Zero-knowledge proof method, system, device, terminal and storage medium

Abstract

The embodiment of the application discloses a kind of zero-knowledge proof method, system, device, terminal and storage medium, belong to encryption technical field.The method includes: prover terminal selects n integer, calculates first commitment value according to n integer, sends first commitment value to verifier terminal, obtains challenge value and random prime number, generates response according to to-be-proved data, challenge value and n integer, calculates first positive integer and second positive integer, so that response is equal to the sum of the product of first positive integer, preset security parameter, random prime number and second positive integer, prover terminal calculates second commitment value according to first positive integer, sends second commitment value and second positive integer to verifier terminal, and verifier terminal verifies to-be-proved data according to second commitment value, preset security parameter, random prime number, first commitment value, challenge value and second positive integer.The calculation cost and communication cost of zero-knowledge proof can be reduced by using the application.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of encryption technology, in particular to a zero-knowledge proof method, system, device, terminal and storage medium. BACKGROUND

[0002] Zero-knowledge proof means that the prover proves to the verifier that he has the information without revealing the information to the verifier. In digital signature technology, zero-knowledge proof is widely used. For example, key generation, ciphertext legality (correctness) verification, etc. in digital signature technology all use zero-knowledge proof.

[0003] At present, in the zero-knowledge proof in digital signature technology, it is usually proved that there exists (x1,..., x n ), so that where (x1,..., x n ) is the data that the prover needs to prove, w, n, gi are all public parameters. In the proving process, the prover first selects n random numbers, then calculates the commitment value according to the relationship to be proved and the n random numbers, and sends the commitment value to the verifier. The verifier sends a challenge value to the prover. The prover calculates n responses according to the challenge value and the random numbers, and calculates two corresponding positive integers di and ei according to each response and the challenge value. The prover calculates the commitment value according to di and the relationship to be proved, and sends the commitment value and ei to the verifier. The verifier verifies whether the commitment value, w, gi, ei and the challenge value satisfy the preset equation relationship, and if they satisfy the preset equation relationship, the verifier sends a random prime number to the prover. The prover calculates two corresponding positive integers pi and ri according to each response and the random prime number. The prover calculates the commitment value according to pi and the relationship to be proved, and sends the commitment value and ri to the verifier. The verifier verifies whether the commitment value, w, gi, ri and the challenge value satisfy the preset equation relationship, and if they satisfy the preset equation relationship, it is proved that there exists (x1,..., x n ), so that

[0004] In the above zero-knowledge proof, the process is relatively complicated, and the prover and the verifier need to interact a large number of times, resulting in large communication cost. SUMMARY

[0005] The embodiments of the present application provide a zero-knowledge proof method, system, device, terminal and storage medium, which can solve the problem of large communication cost caused by too much interaction between the prover terminal and the verifier terminal in the zero-knowledge proof of related technologies. The technical solution is as follows:

[0006] In a first aspect, a zero-knowledge proof method is provided, the method comprising:

[0007] The prover terminal selects n integers within a preset integer range, calculates a first commitment value according to the n integers, and sends the first commitment value to the verifier terminal. The prover terminal obtains a challenge value and a random prime number, and for each piece of data to be proved in the n pieces of data to be proved, the prover terminal generates a response according to the data to be proved, the challenge value and one of the n integers, wherein the challenge value is a positive integer less than a preset security parameter, and the random prime number is less than the preset security parameter. For each response, the prover terminal calculates a first positive integer and a second positive integer according to the response, the preset security parameter and the random prime number, wherein the response is equal to the sum of the product of a positive integer, the preset security parameter and the random prime number and the second positive integer. Then, the prover terminal calculates a second commitment value according to the first positive integer corresponding to each response, and sends the second commitment value and the second positive integer corresponding to each response to the verifier terminal. The verifier terminal verifies the n pieces of data to be proved according to the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value and the second positive integer corresponding to each response.

[0008] In the zero-knowledge proof method provided in the embodiments of the present application, the challenge value and the random prime number can be obtained in one step, without the need for the prover and the verifier to interact at least three times as in the related art. In addition, when the verifier terminal verifies in the present application, the verification is based on the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value and the second positive integer corresponding to each response, rather than being divided into two times of verification as in the related art, and the prover and the verifier need to interact data each time, which not only reduces the communication cost, but also reduces the calculation cost.

[0009] In a possible implementation, the prover terminal can obtain the challenge value and the random prime number in the following manner:

[0010] The prover terminal receives the challenge value and the random prime number sent by the verifier terminal at the same time.

[0011] In the scheme shown in the embodiments of the present application, the verifier terminal can send the challenge value and the random prime number to the prover terminal at the same time, rather than interacting multiple times, which can effectively reduce the communication cost and the calculation cost of the verifier terminal.

[0012] In a possible implementation, the prover terminal can obtain the challenge value and the random prime number in the following manner:

[0013] The prover terminal inputs the first commitment value into a first hash function to obtain the challenge value, and inputs the first commitment value into a second hash function to obtain the random prime number.

[0014] In the scheme shown in the embodiments of the present application, the prover terminal can generate the challenge value and the random prime number through the hash function, without interacting with the verifier terminal, thereby effectively reducing the communication cost.

[0015] In a possible implementation, for each of the n pieces of to-be-proved data, the prover terminal generates a response according to the to-be-proved data, the challenge value, and one of the n integers, including:

[0016] For each of the n pieces of to-be-proved data, the prover terminal generates a response according to the formula s i =k i +cx i , where s i is the response, k i is the i th integer of the n integers, c is the challenge value, and x i is the i th piece of to-be-proved data of the n pieces of to-be-proved data.

[0017] In a possible implementation, for each response, the prover terminal calculates a first positive integer and a second positive integer according to the response, a preset security parameter, and a random prime number, including:

[0018] For each response, the prover terminal calculates the product of the preset security parameter and the random prime number, divides the response by the product, and obtains a quotient as the first positive integer and a remainder as the second positive integer.

[0019] In a possible implementation, the prover terminal calculates a first commitment value according to the n integers, including:

[0020] The prover terminal calculates the first commitment value according to the formula , where R is the first commitment value, g i is a preset value.

