Zero-knowledge proof verification method, device, terminal and storage medium

Abstract

The present application discloses a zero-knowledge proof verification method, device, terminal and storage medium, the method comprising: obtaining n commitment values ​​and n coefficients corresponding to the n commitment values ​​on an elliptic curve; determining a coefficient matrix corresponding to the n coefficients based on the n coefficients and a preset length; determining, based on the coefficient matrix, updated m column vectors and an updated commitment value corresponding to each of the m column vectors; obtaining an elliptic curve multi-scalar point multiplication result based on the updated m column vectors and the updated commitment value corresponding to each of the m column vectors; generating a proof result based on the elliptic curve multi-scalar point multiplication result to verify whether the zero-knowledge proof is correct through the proof result.

Description

Technical Field

[0001] The present application relates to the field of zero-knowledge technology, and in particular to a zero-knowledge proof verification method, device, terminal and storage medium. Background Art

[0002] Zero-knowledge proof is a very useful cryptographic protocol for protecting privacy. It is a commitment-based proof technology. The prover can prove to the verifier that he knows certain knowledge without revealing any information about the knowledge itself through zero-knowledge proof technology. Through zero-knowledge proof technology, private transaction information can be verified in the form of ciphertext.

[0003] Currently, RSA (Rivest-Shamir-Adleman, public key encryption) is generally used to generate keys for zero-knowledge proofs, and the keys are used to verify zero-knowledge proofs.

[0004] However, the steps of generating keys using RSA are complicated, and the efficiency of verifying zero-knowledge proofs is low. Summary of the invention

[0005] The main purpose of this application is to provide a zero-knowledge proof verification method, device, terminal and storage medium to solve the problem of low efficiency in related technologies.

[0006] In order to achieve the above objectives, in a first aspect, the present application provides a zero-knowledge proof verification method, comprising:

[0007] Obtain n commitment values, and obtain n coefficients corresponding to the n commitment values ​​on the elliptic curve; wherein the n commitment values ​​correspond to the n coefficients one-to-one, and n is an integer greater than 1;

[0008] Based on the n coefficients and the preset length, determining a coefficient matrix corresponding to the n coefficients;

[0009] Determine, based on a coefficient matrix, updated m column vectors and an updated commitment value corresponding to each of the m column vectors, wherein the coefficient matrix includes m column vectors, and m is an integer greater than 1;

[0010] Based on the updated m column vectors and the updated commitment value corresponding to each of the m column vectors, an elliptic curve multi-scalar point multiplication result is obtained;

[0011] Based on the multi-scalar point multiplication results of the elliptic curve, a proof result is generated to verify whether the zero-knowledge proof is correct or not.

[0012] In a possible implementation, a coefficient matrix is ​​determined based on n coefficients and a preset length, including:

[0013] Divide each coefficient of the n coefficients into segments according to a preset length to obtain a coefficient sequence corresponding to each coefficient;

[0014] The coefficient sequence corresponding to each coefficient is summarized and arranged to obtain a coefficient matrix.

[0015] In a possible implementation manner, the length of each coefficient in the n coefficients is the same and is a first preset length;

[0016] Each coefficient of the n coefficients is segmented according to a preset length to obtain a coefficient sequence corresponding to each coefficient, including:

[0017] For each of the n coefficients, each coefficient of the first preset length is evenly segmented by the second preset length to obtain a coefficient sequence corresponding to each coefficient, wherein the coefficient sequence includes m vectors, and each of the m vectors is used to represent each segment of data after the average segmentation.

[0018] In a possible implementation, the coefficient sequence corresponding to each coefficient is summarized and arranged to obtain a coefficient matrix, including:

[0019] Summarize the coefficient sequences corresponding to each coefficient to obtain n coefficient sequences;

[0020] Arrange the n coefficient sequences vertically to obtain a coefficient matrix, where the coefficient matrix is ​​a matrix with n rows and m columns.

