A fast verification method and device for partial subset calculation of vector commitment

Abstract

The present invention discloses a fast verification method and device for partial subset calculation of vector commitment, wherein the proving party obtains a subset of the public keys of the signed third parties according to several signed third parties corresponding to the aggregate signature, performs calculation based on the public key subset, obtains a first aggregate public key, generates a certificate based on the public key subset of the signed third party, the public key non-subset of the unsigned third party and the first aggregate public key, and sends the first aggregate public key and the certificate to the verifying party, wherein the certificate is used to prove that each public key in the public key subset is included in the Merkle tree, and proves that the first aggregate public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties; the verifying party verifies the first aggregate public key based on the certificate. By verifying the partial subset calculation result (i.e., the first aggregate public key), the verifying party can further verify the corresponding aggregate signature based on the first aggregate public key, thereby realizing fast verification of the corresponding transaction.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer science and cryptography, and in particular relates to a fast verification method and device for partial subset calculation of vector commitment. Background Art

[0002] In real-world scenarios, it is often necessary to open multiple nodes and use the calculation results of node subsets (such as subset sums) to perform corresponding operations. For example, in a digital currency trading system, transactions require signature authentication using aggregated signatures formed by multiple third parties. The corresponding public keys of multiple signers here are selected from a set, and this set is committed using vector commitments (especially Merkle trees). The transaction recipient (who is also the verifier) ​​needs to verify the aggregated signature using the aggregated public key, and for important aggregated public keys, it is necessary to verify that they are indeed aggregated from a subset of the signer set.

[0003] Currently, the verification of a subset of Merkle tree members is usually done by verifying the subset members and the corresponding Merkle paths. In addition, there is no way to quickly verify the sum of the subset members, for example:

[0004] "Charalampos Papamanthou, Shravan Srinivasan, Nicolas Gailly, IsmaelHishon-Rezaizadeh, Andrus Salumets, Stjepan Golemac: Reckle Trees: UpdatableMerkle Batch Proofs with Applications. IEEE Symposium on Security and Privacy(SP) 2024" provides an updateable Merkle tree batch proof scheme, but its cryptographic structure is complex and contains multiple recursive zero-knowledge proofs. The original Merkle tree commitment scheme needs to be adjusted, which is incompatible with existing applications and does not prove the correctness of the subset member calculations;

[0005] "Lu Rao, Hua Zhang, Tengfei Tu: Dynamic Outsourced Auditing Servicesfor Cloud Storage Based on Batch-Leaves-Authenticated Merkle Hash Tree. IEEE Trans. Serv. Comput. 13(3): 451-463 (2020)" proposes a Merkle tree structure for batch verification of leaf nodes, but it requires adjusting the structure and node information of the original Merkle tree, which is incompatible with existing applications. At the same time, the verification speed is slow and the overhead is high. Summary of the invention

[0006] The purpose of the embodiments of the present application is to provide a method and device for quickly verifying partial subset calculation of vector commitments in order to address the problems existing in the prior art.

[0007] According to a first aspect of an embodiment of the present application, a fast verification method for partial subset calculation of vector commitment is provided, which is applied to a prover, and includes:

[0008] According to a number of signed third parties corresponding to the aggregate signature, a subset of public keys of the signed third parties is obtained, and a first aggregate public key is obtained by performing calculation based on the subset of public keys;

[0009] Generate a certificate based on the signed third-party public key subset, the unsigned third-party public key non-subset, and the first aggregate public key, wherein the certificate is used to prove that each public key in the public key subset is included in the Merkle tree, and that the first aggregate public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0010] The first aggregate public key and the certificate are sent to a verifier, so that the verifier verifies the first aggregate public key based on the certificate.