[0021] The prover terminal calculates a second commitment value according to the first positive integer, including:

[0022] The prover terminal calculates the second commitment value according to the formula , where D is the second commitment value, and d i is the second positive integer.

[0023] In a second aspect, a system for zero-knowledge proof is provided, including a prover terminal and a verifier terminal, where:

[0024] The prover terminal is configured to select n integers in a preset integer range, wherein n is a preset positive integer, calculate a first commitment value according to the n integers, and send the first commitment value to the verifier terminal, obtain a challenge value and a random prime number, and generate a response according to each of the n pieces of to-be-proved data, the challenge value, and one of the n integers for each of the n pieces of to-be-proved data, wherein the challenge value is a positive integer less than a preset security parameter, and the random prime number is less than the preset security parameter, calculate a first positive integer and a second positive integer according to the response, the preset security parameter, and the random prime number for each response, wherein the response is equal to a sum of a product of the first positive integer, the preset security parameter, and the random prime number and the second positive integer, calculate a second commitment value according to the first positive integer, and send the second commitment value and the second positive integer corresponding to each response to the verifier terminal.

[0025] The verifier terminal is configured to verify the n pieces of to-be-proved data according to the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value, and the second positive integer corresponding to each response.

[0026] In a possible implementation, the verifier terminal is further configured to:

[0027] generate the challenge value and the random prime number, and send the challenge value and the random prime number to the prover terminal;

[0028] The prover terminal is configured to:

[0029] receive the challenge value and the random prime number sent by the verifier terminal.

[0030] In a possible implementation, the verifier terminal is configured to:

[0031] input the first commitment value into a first hash function to obtain the challenge value;

[0032] input the first commitment value into a second hash function to obtain the random prime number.

[0033] In a possible implementation, the prover terminal is configured to:

[0034] for each of the n pieces of to-be-proved data, the prover terminal generates a response according to a formula s i = k i + cx i , wherein s i is the response, k i is one of the n integers, c is the challenge value, and x iFor each of the n pieces of to-be-proved data.

[0035] In a possible implementation, the prover terminal is configured to:

[0036] For each response, the product of the preset security parameter and the random prime number is calculated, the response is divided by the product, and a first positive integer is obtained as a quotient and a second positive integer is obtained as a remainder.

[0037] In a possible implementation, the prover terminal calculates a first commitment value according to the n positive integers, including:

[0038] The prover terminal calculates a first commitment value according to a formula , wherein R is the first commitment value, g i is a public parameter, k i is one of the n integers;

[0039] The prover terminal calculates a second commitment value according to the first positive integer, including:

[0040] The prover terminal calculates a second commitment value according to a formula , wherein D is the second commitment value, d i is the second positive integer;

[0041] The verifier terminal is configured to verify whether an equation is established, and if the equation is established, it is determined that the verifier terminal exists n pieces of to-be-proved data, so that , wherein the second commitment value, the q is the preset security parameter, the l is the random prime number, the c is the challenge value, the e i is the second positive integer, and the w is a value known to the verifier terminal, the x i is the i th piece of to-be-proved data in the n pieces of to-be-proved data.

[0042] In a third aspect, a zero-knowledge proof device is provided, and the device is applied to a prover terminal, and the device includes:

[0043] A selection module is configured to select n integers in a preset integer range, wherein the n is a preset positive integer;

[0044] A sending module is configured to calculate a first commitment value according to the n integers, and send the first commitment value to a verifier terminal.

[0045] obtain a challenge value and a random prime number, and for each of the n pieces of to-be-proved data, generate a response according to the to-be-proved data, the challenge value and one of the n integers by the prover terminal, wherein the challenge value is a positive integer less than a preset security parameter, and the random prime number is less than the preset security parameter;

[0046] compute, for each response, a first positive integer and a second positive integer according to the response, the preset security parameter and the random prime number, wherein the response is equal to a sum of a product of the first positive integer, the preset security parameter and the random prime number and the second positive integer;

[0047] The sending module is further configured to compute a second commitment value according to the first positive integer, and send the second commitment value and the second positive integer corresponding to each response to the verifier terminal, so that the verifier terminal verifies the n pieces of to-be-proved data according to the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value and the second positive integer corresponding to each response.

[0048] In a possible implementation, the obtaining module is configured to:

[0049] receive the challenge value and the random prime number sent by the verifier terminal.

[0050] In a possible implementation, the obtaining module is configured to:

[0051] input the first commitment value into a first hash function to obtain the challenge value;

[0052] input the first commitment value into a second hash function to obtain the random prime number.

[0053] In a possible implementation, the obtaining module is configured to:

[0054] for each of the n pieces of to-be-proved data, generate a response according to a formula s i =k i +cx i , wherein s i is the response, k i is one of the n integers, c is the challenge value, and x i is each of the n pieces of to-be-proved data.

[0055] In a possible implementation, the computing module is configured to:

[0056] For each response, the prover terminal calculates a product of the preset security parameter and the random prime number, divides the response by the product, and obtains a first positive integer as a quotient and a second positive integer as a remainder.

[0057] In a possible implementation, the sending module is configured to:

[0058] The first commitment value R is calculated according to the formula wherein R is the first commitment value, g is a public parameter, and k is a random integer. i i The first commitment value R is calculated according to the formula

[0059] The second commitment value D is calculated according to the formula wherein D is the second commitment value, d is the i th response corresponding first positive integer. i

[0060] In a fourth aspect, a terminal is provided, which includes a processor and a memory. The memory stores at least one instruction, which is loaded and executed by the processor to implement the operations performed by the method for zero-knowledge proof according to the first aspect.

[0061] In a fifth aspect, a readable storage medium is provided, which stores at least one instruction. The instruction is loaded and executed by a processor to implement the operations performed by the method for zero-knowledge proof according to the first aspect.

