A method for constructing a non-interactive commitment protocol with XOR homomorphic structure

Abstract

The present invention discloses a construction method of a non-interactive commitment protocol of XOR homomorphism. The method includes: generating a commitment key and transmitting it to a sender and a receiver; then, the sender generates a commitment ciphertext and auxiliary information according to the commitment information and the commitment key, and sends the commitment ciphertext to the receiver; then, based on the commitment calculation circuit, the sender and the receiver perform a commitment calculation together to obtain the calculated commitment ciphertext, the calculated auxiliary information, and the calculated commitment information; finally, the receiver performs a commitment verification according to the commitment key, the calculated commitment ciphertext, the calculated auxiliary information, and the calculated commitment information to obtain a verification result. The commitment protocol constructed by the method proposed by the present invention realizes XOR homomorphism, and the constructed commitment protocol is based on discrete logarithms, and can use elliptic curves, requiring only a small ciphertext space, saving the ciphertext size.

Description

Technical Field

[0001] The invention relates to a construction method of a commitment protocol, in particular to a construction method of a XOR-homomorphic non-interactive commitment protocol. Background Art

[0002] Commitment protocols are widely used in various scenarios. As an important basic component, commitment protocols are used to build a variety of secret state protocols, such as zero-knowledge proofs, active secure multi-party computing protocols, etc.

[0003] The document Pedersen, Torben Pryds. Non-Interactive and Information-TheoreticSecure Verifiable Secret Sharing. CRYPTO 91 discloses a Pedersen commitment protocol. However, Pedersen commitment has additive homomorphism, but not XOR homomorphism.

[0004] The document S. Goldwasser, S. Micali. Probabilistic encryption&how to playmental poker keeping secret all partial information. STOC82 discloses a GM encryption system. Although the GM encryption system has XOR homomorphism, a XOR homomorphic commitment protocol can be constructed through the GM encryption system, but the homomorphic commitment constructed by the GM encryption system is based on factorization, which requires a huge ciphertext space.

[0005] Therefore, it is necessary to propose a method for constructing a XOR homomorphic commitment protocol that requires a smaller ciphertext space. Summary of the invention

[0006] In order to solve the needs and problems in the background technology, the present invention proposes a method for constructing a non-interactive commitment protocol of XOR homomorphism. The commitment protocol constructed by the method proposed by the present invention originates from the Pedersen commitment, but further realizes XOR homomorphism. The commitment protocol constructed by the method proposed by the present invention is based on discrete logarithms, can use elliptic curves, requires only a small ciphertext space, and saves ciphertext size.

[0007] The technical solution of the present invention is as follows:

[0008] 1. A Method for Constructing a XOR Homomorphic Non-Interactive Commitment Protocol

[0009] Generate a commitment key ck using a key generation algorithm and transmit it to the sender and receiver;

[0010] The sender generates the commitment ciphertext c and the auxiliary information d according to the commitment information m and the commitment key ck, and sends the commitment ciphertext c to the receiver;

[0011] Based on the commitment calculation circuit, the sender and the receiver perform commitment calculation together to obtain the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m';

[0012] The receiver performs commitment verification according to the commitment key ck, the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', and obtains a verification result.

[0013] The key generation algorithm specifically includes:

[0014] First, we use the security parameter λ to randomly generate the modulus q and the generator g on the group G, where g∈G; then we use the security parameter λ to randomly generate the modulus q and the generator g on the group G, where g∈G; q A random number α is randomly selected as the trapdoor td, and the base h is calculated at the same time. The calculation formula is h=g α ; Finally, the commitment key ck is set to ck=(G,q,g,h), and the commitment key ck and trapdoor td are output.

[0015] The commitment calculation circuit is based on which the sender and the receiver perform commitment calculation together to obtain the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', including:

[0016] The commitment calculation circuit includes a commitment XOR gate, a commitment and public plaintext AND gate, and a commitment and public plaintext XOR gate. In each gate, the sender calculates the auxiliary information and the plaintext according to the input of the gate, and the receiver calculates the commitment ciphertext according to the input of the gate, thereby obtaining the output of the gate.

