentially a protocol involving two or more parties, in other words, a series of steps taken by two or more parties to complete a task. In zero-knowledge proof, the prover proves to the verifier that he knows or has a certain message, but the proof process cannot leak any information about the message being proved to the verifier. Zero-knowledge proof has been widely used in distributed storage and web3.0 applications. SUMMARY

[0004] The present application provides a polynomial processing method based on zero-knowledge proof, which can improve the speed of polynomial calculation in zero-knowledge proof, thereby speeding up the implementation of zero-knowledge proof.

[0005] The present application provides a polynomial processing method based on zero-knowledge proof, which includes:

[0006] The prover obtains the coefficients of the first polynomial and the random number from the verifier and stores them;

[0007] The coefficients of the first polynomial are grouped according to the order of the first polynomial and the pre-set number of groups and stored;

[0008] For each group of coefficients, the respective responsible coefficients are iteratively processed according to the random number, the number of cycles and the order of the first polynomial;

[0009] A second polynomial is constructed according to the coefficients obtained by the iterative processing, and the second polynomial is the proof information provided by the prover to the verifier.

[0010] In an exemplary example, the pre-set number of groups includes two or more groups;

[0011] The coefficients of different groups are iteratively processed by different processors in parallel.

[0012] In an exemplary example, the iterative processing of the respective responsible coefficients includes:

[0013] using the coefficients of the first polynomial as initial values ​​for the iterative process;

[0014] The cycle starts from Q=0, and Q increases by 1 at the end of each cycle until the next round of 2 Q > N ends the iterative calculation; in each cycle, for i > N-2 Q The coefficient a i , coefficient a i is the value calculated in the previous round, for i≤N-2 Q The coefficient a i , coefficient a i Stored for the previous round With the random number 2 Q The second power is The product of , plus the a stored in the previous round i , the iterative formula is expressed as: Store the coefficients calculated in this loop iteration;

[0015] Wherein, Q is the number of cycles; z is the random number; the first polynomial is expressed as Wherein, x is the variable of the first polynomial p(x), N is the order of the first polynomial; a i are the coefficients of the first polynomial, 0≤i≤N, a i is an element in the finite field GF(p).

[0016] In an exemplary embodiment, constructing a second polynomial according to coefficients obtained by the iterative process includes:

[0017] The second polynomial is: N X N +a N-1 X N-1 +…+a1X+a0, each coefficient in the second polynomial is the coefficient value stored when the loop iterative calculation ends.

[0018] In an exemplary embodiment, the iterative processing of the respective responsible coefficients includes:

[0019] using the coefficients of the first polynomial as initial values ​​for the iterative process;

[0020] The cycle starts from the number of cycles Q = 0, and Q is increased by one at the end of each cycle until the next round of M × 2 Q >N ends the iterative calculation; in each cycle, for i>NM×2 Q The coefficient a i , coefficient a i is the value calculated in the previous round, for i≤NM×2 Q The coefficient ai , coefficient a i is the stored plus the stored a i The iterative formula is represented as: store the coefficient obtained by the current loop iteration calculation;

[0021] wherein Q is the number of iterations; z is the random number, z = 1; M is the order of a certain subgroup H; the first polynomial is expressed as wherein x is the variable of the first polynomial p(x), N is the order of the first polynomial; a i is the coefficient of the first polynomial, 0≤i≤N, a i is an element in the finite field GF(p).

[0022] In an exemplary instance, the coefficient obtained according to the iterative processing is used to construct a second polynomial, comprising:

[0023] The quotient of the second polynomial is a N X N-M +a N-1 X N-M-1 +…+a M+1 X+a M , and the remainder is a M-1 X M-1 +a M-2 X M-2 +…+a1X+a0, each coefficient in the second polynomial is the coefficient value stored when the loop iteration calculation is completed.

[0024] Embodiments of the present application also provide a polynomial processing device based on zero-knowledge proof, comprising: a controller, K finite field data processors, m memories, K≥2, m≥1; wherein,

[0025] the controller, K finite field data processors and m memories are connected to a bus;

[0026] the finite field data processor is configured to perform iterative processing on the coefficients of the group corresponding to itself according to a random number, a number of iterations and an order of a first polynomial;

[0027] the memory is configured to store the coefficients of the first polynomial and the random number, group the coefficients of the first polynomial according to the order of the first polynomial and a pre-set number of groups, and the coefficients of different groups correspond to different finite field data processors;

[0028] The controller is configured to control each of the finite field data processors to perform loop processing according to the number of loops and the order of the first polynomial; read coefficients obtained by iterative processing from each of the finite field data processors, and construct a second polynomial based on the multiple sets of coefficients read, where the second polynomial is proof information provided by the prover to the verifier.

[0029] In an exemplary embodiment, the K finite field data processors are configured to:

[0030] using the coefficients of the first polynomial as initial values ​​for the iterative process;

[0031] The cycle starts from Q=0, and Q increases by 1 at the end of each cycle until the next round of 2 Q > N ends the iterative calculation; in each cycle, for i > N-2 Q The coefficient a i , coefficient a i is the value calculated in the previous round, for i≤N-2 Q The coefficient a i , coefficient a i Stored for the previous round With the random number 2 Q The second power is The product of , plus the a stored in the previous round i , the iterative formula is expressed as: Store the coefficients calculated in this loop iteration;

[0032] Wherein, Q is the number of cycles; z is the random number; the first polynomial is expressed as Wherein, x is the variable of the first polynomial p(x), N is the order of the first polynomial; a i are the coefficients of the first polynomial, 0≤i≤N, a i is an element in the finite field GF(p).

[0033] In an exemplary embodiment, constructing the second polynomial in the controller includes:

[0034] The second polynomial is: N X N +a N-1 X N-1 +…+a1X+a0, each coefficient in the second polynomial is the coefficient value stored when the loop iterative calculation ends.