[0011] Further, generating a certificate based on the signed third party's public key subset, the unsigned third party's public key non-subset and the first aggregate public key includes:

[0012] Using the public key set of all third parties as secret information, constructing a Merkle tree commitment proof subcircuit, and using the second Merkle tree root calculated by the Merkle tree commitment proof subcircuit as public information;

[0013] Linking the public key subset of the signed third party and the public key non-subset of the unsigned third party to obtain a reorganized public key set, using the number of the signed third parties as public information and the public key set and the reorganized public key set as secret information to construct a permutation proof subcircuit, the Merkle tree commitment proof subcircuit and the permutation proof subcircuit together constitute a subset member correctness proof circuit, which is used to prove that each public key in the public key subset is included in the Merkle tree;

[0014] Taking the public key subset of the signed third party as secret information, constructing a calculation correctness proof subcircuit of the subset members, taking the second aggregate public key calculated by the calculation correctness proof circuit of the subset members and the number of the signed third parties as public information, the calculation correctness proof subcircuit of the subset members is used to prove that the first aggregate public key is calculated by the public key subset;

[0015] The Merkle tree commitment proof subcircuit, the permutation proof subcircuit and the computational correctness proof circuit of the subset members are combined into a proof circuit, a proof key generated by a trusted third party based on the proof circuit is obtained, and a proof is generated based on the proof key and the public information and secret information of all subcircuits.

[0016] Furthermore, based on the public key set of all third parties and the Merkle tree public parameters , the Merkle tree commitment proof subcircuit Compute the second Merkle root , Represents a Merkle tree commitment.

[0017] Furthermore, the permutation proof subcircuit Generate a random number based on the number of signed third parties , calculate the polynomial and , and and The same is a constraint, where is the set of public keys of all third parties, , is the reorganized public key set, is the public key subset of the signed third party, is a non-subset of the public key of the unsigned third party, .

[0018] Furthermore, the calculation correctness proof circuit of the subset member Based on the public key subset, a second aggregate public key is calculated ,in The aggregate public key calculation function agreed upon by the prover and the verifier, is the set of signed third parties, is the public key of the third party that signed the document.

[0019] According to a second aspect of an embodiment of the present application, a fast verification device for partial subset calculation of vector commitment is provided, which is applied to a prover, and includes:

[0020] A partial subset calculation module, used to obtain a public key subset of the signed third party according to a number of signed third parties corresponding to the aggregate signature, and perform calculation based on the public key subset to obtain a first aggregate public key;

[0021] a proof generation module, configured to generate a proof based on the signed third party's public key subset, the unsigned third party's public key non-subset, and the first aggregated public key, wherein the proof is used to prove that each public key in the public key subset is included in the Merkle tree, and that the first aggregated public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0022] A sending module is used to send the first aggregate public key and the certificate to a verifier, so that the verifier verifies the first aggregate public key based on the certificate.

[0023] According to a third aspect of an embodiment of the present application, a fast verification method for partial subset calculation of vector commitment is provided, which is applied to a verification party and includes:

[0024] Receive the aggregated public key and the certificate sent by the prover, wherein the prover obtains a subset of the public keys of the signed third parties according to the multiple signed third parties corresponding to the aggregate signature, and obtains a first aggregated public key by performing calculation based on the subset of the public keys; generates a certificate based on the subset of the public keys of the signed third parties, the non-subset of the public keys of the unsigned third parties, and the first aggregated public key, wherein the certificate is used to prove that each public key in the subset of the public keys is included in the Merkle tree, and that the first aggregated public key is calculated from the subset of the public keys, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0025] Based on the proof, the first aggregated public key is verified.

[0026] According to a fourth aspect of an embodiment of the present application, a fast verification device for partial subset calculation of vector commitment is provided, which is applied to a verification party and includes:

[0027] A receiving module, configured to receive an aggregated public key and a certificate sent by a proving party, wherein the proving party obtains a subset of public keys of the signed third parties according to a number of signed third parties corresponding to the aggregated signature, and performs calculation based on the subset of public keys to obtain a first aggregated public key; and generates a certificate based on the subset of public keys of the signed third parties, a non-subset of public keys of unsigned third parties, and the first aggregated public key, wherein the certificate is used to prove that each public key in the subset of public keys is included in a Merkle tree, and that the first aggregated public key is calculated from the subset of public keys, and that the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0028] A verification module is used to verify the first aggregate public key based on the proof.

[0029] According to a fifth aspect of an embodiment of the present application, there is provided an electronic device, including:

[0030] one or more processors;

[0031] A memory for storing one or more programs;

[0032] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in the first aspect or the third aspect.

[0033] According to a sixth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored. When the instructions are executed by a processor, the steps of the method described in the first aspect or the third aspect are implemented.