[0021] In a possible implementation, determining the updated m column vectors and the updated commitment value corresponding to each column vector in the m column vectors based on the coefficient matrix includes:

[0022] For each column vector of the m column vectors in the coefficient matrix, count the number of times each vector in each column vector appears to obtain a statistical result;

[0023] Sort each column vector according to the statistical results to obtain each updated column vector;

[0024] Sum up each updated column vector to obtain updated m column vectors;

[0025] Based on the coefficient matrix and the n commitment values, an updated commitment value corresponding to each column vector in the m column vectors is determined.

[0026] In a possible implementation, the number of occurrences of each vector in each column vector is counted to obtain statistical results, including:

[0027] Obtaining an initial index count table, wherein the initial index count table includes multiple index values, and any two index values ​​among the multiple index values ​​are different;

[0028] For each vector in each column vector, if there is an index value that is the same as each vector in multiple index values;

[0029] The number of times each vector appears in each column vector is used as the count value of each vector, and the count value is set in the initial index count table to obtain the target index count table, wherein the target index count table is used to represent the statistical results.

[0030] In a possible implementation, each column vector is sorted according to the statistical result to obtain each updated column vector, including:

[0031] For each vector in each column vector, each column vector is sorted according to the count value of each vector to obtain each updated column vector.

[0032] In a possible implementation, n vectors among the m column vectors in the coefficient matrix correspond one-to-one to the n commitment values;

[0033] Based on the coefficient matrix and the n commitment values, determining an updated commitment value corresponding to each column vector in the m column vectors includes:

[0034] For each of the m column vectors in the coefficient matrix, the commitment values ​​corresponding to the same vector in the n vectors in each column vector are added to obtain an updated commitment value corresponding to each column vector.

[0035] In a possible implementation, based on the updated m column vectors and the updated commitment value corresponding to each of the m column vectors, an elliptic curve multi-scalar point multiplication result is obtained, including:

[0036] For each column vector of the updated m column vectors, using a first preset function to calculate each column vector and the updated commitment value corresponding to each column vector, to obtain a calculation result corresponding to each column vector;

[0037] Summarize the calculation results corresponding to each column vector to obtain m calculation results corresponding to the m column vectors, where the m column vectors correspond one to one to the m calculation results;

[0038] The m calculation results are calculated using the second preset algorithm to obtain the elliptic curve multi-scalar point multiplication result.

[0039] In a second aspect, an embodiment of the present invention provides a zero-knowledge proof verification device, including:

[0040] An acquisition module, used to acquire n commitment values ​​and n coefficients corresponding to the n commitment values ​​on the elliptic curve, wherein the n commitment values ​​correspond to the n coefficients one by one, and n is an integer greater than 1;

[0041] A matrix determination module, used for determining a coefficient matrix corresponding to the n coefficients based on the n coefficients and a preset length;

[0042] An updating module, used for determining, based on a coefficient matrix, updated m column vectors and an updated commitment value corresponding to each of the m column vectors, wherein the coefficient matrix includes m column vectors, and m is an integer greater than 1;

[0043] A calculation module, used for obtaining an elliptic curve multi-scalar point multiplication result based on the updated m column vectors and the updated commitment value corresponding to each column vector in the m column vectors;

[0044] The verification module is used to generate a proof result based on the multi-scalar point multiplication result of the elliptic curve, so as to verify whether the zero-knowledge proof is correct or not through the proof result.

[0045] In a third aspect, an embodiment of the present invention provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the above zero-knowledge proof verification methods when executing the computer program.

[0046] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of any of the above zero-knowledge proof verification methods are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings constituting a part of this application are used to provide a further understanding of this application, so that other features, purposes and advantages of this application become more obvious. The schematic embodiment drawings and their descriptions of this application are used to explain this application and do not constitute an improper limitation on this application. In the drawings:

[0048] Figure 1 It is a flow chart of an implementation of a zero-knowledge proof verification method provided by an embodiment of the present invention;

[0049] Figure 2 is a schematic diagram of a coefficient matrix provided by an embodiment of the present invention;

[0050] Figure 3 It is a structural diagram of a zero-knowledge proof verification device provided by an embodiment of the present invention;

[0051] Figure 4 is a schematic diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein.