[0035] In an exemplary embodiment, the K finite field data processors are configured to:

[0036] using the coefficients of the first polynomial as initial values ​​for the iterative process;

[0037] starting from the cycle number Q = 0, and increasing Q by one at the end of each cycle, until the next round of M x 2 Q the iterative calculation is ended; in each cycle, for the coefficient a Q of i > N - M x 2 i , the coefficient a i is the value obtained in the last round of calculation, for the coefficient a Q of i ≤ N - M x 2 i , the coefficient a i is the value stored in the last round plus the value of a i stored in the last round, and the iterative formula is represented as: storing the coefficient obtained in the iterative calculation of the current cycle;

[0038] wherein Q is the cycle number; z is the random number, z = 1; M is the order of a certain subgroup H; the first polynomial is expressed as wherein x is the variable of the first polynomial p(x), N is the order of the first polynomial; a i is the coefficient of the first polynomial, 0 ≤ i ≤ N, a i is an element in the finite field GF(p).

[0039] In an exemplary instance, constructing the second polynomial in the controller comprises:

[0040] the quotient of the second polynomial is a N X N-M + a N-1 X N-M-1 + … + a M+1 X + a M , and the remainder is a M-1 X M-1 + a M-2 X M-2 + … + a 1X + a 0, and each coefficient in the second polynomial is the coefficient value stored at the end of the cycle iterative calculation.

[0041] Embodiments of the present application further provide a computer readable storage medium storing computer executable instructions for performing the zero-knowledge proof based polynomial processing method described in any of the above embodiments.

[0042] Embodiments of the present application further provide a computer device comprising a memory and a processor, wherein the memory stores instructions executable by the processor, for performing the steps of the zero-knowledge proof based polynomial processing method described in any of the above embodiments.

[0043] Other features and advantages of the present application will be set forth in the following description, and in part will be apparent from the description, or can be learned by practice of the application. The objects and other advantages of the present application will be realized and attained by the structure particularly pointed out in the written description and claims thereof as well as the appended drawings.

[0044] SUMMARY

[0045] The accompanying drawings are included to provide a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description serve to explain the principles of the application. The drawings are provided for merely the purposes of illustration and description and can not be used to impose the only constructions of the application.

[0046] Figure 1 A flowchart of a polynomial processing method based on zero-knowledge proof in an embodiment of the present application;

[0047] Figure 2 A processing diagram of a Witness polynomial corresponding to a second polynomial p(x) in an embodiment of the present application;

[0048] Figure 3 A processing diagram of a result of dividing a second polynomial p(x) by a Vanishing polynomial v(x) in an embodiment of the present application;

[0049] Figure 4 A structural diagram of a polynomial processing device based on zero-knowledge proof in an embodiment of the present application.

[0050] DETAILED DESCRIPTION

[0051] In order to make the objects, technical solutions and advantages of the present application clearer, the following will describe the embodiments of the present application in detail with reference to the accompanying drawings. It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other as long as there is no conflict.

[0052] In order to facilitate the understanding of the present application, the following will describe the present application more fully with reference to the related drawings. The embodiments of the present application are shown in the drawings. However, the present application can be realized in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. The terminology used in the description of the present application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application.

[0054] For the polynomial commitment used in the zero-knowledge proof protocol, it can be considered as the division of a large polynomial The process of calculating the Witness polynomial [p(x)-p(z)] / (x-z) by the random number z generated by the verifier in the interaction process between the prover and the verifier can prove that p(x)-p(z) can be divided by (x-z) necessarily. Wherein, x is the variable of the first polynomial p(x), a i (0≤i≤N) is the coefficient of the first polynomial, a i The random number z is an element in the finite field GF(p), and N is the order of the first polynomial.

[0055] For the Vanishing polynomial division used in the zero-knowledge proof protocol, it can be considered as the division of a large polynomial The Vanishing polynomial v(x)=x M -1 of a subgroup H, wherein M is the order of the subgroup H, and the division of p(x) by v(x) can be understood as the division operation of two polynomials.

[0056] It should be noted that there are other polynomials in the zero-knowledge proof protocol, and only the Witness polynomial and the Vanishing polynomial are taken as examples for description, and the protection scope of the present application is not limited.

[0057] In order to improve the speed of polynomial calculation in the zero-knowledge proof, an embodiment of the present application provides a polynomial processing method based on zero-knowledge proof, as shown in Figure 1 It can include the following steps:

[0058] Step 100: The prover obtains the coefficients of the first polynomial and the random number from the verifier and stores them.

[0059] In an exemplary instance, the first polynomial can be expressed as Wherein, x is the variable of the first polynomial p(x), a i (0≤i≤N) is the coefficient of the first polynomial, a i is an element in the finite field GF(p), and N is the order of the first polynomial.

[0060] The random number in this step is the random number z generated by the verifier in the interaction process between the prover and the verifier, and the random number z is an element in the finite field GF(p).

[0061] Step 101: Grouping and storing the coefficients of the first polynomial according to the order of the first polynomial and the pre-set number of groups.

[0062] In an exemplary instance, at least two processors (which can be referred to as finite field data calculators herein) for finite field data calculation can be pre-set, and the coefficients of the first polynomial in different groups are processed in parallel by different processors. In an embodiment, the number of processors can be greater than or equal to the number of groups of the coefficients of the first polynomial according to the actual application requirements.

[0063] In an exemplary instance, taking the pre-set K finite field data processors as an example, in an embodiment, the coefficients of the first polynomial can be divided into K groups and stored, wherein each group includes (N+1) / K coefficients, that is, each finite field data processor is configured to be responsible for the processing of (N+1) / K coefficients. In an embodiment, if (N+1) cannot be divided by K, then the finite field data processor responsible for the processing of the coefficients of the highest order is configured to be responsible for the processing of the group including more coefficients, and the finite field data processor responsible for the processing of the coefficients of the lower order is configured to be responsible for the processing of the group including fewer coefficients. For example, taking N=32 and K=16 as an example, (N+1) / K=(32+1) / 16=2 with a remainder of 1, in an embodiment, the finite field data processor responsible for the processing of the coefficients of the highest order is configured to be responsible for the processing of the group including 3 coefficients, and the other finite field data processors are configured to be responsible for the processing of the group including 2 coefficients, such as 1 finite field data processor responsible for the processing of 3 coefficients and 15 finite field data processors responsible for the processing of 2 coefficients. For another example, taking N=33 and K=16 as an example, (N+1) / K=(33+1) / 16=2 with a remainder of 2, in an embodiment, the finite field data processor responsible for the processing of the coefficients of the highest order is configured to be responsible for the processing of the group including 3 coefficients, the finite field data processor responsible for the processing of the coefficients of the second highest order is configured to be responsible for the processing of the group including 3 coefficients, and the other finite field data processors are configured to be responsible for the processing of the group including 2 coefficients, such as 2 finite field data processors responsible for the processing of 3 coefficients and 14 finite field data processors responsible for the processing of 2 coefficients. It should be noted that for the case where (N+1) / K has a remainder, the remainder of the coefficients is evenly distributed to the finite field data processors responsible for the processing of the coefficients of the highest order as much as possible from the finite field data processor responsible for the processing of the coefficients of the highest order.

