Zero-knowledge proof method, device, storage medium, and electronic device

Abstract

The present invention discloses a method, apparatus, storage medium, and electronic device for zero-knowledge proof. The method comprises: inputting intermediate variables and the values ​​of the intermediate variables of a transaction into a first circuit, outputting a first transaction lookup table and a proof of the correctness of the first transaction lookup table; inputting the transaction content and the Merkle tree root of the transaction into a second circuit, outputting a second transaction lookup table and a proof of the correctness of the second transaction lookup table from the second circuit; inputting the bytecode of the transaction into a third circuit, outputting a bytecode table, a bytecode message digest, and a proof that the bytecode table and the bytecode hash are consistent from the third circuit; inputting the operation code of the transaction into a fourth circuit, outputting a proof that the operation code is correctly executed from the fourth circuit; inputting the proofs output by the first, second, third, and fourth circuits into a fifth circuit, outputting an aggregated proof from the fifth circuit. The present invention solves the technical problem that zero-knowledge proof methods do not have Turing completeness.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method, device, storage medium, and electronic device for zero-knowledge proof. Background Art

[0002] Zero-knowledge proofs (ZKPs) are a technique in which a prover can convince a verifier of the correctness of a claim without providing any useful information. Common algorithms include Groth16, PLONK, and Halo2. In blockchains, ZKPs can be used for privacy protection and capacity scalability. For example, transactions and computations can be performed off-chain, and proofs generated and uploaded to the blockchain. On-chain verification of the ZKPs is sufficient, reducing computational burden on the blockchain. Currently, ZKPs rely primarily on converting the problem to be proved into an arithmetic circuit and then proving knowledge of the values ​​of the variables in the circuit. However, converting general problems into arithmetic circuits for ZKPs is difficult. The traditional approach involves defining a new high-level language and describing the problem in that language. A compiler, such as Circom, automatically converts the high-level language into arithmetic circuits. Each different logic to be proved requires rewriting the code and then compiling it to produce the circuit. This approach typically requires several steps: 1. compilation 2. computation 3. proof 4. verification. However, these high-level languages ​​cannot describe some problems, meaning they lack Turing completeness. Summary of the Invention

[0003] Embodiments of the present invention provide a method, apparatus, storage medium, and electronic device for zero-knowledge proof, to at least solve the technical problem that the zero-knowledge proof method does not have Turing completeness.

[0004] According to one aspect of an embodiment of the present invention, a method for zero-knowledge proof is provided, comprising: in the case of executing a transaction, inputting intermediate variables of the transaction and the values ​​of the intermediate variables into a first circuit, and the first circuit outputting a first transaction lookup table and a proof of correctness of the first transaction lookup table; inputting the transaction content of the transaction and the Merkle tree root consisting of the transaction into a second circuit, and the second circuit outputting a second transaction lookup table and a proof of correctness of the second transaction lookup table; inputting the bytecode of the transaction into a third circuit, and the third circuit outputting a bytecode table, a bytecode message digest, and a proof that the bytecode table and the bytecode hash are consistent; inputting the operation code of the transaction into a fourth circuit, and the fourth circuit outputting a proof that the operation code is correctly executed; and inputting the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into a fifth circuit, and the fifth circuit outputting an aggregated proof.

[0005] According to another aspect of an embodiment of the present invention, a zero-knowledge proof device is provided, comprising: a first processing module for inputting, when executing a transaction, intermediate variables of the transaction and the values ​​of the intermediate variables into a first circuit, and the first circuit outputting a first transaction lookup table and a proof of correctness of the first transaction lookup table; a second processing module for inputting, when executing a transaction, the transaction content and the Merkle tree root of the transaction into a second circuit, and the second circuit outputting a second transaction lookup table and a proof of correctness of the second transaction lookup table; a third processing module for inputting, when executing a transaction, the bytecode of the transaction into a third circuit, and the third circuit outputting a proof of consistency between the bytecode table and the bytecode hash; a fourth processing module for inputting, when executing an operation code of the transaction into a fourth circuit, and the fourth circuit outputting a proof of correct execution of the operation code; a fifth processing module for inputting, when executing the first, second, third and fourth circuits, proofs outputted by the first, second, third and fourth circuits into a fifth circuit, and the fifth circuit outputting an aggregated proof.

[0006] As an optional example, the above-mentioned fifth processing module includes: a first verification unit, used to verify by the above-mentioned fifth circuit the output of the i-th step and the input of the i+1-th step in the input proof, wherein the output of the above-mentioned i-th step is equal to the input of the above-mentioned i+1-th step, and the above-mentioned i is the number of steps in the input proof - 1; a second verification unit, used to verify by the above-mentioned fifth circuit whether the instruction corresponding to the i-th step in the input proof satisfies the bytecode table.