[0062] In a sixth aspect, a computer program product is provided, which includes at least one instruction. The instruction is loaded and executed by a processor to implement the operations performed by the method for zero-knowledge proof according to the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 FIG. 1 is a flowchart of a method for zero-knowledge proof provided by an embodiment of the present application;

[0064] Figure 2 FIG. 3 is a flowchart of a method for secret key generation provided by an embodiment of the present application;

[0065] Figure 3 FIG. 4 is a flowchart of a method for ciphertext verification provided by an embodiment of the present application;

[0066] Figure 4 FIG. 5 is a schematic structural diagram of a device for zero-knowledge proof provided by an embodiment of the present application;

[0067] Figure 5 FIG. 6 is a schematic structural diagram of a terminal provided by an embodiment of the present application;

[0068] ​​Figure 6 is a structural schematic diagram of a terminal provided by an embodiment of the present application. DETAILED DESCRIPTION

[0069] To facilitate the understanding of the embodiments of the present application, the terms involved in the embodiments of the present application are explained as follows:

[0070] Digital Signature Algorithm (DSA):

[0071] The signer uses a private key to sign a message, and the verifier uses a public key to verify whether the received signature is correct. With the development of technology, the types of digital signature algorithms are also increasing. At present, commonly used digital signature algorithms include Elliptic Curve Digital Signature Algorithm (ECDSA), Threshold Elliptic Curve Digital Signature Algorithm (ThresholdECDSA), Schnorr signature algorithm, etc. Among them, the application of Elliptic Curve Digital Signature Algorithm is relatively more extensive. Elliptic Curve Digital Signature Algorithm can be applied to digital wallet, WiFi Protected Access 3 (WiFi WPA3), 5th Generation Mobile Communication Technology (5G) cellular network, Transport Layer Security (TLS) protocol used in browsers, confidential currency in blockchains, etc.

[0072] Multi-signature:

[0073] Multi-signature sets the required key combination, for example, two-thirds multi-signature, three-thirds multi-signature, four-thirds multi-signature, etc. Among them, two-thirds multi-signature means that there are a total of three signing parties, and two of the three signing parties are required to sign a message when signing. Three-thirds multi-signature means that there are a total of three signing parties, and all three signing parties are required to sign a message when signing. Four-thirds multi-signature means that there are a total of four signing parties, and three of the four signing parties are required to sign a message when signing.

[0074] A t-of-n multi-signature, also written as n-of-t multi-signature, refers to t different signers using t different private keys to generate t different signatures on the same message, where t < n, and each private key corresponds to a public key. For example, a 2-of-3 multi-signature refers to 2 different signers using 2 different private keys to generate 2 different signatures on the same message. In a transaction of a blockchain, t and n in the t-of-n multi-signature are determined and public, and a transaction is signed by t signers to generate t signatures, and the transaction is valid only when and if the t signatures can be verified by a verifier using the corresponding t public keys. That is, the verifier needs to verify the t signatures of the transaction one by one.

[0075] Threshold elliptic curve digital signature algorithm:

[0076] For the threshold elliptic curve digital signature algorithm, first, each signer obtains a unique part of a private key and signs a message using the obtained private key. Then, the signers jointly sign the message using their part of the private key to generate a signature and send it to the verifier for verification. Specifically, the signers interact with each other through a secure communication protocol, and each signer can obtain the signatures generated by other signers and generate a signature using the signatures of other signers and its own signature.

[0077] The verifier has a public key corresponding to the above private key, and the verifier only needs to verify a signature using this public key. Compared with the multi-signature, the computational cost of the verifier in the threshold elliptic curve digital signature algorithm is smaller.

[0078] Additive homomorphic encryption algorithm and zero-knowledge proof are basic algorithms for constructing threshold elliptic curve digital signature algorithm. Among them, the zero-knowledge proof can use the zero-knowledge proof provided by the embodiments of the present application.

[0079] The embodiments of the present application provide a method of zero-knowledge proof, which can be applied to key generation, verification of ciphertext legality and other processes in a digital signature scheme. Among them, the digital signature algorithm can be elliptic curve digital signature algorithm, threshold elliptic curve digital signature algorithm, Schnorr signature algorithm, etc.

[0080] The method of zero-knowledge proof provided by the embodiments of the present application is described below. Zero-knowledge proof means that the prover proves that he knows (x1,..., x n ) without revealing (x1,..., x n ) to the verifier, so that where w, n, g i For the verifier and the prover, both are public parameters, (x1,..., x n) are integers, w belongs to an unknown order group G, g1, g2...gn belong to a known order subgroup of the unknown order group G, and the order of the known order subgroup is q, q is also a public parameter for the prover and the verifier, and q is also referred to as a security parameter. n is a generator of the group G, the unknown order group G includes a known order subgroup, the order of the known order subgroup is q, q is also a public parameter for the prover and the verifier, and q is also referred to as a security parameter.

[0081] Referring to Figure 1 The processing flow of the method can include the following steps:

[0082] Step 101, the prover terminal randomly selects n integers (k1,..., kn) in [-B, B]. n ).

[0083] In implementation, the value of B is related to q and n, and n and B are configured by a technician according to actual requirements. B is also a public parameter for the prover terminal and the verifier terminal.

[0084] Step 102, the prover terminal calculates a random commitment and sends R to the verifier terminal.

[0085] Step 103, the prover terminal obtains a challenge value c and a random prime number l. Wherein, 0≤c≤q-1, l

[0086] In implementation, the prover terminal can obtain the challenge value c and the random prime number l in multiple ways, and the following describes several of them:

[0087] Method one,

[0088] After receiving R, the verifier terminal randomly generates a challenge value c and a random prime number l, and then sends c and l to the prover terminal. The prover terminal receives c and l sent by the verifier terminal.

[0089] Here, the verifier terminal can randomly select a positive integer as c in the range of [0, q-1], and randomly select a prime number as l in the prime numbers less than q.

[0090] Method two,

[0091] The prover terminal substitutes R and a first numerical value into a hash function to obtain the challenge value c, and substitutes R and a second numerical value into the hash function to obtain the random prime number l. Wherein, the first numerical value and the second numerical value are both preset values, and the first numerical value and the second numerical value are different.

[0092] Alternatively, the prover terminal substitutes R into a first hash function to obtain the challenge value c, and substitutes R into a second hash function to obtain the random prime number l.