[0064] Step 102: For each group of coefficients, the coefficients responsible for each group are iteratively processed according to the random number, the number of cycles, and the order of the first polynomial.

[0065] In an exemplary instance, the second polynomial to be constructed is the Witness polynomial corresponding to p(x), and the formula is expressed as: Where z is a random number from the verifier, and the iterative processing of the respective responsible coefficients according to the random number, the number of cycles Q, and the order of the first polynomial in step 102 may include:

[0066] Using the coefficients of the first polynomial obtained in step 100 as initial values ​​for the iterative process;

[0067] The cycle starts from Q=0, and Q increases by 1 at the end of each cycle until the next round of 2 Q > N ends the iterative calculation. In each loop, for i > N-2 Q The coefficient a i , coefficient a i The value calculated in the previous round (including the initial value or the previous cycle), for i≤N-2 Q The coefficient a i , coefficient a i Stored for the previous round With the random number 2 Q The second power is The product of , plus the a stored in the previous round i , the iterative formula is expressed as: Stores the coefficients calculated for this loop iteration.

[0068] In an exemplary embodiment, the second polynomial to be constructed is the result of dividing p(x) by the Vanishing polynomial v(x), that is, The random number z is 1, M is the order for a certain subgroup H, and M is predetermined. The iterative processing of the respective coefficients according to the random number, the number of cycles Q, and the order of the first polynomial in step 102 may include:

[0069] Using the coefficients of the first polynomial obtained in step 100 as initial values ​​for processing the coefficients;

[0070] The loop starts from Q=0, and Q increases by one at the end of each loop until the next round of M×2 Q >N ends the iterative calculation. In each cycle, for i>NM×2 Q The coefficient a i , coefficient a i The value calculated in the previous round (including the initial value or the previous cycle), for i≤NM×2 Q The coefficient a i , coefficient a i Stored for the previous round Add the a stored in the previous round i , the iterative formula is expressed as: Stores the coefficients calculated for this loop iteration.

[0071] It can be seen from the embodiment that the calculation of each group of coefficients is parallel processed in each loop calculation, and the polynomial processing method based on zero-knowledge proof provided in the embodiment quickly realizes the processing of the polynomial, and improves the calculation efficiency to log2 K, wherein K is the number of processors (which can be referred to as finite field data calculators in the present document) used for finite field data calculation, and the speed of the polynomial calculation in the zero-knowledge proof is greatly improved.

[0072] Step 103: constructing a second polynomial according to the coefficients obtained through the iteration processing, the second polynomial being the proof information provided by the proving party to the verifying party.

[0073] In an exemplary instance, the second polynomial to be constructed is a Witness polynomial corresponding to p(x), and the second polynomial to be constructed is a N X N +a N-1 X N-1 +…+a1X+a0, each coefficient in the second polynomial being the coefficient value stored when the loop iteration calculation is ended.

[0074] In an exemplary instance, the second polynomial to be constructed is the result obtained by dividing p(x) by the Vanishing polynomial v(x), and the quotient of the second polynomial is a N X N-M +a N-1 X N-M-1 +…+a M+1 X+a M , and the remainder is a M-1 X M-1 +a M-2 X M-2 +…+a1X+a0, each coefficient in the second polynomial being the coefficient value stored when the loop iteration calculation is ended.

[0075] The polynomial processing method based on zero-knowledge proof provided in the embodiment divides the coefficients of the first polynomial into multiple groups, respectively uses independent processors to parallel process the coefficients in each group, calculates the coefficients used to construct the second polynomial, quickly realizes the processing of the polynomial, greatly improves the speed of the polynomial calculation in the zero-knowledge proof, and thus speeds up the implementation of the zero-knowledge proof.

[0076] The embodiment of the present application further provides a computer readable storage medium storing computer executable instructions, and the computer executable instructions are used to execute the polynomial processing method based on zero-knowledge proof in any of the above embodiments.

[0077] An embodiment of the present application further provides a computer device, including a memory and a processor, wherein the memory stores the following instructions that can be executed by the processor: used to execute the steps of any of the above-mentioned polynomial processing methods based on zero-knowledge proof.

[0078] Figure 2 This is a processing diagram of the Witness polynomial corresponding to the second polynomial p(x) in an embodiment of the present application. In this embodiment, it is assumed that N=16, K=8, and the finite field data processor responsible for processing the highest-order coefficients includes, in sequence, a first finite field data processor, a second finite field data processor, a third finite field data processor, a fourth finite field data processor, a fifth finite field data processor, a sixth finite field data processor, a seventh finite field data processor, and an eighth finite field data processor. In addition, in this embodiment, it is assumed that the first finite field data processor is responsible for processing a group including three coefficients, and the other finite field data processors are responsible for processing a group including two coefficients, such as Figure 2 As shown, the coefficient a 16 ~a 14 The calculation is assigned to the first finite field data processor, the coefficient a 13 ~a 12 The calculation is assigned to the second finite field data processor, the coefficient a 11 ~a 10 The calculation of coefficients a9 to a8 is assigned to the third finite field data processor, the calculation of coefficients a7 to a6 is assigned to the fifth finite field data processor, the calculation of coefficients a5 to a4 is assigned to the sixth finite field data processor, the calculation of coefficients a3 to a2 is assigned to the seventh finite field data processor, and the calculation of coefficients a1 to a0 is assigned to the eighth finite field data processor. Figure 2 In the embodiment shown, the initial values ​​of the coefficients are as follows Figure 2 As shown in the first row, the order from the highest order is: a 16 、a 15 、a 14 、a 13 、a 12 、a 11 、a 10 , a9, a8, a7, a6, a5, a4, a3, a2, a1, a0, each coefficient in the next round of calculation is iteratively calculated based on the calculation results of this round.