[0017] The commitment XOR gate is the first ciphertext calculation function g executed by the receiver xor and the first auxiliary information calculation function f performed by the sender xor And the plaintext XOR operation ⊕;

[0018] The commitment and the public plaintext are ANDed by a second ciphertext calculation function g executed by the receiver. pand and the second auxiliary information calculation function f performed by the sender pand and plaintext and operation composition;

[0019] The commitment and the public plaintext are XORed by the third ciphertext calculation function g executed by the receiver pxor and the third auxiliary information calculation function f performed by the sender pxor And the plaintext XOR operation ⊕.

[0020] The key generation algorithm also generates a trapdoor td, and transmits the trapdoor td to the sender. ~ The sender uses the trapdoor algorithm to modify the calculated commitment information m' to generate pseudo auxiliary information d ~ , based on the commitment key ck, the calculated commitment ciphertext c', and the pseudo auxiliary information d ~ And the target plaintext m ~ After the commitment verification is performed, the verification result is obtained.

[0021] The step of generating the commitment ciphertext c and the auxiliary information d according to the commitment information m and the commitment key ck includes:

[0022] First, from a size of 2 λ The finite field Z2 λ Randomly select an offset ρ and a finite field Z of size q q The mask r is randomly selected, and λ is the security parameter; then, the commitment ciphertext c is calculated, and the calculation formula satisfies c=g 2ρ+m h r , and calculate the auxiliary information d, the calculation formula satisfies d=(ρ,r), where q is the modulus, g is the generator, and h is the base.

[0023] The commitment verification is performed according to the commitment key ck, the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', including:

[0024] The commitment verification specifically verifies whether the following formula is satisfied:

[0025]

[0026] d'=(ρ',r')

[0027] Among them, q is the modulus, g is the generator, ρ' is the calculated offset, r' is the calculated mask, and h is the base.

[0028] The trapdoor algorithm is used to modify the calculated commitment information m' to generate pseudo auxiliary information d ~ ,include:

[0029] First, from a size of 2 λ The finite field Z2 λ Randomly select a pseudo offset ρ ~ ; Next, calculate the pseudo mask r ~ , the calculation formula is r ~ =(2ρ+m-2ρ ~ +m ~ )α -1+r, where ρ is the offset, r is the mask, λ is the security parameter, and α is a random number equal to the trapdoor value, thereby obtaining pseudo auxiliary information d ~ , satisfying d ~ =(ρ ~ ,r ~ ).

[0030] In the commitment XOR gate, the first ciphertext calculation function g xor is the multiplication operation;

[0031] The first auxiliary information calculation function f xor Specifically include:

[0032] First, calculate the output mask r of the commitment XOR gate z1 , the calculation formula is r z1 =r x1 +r y1 , r x1 is the first input mask of the XOR gate, r y1 is the second input mask of the commitment XOR gate; and calculates the output offset ρ of the commitment XOR gate z1 , the calculation formula is ρ z1 =2ρ x1 + 2ρ y1 +m x1 m y1 , ρ x1 is the first input offset of the committed XOR gate, ρ y1 is the second input offset of the XOR gate; m x1 and m y1 are the commitment information in the two inputs of the commitment XOR gate respectively; thus obtaining the auxiliary information d in the output of the commitment XOR gate z1 , satisfying d z1 =(ρ z1 ,r z1 );

[0033] In the commitment and public plaintext AND gate, the second ciphertext calculation function g pand For exponential operation, specifically c z2 =c y2 ^h x1 ,h x1 For the commitment and public plaintext, the public plaintext held by both the receiver and the sender in the AND gate input, c y2 The commitment ciphertext in the AND gate input is the commitment and public plaintext, c z2 The commitment ciphertext in the output of the AND gate is the commitment and public plaintext; ^ represents the power, i.e. c y2 ^h x1 c y2 h x1 Power;

[0034] The second auxiliary information calculation function f pand Specifically include:

[0035] First, calculate the output mask r of the commitment and public plaintext AND gate z2 , the calculation formula is r z2 =r y2 ×h x1 , r y2 is the input mask of the AND gate for commitment and public plaintext, h x1 The public plaintext held by both the receiver and the sender in the input of the commitment and public plaintext AND gate; and the output offset ρ of the commitment and public plaintext AND gate is calculated z2 , the calculation formula is ρ z2 =ρ y2 , ρ y2 is the input offset of the commitment and public plaintext AND gate; thus obtaining the auxiliary information d in the output of the commitment and public plaintext AND gate z2 , satisfying d z2 =(ρ z2 ,r z2 );

[0036] In the XOR gate between the commitment and the public plaintext, the second ciphertext calculation function g pand Specifically include:

[0037] c z3 =c y3 g^h x2

[0038] Among them, h x2 The public plaintext held by both the receiver and the sender in the XOR gate input is the commitment and the public plaintext, c y3 Find the commitment ciphertext in the XOR gate input for the commitment and the public plaintext, c z3 Find the commitment ciphertext in the output of the XOR gate input for the commitment and the public plaintext, g is the generator;

[0039] The third auxiliary information calculation function f pxor Specifically include:

[0040] First, calculate the output mask r of the XOR gate between the commitment and the public plaintext z3 , the calculation formula is r z3 =r y3 , r y3 Find the input mask of the XOR gate for the commitment and the public plaintext; and calculate the output offset ρ of the AND gate for the commitment and the public plaintext z3 , the calculation formula is ρ z3 =ρ y3 +h x2 ,hx2 Find the public plaintext held by both the receiver and the sender in the XOR gate input for the commitment and the public plaintext, ρ y3 The input offset of the XOR gate for the commitment and the public plaintext is obtained; thus, the auxiliary information d in the output of the AND gate for the commitment and the public plaintext is obtained. z3 , satisfying d z3 =(ρ z3 ,r z3 ).

[0041] The sender completes the proof without disclosing the commitment information m, thereby generating a proof script π, and transmits the proof script π to the recipient. The recipient performs a range proof according to the proof script π during the calculation process.

[0042] The sender completes the proof without disclosing the commitment information m, thereby generating a proof script π, including:

[0043] First, extract the bits of the offset commitment information x bit by bit to obtain the first bit list b0,…,b i ,…,b λ , x=2ρ+m, ρ is the offset, λ is the safety parameter;

[0044] Next, calculate the starting source commitment B0 and source commitment B1,…, B i ,…,B λ , the calculation formula is as follows:

[0045] B0= c / ∏ i=1 λ B i (2^i)， ,i∈{1,…,λ}

[0046] B i =(g^b i ) (h^s i )

[0047] Among them, s i is a finite field Z of size q q A random number randomly selected from the above is recorded as the random offset, c is the committed ciphertext, g is the generator, and h is the base;

[0048] Then, in a finite field Z of size q q Randomly select the first mask list u0,…, u i ,…,u λ 、Second mask list b0',…, b i ' ,…,b λ ' and the third mask list s0',…, s i ' ,…,s λ', calculate commitment B using the following formula i ' and the cross term D i :

[0049] B i '= (g^b i ') (h^s i '), i∈{0,…,λ}

[0050] D i = (g^( b i ⋅b i ')) (h^u i );

[0051] Then use the following formula to calculate the hash value e:

[0052] e=hash(g,h,C,B0,…,B λ ,B0',…,B λ ',D0,…,D λ )

[0053] Wherein, hash() represents a hash function;

[0054] Finally, generate the proof script π, satisfying the following formula:

[0055]

[0056] t i = b i '+ b i ·e,z i = s i '+s i ·e,w i = s i (et i ) + u i ;

[0057] Among them, t i is the first proof auxiliary information, z i is the auxiliary information of the second proof, w i Auxiliary information for the third proof.

[0058] The recipient performs range proof according to the proof script π during the calculation process, including:

[0059] The recipient calculates the starting source commitment B0 and hash value e;

[0060] The verification is correct if and only if the following formula holds:

[0061] (B i ) e Bi '= (g^t i ) (h^z i ), (B i ^(e- t i ))D i = (h^w i ), i∈{1,…,λ}.

[0062] 2. A computer device

[0063] The computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the construction method of the XOR homomorphic non-interactive commitment protocol when executing the computer program.