[0093] Step 104, the prover terminal calculates a response s i=k i +cx i Where i takes the values ​​1, 2, ..., n, calculate d i e i , satisfying s i =d i ql+e i , where d i e is a positive integer i ∈[0, ql-1], calculate

[0094] In implementation, for (x1, ..., x...) n The prover terminal can calculate the corresponding response separately. The formula for calculating the response is: s i =k i +cx i In this way, we can get n responses.

[0095] For each response, calculate the condition that satisfies s. i =d i ql+e i d i e i The calculation method can be as follows:

[0096] Calculate the product of q and l, denoted as ql. Let s... i Dividing by ql, the quotient is d. i The remainder is e i .

[0097] For n responses, we can obtain (d1, ..., dn). n ) and (e1, ..., e n Then, calculate. The commitment value D is obtained.

[0098] Step 105: The prover terminal sends D and (e1, ..., e) to the verifier terminal. n ).

[0099] Step 106, Verifier Terminal Verification Equation Does it hold true? If the equation holds true, then it shows that the prover's terminal contains (x1, ..., x). n ), making

[0100] In practice, if step 103 is implemented using method two, then in step 106, the verifier terminal needs to use the same method as in method two to calculate the challenge value c and the random prime number l, and then verify the above equation.

[0101] For the equation in step 106, if we... s i = k i + cx i , s i = d i ql + e i Substituting the above equation, it can be found that the equation is established, which can prove that there is (x1,..., x n ) such that

[0102] In the method for zero-knowledge proof provided in the embodiments of the present application, the challenge value c and the random prime number l can be obtained in at most one interaction, while in the related art, at least three interactions are required to obtain them. In comparison, the zero-knowledge proof provided in the embodiments of the present application has smaller calculation cost and communication cost than the related art.

[0103] The zero-knowledge proof provided in the embodiments of the present application can be applied in key generation. When applied in key generation, n = 1, w = pk, and x = sk, where pk is a public key and sk is a private key.

[0104] In the plurality of users participating in key generation, each user needs to act as a prover to perform the following processing of the prover terminal through the terminal, and each user also needs to act as a verifier to perform the following processing, and each two users perform the following interaction. For example, there are totally three users (user A, user B and user C), user A needs to act as a prover to perform interaction through the terminal and the terminals of user B and user C, at this time, the terminal of user A performs the following processing of the prover terminal, and user A also needs to act as a verifier to perform interaction through the terminal and the terminals of user B and user C, at this time, the terminal of user A performs the following processing of the verifier terminal, and user B and user C are the same.

[0105] The following describes the interaction between any two users. When two users interact, one is a prover and the other is a verifier.

[0106] Referring to Figure 2 , the processing steps for secret key generation implemented by using the zero-knowledge proof provided in the embodiments of the present application can be as follows:

[0107] Step 201: The prover terminal generates a random number u i , where 0≤u i < q-1, and u i is a positive integer.

[0108] In implementation, the prover terminal randomly selects a positive integer u i between 0 and q-1.

[0109] Step 202: The prover terminal sends u iInput a commitment function (com ( )), get kgc i and kgd i . Wherein, kgc i is a public value, kgd i is used to verify whether kgc i is correct.

[0110] In implementation, the commitment function can include two parts, one part is a random number generation function, and the other part is a hash function. Run the random number generation function to generate a random number kgd i . Input kgd i and u i to the other part of the hash function to get kgc i .

[0111] Step 203, the prover terminal gets the private key sk i and the public key pk i through the key generation algorithm of additive homomorphic encryption.

[0112] Step 204, the prover terminal sends kgc i , pkc i and kgd i to the verifier terminal.

[0113] In implementation, in order to ensure information security, kgc i , pk i and kgd i may not be sent at the same time, but kgc i and pk i are sent to the verifier terminal first, and then kgd i is sent to the verifier terminal.

[0114] Step 205, the prover terminal randomly selects an integer k i in [-B, B].

[0115] Step 206, the prover terminal calculates the random commitment R and sends R to the verifier terminal.

[0116] Step 207, the prover terminal gets the challenge value c and the prime number l. Wherein, 0≤c≤q-1, l

[0117] In implementation, the prover terminal can get the challenge value c and the prime number l in many ways, some of which are described as follows:

[0118] Method one,

[0119] The verifier terminal, after receiving R, randomly generates a challenge value c and a random prime number l, and then sends c and l to the prover terminal. The prover terminal receives c and l sent by the verifier terminal.

[0120] Here, the verifier terminal can randomly select a positive integer as c within the range of [0, q-1], and randomly select a prime number as l from the prime numbers less than q.

[0121] Method two,

[0122] The prover terminal substitutes R and a first numerical value into the hash function to obtain the challenge value c, and substitutes R and a second numerical value into the hash function to obtain the random prime number l. The first numerical value and the second numerical value are both preset values, and the first numerical value and the second numerical value are different.

[0123] Alternatively, the prover terminal substitutes R into a first hash function to obtain the challenge value c, and substitutes R into a second hash function to obtain the random prime number l.

[0124] Step 208, the prover terminal calculates the response s i = k i +c·sk i .

[0125] Calculate d i , e i , which satisfies s i =d i ql+e i , where d i is a positive integer, and e i ∈[0, ql-1].

[0126] Calculate

[0127] In implementation, d i , e i satisfying s i =d i ql+e i may be calculated as follows:

[0128] Calculate the product of q and l, denoted as ql. Divide s i by ql, and the quotient is d i , and the remainder is e i .

[0129] Step 209, send D and e i to the verifier terminal.

[0130] Step 210, the verifier terminal verifies whether the equation is established. If the equation is established, it can be proved that there is sk in the prover terminali such that That is, the proof pk i and sk i Indeed, the above relationship exists.

[0131] Step 211, the verifier terminal inputs kgc i and kgd i into the opening function open() corresponding to the commitment function, to obtain Q i , wherein Q i = u i P.

[0132] In implementation, each commitment function corresponds to an opening function, and the output Q i of the opening function and the input of the commitment function have a relationship.

[0133] Step 212, the verifier terminal calculates the public key to be used Correspondingly, u i is the private key corresponding to Q.