[0079] In the first cycle, Q = 0, and the coefficients to be calculated in the first cycle are i = N-2 Q =16-2 0 =15, that is, the coefficient a in this round of calculation 16 The value of is the value of the previous round, that is, the initial value, and the coefficient a15 The coefficient a0 is calculated according to the iterative formula Calculation, the iterative calculation of the first cycle of this embodiment is as follows:

[0080]

[0081]

[0082] …

[0083]

[0084] After the first cycle, the updated values ​​of the coefficients are as follows Figure 2 As shown in the second row, the order from the highest level is: a 16 、za 16 +a 15 、za 15 +a 14 、za 14 +a 13 、za 13 +a 12 、za 12 +a 11 、za 11 +a 10 、za 10 +a9, za9+a8, za8+a7, za7+a6, za6+a5, za5+a4, za4+a3, za3+a2, za2+a1, za1+a0. In the next round of calculation, each coefficient is iteratively calculated based on the results of this round.

[0085] In the second cycle, Q = 1, and the coefficients to be calculated in the second cycle are i = N-2 Q =16-2 1 =14, that is, the coefficient a 16 , coefficient a 15 The value of is calculated in the first cycle. At this time, the coefficient a 16 The value of is still the initial value, the coefficient a 15 The value of is the value calculated in the first cycle, that is, za 16 +a 15 ; Coefficient a 14 The coefficient a0 is calculated according to the iterative formula Calculation, the iterative calculation of the second cycle of this embodiment is as follows:

[0086]

[0087]

[0088] …

[0089]

[0090]

[0091] The second cycle is over, and the updated coefficients are as follows Figure 2 The third row in the middle shows, from the highest order, in turn: a 16 , za 16 + a 15 , z 2 a 16 + za 15 + a 14 , z 3 a 16 + z 2 a 15 + za 14 + a 13 , z 3 a 15 + z 2 a 14 + za 13 + a 12 , z 3 a 14 + z 2 a 13 + za 12 + a 11 , z 3 a 13 + z 2 a 12 + za 11 + a 10 , z 3 a 12 + z 2 a 11 + za 10 + a9, z 3 a 11 + z 2 a 10 + za9 + a8, z 3 a 10 + z 2 a9 + za8 + a7, z 3 a9 + z 2 a8 + za7 + a6, z 3 a8 + z 2 a7 + za6 + a5, z 3 a7 + z 2 a6 + za5 + a4, z 3 a6 + z 2 a5 + za4 + a3, z 3 a5 + z2 a4+za3+a2, z 3 a4+z 2 a3+za2+a1, z 3 a3+z 2 a2+za1+a0, the coefficients in the next round of calculation are iteratively calculated with the results of this round of calculation.

[0092] In the third cycle, Q=2, the coefficients that need to be calculated in the third cycle start from i=N-2 Q = 16-2 2 = 12, that is, the value of the coefficient a 16 , the value of the coefficient a 15 , the value of the coefficient a 14 , the value of the coefficient a 13 is the value calculated in the second cycle, at this time, the value of the coefficient a 16 is still the initial value, the value of the coefficient a 15 is still the value calculated in the first cycle, that is, za 16 +a 15 , the value of the coefficient a 14 is the value calculated in the second cycle, that is, z 2 a 16 +za 15 +a 14 , the value of the coefficient a 13 is the value calculated in the second cycle, that is, z 3 a 16 +z 2 a 15 +za 14 +a 13 ; the coefficients a 12 ~a0 are calculated according to the iterative formula , the iterative calculation of the third cycle of the embodiment is as follows:

[0093]

[0094]

[0095] …

[0096]

[0097]

[0098] The third cycle is completed, and the updated coefficients are as shown in the fourth row of Figure 2 , arranged in order from the highest order: a 16 , za 16 +a 15 , z 2 a 16+za 15 +a 14 、z 3 a 16 +z 2 a 15 +za 14 +a 13 、z 4 a 16 +z 3 a 15 +z 2 a 14 +za 13 +a 12 、z 5 a 16 +z 4 a 15 +z 3 a 14 +z 2 a 13 +za 12 +a 11 、z 6 a 16 +z 5 a 15 +z 4 a 14 +z 3 a 13 +z 2 a 12 +za 11 +a 10 、z 7 a 16 +z 6 a 15 +z 5 a 14 +z 4 a 13 +z 3 a 12 +z 2 a 11 +za 10 +a9、z 7 a 15 +z 6 a 14 +z 5 a 13 +z 4 a 12 +z 3 a 11 +z 2 a 10 +za9+a8、z 7 a 14 +z 6 a 13 +z5 a 12 +z 4 a 11 +z 3 a 10 +z 2 a9+za8+a7、z 7 a 13 +z 6 a 12 +z 5 a 11 +z 4 a 10 +z 3 a9+z 2 a8+za7+a6、z 7 a 12 +z 6 a 11 +z 5 a 10 +z 4 a9+z 3 a8+z 2 a7+za6+a5、z 7 a 11 +z 6 a 10 +z 5 a9+z 4 a8+z 3 a7+z 2 a6+za5+a4、z 7 a 10 +z 6 a9+z 5 a8+z 4 a7+z 3 a6+z 2 a5+za4+a3、z 7 a9+z 6 a8+z 5 a7+z 4 a6+z 3 a5+z 2 a4+za3+a2、z 7 a8+z 6 a7+z 5 a6+z 4 a5+z 3 a4+z 2 a3+za2+a1、z 7 a7+z 6 a6+z 5 a5+z 4 a4+z 3 a3+z 2a2+za1+a0, the coefficients in the next round are iteratively calculated with the results of this round.