[0064] 3. A computer-readable storage medium

[0065] The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for constructing the XOR-homomorphic non-interactive commitment protocol.

[0066] IV. A COMPUTER PROGRAM PRODUCT

[0067] The computer program product comprises a computer program / instruction, which, when executed by a processor, implements the steps of the construction method of the XOR homomorphic non-interactive commitment protocol.

[0068] The beneficial effects of the present invention are as follows:

[0069] The commitment protocol constructed by the method proposed in the present invention originates from the Pedersen commitment, but further realizes XOR homomorphism. The commitment protocol constructed by the method proposed in the present invention is based on discrete logarithms, can use elliptic curves, requires only a small ciphertext space, and saves ciphertext size. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 The figure is a flow chart of the method of the present invention.

[0071] Figure 2 Schematic diagram of performing commitment calculation according to the circuit.

[0072] Figure 3 Schematic diagram of the homomorphism of XOR commitment.

[0073] Figure 4 Schematic diagram of a commitment ciphertext sent with a range proof.

[0074] Figure 5 This is a schematic diagram showing the difference between the XOR commitment and the Pedersen commitment proposed in the present invention. DETAILED DESCRIPTION

[0075] In order to enable those skilled in the art to better understand the present invention, and thus to more clearly define the scope of protection claimed in the present invention, the present invention is described in detail with respect to certain specific embodiments and drawings of the present invention. It should be noted that the following are only certain specific implementation methods of the present invention, which are only part of the embodiments of the present invention, wherein the specific and direct description of the relevant structures is only for the convenience of understanding the present invention, and each specific feature does not naturally and directly limit the scope of implementation of the present invention. The conventional selections and substitutions made by those skilled in the art under the guidance of the present invention, as well as the reasonable arrangement and combination of several technical features under the guidance of the present invention, should all be deemed to be within the scope of protection claimed in the present invention.

[0076] The XOR commitment proposed in the present invention originates from the Pedersen commitment. Figure 5 Schematic diagram of the difference between the XOR commitment proposed by the present invention and the Pedersen commitment. The homomorphism of the XOR commitment proposed by the present invention is as follows: Figure 3 shown. Figure 1 The process of the sender and the receiver using the commitment protocol proposed in the present invention is described. First, the key generation algorithm will send the commitment key to the sender and the receiver. Then the sender will calculate the message to be committed through the commitment algorithm to obtain the commitment ciphertext, and send the commitment ciphertext to the receiver. The receiver can perform a series of calculations on the commitment ciphertext to obtain a new ciphertext c'. At the same time, the corresponding sender performs corresponding calculations on the commitment message and auxiliary information to obtain a new plaintext m' and auxiliary information d'. Finally, the sender can send the auxiliary information and the commitment message to the receiver. After the receiver obtains the auxiliary information and the commitment message, it can verify the correctness of the commitment.

[0077] The method for constructing a XOR-homomorphic non-interactive commitment protocol proposed by the present invention specifically includes:

[0078] The third party generates a commitment key ck using a key generation algorithm and transmits it to the sender and receiver;

[0079] The key generation algorithm specifically includes:

[0080] First, we use the security parameter λ to randomly generate the modulus q and the generator g on the group G, where g∈G; then we use the security parameter λ to randomly generate the modulus q and the generator g on the group G, where g∈G; q A random number α is randomly selected as the trap door td, that is, td=α, and the base h is calculated at the same time. The calculation formula is h=g α Finally, the commitment key ck is set to ck=(G,q,g,h), and the commitment key ck and trapdoor td are output. The group G selects an elliptic curve.

[0081] The sender generates the commitment ciphertext c and the auxiliary information d according to the commitment information m and the commitment key ck, and sends the commitment ciphertext c to the receiver;

[0082] Generate commitment ciphertext c and auxiliary information d based on commitment information m and commitment key ck, including:

[0083] First, from a size of 2 λ The finite field Z2 λ Randomly select an offset ρ and a finite field Z of size q q The mask r is randomly selected, and λ is the security parameter; then, the commitment ciphertext c is calculated, and the calculation formula satisfies c=Com(ck,m)= g 2ρ+m h r , and calculate the auxiliary information d. The calculation formula satisfies d=(ρ,r), that is, the auxiliary information d is composed of a two-tuple ρ, r, where q is the modulus, g is the generator, and h is the base.