[0034] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0035] As can be seen from the above embodiments, the present application uses a zero-knowledge proof protocol (such as Halo2, Plonk) to make the proof size very small (can reach a constant level, about hundreds of bytes), greatly reducing the storage overhead and computational overhead of the verifier; this enables the transaction verifier to quickly and efficiently verify the proof. A new logic for verifying the subset members of the vector commitment (Merkle tree) is constructed, that is, the original member set that can correctly generate the commitment is equivalent to the new set containing the subset members. This proof logic is fully compatible with existing application implementations, and there is no need to modify the original data structure of the Merkle tree, which improves the efficiency and accuracy of the proof. The proof efficiency is independent of the size of the subset, and has advantages when the subset is large; for example, when the number of public keys aggregated by the aggregated public key is linear (linear for the total number of public keys), the proof efficiency is high. By embedding the calculation logic of the subset members into the circuit to be proved, the present application can support all subset member calculation logics that can be converted into arithmetic circuits, and has a wide range of applications. For example, the operation of calculating the aggregated public key requires the public keys in the subset to be summed, and the calculation logic of the present application supports this operation. By verifying the calculation results of some subsets (i.e., the aggregated public key), the verifier can further verify the corresponding aggregated signature based on the aggregated public key, thereby achieving rapid verification of the corresponding transaction.

[0036] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0038] Figure 1 A fast verification method for partial subset calculation of vector commitment is shown in FIG. 1 according to an exemplary embodiment.

[0039] Figure 2 The invention is a flowchart of a fast verification method (applied to a prover) for partial subset calculation of a vector commitment according to an exemplary embodiment.

[0040] Figure 3 The invention is a flowchart of a fast verification method (applied to a verification party) for partial subset calculation of vector commitment according to an exemplary embodiment.

[0041] Figure 4 The invention is a block diagram of a fast verification device (applied to a prover) for partial subset calculation of a vector commitment according to an exemplary embodiment.

[0042] Figure 5The diagram is a block diagram of a fast verification device (applied to a verification party) for partial subset calculation of vector commitment according to an exemplary embodiment.

[0043] Figure 6 The diagram is a schematic diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0044] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0045] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0046] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0047] Terminology explanation:

[0048] 1) Vector commitment

[0049] A cryptographic structure that represents a vector, that is, an ordered set of elements, as .in is the first elements. A vector promises to the entire vector Make a commitment , and we can prove that an element in a vector , without exposing the entire vector.

[0050] 2) Hash function

[0051] A function that maps arbitrary-length input to fixed-length output, with one-way and collision-resistant properties. One-way means that given a hash value, it is impossible (difficult) to reverse-compute its original image input. Collision-resistant means that it is difficult to find two different input values ​​that have the same hashed output value.

[0052] 3) Succinct Non-Interactive Zero-Knowledge Argument (ZK-SNARK)

[0053] A cryptographic technique that allows one party (the prover) to prove to another party (the verifier) ​​that he knows certain information or that certain information satisfies certain conditions without revealing any specific details. At the same time, simplicity ensures that the proof size is small and the verification speed is fast. Non-interactive means that the two parties do not need to interact with each other except for passing the proof.

[0054] 4) Fiat-Shamir Transformation

[0055] In interactive proofs, the prover and the verifier interact in multiple rounds to complete the proof protocol. Fiat-Shamir

[0056] The transformation replaces the verifier's information (also called the challenge) with the output of the hash function to eliminate interactivity. Specifically, the input of the hash function is the public information and all the information records before each round (also called transcripts). , where the transcript is of the form , It is the information sent by the prover in round i.

[0057] 5) Elliptic Curve

[0058] It is a special type of algebraic curve that is widely used in number theory, cryptography and other mathematical fields. Elliptic curves over wired fields are usually represented by the following standard equation ,in The modulus is a prime number The point form on the elliptic curve is The points on the elliptic curve form a group, and the order of the group is q.

[0059] like Figure 1As shown, this application proposes a fast verification method for partial subset calculation of vector commitment, which can be applied to security and privacy-related applications such as blockchain, and is mainly divided into calculation phase, proof phase and verification phase. The calculation phase calculates the commitment and subset calculation results as public information, the proof phase constructs and proves the correctness proof circuit of subset members and the calculation correctness proof circuit of subset members, and the verification phase verifies the proof based on the public information.