[0099] In the fourth cycle, Q=3, the coefficients that need to be calculated in the fourth cycle start from i=N-2 Q = 16-2 3 = 8, that is, the value of the coefficient a 16 , the value of the coefficient a 15 , the value of the coefficient a 14 , the value of the coefficient a 13 , the value of the coefficient a 12 , the value of the coefficient a 11 , the value of the coefficient a 10 , the value of the coefficient a9is the value calculated in the third cycle, at this time, the value of the coefficient a 16 is still the initial value, the value of the coefficient a 15 is still the value calculated in the first cycle, that is, za 16 +a 15 , the value of the coefficient a 14 is still the value calculated in the second cycle, that is, z 2 a 16 +za 15 +a 14 , the value of the coefficient a 13 is still the value calculated in the second cycle, that is, z 3 a 16 +z 2 a 15 +za 14 +a 13 , the value of the coefficient a 12 is the value calculated in the third cycle, that is, z 4 a 16 +z 3 a 15 +z 2 a 14 +za 13 +a 12 , the value of the coefficient a 11 is the value calculated in the third cycle, that is, z 5 a 16 +z 4 a 15 +z 3 a 14 +z 2 a 13 +za 12 +a 11 , the value of the coefficient a 10 is the value calculated in the third cycle, that is, z 6 a 16 +z 5 a 15 +z4 a 14 +z 3 a 13 +z 2 a 12 +za 11 +a 10 The value of coefficient a9 is the value obtained by the third cycle calculation, that is, z 7 a 16 +z 6 a 15 +z 5 a 14 +z 4 a 13 +z 3 a 12 +z 2 a 11 +za 10 +a9; coefficients a8 to a0 follow the iterative formula Calculation, the iterative calculation of the fourth cycle of this embodiment is as follows:

[0100]

[0101]

[0102] …

[0103]

[0104]

[0105] After the fourth cycle ends, the updated coefficients are as follows Figure 2 As shown in the fifth row, the order from the highest level is: a 16 、za 16 +a 15 、z 2 a 16 +z3 15 +a 14 、z 3 a 16 +z 2 a 15 +za 14 +a 13 、z 4 a 16 +z 3 a 15 +z 2 a 14 +za 13 +a 12 、z 5 a 16 +z 4 a 15 +z3 a 14 +z 2 a 13 +za 12 +a 11 、z 6 a 16 +z 5 3 15 +z 4 a 14 +z 3 a 13 +z 2 a 12 +z3 11 +a 10 、z 7 a 16 +z 6 a 15 +z 5 a 14 +z 4 a 13 +z 3 a 12 +z 2 a 11 +za 10 +a9、z 8 a 16 +z 7 a 15 +z 6 a 14 +z 5 a 13 +z 4 a 12 +z 3 a 11 +z 2 a 10 +za9+a8、z 9 a 16 +z 8 a 15 +z 7 a 14 +z 6 a 13 +z 5 a 12 +z 4 a 11 +z 3 a 10 +z 2 a9+za8+a7、z 10 a 16 +z 9 a 15 +z 8 a 14 +z 7 a13 +z 6 a 12 +z 5 a 11 +z 4 a 10 +z 3 a9+z 2 a8+za7+a6、z 11 a 16 +z 10 a 15 +z 9 a 14 +z 8 a 13 +z 7 a 12 +z 6 a 11 +z 5 a 10 +z 4 a9+z 3 a8+z 2 a7+z36+a5、z 12 a 16 +z 11 a 15 +z 10 a 14 +z 9 a 13 +z 8 a 12 +z 7 a 11 +z 6 a 10 +z 5 a9+z 4 a8+z 3 a7+z 2 a6+za5+a4、z 13 a 16 +z 12 a 15 +z 11 a 14 +z 10 a 13 +z 9 a 12 +z 8 a 11 +z 7 a 10 +z 6 a9+z 5 a8+z 4 a7+z 3 a6+z 2 a5+za4+a3、z 14 a 16+z 13 a 15 +z 12 a 14 +z 11 a 13 +z 10 a 12 +z 9 a 11 +z 8 a 10 +z 7 a9+z 6 a8+z 5 a7+z 4 a6+z 3 a5+z 2 a4+za3+a2、z 15 a 16 +z 14 a 15 +z 13 a 14 +z 12 a 13 +z 11 a 12 +z 10 a 11 +z 9 a 10 +z 8 a9+z 7 a8+z 6 a7+z 5 a6+z 4 a5+z 3 a4+z 2 a3+za2+a1、z 16 a 16 +z 15 a 15 +z 14 a 14 +z 13 a 13 +z 12 a 12 +z 11 a 11 +z 10 a 10 +z 9 a9+z 8 a8+z 7 a7+z 6 a6+z 5 a5+z 4 a4+z 3 a3+z 2 a2+z31+a0。由于本轮循环 Therefore, the iteration of the polynomial coefficients is completed after the fourth loop.

[0106] According to Figure 2 The coefficients obtained by the last loop iteration in the embodiment shown in the figure construct the second polynomial a 16 X 16 +a 15 X 15 +…+a1X+a0. It should be noted that the coefficients in the second polynomial are the above-mentioned Figure 2 The coefficient values obtained after the fourth loop shown in the figure end.

[0107] Figure 3 The figure shows the processing of the second polynomial p(x) divided by the Vanishing polynomial v(x) in the embodiment of the present application. In the embodiment, it is assumed that N=32, K=16, and M=5. The finite field data processor responsible for the processing of the highest order coefficient is followed by the first finite field data processor, the second finite field data processor, the third finite field data processor, the fourth finite field data processor, the fifth finite field data processor, the sixth finite field data processor, the seventh finite field data processor, the eighth finite field data processor, the ninth finite field data processor, the tenth finite field data processor, the eleventh finite field data processor, the twelfth finite field data processor, the thirteenth finite field data processor, the fourteenth finite field data processor, the fifteenth finite field data processor, and the sixteenth finite field data processor. In the embodiment, it is assumed that the first finite field data processor is responsible for the processing of a group of three coefficients, and the other finite field data processors are responsible for the processing of a group of two coefficients, as shown in the figure. Figure 3 The calculation of the coefficients a 32 ~a 30 is assigned to the first finite field data processor, the calculation of the coefficients a 29 ~a 28 is assigned to the second finite field data processor, the calculation of the coefficients a 27 ~a 26 is assigned to the third finite field data processor, the calculation of the coefficients a 25 ~a 24 is assigned to the fourth finite field data processor, the calculation of the coefficients a 23 ~a 22 is assigned to the fifth finite field data processor, the calculation of the coefficients a 21 ~a 20 is assigned to the sixth finite field data processor, the calculation of the coefficients a 19 ~a 18 is assigned to the seventh finite field data processor, the calculation of the coefficients a 17 ~a 16The calculation of the coefficient a 15 ~a 14 The calculation of the coefficient a 13 ~a 12 The calculation of the coefficient a 11 ~a 10 The calculation of the coefficient a9~a8 is assigned to the twelfth finite field data processor, the calculation of the coefficient a7~a6 is assigned to the thirteenth finite field data processor, the calculation of the coefficient a5~a4 is assigned to the fourteenth finite field data processor, the calculation of the coefficient a3~a2 is assigned to the fifteenth finite field data processor, and the calculation of the coefficient a1~a0 is assigned to the sixteenth finite field data processor. Figure 3 In the embodiment shown in the figure, the initial values of the coefficients are arranged in order of the highest order as shown in the first row of the figure, i.e. a Figure 3 , a 32 , a 31 , a 30 , a 29 , a 28 , a 27 , a 26 , a 25 , a 24 , a 23 , a 22 , a 21 , a 20 , a 19 , a 18 , a 17 , a 16 , a 15 , a 14 , a 13 , a 12 , a 11 , a 10 , a9, a8, a7, a6, a5, a4, a3, a2, a1, a0, and each coefficient is iteratively calculated in the next round of calculation according to the result of the current round of calculation.