[0007] As an optional example, the apparatus further includes: an operating module configured to operate the first circuit, the second circuit, the third circuit, the fourth circuit, and the fifth circuit via a virtual machine.

[0008] As an optional example, the above-mentioned running module includes: a control unit, used to control the counter to add 1; an operation unit, used to operate the top element of the stack of the above-mentioned virtual machine according to the meaning of the above-mentioned bytecode when the above-mentioned counter does not point to the last bytecode.

[0009] As an optional example, the operation unit includes: an operation sub-unit, which performs any one of the following operations on the top element of the stack: algebraic operation, push operation, pop operation, load operation from storage area and write operation into storage area.

[0010] As an optional example, the above-mentioned device also includes: a predefinition module, which is used to predefine an auxiliary circuit before inputting the intermediate variables of the above-mentioned transaction and the values ​​of the above-mentioned intermediate variables into the first circuit, wherein the above-mentioned auxiliary circuit is a circuit after abstracting the algorithm into a custom gate circuit and generating a lookup table for the above-mentioned custom gate circuit.

[0011] As an optional example, the above-mentioned device also includes: a verification module, which is used to input the certificates output by the above-mentioned first circuit, second circuit, third circuit and fourth circuit into the fifth circuit, and after the above-mentioned fifth circuit outputs the aggregated certificate, input the above-mentioned aggregated certificate and the initial state and final state of the account that executes a transaction as input into the verification circuit; when the above-mentioned verification circuit verifies that the above-mentioned aggregated certificate is correct, it is determined that the above-mentioned transaction executed is valid.

[0012] According to another aspect of an embodiment of the present invention, a storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the zero-knowledge proof method is executed.

[0013] According to another aspect of an embodiment of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned zero-knowledge proof method through the computer program.

[0014] In an embodiment of the present invention, when executing a transaction, intermediate variables and their values ​​are input into a first circuit, which outputs a first transaction lookup table and a proof of the correctness of the first transaction lookup table; the transaction content and the Merkle tree root of the transaction are input into a second circuit, which outputs a second transaction lookup table and a proof of the correctness of the second transaction lookup table; the bytecode of the transaction is input into a third circuit, which outputs a bytecode table, a bytecode message digest, and a proof of consistency between the bytecode table and the bytecode hash; the operation code of the transaction is input into a fourth circuit, which outputs a proof of correct execution of the operation code; and the proofs output by the first, second, third, and fourth circuits are input into a fifth circuit, which outputs an aggregated proof. Because the proof process is decomposed into a series of outsourced circuits, and the final proof is obtained through lookup table technology and recursive proof technology, this method achieves the goal of converting the correctness proof of any program into the correctness proof of a general-purpose virtual machine, achieving universality and addressing the technical problem that zero-knowledge proof methods lack Turing completeness. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0016] Figure 1is a flowchart of an optional zero-knowledge proof method according to an embodiment of the present invention;

[0017] Figure 2 is a schematic structural diagram of an optional zero-knowledge proof device according to an embodiment of the present invention;

[0018] Figure 3 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0020] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0021] According to a first aspect of an embodiment of the present invention, a method for zero-knowledge proof is provided, optionally, as follows: Figure 1 As shown, the above method includes:

[0022] S102, when executing a transaction, inputting the intermediate variables of the transaction and the values ​​of the intermediate variables into the first circuit, and the first circuit outputting a first transaction lookup table and a proof of correctness of the first transaction lookup table;

[0023] S104: Input the transaction content and the Merkle tree root of the transaction into the second circuit, and the second circuit outputs a second transaction lookup table and a proof of correctness of the second transaction lookup table;

[0024] S106, inputting the transaction bytecode into the third circuit, which outputs a bytecode table, a bytecode message digest, and a certificate of consistency between the bytecode table and the bytecode hash;

[0025] S108, inputting the transaction operation code into the fourth circuit, and the fourth circuit outputting proof that the operation code was correctly executed;

[0026] S110: Input the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into the fifth circuit, and the fifth circuit outputs an aggregated proof.

[0027] Optionally, in this embodiment, the first circuit can be a predefined storage access circuit, the second circuit can be a predefined transaction circuit, the third circuit can be a predefined bytecode circuit, the fourth circuit can be a predefined series of opcode circuits, and the fifth circuit can be an aggregation circuit. Lookup table technology, zk-lookup technology, or similar technologies use lookup tables to describe custom gate logic. By proving that the calculated (input, output) pair is in the lookup table, it is proved that the input and output satisfy a certain logic. Bytecode is a binary file containing an executable program and composed of a sequence of opcode / data pairs. It is an intermediate code. Circuits are arithmetic circuits obtained by converting the original problem to prove the calculation process using a zero-knowledge proof algorithm.