[0060] A fast verification method for partial subset calculation of vector commitment, which is applied in digital currency transaction systems (such as Ethereum). The prover (i.e., the transaction sender) signs the transaction information through multiple third parties, obtains multiple single signatures and further obtains the aggregate signature corresponding to all the single signatures. The transaction receiver needs to verify the aggregate signature to ensure that the multiple single signatures corresponding to the aggregate signature are obtained by the above-mentioned third-party signatures (by using the aggregate public key to verify the aggregate signature). At the same time, it must be ensured that the aggregate public key for verifying the aggregate signature is correctly aggregated by some subset members. Based on the verification of the aggregate public key, the verifier can further verify the corresponding aggregate signature, thereby realizing the verification of the corresponding transaction.

[0061] Before the transaction begins, all third parties (i.e. all members) should have made vector commitments based on their respective public keys. In this application, the specific vector commitment form is a Merkle tree, and the hash function used is a zero-knowledge proof-friendly hash function - Poseidon. The set of public keys of all members that need to be committed is ,in is the total number of member public keys, that is . Each public key is a point on the elliptic curve, that is, ,in For the public key coordinate, For the public key coordinate, The prime number domain specified for the signature. Specifically, the following processes may be involved:

[0062] A) Determine the Merkle tree construction

[0063] First, the members agree on all the necessary construction parameters of the Merkle tree. For example, the height and number of members of the first Merkle tree, which represents the commitment to the size of the collection vector. At the same time, the parameters of the hash function used are determined, such as the prime number domain on which it works. (Based on the public key Setting), and the hash rate RATE of the hash function: , It is the public parameter of the Merkle tree.

[0064] B) Compute vector commitment

[0065] Based on the previous step, the vector commitment is calculated based on the set of public keys that need to be committed and the agreed parameters. Calculate the iterative hash: .in, represents the height (i.e. the number of layers) of the first Merkle tree, Represents the node number in the current layer. Each leaf node of the first Merkle tree is a BLS public key. This vector commitment is based on the public parameter Public key set Commitment , which is the first Merkle root: , Represents a Merkle tree commitment.

[0066] Based on the above settings, a fast verification method for partial subset calculation of vector commitment provided by the present application may include:

[0067] Step S1: The prover obtains a subset of public keys of the signed third parties according to the signed third parties corresponding to the aggregate signature, and performs calculation based on the subset of public keys to obtain a first aggregate public key;

[0068] At this stage, according to the agreed subset subscript , get the subset . According to the calculation function agreed upon by both parties in advance , calculate the corresponding result: For example, the members in the subset are summed up to calculate the BLS aggregate public key: .

[0069] Step S2: the prover generates a certificate based on the signed third-party public key subset, the unsigned third-party public key non-subset and the first aggregated public key, and sends the first aggregated public key and the certificate to the verifier, wherein the certificate is used to prove that each public key in the public key subset is included in the Merkle tree, and that the first aggregated public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0070] In this process, the prover needs to prove the entire process, including proving the calculation results of the subset members and that the subset members are indeed included in the initial set of vector commitments. Here, a more efficient method is used to generate the proof circuit. After that, a concise non-interactive zero-knowledge proof protocol is used to generate the proof.

[0071] (1) Subset membership correctness proof circuit

[0072] For all subset members, it is necessary to prove that each of them is included in the Merkle tree. This is mainly done through two parts: Merkle tree proof and permutation proof.

[0073] First, the prover holds all subset members and non-subset members, and constructs a Merkle tree according to their initial vector arrangement. The public key set of all third parties is used as secret information to construct a Merkle tree commitment proof subcircuit, and the second Merkle tree root calculated by the Merkle tree commitment proof subcircuit is used as public information, that is, the logic of the circuit is as follows:

[0074] Public information: Second Merkle root

[0075] Secret Message:

[0076] Calculation circuit:

[0077] Convert the Merkle tree commitment logic into a circuit, which is recorded as This circuit ensures that the Merkle tree commitment is indeed computed from the set of all public keys.