[0108] In the first loop, Q=0, and the coefficients that need to be calculated in the first loop start from i=N-Mx2 Q =32-5x2 0 =27, that is, the values of the coefficients a 32 ~a 28 in the current round of calculation are the initial values of the last round of calculation, and the coefficients a 27 ~a0 are calculated according to the iterative formula The iterative calculation of the first loop in the embodiment is as follows:

[0109]

[0110]

[0111] …

[0112]

[0113]

[0114] After the first cycle, the updated values ​​of the coefficients are as follows Figure 3 As shown in the second row, the order from the highest level is: a 32 、a 31 、a 30 、a 29 、a 28 、a 32 +a 27 、a 31 +a 26 、a 30 +a 25 、a 29 +a 24 、a 28 +a 23 、a 27 +a 22 、a 26 +a 21 、a 25 +a 20 、a 24 +a 19 、a 23 +a 18 、a 22 +a 17 、a 21 +a 16 、a 20 +a 15 、a 19 +a 14 、a 18 +a 13 、a 17 +a 12 、a 16 +a 11 、a 15 +a 10 、a 14 +a9、a 13 +a8、a 12 +a7、a 11 +a6、a 10 +a5, a9+a4, a8+a3, a7+a2, a6+a1, a5+a0. In the next round of calculation, each coefficient is iteratively calculated based on the calculation results of this round.

[0115] In the second cycle, Q = 1, and the coefficients to be calculated in the second cycle are i = NM × 2 Q =32-5×2 1 =22, that is, the coefficient a in this round of calculation 32 ~ coefficient a 23 The value of is the value of the previous round, that is, the result of the first round, and the coefficient a 22 ~ Coefficient a0 according to the iterative formula Calculation, the iterative calculation of the second cycle of this embodiment is as follows:

[0116]

[0117]

[0118] …

[0119]

[0120]

[0121] After the second cycle, the updated values ​​of the coefficients are as follows Figure 3 As shown in the third row, the order from the highest level is: a 32 、a 31 、a 30 、a 29 、a 28 、a 32 +a 27 、a 31 +a 26 、a 30 +a 25 、a 29 +a 24 、a 28 +a 23 、a 32 +a 27 +a 22 、a 31 +a 26 +a 21 、a 30 +a 25 +a 20 、a 29 +a 24 +a 19 、a 28 +a 23 +a 18 、a 32 +a 27 +a 22 +a 17 、a 31 +a 26+a 21 +a 16 、a 30 +a 25 +a 20 +a 15 、a 29 +a 24 +a 19 +a 14 、a 28 +a 23 +a 18 +a 13 、a 27 +a 22 +a 17 +a 12 、a 26 +a 21 +a 16 +a 11 、a 25 +a 20 +a 15 +a 10 、a 24 +a 19 +a 14 +a9、a 23 +a 18 +a 13 +a8、a 22 +a 17 +a 12 +a7、a 21 +a 16 +a 11 +a6、a 20 +a 15 +a 10 +a5、a 19 +a 14 +a9+a4、a 18 +a 13 +a8+a3、a 17 +a 12 +a7+a2、a 16 +a 11 +a6+a1、a 15 +a 10 +a5+a0, in the next round of calculation, each coefficient is iteratively calculated based on the calculation results of this round.

[0122] In the third cycle, Q = 2, and the coefficients to be calculated in the third cycle are i = NM × 2 Q =32-5×2 2 =12, that is, the coefficient a in this round of calculation 32 ~ coefficient a 13 The value of is the value of the previous round, that is, the result of the second round, and the coefficient a12 The coefficient a0is arranged according to the iterative formula The iterative calculation of the second cycle of the present embodiment is as follows:

[0123]

[0124]

[0125] …

[0126]

[0127]

[0128] After the third cycle, the values of the updated coefficients are as shown in the fourth row of Table 1, arranged in order from the highest order as follows: a Figure 3 32 , a 31 , a 30 , a 29 , a 28 , a 32 +a 27 , a 31 +a 26 , a 30 +a 25 , a 29 +a 24 , a 28 +a 23 , a 32 +a 27 +a 22 , a 31 +a 26 +a 21 , a 30 +a 25 +a 20 , a 29 +a 24 +a 19 , a 28 +a 23 +a 18 , a 32 +a 27 +a 22 +a 17 , a 31 +a 26 +a 21 +a 16 , a 30 +a 25 +a 20 +a 15 , a 29 +a 24 +a 19 +a 14 ​, a 28 + a 23 + a 18 + a 13 , a 32 + a 27 + a 22 + a 17 + a 12 , a 31 + a 26 + a 21 + a 16 + a 11 , a 30 + a 25 + a 20 + a 15 + a 10 , a 29 + a 24 + a 19 + a 14 + a9, a 28 + a 23 + a 18 + a 13 + a8, a 32 + a 27 + a 22 + a 17 + a 12 + a7, a 31 + a 26 + a 21 + a 16 + a 11 + a6, a 30 + a 25 + a 20 + a 15 + a 10 + a5, a 29 + a 24 + a 19 + a 14 + a9 + a4, a 28 + a 23 + a 18 + a 13 + a8 + a3, a 32 + a 27 + a 22 + a 17 + a 12 + a7 + a2, a 31 + a 26 + a 21 + a 16 + a 11 + a6 + a1, a 30 + a 25 + a 20 + a 15 + a10 +a5+a0. Since the next round of M×2 Q =5×2 3 =40>N=36, therefore, the iterative calculation of the polynomial coefficients is completed after the third cycle.