[0028] Optionally, in this embodiment, it includes an aggregate circuit (main circuit) and a series of outsourced circuits. The outsourced circuits are used to generate lookup tables and prove the correctness of the lookup tables. The main circuit uses these lookup tables through lookup table technology and custom gate technology to complete the proof.

[0029] 1. A predefined storage access circuit (circuit_storage) that accepts execution intermediate variables and values ​​as input and outputs the first transaction lookup table and correctness proof.

[0030] 2. A predefined transaction circuit (circuit_tx) accepts the transaction content and the Merkle root of the transaction as input, and outputs a second transaction lookup table and a proof that the second transaction lookup table generated the correct result. The second transaction lookup table can be used to query the field information in the transaction.

[0031] 3. A predefined bytecode circuit (circuit_bytecode) accepts a complete bytecode as input and outputs a bytecode table ({op1, op2...opn}), a bytecode message digest (digest_bytecod), and a proof that the bytecode table and the bytecode hash are consistent: hash(op1, op2...opn) = digest_bytecod.

[0032] 4. Predefine a series of opcode circuits (circuit_op_add, circuit_op_mul, etc.) to prove the correctness of the opcode execution. An opcode circuit is a series of circuits that are specific to the virtual machine's instruction set. For example, if the EVM (the virtual machine used by the Ethereum platform to execute smart contracts) contains 142 instructions, there should be 142 corresponding circuits. For each opcode, a corresponding circuit is used to prove the correctness of the opcode execution. For example, for an addition operation, two inputs (in1, in2) and one output (out) are required, and the circuit generates a zero-knowledge proof (out = in1 + in2). Proving the correctness of other opcodes is similar.

[0033] 5. The aggregation circuit takes the proof output by the outsourced circuit as input, outputs an aggregated proof, and proves the correctness of the aggregation process.

[0034] 6. Other auxiliary predefined circuits are used to accelerate the efficiency of proof. For example, the Keccak256 algorithm is abstracted into a custom gate to pre-generate a lookup table for it, thereby accelerating the proof speed of the hash algorithm through the lookup table technology in the future.

[0035] Optionally, in this embodiment, the algorithm is as follows (described in C language):

[0036]

[0037]

[0038] The program involves variables a, b, and i. These variables may come from external input or read from the user's account. Assume that a and b are read from the user's account. It also involves some registers, such as PC, Counter, and NegFlag. The memory (Mem) distribution after loading these variables is assumed to be as follows:

[0039] a b other i Counter NegFlag PC Null Null Null

[0040] Assume that the user's account status is as follows

[0041] a b other

[0042] The compiled bytecode (also the input code) is as follows:

[0043] 0 CMP i,a ia, the result is counted into NegFlag 1 JG 5 If NegFlag is not a negative number, jump to PC=5 2 ADD i,1 i increments 3 ADD b,a b=b+a 4 JMP 0 Unconditional jump PC = 0 5 STOP termination

[0044] The bytecode circuit accepts Code as input, computes the message digest hash(Code), and uses the output table as a subsequent lookup table, Table_Code, where the key is the first column and the values ​​are the bytecode and operands (the second column). The circuit outputs a zero-knowledge proof, proof1, which proves the correctness of the hash(Code) computation and the correctness of the Table_Code generation.

[0045] The transaction circuit accepts the user account state, the user account state Merkle root root root_account, and the initial value of the memory Mem Mem_init as input, calculates the initial Merkle root root root_mem of the memory, and generates proof2 that the corresponding value in the initial memory state Mem_i nit is equal to the corresponding value in the user account state (that is, a, b, other are correctly loaded, where other is the part of the user account that is irrelevant to this proof).

[0046] Traverse the bytecode from 0 to 5 in sequence and calculate the corresponding bytecode circuit to obtain the corresponding proof3 to proof8, which is used to prove that the corresponding instructions are executed correctly. Take instructions 0, 1, and 2 as an example:

[0047] The input is the current value of Mem Mem_0 and the corresponding Merkle tree root Mem_0_root, and the output is the new value of Mem Mem_0' and Mem_0_root', proving that NegFlag_0'=i_0'-a_0' and Mem_0_root' are calculated correctly.

[0048] The input is the current value of Mem Mem_1 and the corresponding Merkle tree root Mem_1_root, and the output is the new value of Mem Mem_1' and Mem_1_root', which proves that PC is correctly assigned and Mem_1_root' is calculated correctly.

[0049] The input is the current value of Mem Mem_2 and the corresponding Merkle tree root Mem_2_root, and the output is the new value of Mem Mem_2' and Mem_2_root', proving that i_2'=i_2+1 and Mem_2_root' is calculated correctly.