[0054] It should be understood that in various embodiments of the present invention, the size of the sequence number of each process does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0055] It should be understood that in the present invention, "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatuses.

[0056] It should be understood that in the present invention, "plurality" refers to two or more than two. "And / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "Contains A, B and C", "Contains A, B, C" means that A, B, and C are all included, "Contains A, B or C" means that one of A, B, and C is included, and "Contains A, B and / or C" means that any one, any two, or any three of A, B, and C are included.

[0057] It should be understood that in the present invention, "B corresponding to A", "B corresponding to A", "A corresponds to B" or "B corresponds to A" means that B is associated with A and B can be determined based on A. Determining B based on A does not mean determining B based only on A, but B can also be determined based on A and / or other information. A and B match when the similarity between A and B is greater than or equal to a preset threshold.

[0058] Depending on the context, "if" as used herein may be interpreted as "when" or "when" or "in response to determining" or "in response to detecting."

[0059] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0060] In order to make the purpose, technical solutions and advantages of the present invention more clear, specific embodiments will be described below in conjunction with the accompanying drawings.

[0061] In one embodiment, if Figure 1 As shown, the present invention provides an elliptic curve multi-scalar point multiplication calculation optimization method, comprising the following steps:

[0062] Step S101: Obtain n commitment values ​​and n coefficients corresponding to the n commitment values ​​on the elliptic curve.

[0063] The n commitment values ​​correspond to the n coefficients one by one, and n is an integer greater than 1. The n commitment values ​​are used to represent n elliptic curve points on the elliptic curve, and the n commitment values ​​correspond to the n elliptic curve points on the elliptic curve one by one.

[0064] Suppose there are n elliptic curve points on the elliptic curve, namely P1, P2, ...P n , where each elliptic curve point corresponds to a coefficient. Let the n coefficients corresponding to n elliptic curve points be k1, k2, ... k n That is, the elliptic curve point P1 corresponds to the coefficient k1, the elliptic curve point P2 corresponds to the coefficient k2, ..., the elliptic curve point P n Corresponding coefficient k n .

[0065] Step S102: Based on the n coefficients and a preset length, determine a coefficient matrix corresponding to the n coefficients.

[0066] To determine the coefficient matrix based on n coefficients and a preset length, it is necessary to first segment each of the n coefficients according to the preset length to obtain a coefficient sequence corresponding to each coefficient, and then summarize and arrange the coefficient sequence corresponding to each coefficient to obtain the coefficient matrix.

[0067] The length of each coefficient in the n coefficients is the same and is a first preset length. That is, coefficient k1, coefficient k2, ... and coefficient k n The lengths are the same and are the first preset length, wherein the first preset length is set according to specific circumstances and is not limited here.

[0068] Each of the n coefficients is segmented according to a preset length to obtain a coefficient sequence corresponding to each coefficient. For each of the n coefficients, each coefficient of the first preset length is segmented evenly with a second preset length to obtain a coefficient sequence corresponding to each coefficient, wherein the coefficient sequence includes m vectors, each of the m vectors is used to represent each segment of data after average segmentation, and m is an integer greater than 1.

[0069] By segmenting the coefficients corresponding to the commitment value, the efficiency of the prover in obtaining the proof result after obtaining the commitment value can be improved.

[0070] For example, assuming that the first preset length is K and the second preset length is W, then each coefficient is evenly segmented by the second preset length W, and there are m=k / W segments, and the value range of each segment is 0-M, where M=2 W -1, W is the number of bits, and M is a decimal number. For example, if W is 8 bits, its decimal value range is 0-255, and M is 255.

[0071] Taking coefficient k1 as an example, the coefficient k1 is segmented by the above method, and the coefficient sequence corresponding to the coefficient k1 is: k1seg1, k1seg2, ..., k1seg m Correspondingly, the coefficient sequence corresponding to coefficient k2 is: k2seg1, k2seg2, ..., k2seg m , ..., coefficient k n The corresponding coefficient sequence is: k n seg1,k n seg2,...,k n seg m .