[0078] Then, by linking all subset members and non-subset members , forming a reorganized public key set, which is also a vector, recorded as . It is necessary to prove that the new member set and the original member set in the vector commitment are in a permutation relationship. The so-called permutation relationship means that the members in the two vector sets correspond one to one, but the order in the vector is different. If the permutation relationship holds, it can be shown that the new member set and the member set in the commitment are completely equivalent. It can also be shown that all the subset members are indeed in the original set of the vector commitment. Taking the number of the signed third parties as public information, and the public key set and the reorganized public key set as secret information, a permutation proof subcircuit is constructed to convert this relationship into a circuit, that is, the circuit logic is as follows:

[0079] Public information: Subset size

[0080] Verifier Challenge: Random Number

[0081] Secret Message:

[0082] Calculation circuit:

[0083]

[0084]

[0085] in is a permutation function. This application does not provide the permutation function as secret information, but proves the permutation relationship between the two by proving the equality of polynomials. Here’s how it works:

[0086] Evaluating Polynomials

[0087] Evaluating Polynomials

[0088] Get random numbers , this random number can be obtained by Fiat-shamir transformation .in is a hash function, refers to the public information of the subset membership correctness proof circuit, namely the subset size and the second Merkle tree root. Refers to the transcript.

[0089] prove , that is, prove =

[0090] So the final circuit to prove the permutation relationship is:

[0091] Public information: Subset size

[0092] Verifier Challenge: Random Number

[0093] Secret Message:

[0094] Calculation circuit:

[0095]

[0096] =

[0097] Let this circuit be , this circuit ensures that the union of subset members and non-subset members is completely consistent with the originally promised set. In other words, the set formed by some subset members is indeed included in the original set. In this way, the attribution proof of all subset members is completed.

[0098] (2) Subset member calculation correctness proof circuit

[0099] For all subset members, perform calculations and obtain the calculation results , using the public key subset of the signed third party as secret information, constructing a calculation correctness proof subcircuit for the subset members, using the second aggregate public key calculated by the calculation correctness proof circuit for the subset members and the number of the signed third parties as public information, the corresponding circuit logic is as follows:

[0100] Public information: Second aggregate public key , subset size

[0101] Secret Information:

[0102] Calculation circuit:

[0103]

[0104] Let this circuit be This circuit ensures that the calculation result / sum result (aggregate public key) is indeed correctly calculated by the subset members. (3) Proof Generation

[0105] According to the above three circuits, the public information (that is, the output of the circuit) is determined as the second Merkle tree root and the second aggregate public key , subset size , random number (that is, both the prover and the verifier should know that there is a random number and that the random number is part of the proof). And use a concise non-interactive zero-knowledge proof algorithm to combine the Merkle tree commitment proof subcircuit, the permutation proof subcircuit and the computational correctness proof circuit of the subset member into a proof circuit, obtain the proof key generated by the trusted third party based on the proof circuit, and generate a proof based on the proof key and the public information and secret information of all subcircuits:

[0106] (3.1) Synthesize the final circuit: ( ),in representation synthesis, including unified circuit inputs and constraints;

[0107] (3.2) Generate global parameters: ,in It is a key generation function in a concise non-interactive zero-knowledge proof algorithm. is a safety parameter, is the proof key, It is the verification key. pk and vk are completed by a trusted third party and sent to the prover and verifier respectively.

[0108] (3.3) Generate proof: .in is the proof generation function in the concise non-interactive zero-knowledge proof algorithm, Refers to all public information mentioned in the above circuit, Refers to all secret information mentioned in the above circuit.

[0109] Step S3: The verifier verifies the first aggregated public key based on the proof;

[0110] The verifier can use the public information of the proof and the corresponding circuit (the second Merkle tree root) , Second aggregate public key , subset size ), plus the verification key and the first Merkle root in the digital currency transaction system that is open to everyone , to quickly verify the partial subset calculation result of the vector commitment, that is, the first aggregate public key After verifying that the first aggregate public key is correct and valid, in this scenario, the corresponding aggregate signature can be verified by the calculation result of the subset member, that is, the first aggregate public key RES. Once the aggregate signature is verified, the transaction is considered valid. In this way, the verifier completes the quick verification of the transaction. The verification process is as follows:

[0111] Verify public information: Determine whether and , if both are equal, continue the verification operation;

[0112] Verification Proof: ;

[0113] Verify multi-signature: .

[0114] in is the verification function of a concise non-interactive zero-knowledge proof, It is the verification function of the aggregate signature.