[0050] The aggregation circuit verifies that all the (PC, bytecode) pairs constructed from the input and output in the above steps exist in Table_Code, verifies the correctness of the above eight proofs, verifies that the starting Mem_{i+1}_root of the next step is consistent with the ending Mem_i_root of the previous step (thus proving memory consistency), and outputs proof_fina l, a proof of correctness of the verification process. The input of this step includes the previous proof and the input and output.

[0051] The verifier uses proof_final and the initial and final states of the initial account as input to verify the correctness of proof_final. If correct, the verifier accepts the final state as a valid execution result.

[0052] Optionally, in this embodiment, the proof process is decomposed into a series of outsourced circuits, and the final proof is obtained through lookup table technology and recursive proof technology, thereby realizing the conversion of the correctness proof of any program into the correctness proof of a general virtual machine, with the purpose of universality, and further solving the technical problem that the zero-knowledge proof method does not have Turing completeness.

[0053] As an optional example, the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit are input into the fifth circuit, and the aggregated proof output by the fifth circuit includes:

[0054] The fifth circuit verifies the output of the i-th step and the input of the i+1-th step in the proof of the input, where the output of the i-th step is equal to the input of the i+1-th step, and i is the number of steps in the proof of the input - 1.

[0055] The fifth circuit verifies whether the instruction corresponding to the i-th step in the input proof satisfies the bytecode table.

[0056] Optionally, in this embodiment, the aggregation circuit needs to prove that the input of the previous instruction is consistent with the output of the previous instruction. For example, if the result of the calculation of the top element of the stack in step i is top_i_out, then the input of step i+1, top_{i+1}_in, should also be the same value. That is, top_{i+1}_in = top_i_out. The i-th instruction satisfies the bytecode table, that is, the i-th row of the bytecode table contains the current instruction.

[0057] As an optional example, the above method further includes:

[0058] The first circuit, the second circuit, the third circuit, the fourth circuit, and the fifth circuit are executed by the virtual machine.

[0059] Optionally, in this embodiment, the first circuit, the second circuit, the third circuit, the fourth circuit and the fifth circuit are run through a virtual machine, and the virtual machine includes a stack, an addressable local storage area, an addressable global storage area, a bytecode storage area with a sequence number, and a PC counter.

[0060] As an optional example, the virtual machine running the first circuit, the second circuit, the third circuit, the fourth circuit, and the fifth circuit includes:

[0061] Control counter plus 1;

[0062] When the counter does not point to the last bytecode, the top element of the virtual machine stack is operated according to the meaning of the bytecode.

[0063] Optionally, in this embodiment, the virtual machine operates as follows:

[0064] 1. The PC counter is incremented by 1, and the PC value corresponding to the unknown bytecode is taken out;

[0065] 2. Operate the top element of the stack according to the meaning of the bytecode, such as algebraic operations, stacking and popping, loading from and writing to storage areas, etc.

[0066] 3. Determine whether PC points to the last bytecode. If so, complete the pointing; otherwise, execute step 1.

[0067] As an optional example, when the counter does not point to the last bytecode, operating the top element of the stack of the virtual machine according to the meaning of the bytecode includes:

[0068] Perform any of the following operations on the top element of the stack: algebraic operation, push operation, pop operation, load from storage area operation and write to storage area operation.

[0069] Optionally, in this embodiment, one of a variety of operations may be performed on the top element of the stack, such as algebraic operations, stacking and popping, loading from a storage area and writing to a storage area, and the like.

[0070] As an optional example, before inputting the intermediate variable of the transaction and the value of the intermediate variable into the first circuit, the method further includes:

[0071] A predefined auxiliary circuit, wherein the auxiliary circuit is a circuit obtained by abstracting the algorithm into a custom gate circuit and generating a lookup table for the custom gate circuit.

[0072] Optionally, the auxiliary circuit in this embodiment is used to accelerate the efficiency of proof, for example, abstracting the Keccak256 algorithm into a custom gate to pre-generate a lookup table for it, thereby subsequently accelerating the proof speed of the hash algorithm through the lookup table technology.

[0073] As an optional example, after inputting the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into the fifth circuit, and the fifth circuit outputting an aggregated proof, the method further includes:

[0074] The aggregated proof and the initial and final states of the account that executed the transaction are fed into the verification circuit.

[0075] When the verification circuit verifies that the aggregated proof is correct, it is determined that the executed transaction is valid.

[0076] In this embodiment, the verifier uses the aggregated proof and the initial and final states of the initial account as input to verify the correctness of the aggregated proof, and if correct, accepts the final state as a valid execution result.

[0077] Optionally, the present application relates to a method for zero-knowledge proof, which decomposes the proof process into an aggregate circuit (main circuit) and a series of outsourced circuits, and obtains the final proof through lookup table technology and recursive proof technology. It can achieve Turing completeness, that is, any program that can be executed by a Turing machine can be proved by this solution, avoiding the need to write a dedicated circuit for each program. It can be processed uniformly by a virtual machine and can prove the correctness of the execution process, specifically including: proving the correctness of the execution of each instruction; proving the correctness of bytecode loading; proving memory consistency, also known as state proof.