[0072] After obtaining the coefficient sequence corresponding to each coefficient, the coefficient sequence corresponding to each coefficient can be summarized and arranged to obtain a coefficient matrix. Specifically, the coefficient sequence corresponding to each coefficient is first summarized to obtain n coefficient sequences, and then the n coefficient sequences are arranged vertically to obtain a coefficient matrix, wherein the coefficient matrix is ​​a matrix of n rows and m columns.

[0073] Exemplarily, the coefficient sequence corresponding to the coefficient k1 obtained in the above embodiment: k1seg1, k1seg2, ..., k1seg m Correspondingly, the coefficient sequence corresponding to coefficient k2 is: k2seg1, k2seg2, ..., k2seg m , ..., coefficient k n The corresponding coefficient sequence: k n seg1,k n seg2,...,k n segm Arrange vertically and get the coefficient matrix as follows Figure 2 The coefficient matrix is ​​shown.

[0074] The above coefficient matrix includes m column vectors, namely: k1seg1, k2seg1, ..., k n seg1, k1seg2, k2seg2, ..., k n seg2, ..., k1seg m ,k2seg m ,...,k n seg m .

[0075] Step S103: Based on the coefficient matrix, determine the updated m column vectors and the updated commitment value corresponding to each of the m column vectors.

[0076] To determine the updated m column vectors and the updated commitment value corresponding to each of the m column vectors based on the coefficient matrix, it is necessary to first count the number of occurrences of each vector in each column vector for each of the m column vectors in the coefficient matrix to obtain the statistical result, then sort each column vector according to the statistical result to obtain each updated column vector, and then summarize each updated column vector to obtain the updated m column vectors, and finally determine the updated commitment value corresponding to each of the m column vectors based on the coefficient matrix and the n commitment values. Among them, the n vectors in the m column vectors in the coefficient matrix correspond to the n commitment values ​​one by one.

[0077] In order to count the number of times each vector in each column vector appears and obtain the statistical results, it is necessary to first obtain the initial index count table, wherein the initial index count table includes multiple index values, and any two index values ​​in the multiple index values ​​are different. Then, for each vector in each column vector, if there is an index value that is the same as each vector in the multiple index values, the number of times each vector appears in each column vector is used as the count value of each vector, and the count value is set in the initial index count table to obtain the target index count table, wherein the target index count table is used to represent the statistical results. In the index count table, the multiple index values ​​are arranged according to the serial numbers corresponding to the index values.

[0078] For example, with column vectors k1seg1, k2seg1, ..., k n Take seg1 as an example, k1seg1, k2seg1, ..., k n The decimal value corresponding to seg1 is 0-9, so 0-9 is used as the index value in the initial index count table, and the column vectors k1seg1, k2seg1, ..., k nFor each vector in seg1, if the column vector k1seg1,k2seg1,...,k n If there is a vector with the same index value in seg1, then add 1 to the count value corresponding to this index value. If there are two vectors with the same index value, then add 1 to the count value corresponding to this index value. And so on. n The number of times the vector with the same index value appears in seg1 is used as the count value corresponding to this index value. The method for determining the count values ​​corresponding to other index values ​​is similar to the above method. n After all vectors in seg1 are counted into the initial index count table, other column vectors are traversed and all column vectors are counted into the initial index count table to obtain the target index count table.

[0079] Among them, each column vector is sorted according to the statistical result to obtain each updated column vector. It is necessary to sort each column vector according to the count value of each vector in each column vector to obtain each updated column vector.

[0080] For example, after obtaining the target index count table, it is necessary to reorder each vector in each column vector. Suppose the column vectors k1seg1, k2seg1, ..., k n seg1, the target index count table counts the count values ​​of all vectors, and the column vectors k1seg1, k2seg1, ..., k n seg1 is reordered, such as the column vector k1seg1, k2seg1, ..., k n seg1 is reordered to obtain a sorted column vector. Then, the same multiple vectors in the sorted column vector need to be taken as a vector, that is, the updated column vectors c1seg1, c2seg1, ... cxseg1 are obtained, where x is an integer less than or equal to n. The other column vectors are also reordered according to the above method, and each updated column vector can be obtained.