[0134] In implementation, the verifier terminal, when acting as a prover terminal, also obtains kgc j and kgd j according to the commitment function, and sends kgc j and kgd j to the verifier terminal. Wherein j belongs to 1 to n. In addition, the verifier terminal also needs to input kgc j and kgd j into the opening function to obtain Q j . After the verifier terminal calculates Q i sent by other prover terminals, the public key to be used Q can be obtained through the formula , and the public key to be used can be used to verify the signature.

[0135] In the method for zero-knowledge proof provided in the embodiments of the present application, the challenge value c and the random prime number l can be obtained in at most one interaction, while in the related art, at least three interactions are required, and compared with the related art, the zero-knowledge proof provided in the embodiments of the present application has smaller calculation cost and communication cost.

[0136] The method for zero-knowledge proof provided in the embodiments of the present application can also be extended to prove multiple discrete logarithm relationships simultaneously, which is described below by taking an example. The prover proves to the verifier that there exist m, ρ, such that C1 = f m pk ρ , C2 = g p ρwherein f is a generator of a known order subgroup of the group G, the order of the known order subgroup is f, m is the plaintext, C1 and C2 are ciphertexts encrypted by using an additive homomorphic encryption algorithm. The legitimacy of the ciphertexts can be verified by the following process, and the specific proving process is as follows:

[0137] Referring to Figure 3 The processing steps for implementing the ciphertext legitimacy verification by the zero-knowledge proof provided in the embodiments of the present application can be as follows:

[0138] Step 301, the prover terminal obtains plaintext m and a random number p.

[0139] In implementation, the prover terminal generates plaintext m and a random number p.

[0140] Step 302, the prover terminal randomly selects an integer s in [-B, B] ρ , and randomly selects an integer s m in [-B, B].

[0141] wherein s represents [0, q-1], and is contained in [-B, B]. Of course, s m may also be selected in [-B, B].

[0142] Step 303, the prover terminal calculates a random commitment and sends S1 and S2 to the verifier terminal.

[0143] Step 304, the prover terminal obtains challenge value c and random prime number l. Wherein 0≤c≤q-1, l

[0144] In implementation, the prover terminal can have multiple ways to obtain challenge value c and prime number l, and several of them are described as follows:

[0145] Method one,

[0146] After receiving S1 and S2, the verifier terminal randomly generates challenge value c and random prime number l, and then sends c and l to the prover terminal. The prover terminal receives c and l sent by the verifier terminal.

[0147] Here, the verifier terminal can randomly select a positive integer as c in the range of [0, q-1], and randomly select a prime number as l in the prime numbers less than q.

[0148] Method two,

[0149] The prover terminal substitutes S1, S2 and the first value into the hash function to obtain the challenge value c, and substitutes S1, S2 and the second value into the hash function to obtain the random prime number l. The first value and the second value are both preset values, and the first value and the second value are different.

[0150] Alternatively, the prover terminal substitutes S1 and S2 into the first hash function to obtain the challenge value c, and substitutes S1 and S2 into the second hash function to obtain the random prime number l.

[0151] In step 305, the prover terminal calculates the response u ρ = s ρ +c ρ , u m = s m +c m .

[0152] d ρ , e ρ are calculated, and s ρ = d ρ ql+e ρ , where d ρ is a positive integer, and e ρ ∈[0, ql-1].

[0153] d m , e m are calculated, and s m = d m ql+e m , where d ρ is a positive integer, and e ρ ∈[0, ql-1].

[0154]

[0155] In step 306, the prover terminal sends D1, D2, e ρ , e m to the verifier terminal.

[0156] In step 307, the verifier terminal verifies whether the equations and are established. If the equations are established, it can be proved that there are m and ρ in the prover terminal, such that C1 = f m pk ρ , C2 = g p ρ , that is, the ciphertext is legal.

[0157] In a possible implementation, since f is the generator of the subgroup of a known order, in step 305, d m , e m ​Correspondingly, the calculation formula of D1 in step 305 can be:

[0158] Further, in step 306, e m is sent instead of e m to replace e m .

[0159] Further, in step 307, the equation to be verified can be:

[0160] In the zero-knowledge proof method provided in the embodiments of the present application, the challenge c and the random prime number l can be obtained by the prover terminal in at most one interaction, while in the related art, at least three interactions with the verifier terminal are required to obtain the challenge c and the random prime number l, and the verifier terminal needs to perform verification twice. In comparison, the zero-knowledge proof provided in the embodiments of the present application has smaller calculation cost and communication cost than the related art.

[0161] Based on the same technical concept, the embodiments of the present application further provide a zero-knowledge proof device, which can be the prover terminal, as shown in Figure 4 The device includes a selection module 410, a sending module 420, an acquisition module 430, and a calculation module 440.

[0162] The selection module 410 is configured to select n integers in a preset integer range, where n is a preset positive integer. Figure 1 The selection module 410 can implement the processing of steps 101, Figure 2 steps 205, Figure 3 and steps 302.

[0163] The sending module 420 is configured to calculate a first commitment value according to the n integers, and send the first commitment value to the verifier terminal. Figure 1 The sending module 420 can implement the processing of steps 102, Figure 2 steps 206, Figure 3 and steps 303.

[0164] The acquisition module 430 is configured to acquire a challenge value and a random prime number. For each piece of to-be-proved data in the n pieces of to-be-proved data, the prover terminal generates a response according to the to-be-proved data, the challenge value, and one of the n integers. Figure 1 The acquisition module 430 can implement the processing of steps 103 and 104, Figure 2 steps 207 and 208, Figure 3 and steps 304 and 305.

[0165] The computing module 440 is configured to calculate, for each response, a first positive integer and a second positive integer according to the response, the preset security parameter, and the random prime number, where the response is equal to the sum of the product of the first positive integer, the preset security parameter, and the random prime number and the second positive integer. Specifically, the computing module 440 can implement the processing of step 104 of the method 100, Figure 1 step 208 of the method 200, Figure 2 step 305 of the method 300. Figure 3

[0166] The sending module 420 is further configured to calculate a second commitment value according to the first positive integer, and send the second commitment value and the second positive integer corresponding to each response to the verifier terminal, so that the verifier terminal verifies the n pieces of to-be-proved data according to the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value, and the second positive integer corresponding to each response. Specifically, the sending module 420 can implement step 105 of the method 100, Figure 1 step 209 of the method 200, Figure 2 step 306 of the method 300. Figure 3

[0167] In a possible implementation, the obtaining module 430 is configured to:

[0168] receive the challenge value and the random prime number sent by the verifier terminal.