[0078] It should be noted that for the aforementioned method embodiments, for simplicity of description, they are all expressed as a series of action combinations. However, those skilled in the art should be aware that the present invention is not limited by the order of the actions described, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0079] According to another aspect of the embodiment of the present application, a zero-knowledge proof device is also provided. Figure 2 Shown, including:

[0080] A first processing module 202 is configured to, when executing a transaction, input intermediate variables and their values ​​into a first circuit, and have the first circuit output a first transaction lookup table and a proof of correctness of the first transaction lookup table;

[0081] A second processing module 204 is configured to input the transaction content and the Merkle tree root of the transaction into a second circuit, and the second circuit outputs a second transaction lookup table and a proof of correctness of the second transaction lookup table;

[0082] A third processing module 206 is configured to input the transaction bytecode into a third circuit, which outputs a bytecode table, a bytecode message digest, and a certificate of consistency between the bytecode table and the bytecode hash;

[0083] A fourth processing module 208 is configured to input the transaction operation code into a fourth circuit, and the fourth circuit outputs proof that the operation code is correctly executed;

[0084] The fifth processing module 210 is configured to input the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into the fifth circuit, and the fifth circuit outputs an aggregated proof.

[0085] Optionally, in this embodiment, the first circuit can be a predefined storage access circuit, the second circuit can be a predefined transaction circuit, the third circuit can be a predefined bytecode circuit, the fourth circuit can be a predefined series of opcode circuits, and the fifth circuit can be an aggregation circuit. Lookup table technology, zk-lookup technology, or similar technologies use lookup tables to describe custom gate logic. By proving that the calculated (input, output) pair is in the lookup table, it is proved that the input and output satisfy a certain logic. Bytecode is a binary file containing an executable program and composed of a sequence of opcode / data pairs. It is an intermediate code. Circuits are arithmetic circuits obtained by converting the original problem to prove the calculation process using a zero-knowledge proof algorithm.

[0086] Optionally, in this embodiment, it includes an aggregate circuit (main circuit) and a series of outsourced circuits. The outsourced circuits are used to generate lookup tables and prove the correctness of the lookup tables. The main circuit uses these lookup tables through lookup table technology and custom gate technology to complete the proof.

[0087] 1. A predefined storage access circuit (circuit_storage) that accepts execution intermediate variables and values ​​as input and outputs the first transaction lookup table and correctness proof.

[0088] 2. A predefined transaction circuit (circuit_tx) accepts the transaction content and the Merkle root of the transaction as input, and outputs a second transaction lookup table and a proof that the second transaction lookup table generated the correct result. The second transaction lookup table can be used to query the field information in the transaction.

[0089] 3. A predefined bytecode circuit (circuit_bytecode) accepts a complete bytecode as input and outputs a bytecode table ({op1, op2...opn}), a bytecode message digest (digest_bytecod), and a proof that the bytecode table and the bytecode hash are consistent: hash(op1, op2...opn) = digest_bytecod.

[0090] 4. Predefine a series of opcode circuits (circuit_op_add, circuit_op_mul, etc.) to prove the correctness of the opcode execution. An opcode circuit is a series of circuits that are specific to the virtual machine's instruction set. For example, if the EVM (the virtual machine used by the Ethereum platform to execute smart contracts) contains 142 instructions, there should be 142 corresponding circuits. For each opcode, a corresponding circuit is used to prove the correctness of the opcode execution. For example, for an addition operation, two inputs (in1, in2) and one output (out) are required, and the circuit generates a zero-knowledge proof (out = in1 + in2). Proving the correctness of other opcodes is similar.

[0091] 5. The aggregation circuit takes the proof output by the outsourced circuit as input, outputs an aggregated proof, and proves the correctness of the aggregation process.

[0092] 6. Other auxiliary predefined circuits are used to accelerate the efficiency of proof. For example, the Keccak256 algorithm is abstracted into a custom gate to pre-generate a lookup table for it, thereby accelerating the proof speed of the hash algorithm through the lookup table technology in the future.

[0093] Optionally, in this embodiment, the algorithm is as follows (described in C language):

[0094]

[0095] The program involves variables a, b, and i. These variables may come from external input or read from the user's account. Assume that a and b are read from the user's account. It also involves some registers, such as PC, Counter, and NegFlag. The memory (Mem) distribution after loading these variables is assumed to be as follows:

[0096] a b other i Counter NegFlag PC Null Null Null

[0097] Assume that the user's account status is as follows

[0098] a b other

[0099] The compiled bytecode (also the input code) is as follows:

[0100]

[0101]

[0102] The bytecode circuit accepts Code as input, computes the message digest hash(Code), and uses the output table as a subsequent lookup table, Table_Code, where the key is the first column and the values ​​are the bytecode and operands (the second column). The circuit outputs a zero-knowledge proof, proof1, which proves the correctness of the hash(Code) computation and the correctness of the Table_Code generation.