[0081] Among them, based on the coefficient matrix and n commitment values, the updated commitment value corresponding to each column vector in the m column vectors is determined. It is necessary to add the commitment values ​​corresponding to the same vector in the n vectors in each column vector for each column vector in the m column vectors in the coefficient matrix to obtain the updated commitment value corresponding to each column vector.

[0082] For example, let the column vectors k1seg1, k2seg1, ..., k nseg1, for each vector in the sorted column vector, the same vector corresponds to a different commitment value, that is, an elliptic curve point. It is necessary to add the different elliptic curve points corresponding to the same vector to obtain the updated elliptic curve points r1, r2, ..., rx. Other column vectors also update their corresponding elliptic curve points according to the above method to obtain the updated elliptic curve points corresponding to each column vector.

[0083] The present invention sets an index table and does not need to change the address of the original data. It only needs to calculate the offset of the address of the coefficient and quickly sorts the coefficients of the commitment value, thereby reducing the amount of calculation, improving the calculation efficiency and making it easy to implement in hardware.

[0084] Step S104: Based on the updated m column vectors and the updated commitment value corresponding to each of the m column vectors, an elliptic curve multi-scalar point multiplication result is obtained.

[0085] Based on the updated m column vectors and the updated commitment value corresponding to each of the m column vectors, the elliptic curve multi-scalar point multiplication result is obtained. It is necessary to first calculate each column vector and the updated commitment value corresponding to each column vector for each of the m column vectors after the update using the first preset function to obtain the calculation result corresponding to each column vector, and then summarize the calculation results corresponding to each column vector to obtain m calculation results corresponding to the m column vectors, wherein the m column vectors correspond one-to-one to the m calculation results, and then use the second preset algorithm to calculate the m calculation results to obtain the elliptic curve multi-scalar point multiplication result.

[0086] Exemplarily, after obtaining the updated m column vectors and the updated commitment value corresponding to each of the m column vectors, it is necessary to calculate the calculation result of each column. Assume the calculation result corresponding to the first column vector of the updated m column vectors, that is, multiply each vector in the first column vector with the commitment value at the same position of each vector, that is, the elliptic curve point, and then perform the sum calculation on all the multiplication values ​​to obtain the calculation result corresponding to the first column vector, the calculation result of the seg1 column (that is, the first column vector) Qseg1 = c1*seg1r1+c2*seg1r2+...+cx*seg1rx. Similarly, calculate the calculation result Qseg2 of the second column vector, ..., the calculation result Qsegx of the xth column vector.

[0087] After all the column vector calculation results are calculated, all the column vector calculation results are calculated according to the following formula to obtain the elliptic curve multi-scalar point multiplication result Q, the calculation formula is as follows:

[0088] Q=((Qseg1*2 M +Qseg2)2 M+Qseg3)2 M +...=Qseg1*2 L-M +Qseg2*2 L-

[0089] 2M +...+Qsegx

[0090] Wherein, L is the length of each vector in each column of vectors, and M is the value range of the length of each vector in each column of vectors.

[0091] Step S105: Generate a proof result based on the result of multi-scalar point multiplication of the elliptic curve, so as to verify whether the zero-knowledge proof is correct or not through the proof result.

[0092] Among them, the zero-knowledge proof at least includes the result of multi-scalar point multiplication of elliptic curves.

[0093] After the elliptic curve multi-scalar point multiplication result is calculated through the above embodiment, the proof result generated based on the elliptic curve multi-scalar point multiplication result can have a better verification effect on the zero-knowledge proof, which can improve the accuracy of the zero-knowledge proof verification.

[0094] The embodiment of the present invention provides a zero-knowledge proof verification method, including: first obtaining n commitment values ​​and n coefficients corresponding to the n commitment values ​​on an elliptic curve, then determining the coefficient matrix corresponding to the n coefficients based on the n coefficients and a preset length, then determining the updated m column vectors and the updated commitment value corresponding to each of the m column vectors based on the coefficient matrix, further obtaining the elliptic curve multi-scalar point multiplication result based on the updated m column vectors and the updated commitment value corresponding to each of the m column vectors, and finally generating a proof result based on the elliptic curve multi-scalar point multiplication result to verify whether the zero-knowledge proof is correct or not through the proof result. The present invention uses an elliptic curve encryption algorithm to quickly calculate the proof result, reduce the amount of calculation, and improve the calculation efficiency. In addition, the present invention also verifies the zero-knowledge proof through the calculated proof result, which can improve the accuracy and efficiency of the zero-knowledge proof.