[0115] Based on the above method, this application proposes a fast verification method for partial subset calculation of vector commitment, which is applied to the prover, referring to Figure 2 , the method may include:

[0116] S11: obtaining a subset of public keys of the signed third parties corresponding to the aggregate signature, and performing calculation based on the subset of public keys to obtain a first aggregate public key;

[0117] S12: Generate a certificate based on the signed third-party public key subset, the unsigned third-party public key non-subset, and the first aggregated public key, wherein the certificate is used to prove that each public key in the public key subset is included in the Merkle tree, and that the first aggregated public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0118] S13: Send the first aggregate public key and the certificate to a verifier, so that the verifier verifies the first aggregate public key based on the certificate.

[0119] Based on the above method, this application also proposes a fast verification method for partial subset calculation of vector commitment, which is applied to the verification party, referring to Figure 3 , the method may include:

[0120] S21: receiving the aggregated public key and the certificate sent by the prover, wherein the prover obtains a subset of the public keys of the signed third parties according to the plurality of signed third parties corresponding to the aggregated signature, and performs calculation based on the subset of the public keys to obtain a first aggregated public key; generating a certificate according to the subset of the public keys of the signed third parties, the non-subset of the public keys of the unsigned third parties, and the first aggregated public key, wherein the certificate is used to prove that each public key in the subset of the public keys is included in the Merkle tree, and that the first aggregated public key is obtained by calculation based on the subset of the public keys, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0121] S22: Based on the proof, verify the first aggregated public key.

[0122] Corresponding to the aforementioned embodiment of the method for fast verification of partial subset calculation of vector commitment, the present application also provides an embodiment of an apparatus for fast verification of partial subset calculation of vector commitment.

[0123] This application proposes a fast verification device for partial subset calculation of vector commitment, referring to Figure 4 The device is applied to the proving party and may include:

[0124] A partial subset calculation module 11 is used to obtain a public key subset of the signed third party according to a number of signed third parties corresponding to the aggregate signature, and perform calculation based on the public key subset to obtain a first aggregate public key;

[0125] A proof generating module 12, configured to generate a proof based on the signed third party's public key subset, the unsigned third party's public key non-subset and the first aggregated public key, wherein the proof is used to prove that each public key in the public key subset is included in the Merkle tree, and that the first aggregated public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0126] The sending module 13 is used to send the first aggregate public key and the certificate to the verification party, so that the verification party verifies the first aggregate public key based on the certificate.

[0127] This application also proposes a fast verification device for partial subset calculation of vector commitment, referring to Figure 5 , the device is applied to the verification party and may include:

[0128] A receiving module 21 is used to receive an aggregated public key and a certificate sent by a prover, wherein the prover obtains a subset of public keys of the signed third parties according to a number of signed third parties corresponding to the aggregate signature, and performs calculation based on the subset of public keys to obtain a first aggregated public key; generates a certificate based on the subset of public keys of the signed third parties, a non-subset of public keys of unsigned third parties, and the first aggregated public key, wherein the certificate is used to prove that each public key in the subset of public keys is included in a Merkle tree, and that the first aggregated public key is calculated from the subset of public keys, and that the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system;

[0129] The verification module 22 is used to verify the first aggregate public key based on the proof.

[0130] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0131] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0132] Accordingly, the present application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned fast verification method for partial subset calculation of vector commitment. Figure 6 As shown, a hardware structure diagram of a device having data processing capability for fast verification of partial subset calculation of vector commitment provided by an embodiment of the present invention is shown, except Figure 6 In addition to the processor, memory and network interface shown, any device with data processing capability in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capability, which will not be described in detail.

[0133] Accordingly, the present application also provides a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by the processor, the fast verification method for partial subset calculation of vector commitment as described above is implemented. The computer-readable storage medium can be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card (Flash Card), etc. equipped on the device. Furthermore, the computer-readable storage medium can also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and can also be used to temporarily store data that has been output or is to be output.