[0103] The transaction circuit accepts the user account state, the user account state Merkle root root root_account, and the initial value of the memory Mem Mem_init as input, calculates the initial Merkle root root root_mem of the memory, and generates proof2 that the corresponding value in the initial memory state Mem_i nit is equal to the corresponding value in the user account state (that is, a, b, other are correctly loaded, where other is the part of the user account that is irrelevant to this proof).

[0104] Traverse the bytecode from 0 to 5 in sequence and calculate the corresponding bytecode circuit to obtain the corresponding proof3 to proof8, which is used to prove that the corresponding instructions are executed correctly. Take instructions 0, 1, and 2 as an example:

[0105] The input is the current value of Mem Mem_0 and the corresponding Merkle tree root Mem_0_root, and the output is the new value of Mem Mem_0' and Mem_0_root', proving that NegFlag_0'=i_0'-a_0' and Mem_0_root' are calculated correctly.

[0106] The input is the current value of Mem Mem_1 and the corresponding Merkle tree root Mem_1_root, and the output is the new value of Mem Mem_1' and Mem_1_root', which proves that PC is correctly assigned and Mem_1_root' is calculated correctly.

[0107] The input is the current value of Mem Mem_2 and the corresponding Merkle tree root Mem_2_root, and the output is the new value of Mem Mem_2' and Mem_2_root', proving that i_2'=i_2+1 and Mem_2_root' is calculated correctly.

[0108] The aggregation circuit verifies that all the (PC, bytecode) pairs constructed from the input and output in the above steps exist in Table_Code, verifies the correctness of the above eight proofs, verifies that the starting Mem_{i+1}_root of the next step is consistent with the ending Mem_i_root of the previous step (thus proving memory consistency), and outputs proof_fina l, a proof of correctness of the verification process. The input of this step includes the previous proof and the input and output.

[0109] The verifier uses proof_final and the initial and final states of the initial account as input to verify the correctness of proof_final. If correct, the verifier accepts the final state as a valid execution result.

[0110] Optionally, in this embodiment, the proof process is decomposed into a series of outsourced circuits, and the final proof is obtained through lookup table technology and recursive proof technology, thereby realizing the conversion of the correctness proof of any program into the correctness proof of a general virtual machine, with the purpose of universality, and further solving the technical problem that the zero-knowledge proof method does not have Turing completeness.

[0111] As an optional example, the fifth processing module includes:

[0112] a first verification unit configured to verify, by a fifth circuit, an output of an i-th step and an input of an i+1-th step in the input proof, wherein the output of the i-th step is equal to the input of the i+1-th step, and i is the number of steps in the input proof minus 1;

[0113] The second verification unit is configured to verify, by a fifth circuit, whether the instruction corresponding to the i-th step in the input proof satisfies the bytecode table.

[0114] Optionally, in this embodiment, the aggregation circuit needs to prove that the input of the previous instruction is consistent with the output of the previous instruction. For example, if the result of the calculation of the top element of the stack in step i is top_i_out, then the input of step i+1, top_{i+1}_in, should also be the same value. That is, top_{i+1}_in = top_i_out. The i-th instruction satisfies the bytecode table, that is, the i-th row of the bytecode table contains the current instruction.

[0115] As an optional example, the above device further includes:

[0116] The running module is configured to run the first circuit, the second circuit, the third circuit, the fourth circuit, and the fifth circuit by the virtual machine.

[0117] Optionally, in this embodiment, the first circuit, the second circuit, the third circuit, the fourth circuit and the fifth circuit are run through a virtual machine, and the virtual machine includes a stack, an addressable local storage area, an addressable global storage area, a bytecode storage area with a sequence number, and a PC counter.

[0118] As an optional example, the running module includes:

[0119] The control unit is used to control the counter to add 1; the operation unit is used to operate the top element of the virtual machine stack according to the meaning of the bytecode when the counter does not point to the last bytecode.

[0120] Optionally, in this embodiment, the virtual machine operates as follows:

[0121] 1. The PC counter is incremented by 1, and the PC value corresponding to the unknown bytecode is taken out;

[0122] 2. Operate the top element of the stack according to the meaning of the bytecode, such as algebraic operations, stacking and popping, loading from and writing to storage areas, etc.

[0123] 3. Determine whether PC points to the last bytecode. If so, complete the pointing; otherwise, execute the next step.

[0124] As an optional example, the operation unit includes: an operation sub-unit, which performs any one of the following operations on the top element of the stack: algebraic operation, push operation, pop operation, load operation from storage area and write operation into storage area.