[0084] Based on the commitment calculation circuit, after the sender and the receiver perform the commitment calculation together, they obtain the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', where the calculated commitment ciphertext c' still maintains a corresponding relationship with the calculated auxiliary information d' and the calculated commitment information m'. The sender sends the calculated auxiliary information d' and the calculated commitment information m' to the receiver; it can be expressed as:

[0085] (c',d',m')=Evl(C, {c0,d0,m0},…,{ c i ,d i ,m i},…,{ c n ,d n ,m n},h0,…h k )

[0086] Among them, Evl( ) is the commitment calculation function, c0,…,c n is a series of commitment ciphertexts held by the recipient, d0,…,d n is a series of auxiliary information held by the sender, m0,…,m n is a series of commitment information held by the sender, h0,…,h kis the public plaintext held by both the receiver and the sender, n+1 is the number of committed ciphertexts held by the receiver, and k+1 is the number of public plaintexts. C represents the commitment calculation circuit. The input of each gate of the circuit is the committed ciphertext, auxiliary information, and commitment information. After gate operation, the calculated committed ciphertext, auxiliary information, and commitment information are output. After layer-by-layer calculation, the calculated committed ciphertext c', calculated auxiliary information d', and calculated commitment information m' are finally obtained.

[0087] Based on the commitment calculation circuit, the sender and the receiver perform commitment calculation together to obtain the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', including:

[0088] like Figure 2 As shown, the commitment calculation circuit includes a commitment XOR gate, a commitment and public plaintext AND gate, and a commitment and public plaintext XOR gate. The commitment calculation circuit is a topological structure circuit composed of three types of gates. In each gate, the sender calculates the auxiliary information and the plaintext according to the input of the gate, and the receiver calculates the commitment ciphertext according to the input of the gate, thereby obtaining the output of the gate.

[0089] The commitment XOR gate is the first ciphertext computation function g executed by the receiver xor and the first auxiliary information calculation function f performed by the sender xor and the plaintext XOR operation ⊕, the input of the commitment XOR gate is recorded as {c x1 , d x1 , m x1 ,c y1 , d y1 ,m y1}, the output of the commitment XOR gate is recorded as {c z1 , d z1 , m z1}, satisfying c z1 =g xor (c x1 ,c y1 ) =Com(ck,m x1 ⊕m y1 ), d z1 =f xor (d x1 ,d y1 ), m z1 =m x1 ⊕m y1 , where c x1 , d x1 , m x1 are the commitment ciphertext, auxiliary information and commitment information in the first input of the commitment XOR gate, respectively, y1 , d y1 , my1 are the committed ciphertext, auxiliary information and committed information in the second input of the commitment XOR gate, respectively, z1 , d z1 , m z1 are respectively the committed ciphertext, auxiliary information and committed information in the output of the committed XOR gate;

[0090] The commitment and the public plaintext are ANDed together to form the second ciphertext computation function g executed by the receiver. pand and the second auxiliary information calculation function f performed by the sender pand and plaintext and operation The input of the commitment and public plaintext AND gate is denoted as {h x1 ,c y2 , d y2 , m y2}, the output of the commitment and public plaintext AND gate is recorded as {c z2 , d z2 , m z2}, satisfying c z2 = g pand (h x1 ,c y2 )=Com(ck,h x1 m y2 ), d z2 =f pand (h x1 ,d y2 ), m z2 =h x1 m y2 , where h x1 For the commitment and public plaintext, the public plaintext held by both the receiver and the sender in the AND gate input, c y2 , d y2 , m y2 are the commitment ciphertext, auxiliary information and commitment information in the AND gate input respectively, and c z2 , d z2 , m z2 are respectively the commitment ciphertext, auxiliary information and commitment information in the output of the commitment and public plaintext AND gate;