[0129] according to Figure 3 In the embodiment shown, the coefficients calculated in the last cycle are used to construct the quotient of the second polynomial. 32 X 27 +a 31 X 26 +…+a6X+a5, the remainder is a4X 4 +a3X 3 +a2X 2 +a1X+a0. It should be noted that the coefficients in the second polynomial are the above Figure 3 The coefficient values ​​obtained after the third cycle are shown.

[0130] It should be noted that there are other polynomials in the zero-knowledge proof protocol. Here, only the Witness polynomial and the Vanishing polynomial are used as examples for illustration, and are not used to limit the scope of protection of this application.

[0131] The embodiment of the present application also provides a polynomial processing device based on zero-knowledge proof, such as Figure 4 As shown, it includes: a controller, K finite field data processors, m memories, K ≥ 2, m ≥ 1; wherein,

[0132] The controller, K finite field data processors and m memories are connected to the bus;

[0133] A finite field data processor, configured to iteratively process coefficients of a group corresponding to itself according to a random number, a number of cycles, and an order of the first polynomial;

[0134] a memory, configured to store coefficients of a first polynomial and random numbers, and group the coefficients of the first polynomial according to the order of the first polynomial and a preset number of groups, wherein coefficients of different groups correspond to different finite field data processors;

[0135] The controller is used to control each finite field data processor to perform loop processing according to the number of loops and the order of the first polynomial; read the coefficients obtained by the iterative processing from each finite field data processor, and construct a second polynomial based on the multiple sets of coefficients read, where the second polynomial is the proof information provided by the prover to the verifier.

[0136] The polynomial processing device based on zero-knowledge proof provided in the embodiment of the present application divides the coefficients of the first polynomial into multiple groups, and uses an independent finite field data processor to process the coefficients of each group in parallel to calculate the coefficients used to construct the second polynomial, thereby quickly realizing the processing of the polynomial and greatly improving the calculation speed of the polynomial in the zero-knowledge proof, thereby accelerating the implementation of the zero-knowledge proof.

[0137] In an exemplary embodiment, the finite field data processor is used to implement addition and multiplication operations within a specific finite field GF(p). For example, assuming that a and b are two elements in the finite field GF(p), the finite field data processor can implement the calculation of (a+b) mod p and (a×b) mod p, where p is a positive integer, the order of the finite field, p is a prime number, and mod represents the remainder calculation.

[0138] In an exemplary embodiment, the second polynomial to be constructed is the Witness polynomial corresponding to p(x), namely Where z is a random number from the verifier, and K finite field data processors can be used to:

[0139] Using the coefficients of the first polynomial stored in the memory as initial values ​​for processing the coefficients;

[0140] The loop starts from Q=0, and the number of loops Q increases by one at the end of each loop until the next round of 2 Q > N ends the iterative calculation. In each loop, for i > N-2 Q The coefficient a i , coefficient a i The value calculated in the previous round (including the initial value or the previous cycle), for i≤N-2 Q The coefficient a i , coefficient a i Stored for the previous round With random numbers The product of , plus the a stored in the previous round i , the iterative formula is expressed as: The coefficients of different groups are processed in parallel by their corresponding finite field data processors respectively; the coefficients calculated by this loop iteration are stored in the memory.

[0141] Accordingly, constructing the second polynomial in the controller may include: constructing the second polynomial as a N X N +a N-1 X N-1 +…+a1X+a0, the coefficients in the second polynomial are the coefficient values ​​stored when the loop iterative calculation ends.

[0142] In an exemplary embodiment, the second polynomial to be constructed is the result of dividing p(x) by the Vanishing polynomial v(x), that is, Wherein, the random number z is 1, M is the order of a subgroup H, M is predetermined, and K finite field data processors can be used for:

[0143] Using the coefficients of the first polynomial stored in the memory as initial values ​​for processing the coefficients;

[0144] The loop starts from Q=0, and the number of loops Q increases by one at the end of each loop until the next round of M×2 Q >N ends the iterative calculation. In each cycle, for i>NM×2 Q The coefficient a i , coefficient a i The value calculated for the previous round (including the initial value or the previous cycle), for i≤NM×2 Q The coefficient a i , coefficient a i Stored for the previous round Add the a stored in the previous round i , the iterative formula is expressed as: The coefficients of different groups are processed in parallel by their corresponding finite field data processors respectively; the coefficients calculated by this loop iteration are stored in the memory.

[0145] Accordingly, constructing the second polynomial in the controller may include: the quotient of the constructed second polynomial is a N X N-M +a N-1 X N-M-1 +…+a M+1 X+a M , the remainder is a M-1 X M-1 +a M-2 X M-2 +…+a1X+a0, the coefficients in the second polynomial are the coefficient values ​​stored when the loop iterative calculation ends.

[0146] It can be seen from this embodiment that the calculation of each set of coefficients is processed in parallel by each finite field data processor in each loop calculation. The polynomial processing device based on zero-knowledge proof provided by the embodiment of the present application quickly realizes the processing of polynomials, and improves the calculation efficiency to log2 K, where K is the number of finite field data calculators used for finite field data calculation, which greatly improves the speed of polynomial calculation in zero-knowledge proof.

[0147] Although the present application has been described with reference to the above embodiments, the contents described are merely employed embodiments for facilitating the understanding of the present application, and are not intended to limit the present application. Any modification and change in the form and details can be made by any person skilled in the art without departing from the spirit and scope of the present application, and the patent protection scope of the present application shall be subject to the scope defined by the appended claims.

Claims

1. A zero-knowledge proof based polynomial processing method, comprising: a proving party obtaining coefficients of a first polynomial and a random number from a verifying party and storing; grouping the coefficients of the first polynomial according to an order of the first polynomial and a preset number of groups and storing; for each group of coefficients, iteratively processing the respective group of coefficients according to the random number, a number of iterations and the order of the first polynomial; constructing a second polynomial according to the iteratively processed coefficients, the second polynomial being proof information provided by the proving party to the verifying party.