[0125] Perform any of the following operations on the top element of the stack: algebraic operation, push operation, pop operation, load from storage area operation and write to storage area operation.

[0126] Optionally, in this embodiment, one of a variety of operations may be performed on the top element of the stack, such as algebraic operations, stacking and popping, loading from a storage area and writing to a storage area, and the like.

[0127] As an optional example, the above device further includes:

[0128] The predefined module is used to predefine an auxiliary circuit before inputting the intermediate variables of the above-mentioned transaction and the values ​​of the above-mentioned intermediate variables into the first circuit, wherein the above-mentioned auxiliary circuit is a circuit after abstracting the algorithm into a custom gate circuit and generating a lookup table for the above-mentioned custom gate circuit.

[0129] A predefined auxiliary circuit, wherein the auxiliary circuit is a circuit obtained by abstracting the algorithm into a custom gate circuit and generating a lookup table for the custom gate circuit.

[0130] Optionally, the auxiliary circuit in this embodiment is used to accelerate the efficiency of proof, for example, abstracting the Keccak256 algorithm into a custom gate to pre-generate a lookup table for it, thereby subsequently accelerating the proof speed of the hash algorithm through the lookup table technology.

[0131] As an optional example, the above-mentioned device also includes: a verification module, which is used to input the certificates output by the above-mentioned first circuit, second circuit, third circuit and fourth circuit into the fifth circuit, and after the above-mentioned fifth circuit outputs the aggregated certificate, input the above-mentioned aggregated certificate and the initial state and final state of the account that executes a transaction as input into the verification circuit; when the above-mentioned verification circuit verifies that the above-mentioned aggregated certificate is correct, it is determined that the above-mentioned transaction executed is valid.

[0132] In this embodiment, the verifier uses the aggregated proof and the initial and final states of the initial account as input to verify the correctness of the aggregated proof, and if correct, accepts the final state as a valid execution result.

[0133] For other examples of this embodiment, please refer to the above examples and will not be repeated here.

[0134] Figure 3 is a schematic diagram of an optional electronic device according to an embodiment of the present application, such as Figure 3 As shown, it includes a processor 302, a communication interface 304, a memory 306 and a communication bus 308, wherein the processor 302, the communication interface 304 and the memory 306 communicate with each other through the communication bus 308, wherein,

[0135] Memory 306, for storing computer programs;

[0136] The processor 302 is configured to execute the computer program stored in the memory 306 to implement the following steps:

[0137] In the case of executing a transaction, the intermediate variables of the transaction and the values ​​of the intermediate variables are input into the first circuit, and the first circuit outputs a first transaction lookup table and a proof of correctness of the first transaction lookup table;

[0138] Inputting the transaction content and the Merkle tree root of the transaction into the second circuit, the second circuit outputting a second transaction lookup table and a proof of correctness of the second transaction lookup table;

[0139] The transaction bytecode is input into the third circuit, which outputs a bytecode table, a bytecode message digest, and a proof that the bytecode table and the bytecode hash are consistent.

[0140] Inputting the transaction's opcode into the fourth circuit, which then outputs proof that the opcode was correctly executed;

[0141] The proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit are input to the fifth circuit, and the fifth circuit outputs an aggregated proof.

[0142] Optionally, in this embodiment, the communication bus may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The use of only one thick line in the figure does not mean that there is only one bus or only one type of bus. The communication interface is used for communication between the above electronic devices and other devices.

[0143] The memory may include RAM, or may include non-volatile memory, such as at least one disk memory. Alternatively, the memory may also be at least one storage device located away from the aforementioned processor.

[0144] As an example, the memory 306 may include, but is not limited to, the first processing module 202, the second processing module 204, the third processing module 206, the fourth processing module 208, and the fifth processing module 210 in the zero-knowledge proof apparatus. Furthermore, the memory 306 may also include, but is not limited to, other module units in the zero-knowledge proof apparatus, which will not be described in detail in this example.

[0145] The above-mentioned processor can be a general-purpose processor, including but not limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; it can also be DSP (Digital Signal Processing), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0146] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0147] It can be understood by those skilled in the art that Figure 3The structure shown is for illustration only. The device for implementing the above-mentioned zero-knowledge proof method may be a terminal device, which may be a smartphone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, and other terminal devices. Figure 3 The structure of the electronic device is not limited. For example, the electronic device may also include Figure 3 More or fewer components (such as network interfaces, display devices, etc.) shown in, or with Figure 3 Different configurations shown.

[0148] A person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a computer-readable storage medium, which can include: a flash drive, ROM, RAM, a magnetic disk or an optical disk, etc.

[0149] According to another aspect of the embodiments of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned zero-knowledge proof method are executed.