[0095] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0096] The following is an embodiment of the device of the present invention. For details not described in detail therein, reference may be made to the corresponding method embodiment described above.

[0097] Figure 3The structure diagram of a zero-knowledge proof verification device provided by an embodiment of the present invention is shown. For the convenience of explanation, only the part related to the embodiment of the present invention is shown. A zero-knowledge proof verification device includes an acquisition module 31, a matrix determination module 32, an update module 33, a calculation module 34 and a verification module 35, which are as follows:

[0098] An acquisition module 31, used to acquire n commitment values ​​and n coefficients corresponding to the n commitment values ​​on the elliptic curve, wherein the n commitment values ​​correspond to the n coefficients one-to-one, and n is an integer greater than 1;

[0099] A matrix determination module 32, for determining a coefficient matrix corresponding to the n coefficients based on the n coefficients and a preset length;

[0100] An updating module 33, configured to determine, based on a coefficient matrix, updated m column vectors and an updated commitment value corresponding to each of the m column vectors, wherein the coefficient matrix includes m column vectors, and m is an integer greater than 1;

[0101] A calculation module 34, configured to obtain an elliptic curve multi-scalar point multiplication result based on the updated m column vectors and the updated commitment value corresponding to each column vector in the m column vectors;

[0102] The verification module 35 is used to generate a proof result based on the multi-scalar point multiplication result of the elliptic curve, so as to verify whether the zero-knowledge proof is correct through the proof result.

[0103] In a possible implementation, the matrix determination module 32 is further used to segment each coefficient of the n coefficients according to a preset length to obtain a coefficient sequence corresponding to each coefficient;

[0104] The coefficient sequence corresponding to each coefficient is summarized and arranged to obtain a coefficient matrix.

[0105] In a possible implementation manner, the length of each coefficient in the n coefficients is the same and is a first preset length;

[0106] The matrix determination module 32 is also used to averagely segment each coefficient of the first preset length with a second preset length for each coefficient among the n coefficients, so as to obtain a coefficient sequence corresponding to each coefficient, wherein the coefficient sequence includes m vectors, and each vector among the m vectors is used to represent each segment of data after average segmentation.

[0107] In a possible implementation, the matrix determination module 32 is further used to aggregate the coefficient sequences corresponding to each coefficient to obtain n coefficient sequences;

[0108] Arrange the n coefficient sequences vertically to obtain a coefficient matrix, where the coefficient matrix is ​​a matrix with n rows and m columns.

[0109] In a possible implementation, the updating module 33 is further used to count the number of occurrences of each vector in each column vector of the m column vectors in the coefficient matrix to obtain a statistical result;

[0110] Sort each column vector according to the statistical results to obtain each updated column vector;

[0111] Sum up each updated column vector to obtain updated m column vectors;

[0112] Based on the coefficient matrix and the n commitment values, an updated commitment value corresponding to each column vector in the m column vectors is determined.

[0113] In a possible implementation, the updating module 33 is further configured to obtain an initial index count table, wherein the initial index count table includes a plurality of index values, and any two of the plurality of index values ​​are different;

[0114] For each vector in each column vector, if there is an index value that is the same as each vector in multiple index values;

[0115] The number of times each vector appears in each column vector is used as the count value of each vector, and the count value is set in the initial index count table to obtain the target index count table, wherein the target index count table is used to represent the statistical results.

[0116] In a possible implementation, the updating module 33 is further configured to sort each column vector according to the count value of each vector in each column vector to obtain each updated column vector.