2. The polynomial processing method of claim 1, wherein, the preset number of groups comprises two or more groups; coefficients of different groups are iteratively processed in parallel by different processors.

3. The polynomial processing method of claim 1 or 2, wherein, the iteratively processing the respective group of coefficients comprises: using the coefficients of the first polynomial as initial values for the iterative processing; The cycle starts from Q=0, and Q increases by 1 at the end of each cycle until the next round of 2 Q > N ends the iterative calculation; in each cycle, for i > N-2 Q The coefficient a i , coefficient a i is the value calculated in the previous round, for i≤N-2 Q The coefficient a i , coefficient a i Stored for the previous round With the random number 2 Q The second power is The product of , plus the a stored in the previous round i , the iterative formula is expressed as: Store the coefficients calculated in this loop iteration; wherein Q is the number of cycles; z is the random number; the first polynomial is expressed as wherein x is a variable of the first polynomial p(x), N is the order of the first polynomial; a i is a coefficient of the first polynomial, 0≤i≤N, a i is an element in a finite field GF(p).

4. The polynomial processing method of claim 3, wherein, the constructing the second polynomial according to the iteratively processed coefficients comprises: The second polynomial is: a N X N +a N-1 X N-1 +…+a1X+a0, each coefficient in the second polynomial being the value of the coefficient stored at the time the loop iteration calculation is terminated.

5. The polynomial processing method of claim 1 or 2, wherein, the iteratively processing the respective group of coefficients comprises: using the coefficients of the first polynomial as initial values for the iterative processing; The loop starts from Q = 0, and Q is incremented by one at the end of each loop until M x 2 in the next round Q The iteration calculation ends at N; in each loop, for i > N - M x 2 Q coefficient a i , coefficient a i is the value obtained in the last round of calculation, for i ≤ N - M x 2 Q coefficient a i , coefficient a i is the value stored in the last round plus a i stored in the last round, and the iteration formula is represented as: Store the coefficient obtained by the iteration calculation in this loop; wherein Q is the number of cycles; z is the random number, z = 1; M is the order of a certain subgroup H; the first polynomial is expressed as wherein x is the variable of the first polynomial p(x), N is the order of the first polynomial; a i is the coefficient of the first polynomial, 0≤i≤N, a i is an element in the finite field GF(p).

6. The polynomial processing method of claim 4, wherein, the constructing the second polynomial according to the iteratively processed coefficients comprises: the quotient of the second polynomial is a N X N-M +a N-1 X N-M-1 +…+a M+1 X+a M , and the remainder is a M-1 X M-1 +a M-2 X M-2 +…+a1X+a0, each coefficient in the second polynomial being the value of the coefficient stored at the time the loop iteration calculation is terminated.

7. A zero-knowledge proof based multi-polynomial processing apparatus comprising: a controller, K finite field data processors and m memories, K≥2, m≥1; wherein, the controller, the K finite field data processors and the m memories are connected to a bus; the finite field data processors are configured to iteratively process coefficients of a group corresponding to the finite field data processors according to a random number, a number of iterations and an order of a first polynomial; the memories are configured to store the coefficients of the first polynomial and the random number, and store the coefficients of the first polynomial grouped according to an order of the first polynomial and a preset number of groups, different groups of coefficients corresponding to different finite field data processors; the controller is configured to control each of the finite field data processors to iteratively process according to the number of iterations and the order of the first polynomial, read the iteratively processed coefficients from each of the finite field data processors, and construct a second polynomial according to the read groups of coefficients, the second polynomial being proof information provided by a proving party to a verifying party.

8. The polynomial processing device of claim 7, wherein, the K finite field data processors are configured to: use the coefficients of the first polynomial as initial values for the iterative processing; Q = 0 Q > N end the iterative computation; in each of the loops, for i > N - 2 Q the coefficient a i , the coefficient a i is the value obtained in the previous round of computation, for i ≤ N - 2 Q the coefficient a i , the coefficient a i is the value stored in the previous round the product of the random number and the 2 Q power of the random number, i.e. , plus the value of a i stored in the previous round, the iterative formula is: store the coefficient obtained in the current round of iterative computation; where Q is the number of cycles; z is the random number; the first polynomial is expressed as where x is the variable of the first polynomial p(x), N is the order of the first polynomial; a i is the coefficient of the first polynomial, 0≤i≤N, a i is an element in the finite field GF(p).

9. The polynomial processing device of claim 8, wherein, the controller is configured to: The second polynomial is: a N X N +a N-1 X N-1 +…+a1X+a0, each coefficient in the second polynomial being the value of the coefficient stored at the time the loop iteration calculation is terminated.

10. The polynomial processing device of claim 7, wherein, the K finite field data processors are configured to: use the coefficients of the first polynomial as initial values for the iterative processing; The loop is started from Q = 0, and Q is increased by one at the end of each loop until M x 2 in the next round Q The iteration calculation is ended for N; in each loop, for i > N - M x 2 Q coefficient a i , coefficient a i is the value obtained in the last round calculation, for i ≤ N - M x 2 Q coefficient a i , coefficient a i is the value stored in the last round plus a i stored in the last round, and the iteration formula is represented as: The coefficient obtained in the iteration calculation of this round is stored; wherein Q is the number of cycles; z is the random number, z = 1; M is the order of a certain subgroup H; the first polynomial is expressed as wherein x is the variable of the first polynomial p(x), N is the order of the first polynomial; a i is the coefficient of the first polynomial, 0≤i≤N, a i is an element in the finite field GF(p).

11. The polynomial processing device of claim 10, wherein, the controller is configured to: the quotient of the second polynomial is a N X N-M +a N-1 X N-M-1 +…+a M+1 X+a M , and the remainder is a M-1 X M-1 +a M-2 X M-2 +…+a1X+a0, each coefficient in the second polynomial being the value of the coefficient stored at the time the loop iteration calculation is terminated. 12.A computer readable storage medium storing computer executable instructions for performing the zero-knowledge proof based polynomial processing method of any one of claims 1-6.

13. A computer device comprising a memory and a processor, wherein, a memory storing instructions executable by a processor for performing the steps of the zero-knowledge proof based polynomial processing method of any one of claims 1-6.

Images