[0134] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

Claims

1. A fast verification method for partial subset computation of vector commitments, characterized in that: Applicable to the proving party, including: According to a number of signed third parties corresponding to the aggregate signature, a subset of public keys of the signed third parties is obtained, and a first aggregate public key is obtained by performing calculation based on the subset of public keys; Generate a certificate based on the signed third-party public key subset, the unsigned third-party public key non-subset, and the first aggregate public key, wherein the certificate is used to prove that each public key in the public key subset is included in the Merkle tree, and that the first aggregate public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system; Sending the first aggregate public key and the certificate to a verifier, so that the verifier verifies the first aggregate public key based on the certificate; The step of generating a certificate according to the signed third party's public key subset, the unsigned third party's public key non-subset, and the first aggregated public key includes: Using the public key set of all third parties as secret information, constructing a Merkle tree commitment proof subcircuit, and using the second Merkle tree root calculated by the Merkle tree commitment proof subcircuit as public information; Linking the public key subset of the signed third party and the public key non-subset of the unsigned third party to obtain a reorganized public key set, using the number of the signed third parties as public information and the public key set and the reorganized public key set as secret information to construct a permutation proof subcircuit, the Merkle tree commitment proof subcircuit and the permutation proof subcircuit together constitute a subset member correctness proof circuit, which is used to prove that each public key in the public key subset is included in the Merkle tree; Taking the public key subset of the signed third party as secret information, constructing a calculation correctness proof subcircuit of the subset members, taking the second aggregate public key calculated by the calculation correctness proof circuit of the subset members and the number of the signed third parties as public information, the calculation correctness proof subcircuit of the subset members is used to prove that the first aggregate public key is calculated by the public key subset; The Merkle tree commitment proof subcircuit, the permutation proof subcircuit and the computational correctness proof circuit of the subset members are combined into a proof circuit, a proof key generated by a trusted third party based on the proof circuit is obtained, and a proof is generated based on the proof key and the public information and secret information of all subcircuits.

2. The method according to claim 1, characterized in that Based on the public key set of all third parties and the Merkle tree public parameters , the Merkle tree commitment proof subcircuit Compute the second Merkle root , Represents a Merkle tree commitment.

3. The method according to claim 1, characterized in that The permutation proof subcircuit Generate a random number based on the number of signed third parties , calculate the polynomial and , and and The same is a constraint, where is the set of public keys of all third parties, , is the reorganized public key set, is the public key subset of the signed third party, is a non-subset of the public key of the unsigned third party, .

4. The method according to claim 1, characterized in that The computational correctness proof circuit of the subset members Based on the public key subset, a second aggregate public key is calculated ,in The aggregate public key calculation function agreed upon by the prover and the verifier, is the set of signed third parties, is the public key of the third party that signed the document.

5. A fast verification device for partial subset calculation of vector commitment, characterized in that: Applicable to the proving party, including: A partial subset calculation module, used to obtain a public key subset of the signed third party according to a number of signed third parties corresponding to the aggregate signature, and perform calculation based on the public key subset to obtain a first aggregate public key; a proof generation module, configured to generate a proof based on the signed third party's public key subset, the unsigned third party's public key non-subset, and the first aggregated public key, wherein the proof is used to prove that each public key in the public key subset is included in the Merkle tree, and that the first aggregated public key is calculated from the public key subset, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system; A sending module, configured to send the first aggregated public key and the certificate to a verifier, so that the verifier verifies the first aggregated public key based on the certificate; The step of generating a certificate according to the signed third party's public key subset, the unsigned third party's public key non-subset, and the first aggregated public key includes: Using the public key set of all third parties as secret information, constructing a Merkle tree commitment proof subcircuit, and using the second Merkle tree root calculated by the Merkle tree commitment proof subcircuit as public information; Linking the public key subset of the signed third party and the public key non-subset of the unsigned third party to obtain a reorganized public key set, using the number of the signed third parties as public information and the public key set and the reorganized public key set as secret information to construct a permutation proof subcircuit, the Merkle tree commitment proof subcircuit and the permutation proof subcircuit together constitute a subset member correctness proof circuit, which is used to prove that each public key in the public key subset is included in the Merkle tree; Taking the public key subset of the signed third party as secret information, constructing a calculation correctness proof subcircuit of the subset members, taking the second aggregate public key calculated by the calculation correctness proof circuit of the subset members and the number of the signed third parties as public information, the calculation correctness proof subcircuit of the subset members is used to prove that the first aggregate public key is calculated by the public key subset; The Merkle tree commitment proof subcircuit, the permutation proof subcircuit and the computational correctness proof circuit of the subset members are combined into a proof circuit, a proof key generated by a trusted third party based on the proof circuit is obtained, and a proof is generated based on the proof key and the public information and secret information of all subcircuits.