[0169] In a possible implementation, the obtaining module 430 is configured to:

[0170] input the first commitment value into a first hash function to obtain the challenge value.

[0171] input the first commitment value into a second hash function to obtain the random prime number.

[0172] In a possible implementation, the obtaining module 430 is configured to:

[0173] for each piece of to-be-proved data in the n pieces of to-be-proved data, the prover terminal generates a response according to the formula s i =k i +cx i , where s i is the response, k i is one of the n integers, c is the challenge value, and x i is each piece of to-be-proved data in the n pieces of to-be-proved data.

[0174] In a possible implementation, the computing module 440 is configured to:

[0175] ​​For each response, the prover terminal calculates a product of the preset security parameter and the random prime number, divides the response by the product, and obtains a first positive integer as a quotient and a second positive integer as a remainder.

[0176] In a possible implementation, the sending module 420 is configured to:

[0177] The first commitment value R is calculated according to the formula The first commitment value R is calculated according to the formula i is a public parameter, and k i is one of the n integers.

[0178] The second commitment value D is calculated according to the formula The second commitment value D is calculated according to the formula i is the first positive integer corresponding to the i th response.

[0179] In the embodiments of the present application, the prover terminal can obtain the challenge c and the random prime number l in at most one interaction, while in the related art, the prover terminal needs to interact with the verifier terminal at least three times to obtain the challenge c and the random prime number l. In the related art, the verifier terminal needs to perform verification twice, while in the embodiments of the present application, the verifier terminal only needs to perform verification once at the end. In comparison, the zero-knowledge proof provided in the embodiments of the present application has smaller calculation cost and communication cost than the related art.

[0180] It should be noted that the zero-knowledge proof apparatus provided in the embodiments of the present application is only used as an example to divide the above functions, and in actual applications, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the prover terminal is divided into different functional modules to complete all or part of the above-described functions. In addition, the zero-knowledge proof apparatus provided in the embodiments of the present application and the zero-knowledge proof method embodiments belong to the same concept, and the specific implementation process is described in detail in the method embodiments, which will not be repeated here.

[0181] Figure 5 A structure block diagram of a terminal 500 provided in an example embodiment of the present application is shown. The terminal 500 can be a smart phone, a tablet computer, an MP3 (Moving Picture Experts Group Audio Layer III) player, an MP4 (Moving Picture Experts Group Audio Layer IV) player, a notebook computer, or a desktop computer. The terminal 500 can also be referred to as a user equipment, a portable terminal, a laptop terminal, a desktop terminal, or other names.

[0182] Generally, the terminal 500 includes a processor 501 and a memory 502.

[0183] The processor 501 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 501 can be implemented in at least one of a hardware form of a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), a PLA (Programmable Logic Array). The processor 501 can also include a main processor and a coprocessor. The main processor is a processor for processing data in an awake state, also referred to as a CPU (Central Processing Unit). The coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 501 can be integrated with a GPU (Graphics Processing Unit) for rendering and drawing content required to be displayed by a display screen. In some embodiments, the processor 501 can further include an AI (Artificial Intelligence) processor for processing computing operations related to machine learning.

[0184] The memory 502 can include one or more computer-readable storage media, which can be non-transitory. The memory 502 can also include a high-speed random access memory, and a nonvolatile memory such as one or more disk storage devices, flash storage devices. In some embodiments, the non-transitory computer-readable storage medium in the memory 502 is used to store at least one instruction for being executed by the processor 501 to implement the method of zero-knowledge proof provided by the method embodiments in the present application.

[0185] In some embodiments, the terminal 500 can also optionally include a peripheral device interface 503 and at least one peripheral device. The processor 501, the memory 502, and the peripheral device interface 503 can be connected through a bus or a signal line. Each peripheral device can be connected to the peripheral device interface 503 through a bus, a signal line, or a circuit board. Specifically, the peripheral device includes at least one of a radio frequency circuit 504, a touch display screen 505, a camera 506, an audio circuit 507, a positioning component 508, and a power supply 509.

[0186] The peripheral interface 503 can be used to connect at least one I / O (Input / Output) related peripheral device to the processor 501 and the memory 502. In some embodiments, the processor 501, the memory 502 and the peripheral interface 503 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 501, the memory 502 and the peripheral interface 503 can be implemented on a separate chip or circuit board, and the present embodiments are not limited in this regard.

[0187] The radio frequency circuit 504 is configured to receive and send RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 504 communicates with communication networks and other communication devices through electromagnetic signals. The radio frequency circuit 504 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals into electrical signals. Optionally, the radio frequency circuit 504 includes an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a subscriber identity module card, and the like. The radio frequency circuit 504 can communicate with other terminals through at least one wireless communication protocol. The wireless communication protocol includes but is not limited to: a metropolitan area network, various generations of mobile communication networks (2G, 3G, 4G and 5G), a wireless local area network and / or a WiFi (Wireless Fidelity) network. In some embodiments, the radio frequency circuit 504 can also include NFC (Near Field Communication) related circuitry, and the present application is not limited in this regard.

[0188] The display screen 505 is configured to display a UI (User Interface). The UI can include graphics, text, icons, video, and any combination thereof. When the display screen 505 is a touch display screen, the display screen 505 is further configured to capture touch signals on or above the surface of the display screen 505. The touch signals can be input to the processor 501 as control signals for processing. In this case, the display screen 505 can also be configured to provide virtual buttons and / or virtual keyboard, also known as soft buttons and / or soft keyboard. In some embodiments, the display screen 505 can be one, arranged on the front panel of the terminal 500; in other embodiments, the display screen 505 can be at least two, arranged on different surfaces of the terminal 500 or in a folding design; in still other embodiments, the display screen 505 can be a flexible display screen, arranged on a curved surface or a folding surface of the terminal 500. Even, the display screen 505 can also be arranged in an irregular shape other than a rectangle, i.e., a special-shaped screen. The display screen 505 can be made of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc.