[0117] In a possible implementation, n vectors among the m column vectors in the coefficient matrix correspond one-to-one to the n commitment values;

[0118] The updating module 33 is further used to add the commitment values ​​corresponding to the same vectors in the n vectors in each column vector for each of the m column vectors in the coefficient matrix to obtain an updated commitment value corresponding to each column vector.

[0119] In a possible implementation, the calculation module 34 is further configured to calculate, for each column vector of the updated m column vectors, each column vector and the updated commitment value corresponding to each column vector using a first preset function to obtain a calculation result corresponding to each column vector;

[0120] Summarize the calculation results corresponding to each column vector to obtain m calculation results corresponding to the m column vectors, where the m column vectors correspond one to one to the m calculation results;

[0121] The m calculation results are calculated using the second preset algorithm to obtain the elliptic curve multi-scalar point multiplication result.

[0122] Figure 4 is a schematic diagram of a terminal provided by an embodiment of the present invention. Figure 4 As shown, the terminal 4 of this embodiment includes: a processor 401, a memory 402, and a computer program 403 stored in the memory 402 and executable on the processor 401. When the processor 401 executes the computer program 403, the steps in the above-mentioned zero-knowledge proof verification method embodiments are implemented, for example Figure 1 Alternatively, when the processor 401 executes the computer program 403, the functions of each module / unit in the above-mentioned zero-knowledge proof verification device embodiments are implemented, for example Figure 3 Functionality of the modules / units 31 to 34 shown.

[0123] The present invention also provides a readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, it is used to implement the zero-knowledge proof verification method provided by the various embodiments described above.

[0124] Among them, the readable storage medium can be a computer storage medium or a communication medium. The communication medium includes any medium that facilitates the transmission of a computer program from one place to another. The computer storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer. For example, a readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application-specific integrated circuit (Application Specific Integrated Circuits, abbreviated as: ASIC). In addition, the ASIC can be located in a user device. Of course, the processor and the readable storage medium can also exist in a communication device as discrete components. The readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0125] The present invention also provides a program product, which includes an execution instruction, which is stored in a readable storage medium. At least one processor of a device can read the execution instruction from the readable storage medium, and at least one processor executes the execution instruction so that the device implements the zero-knowledge proof verification method provided by the various embodiments described above.

[0126] In the embodiments of the above-mentioned devices, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0127] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A zero-knowledge proof verification method, characterized in that: include: Obtain n commitment values ​​and n coefficients corresponding to the n commitment values ​​on the elliptic curve; wherein the n commitment values ​​correspond to the n coefficients one-to-one, and n is an integer greater than 1; Based on the n coefficients and a preset length, determining a coefficient matrix corresponding to the n coefficients; Based on the coefficient matrix, determining updated m column vectors and an updated commitment value corresponding to each of the m column vectors, wherein the coefficient matrix includes m column vectors, and m is an integer greater than 1; Obtaining the elliptic curve multi-scalar point multiplication result based on the updated m column vectors and the updated commitment value corresponding to each column vector in the m column vectors; Based on the multi-scalar point multiplication result of the elliptic curve, a proof result is generated to verify whether the zero-knowledge proof is correct or not through the proof result.

2. The zero-knowledge proof verification method according to claim 1, characterized in that: The step of determining a coefficient matrix based on the n coefficients and a preset length includes: Segment each of the n coefficients according to the preset length to obtain a coefficient sequence corresponding to each coefficient; The coefficient sequence corresponding to each coefficient is summarized and arranged to obtain the coefficient matrix.

3. The zero-knowledge proof verification method as claimed in claim 2, characterized in that: The length of each coefficient in the n coefficients is the same and is a first preset length; The step of segmenting each of the n coefficients according to the preset length to obtain a coefficient sequence corresponding to each coefficient includes: For each of the n coefficients, each coefficient of the first preset length is evenly segmented by the second preset length to obtain a coefficient sequence corresponding to each coefficient, wherein the coefficient sequence includes m vectors, and each of the m vectors is used to represent each segment of data after the average segmentation.