[0150] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing the hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0151] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0152] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above-mentioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing one or more computer devices (such as personal computers, servers, or network devices) to execute all or part of the steps of the methods described in various embodiments of the present invention.

[0153] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, and can be electrical or other forms.

[0155] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0156] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0157] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as within the scope of protection of the present invention.

Claims

1. A zero-knowledge proof method, characterized in that: include: In the case of executing a transaction, an intermediate variable of the transaction and the value of the intermediate variable are input into a first circuit, and the first circuit outputs a first transaction lookup table and a proof of correctness of the first transaction lookup table; Inputting the transaction content and the Merkle tree root of the transaction into a second circuit, and having the second circuit output a second transaction lookup table and a proof of correctness of the second transaction lookup table; Inputting the bytecode of the transaction into a third circuit, and having the third circuit output a bytecode table, a bytecode message digest, and a certificate of consistency between the bytecode table and the bytecode hash; inputting the transaction operation code into a fourth circuit, and having the fourth circuit output proof that the operation code was correctly executed; Inputting the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into a fifth circuit, and having the fifth circuit output an aggregated proof; The step of inputting the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into the fifth circuit, and outputting the aggregated proof by the fifth circuit, includes: verifying, by the fifth circuit, the output of the i-th step and the input of the i+1-th step in the input proof, wherein the output of the i-th step is equal to the input of the i+1-th step, where i is the number of steps in the input proof minus 1; and verifying, by the fifth circuit, whether the instruction corresponding to the i-th step in the input proof satisfies the bytecode table; In which, after the certificates output by the first circuit, the second circuit, the third circuit and the fourth circuit are input into the fifth circuit and the fifth circuit outputs the aggregated certificate, the method further includes: inputting the aggregated certificate and the initial and final states of the account that executes a transaction as input into the verification circuit; and determining that the executed transaction is valid when the verification circuit verifies that the aggregated certificate is correct.

2. The method according to claim 1, characterized in that The method further comprises: The first circuit, the second circuit, the third circuit, the fourth circuit, and the fifth circuit are executed by a virtual machine.

3. The method according to claim 2, characterized in that The executing the first circuit, the second circuit, the third circuit, the fourth circuit, and the fifth circuit by the virtual machine includes: Control counter plus 1; When the counter does not point to the last bytecode, the top element of the stack of the virtual machine is operated according to the meaning of the bytecode.

4. The method according to claim 3, characterized in that When the counter does not point to the last bytecode, operating the top element of the stack of the virtual machine according to the meaning of the bytecode includes: Perform any one of the following operations on the top element of the stack: an algebraic operation, a push operation, a pop operation, a load operation from a storage area, and a write operation to a storage area.

5. The method according to claim 1, characterized in that Before inputting the intermediate variable of the transaction and the value of the intermediate variable into the first circuit, the method further includes: A predefined auxiliary circuit, wherein the auxiliary circuit is a circuit obtained by abstracting the algorithm into a custom gate circuit and generating a lookup table for the custom gate circuit.

6. A zero-knowledge proof device, characterized in that: include: a first processing module, configured to, when executing a transaction, input intermediate variables of the transaction and values ​​of the intermediate variables into a first circuit, and have the first circuit output a first transaction lookup table and a proof of correctness of the first transaction lookup table; a second processing module, configured to input the transaction content and the Merkle tree root of the transaction into a second circuit, and have the second circuit output a second transaction lookup table and a proof of correctness of the second transaction lookup table; a third processing module, configured to input the bytecode of the transaction into a third circuit, and have the third circuit output a bytecode table, a bytecode message digest, and a certificate of consistency between the bytecode table and the bytecode hash; a fourth processing module, configured to input the transaction operation code into a fourth circuit, and have the fourth circuit output proof that the operation code was correctly executed; a fifth processing module, configured to input the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into a fifth circuit, and have the fifth circuit output an aggregated proof; The step of inputting the proofs output by the first circuit, the second circuit, the third circuit, and the fourth circuit into the fifth circuit, and outputting the aggregated proof by the fifth circuit, includes: verifying, by the fifth circuit, the output of the i-th step and the input of the i+1-th step in the input proof, wherein the output of the i-th step is equal to the input of the i+1-th step, where i is the number of steps in the input proof minus 1; and verifying, by the fifth circuit, whether the instruction corresponding to the i-th step in the input proof satisfies the bytecode table; Among them, after the certificates output by the first circuit, the second circuit, the third circuit and the fourth circuit are input into the fifth circuit, and the fifth circuit outputs the aggregated certificate, it also includes: inputting the aggregated certificate and the initial state and final state of the account that executes a transaction as input into the verification circuit; when the verification circuit verifies that the aggregated certificate is correct, determining that the executed transaction is valid.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is executed.

8. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 5 through the computer program.

Images