[0091] The commitment and the public plaintext are XORed together. The third ciphertext calculation function g is executed by the receiver. pxor and the third auxiliary information calculation function f performed by the sender pxor The input of the commitment and public plaintext XOR gate is denoted as {h x2 ,c y3 , d y3 , m y3}, the output of the XOR gate between the commitment and the public plaintext is recorded as {c z3 , d z3 , m z3}, satisfying c z3 =g pxor (h x2 ,c y3 )=Com(ck,h x2 m y3 ), d z3 = f pxor (h x2 ,d y3 ), m z3 =h x2 m y3 , where h x2 The public plaintext held by both the receiver and the sender in the XOR gate input is the commitment and the public plaintext, c y3 , d y3 , m y3 The commitment ciphertext, auxiliary information and commitment information in the XOR gate input are respectively the commitment and the public plaintext, c z3 , d z3 , m z3 The commitment ciphertext, auxiliary information and commitment information in the output of the XOR gate input are obtained for the commitment and public plaintext respectively.

[0092] In the commitment XOR gate, the first ciphertext calculation function g xor is the multiplication operation, that is, c z =c x ×c y ;

[0093] The first auxiliary information calculation function f xor Specifically include:

[0094] First, calculate the output mask r of the commitment XOR gate z1 , the calculation formula is r z1 =r x1 +r y1 , r x1 is the first input mask of the XOR gate, r y1 is the second input mask of the commitment XOR gate; and calculates the output offset ρ of the commitment XOR gate z1 , the calculation formula is ρ z1 =2ρ x1 + 2ρ y1 +m x1 m y1 , ρ x1 is the first input offset of the committed XOR gate, ρ y1is the second input offset of the XOR gate; m x1 and m y1 are the commitment information in the two inputs of the commitment XOR gate respectively; thus obtaining the auxiliary information d in the output of the commitment XOR gate z1 , satisfying d z1 =(ρ z1 ,r z1 ).

[0095] In the commitment and public plaintext AND gate, the second ciphertext calculation function g pand For exponential operation, specifically c z2 =c y2 ^h x1 ,h x1 For the commitment and public plaintext, the public plaintext held by both the receiver and the sender in the AND gate input, c y2 The commitment ciphertext in the AND gate input is the commitment and public plaintext, c z2 The commitment ciphertext in the output of the AND gate is the commitment and public plaintext; ^ represents the power, i.e. c y2 ^h x1 c y2 h x1 Power;

[0096] The second auxiliary information calculation function f pand Specifically include:

[0097] First, calculate the output mask r of the commitment and public plaintext AND gate z2 , the calculation formula is r z2 =r y2 ×h x1 , r y2 is the input mask of the AND gate for commitment and public plaintext, h x1 The public plaintext held by both the receiver and the sender in the input of the commitment and public plaintext AND gate; and the output offset ρ of the commitment and public plaintext AND gate is calculated z2 , the calculation formula is ρ z2 =ρ y2 , ρ y2 is the input offset of the commitment and public plaintext AND gate; thus obtaining the auxiliary information d in the output of the commitment and public plaintext AND gate z2 , satisfying d z2 =(ρ z2 ,r z2 ).

[0098] In the XOR gate between commitment and public plaintext, the second ciphertext calculation function g pand Specifically include:

[0099] c z3 =c y3 g^hx2

[0100] Among them, h x2 The public plaintext held by both the receiver and the sender in the XOR gate input is the commitment and the public plaintext, c y3 Find the commitment ciphertext in the XOR gate input for the commitment and the public plaintext, c z3 Find the commitment ciphertext in the output of the XOR gate input for the commitment and the public plaintext, g is the generator;

[0101] The third auxiliary information calculation function f pxor Specifically include:

[0102] First, calculate the output mask r of the XOR gate between the commitment and the public plaintext z3 , the calculation formula is r z3 =r y3 , r y3 Find the input mask of the XOR gate for the commitment and the public plaintext; and calculate the output offset ρ of the AND gate for the commitment and the public plaintext z3 , the calculation formula is ρ z3 =ρ y3 +h x2 ,h x2 Find the public plaintext held by both the receiver and the sender in the XOR gate input for the commitment and the public plaintext, ρ y3 The input offset of the XOR gate for the commitment and the public plaintext is obtained; thus, the auxiliary information d in the output of the AND gate for the commitment and the public plaintext is obtained. z3 , satisfying d z3 =(ρ z3 ,r z3 ).