4. The zero-knowledge proof verification method as claimed in claim 3, characterized in that: The coefficient sequence corresponding to each coefficient is summarized and arranged to obtain the coefficient matrix, including: Summarize the coefficient sequences corresponding to each coefficient to obtain n coefficient sequences; The n coefficient sequences are arranged vertically to obtain the coefficient matrix, wherein the coefficient matrix is ​​a matrix with n rows and m columns.

5. The zero-knowledge proof verification method as claimed in claim 4, characterized in that: The determining, based on the coefficient matrix, the updated m column vectors and the updated commitment value corresponding to each of the m column vectors comprises: For each column vector of the m column vectors in the coefficient matrix, count the number of occurrences of each vector in each column vector to obtain a statistical result; Sort each column vector according to the statistical result to obtain each updated column vector; Summarize each updated column vector to obtain the updated m column vectors; Based on the coefficient matrix and the n commitment values, an updated commitment value corresponding to each column vector in the m column vectors is determined.

6. The zero-knowledge proof verification method according to claim 5, characterized in that: The counting the number of occurrences of each vector in each column vector to obtain a statistical result includes: Obtain an initial index count table, wherein the initial index count table includes multiple index values, and any two index values ​​among the multiple index values ​​are different; For each vector in each column vector, if there is an index value in the multiple index values ​​that is the same as that of each vector; The number of times each vector appears in each column vector is used as the count value of each vector, and the count value is set in the initial index count table to obtain a target index count table, wherein the target index count table is used to characterize the statistical result.

7. The zero-knowledge proof verification method according to claim 6, characterized in that: The step of sorting each column vector according to the statistical result to obtain each updated column vector includes: For each vector in each column vector, each column vector is sorted according to the count value of each vector to obtain each updated column vector.

8. The zero-knowledge proof verification method as claimed in claim 5, characterized in that: The n vectors in the m column vectors in the coefficient matrix correspond one-to-one to the n commitment values; The step of determining, based on the coefficient matrix and the n commitment values, an updated commitment value corresponding to each column vector in the m column vectors comprises: For each column vector in the m column vectors in the coefficient matrix, the commitment values ​​corresponding to the same vector in the n vectors in each column vector are added to obtain an updated commitment value corresponding to each column vector.

9. The zero-knowledge proof verification method according to claim 1, characterized in that: The step of obtaining the elliptic curve multi-scalar point multiplication result based on the updated m column vectors and the updated commitment value corresponding to each column vector in the m column vectors includes: For each column vector of the updated m column vectors, using a first preset function to calculate each column vector and the updated commitment value corresponding to each column vector, to obtain a calculation result corresponding to each column vector; Summarizing the calculation results corresponding to each column vector to obtain m calculation results corresponding to the m column vectors, wherein the m column vectors correspond one-to-one to the m calculation results; The m calculation results are calculated using a second preset algorithm to obtain the elliptic curve multi-scalar point multiplication result.

10. A zero-knowledge proof verification device, characterized in that: include: An acquisition module, used to acquire n commitment values ​​and n coefficients corresponding to the n commitment values ​​on an elliptic curve, wherein the n commitment values ​​correspond to the n coefficients one-to-one, and n is an integer greater than 1; A matrix determination module, used to determine a coefficient matrix corresponding to the n coefficients based on the n coefficients and a preset length; An updating module, configured to determine, based on the coefficient matrix, updated m column vectors and an updated commitment value corresponding to each of the m column vectors, wherein the coefficient matrix includes m column vectors, and m is an integer greater than 1; A calculation module, configured to obtain the elliptic curve multi-scalar point multiplication result based on the updated m column vectors and the updated commitment value corresponding to each column vector in the m column vectors; The verification module is used to generate a proof result based on the multi-scalar point multiplication result of the elliptic curve, so as to verify whether the zero-knowledge proof is correct or not through the proof result.

11. A terminal, characterized in that: comprising a memory, and one or more processors communicatively connected to the memory; The memory stores instructions that can be executed by the one or more processors, and the instructions are executed by the one or more processors to enable the one or more processors to implement the zero-knowledge proof verification method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The invention comprises a program or an instruction, and when the program or the instruction is executed on a computer, the zero-knowledge proof verification method described in any one of claims 1 to 9 is implemented.

Images