[0189] The camera assembly 506 is configured to capture images or videos. Optionally, the camera assembly 506 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is arranged on the front panel of the terminal, and the rear-facing camera is arranged on the back of the terminal. In some embodiments, the rear-facing camera is at least two, which are any one of a main camera, a depth-of-field camera, a wide-angle camera, and a telephoto camera, to realize the background blur function by fusing the main camera and the depth-of-field camera, the panoramic shooting and VR (Virtual Reality) shooting function by fusing the main camera and the wide-angle camera, or other fusion shooting functions. In some embodiments, the camera assembly 506 can further include a flash. The flash can be a single-color-temperature flash or a dual-color-temperature flash. The dual-color-temperature flash refers to a combination of a warm light flash and a cold light flash, which can be used for light compensation under different color temperatures.

[0190] The audio circuit 507 can include a microphone and a speaker. The microphone is used to collect sound waves of a user and an environment, and convert the sound waves into an electrical signal input to the processor 501 for processing, or input to the radio frequency circuit 504 to realize voice communication. For the purpose of stereo sound collection or noise reduction, the microphone can be multiple, which are respectively arranged at different parts of the terminal 500. The microphone can also be an array microphone or an omnidirectional collection microphone. The speaker is used to convert an electrical signal from the processor 501 or the radio frequency circuit 504 into sound waves. The speaker can be a conventional diaphragm speaker, or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, not only can the electrical signal be converted into a sound wave audible to humans, but also can be converted into a sound wave inaudible to humans for ranging purposes. In some embodiments, the audio circuit 507 can also include a headphone jack.

[0191] The positioning component 508 is used to position the current geographic location of the terminal 500 to realize navigation or LBS (Location Based Service). The positioning component 508 can be a positioning component based on the GPS (Global Positioning System) of the United States, the Beidou system of China, the Glonass system of Russia, or the Galileo system of the European Union.

[0192] The power supply 509 is used to supply power to each component in the terminal 500. The power supply 509 can be alternating current, direct current, disposable batteries, or rechargeable batteries. When the power supply 509 includes rechargeable batteries, the rechargeable batteries can support wired charging or wireless charging. The rechargeable batteries can also be used to support fast charging technology.

[0193] Those skilled in the art can understand that the structure shown in FIG. 6 is not a limitation on the terminal 500, and the terminal 500 can include more or fewer components than those shown in the figure, or combine certain components, or use different component arrangements. Figure 5 The structure shown in FIG. 6 is not a limitation on the terminal 500, and the terminal 500 can include more or fewer components than those shown in the figure, or combine certain components, or use different component arrangements.

[0194] Figure 6 FIG. 6 is a structural schematic diagram of a terminal provided by an embodiment of the present application. The terminal 600 can have great differences due to different configurations or performances, and can include one or more processors (CPU) 601 and one or more memories 602, wherein the memory 602 stores at least one instruction, which is loaded and executed by the processor 601 to realize the method provided by each method embodiment described above. Of course, the terminal 500 can also have a wired or wireless network interface, a keyboard, and an input and output interface, and other components for realizing device functions, which are not described here.

[0195] In an example embodiment, a computer readable storage medium, such as a memory including instructions executable by a processor in a terminal to perform the method of zero-knowledge proof in the above embodiments, is also provided. The computer readable storage medium can be non-transitory. For example, the computer readable storage medium can be a ROM (Read-Only Memory), a RAM (Random Access Memory), a CD-ROM (Compact Disc Read-Only Memory), a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0196] In the present application, the terms "first", "second" and the like are used to distinguish between similar or identical items or items having substantially the same function, and it should be understood that there is no logical or chronological dependency between "first" and "second", nor does it limit the number and execution order.

[0197] A person of ordinary skill in the art can understand that all or part of the steps of the above embodiments can be completed by hardware, or by a program instructing relevant hardware, and the program can be stored in a computer readable storage medium, such as a read-only memory, a magnetic disk or an optical disk.

[0198] The above is only an optional embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method of zero-knowledge proof, characterized by, The method comprises: The prover terminal selects n integers in a preset integer range, wherein the n is a preset positive integer; The prover terminal calculates a first commitment value according to the n integers and sends the first commitment value to the verifier terminal; The prover terminal obtains a challenge value and a random prime number, and for each of the n pieces of to-be-proved data, the prover terminal generates a response according to the to-be-proved data, the challenge value and one of the n integers, wherein the challenge value is a positive integer less than a preset security parameter, and the random prime number is less than the preset security parameter; For each response, the prover terminal calculates a first positive integer and a second positive integer according to the response, the preset security parameter and the random prime number, wherein the response is equal to the sum of the product of the first positive integer, the preset security parameter and the random prime number and the second positive integer; The prover terminal calculates a second commitment value according to the first positive integer corresponding to each response, and sends the second commitment value and the second positive integer corresponding to each response to the verifier terminal, so that the verifier terminal verifies the n pieces of to-be-proved data according to the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value and the second positive integer corresponding to each response.

2. The method of claim 1, wherein, The prover terminal obtains a challenge value and a random prime number, comprising: Receiving the challenge value and the random prime number sent by the verifier terminal.

3. The method of claim 1, wherein, The prover terminal obtains a challenge value and a random prime number, comprising: Inputting the first commitment value into a first hash function to obtain the challenge value; Inputting the first commitment value into a second hash function to obtain the random prime number.

4. The method according to any one of claims 1 to 3, characterized in that, For each of the n pieces of to-be-proved data, the prover terminal generates a response according to the to-be-proved data, the challenge value and one of the n integers, comprising: For each of the n pieces of data to be proved, the prover terminal generates a response according to the formula s i =k i +cx i , wherein s i is the response, k i is one of the n integers, c is the challenge value, and x i is each of the n pieces of data to be proved.

5. The method according to any one of claims 1-3, characterized in that, For each response, the prover terminal calculates a first positive integer and a second positive integer according to the response, the preset security parameter and the random prime number, comprising: For each response, the prover terminal calculates the product of the preset security parameter and the random prime number, divides the response by the product, and obtains a first positive integer as the quotient and a second positive integer as the remainder.