6. A fast verification method for partial subset computation of vector commitments, characterized in that: Applicable to the verification party, including: Receive the aggregated public key and the certificate sent by the prover, wherein the prover obtains a subset of the public keys of the signed third parties according to the multiple signed third parties corresponding to the aggregate signature, and obtains a first aggregated public key by performing calculation based on the subset of the public keys; generates a certificate based on the subset of the public keys of the signed third parties, the non-subset of the public keys of the unsigned third parties, and the first aggregated public key, wherein the certificate is used to prove that each public key in the subset of the public keys is included in the Merkle tree, and that the first aggregated public key is calculated from the subset of the public keys, and the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system; Based on the proof, verifying the first aggregated public key; The proving party generates a certificate according to the signed third party's public key subset, the unsigned third party's public key non-subset and the first aggregated public key, including: Using the public key set of all third parties as secret information, constructing a Merkle tree commitment proof subcircuit, and using the second Merkle tree root calculated by the Merkle tree commitment proof subcircuit as public information; Linking the public key subset of the signed third party and the public key non-subset of the unsigned third party to obtain a reorganized public key set, using the number of the signed third parties as public information and the public key set and the reorganized public key set as secret information to construct a permutation proof subcircuit, the Merkle tree commitment proof subcircuit and the permutation proof subcircuit together constitute a subset member correctness proof circuit, which is used to prove that each public key in the public key subset is included in the Merkle tree; Taking the public key subset of the signed third party as secret information, constructing a calculation correctness proof subcircuit of the subset members, taking the second aggregate public key calculated by the calculation correctness proof circuit of the subset members and the number of the signed third parties as public information, the calculation correctness proof subcircuit of the subset members is used to prove that the first aggregate public key is calculated by the public key subset; The Merkle tree commitment proof subcircuit, the permutation proof subcircuit and the computational correctness proof circuit of the subset members are combined into a proof circuit, a proof key generated by a trusted third party based on the proof circuit is obtained, and a proof is generated based on the proof key and the public information and secret information of all subcircuits.

7. A fast verification device for partial subset calculation of vector commitment, characterized in that: Applicable to the proving party, including: A receiving module, configured to receive an aggregated public key and a certificate sent by a proving party, wherein the proving party obtains a subset of public keys of the signed third parties according to a number of signed third parties corresponding to the aggregated signature, and performs calculation based on the subset of public keys to obtain a first aggregated public key; and generates a certificate based on the subset of public keys of the signed third parties, a non-subset of public keys of unsigned third parties, and the first aggregated public key, wherein the certificate is used to prove that each public key in the subset of public keys is included in a Merkle tree, and that the first aggregated public key is calculated from the subset of public keys, and that the Merkle tree is constructed based on the public keys of all third parties in the digital currency transaction system; a verification module, configured to verify the first aggregated public key based on the proof; The proving party generates a certificate according to the signed third party's public key subset, the unsigned third party's public key non-subset and the first aggregated public key, including: Using the public key set of all third parties as secret information, constructing a Merkle tree commitment proof subcircuit, and using the second Merkle tree root calculated by the Merkle tree commitment proof subcircuit as public information; Linking the public key subset of the signed third party and the public key non-subset of the unsigned third party to obtain a reorganized public key set, using the number of the signed third parties as public information and the public key set and the reorganized public key set as secret information to construct a permutation proof subcircuit, the Merkle tree commitment proof subcircuit and the permutation proof subcircuit together constitute a subset member correctness proof circuit, which is used to prove that each public key in the public key subset is included in the Merkle tree; Taking the public key subset of the signed third party as secret information, constructing a calculation correctness proof subcircuit of the subset members, taking the second aggregate public key calculated by the calculation correctness proof circuit of the subset members and the number of the signed third parties as public information, the calculation correctness proof subcircuit of the subset members is used to prove that the first aggregate public key is calculated by the public key subset; The Merkle tree commitment proof subcircuit, the permutation proof subcircuit and the computational correctness proof circuit of the subset members are combined into a proof circuit, a proof key generated by a trusted third party based on the proof circuit is obtained, and a proof is generated based on the proof key and the public information and secret information of all subcircuits.

8. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4 and 6.

9. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method as described in any one of claims 1-4 and 6 are implemented.

Images