6. The method according to any one of claims 1-3, characterized in that, The prover terminal calculates a first commitment value according to the n integers, comprising: The prover terminal calculates a first commitment value according to a formula , wherein R is the first commitment value, is a public parameter, is the i th integer in the n integers. The prover terminal calculates a second commitment value according to the first positive integer corresponding to each response, comprising: The prover terminal calculates a second commitment value according to the formula , wherein D is the second commitment value, is the first positive integer corresponding to the ith response.

7. A system for zero-knowledge proof, characterized by The system comprises a prover terminal and a verifier terminal, wherein: The prover terminal is configured to: select n integers in a preset integer range, wherein n is a preset positive integer; calculate a first commitment value according to the n integers, and send the first commitment value to the verifier terminal; obtain a challenge value and a random prime number; for each piece of to-be-proved data in n pieces of to-be-proved data, generate a response according to the to-be-proved data, the challenge value, and one of the n integers; the challenge value is a positive integer less than a preset security parameter, and the random prime number is less than the preset security parameter; for each response, calculate a first positive integer and a second positive integer according to the response, the preset security parameter, and the random prime number, wherein the response is equal to a sum of a product of the first positive integer, the preset security parameter, and the random prime number and the second positive integer; calculate a second commitment value according to the first positive integer, and send the second commitment value and the second positive integer corresponding to each response to the verifier terminal. The verifier terminal is configured to: verify the n pieces of to-be-proved data according to the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value, and the second positive integer corresponding to each response.

8. The system of claim 7, wherein, The verifier terminal is further configured to: generate a challenge value and a random prime number, and send the challenge value and the random prime number to the prover terminal. The prover terminal is configured to: receive the challenge value and the random prime number sent by the verifier terminal.

9. The system of claim 7, wherein, The prover terminal is configured to: input the first commitment value into a first hash function to obtain the challenge value. Input the first commitment value into a second hash function to obtain the random prime number.

10. The system of any of claims 7-9, wherein, The prover terminal is configured to: For each of the n pieces of data to be proved, the prover terminal generates a response according to the formula s i =k i +cx i , wherein s i is the response, k i is one of the n integers, c is the challenge value, and x i is each of the n pieces of data to be proved.

11. The system of any one of claims 7-9, wherein, The prover terminal is configured to: for each response, calculate a product of the preset security parameter and the random prime number, divide the response by the product to obtain a first positive integer, and obtain a second positive integer as a remainder.

12. The system of any one of claims 7-9, wherein, The prover terminal calculates a first commitment value according to the n integers, and the method comprises the following steps: The prover terminal calculates a first commitment value according to a formula , wherein R is the first commitment value, is a public parameter, is one of the n integers; The prover terminal calculates a second commitment value according to the first positive integer, and the method comprises the following steps: The prover terminal calculates a second commitment value according to the formula , wherein D is the second commitment value, is the first positive integer corresponding to the ith response. The verifier terminal is configured to verify whether an equation holds, and if the equation holds, determine that the verifier terminal has n pieces of to-be-proved data such that wherein q is a preset security parameter, l is a random prime number, c is a challenge value, e i is the second positive integer, w is a value known to the verifier terminal, x i is an i-th piece of to-be-proved data in the n pieces of to-be-proved data.

13. An apparatus for zero-knowledge proof, the apparatus comprising: The device is applied to a prover terminal, and the device comprises: a selection module configured to select n integers in a preset integer range, wherein n is a preset positive integer; a sending module configured to calculate a first commitment value according to the n integers, and send the first commitment value to a verifier terminal; an obtaining module configured to obtain a challenge value and a random prime number, and for each piece of to-be-proved data in n pieces of to-be-proved data, the prover terminal generates a response according to the to-be-proved data, the challenge value, and one of the n integers, wherein the challenge value is a positive integer less than a preset security parameter, and the random prime number is less than the preset security parameter; a calculation module configured to, for each response, calculate a first positive integer and a second positive integer according to the response, the preset security parameter, and the random prime number, wherein the response is equal to a sum of a product of the first positive integer, the preset security parameter, and the random prime number and the second positive integer. The sending module is further configured to calculate a second commitment value according to the first positive integer, and send the second commitment value and a second positive integer corresponding to each response to the verifier terminal, so that the verifier terminal verifies the n pieces of data to be proved according to the second commitment value, the preset security parameter, the random prime number, the first commitment value, the challenge value and the second positive integer corresponding to each response.

14. The apparatus of claim 13, wherein, The obtaining module is configured to: receive the challenge value and the random prime number sent by the verifier terminal.

15. The apparatus of claim 13, wherein, The obtaining module is configured to: input the first commitment value into a first hash function to obtain the challenge value; input the first commitment value into a second hash function to obtain the random prime number.

16. The apparatus of any one of claims 13-15, wherein, The obtaining module is configured to: For each of the n pieces of data to be proved, the prover terminal generates a response according to the formula s i =k i +cx i , wherein s i is the response, k i is one of the n integers, c is the challenge value, and x i is each of the n pieces of data to be proved.

17. The apparatus of any one of claims 13-15, wherein, The calculating module is configured to: for each response, the prover terminal calculates a product of the preset security parameter and the random prime number, divides the response by the product, and obtains a first positive integer as a quotient and a second positive integer as a remainder.

18. The apparatus of any one of claims 13-15, wherein, The sending module is configured to: The first commitment value is calculated according to the formula , wherein R is the first commitment value, is a public parameter, is one of the n integers; The second commitment value is calculated according to the formula , wherein D is the second commitment value, is the first positive integer corresponding to the i-th response.

19. A terminal, characterized by The terminal comprises a processor and a memory, and the memory stores at least one instruction which is loaded and executed by the processor to implement the operations performed by the method for zero-knowledge proof according to any one of claims 1-6.

20. A readable storage medium, characterized by, The readable storage medium stores at least one instruction which is loaded and executed by the processor to implement the operations performed by the method for zero-knowledge proof according to any one of claims 1-6.

Images