[0103] It is worth noting that since the auxiliary information is held by the sender and the ciphertext information is held by the receiver, the calculation of the auxiliary information d is performed by the sender, and the calculation of the ciphertext c is performed by the receiver.

[0104] The receiver performs commitment verification based on the commitment key ck, the calculated commitment ciphertext c', the calculated auxiliary information d', and the calculated commitment information m', and obtains the verification result. It can be expressed as:

[0105] V=Verify(ck,c',m',d')

[0106] Wherein, V represents the verification result. When it is 1, it means that the calculated auxiliary information d' is the commitment verification of the calculated commitment information m', that is, the verification is passed. When it is 0, it is not, that is, the verification is not passed.

[0107] Commitment verification is performed based on the commitment key ck, the calculated commitment ciphertext c', the calculated auxiliary information d', and the calculated commitment information m', including:

[0108] Commitment verification specifically verifies whether the following formula is satisfied:

[0109]

[0110] d'=(ρ',r')

[0111] Among them, q is the modulus, g is the generator, ρ' is the calculated offset, r' is the calculated mask, and h is the base.

[0112] The key generation algorithm transmits the trapdoor td to the sender, according to the target plaintext m ~ The sender uses the trapdoor algorithm to modify the calculated commitment information m' to generate pseudo auxiliary information d ~ , which can be expressed as d ~ =Equiv(ck,td,c,m,d,m ~ ), based on the commitment key ck, the calculated commitment ciphertext c', and the pseudo auxiliary information d ~ And the target plaintext m ~ After the commitment verification, the verification result is obtained, that is, Verify(ck,c', m ~ , d ~ )=1, Verify() is the commitment verification function, "=1" means the verification is passed, and "=0" means the verification is not passed.

[0113] The calculated commitment information m' is modified using the trapdoor algorithm to generate pseudo auxiliary information d ~ ,include:

[0114] First, from a size of 2 λ The finite field Z2 λ Randomly select a pseudo offset ρ ~ ; Next, calculate the pseudo mask r ~ , the calculation formula is r ~ =(2ρ+m-2ρ ~ +m ~ )α -1 +r, where ρ is the offset, r is the mask, λ is the security parameter, and α is a random number equal to the trapdoor value, thereby obtaining pseudo auxiliary information d ~ , satisfying d ~ =(ρ ~ ,r ~ ).

[0115] The commitment function Com(ck,m) proposed in the present invention is valid only when 2ρ+m∈[0,q-1]. When 2ρ+m wraps around, the value of m will change, i.e., 2ρ+mq, the lowest bit 0 / 1 value will be converted. Therefore, the commitment protocol needs to ensure that ρ is less than a certain range during the calculation process. The present invention introduces a range proof to ensure that 2ρ+m maintains the correct range. The range is defined as Z2 λ , of which 2 λ is a value less than q.

[0116] The corresponding range proof is given below. When sending a commitment, the sender needs to prove to the receiver that 2ρ+m is in Z2 λ middle.

[0117] The recipient holds g, h, c, satisfying c = g 2ρ+m h r , the sender holds the offset commitment information x and r, x=2ρ+m.

[0118] like Figure 4 As shown, the sender completes the proof without leaking the commitment information m, thereby generating a proof script π, and transmits the proof script π to the recipient. The recipient performs a range proof based on the proof script π during the calculation process.

[0119] The sender completes the proof without revealing the commitment information m, thereby generating a proof script π, including:

[0120] First, extract the bits of the offset commitment information x bit by bit to obtain the first bit list b0,…,b i ,…,b λ ,x=2ρ+m=∑ (i=0) λ b i 2 i , b i is the first bit of the ith bit, ρ is the offset, and λ is the security parameter;

[0121] Next, calculate the starting source commitment B0 and source commitment B1,…, B i ,…,B λ , the calculation formula is as follows:

[0122] B0= c / ∏ i=1 λ B i (2^i) ,i∈{1,…,λ}

[0123] B i =(g^b i ) (h^s i )

[0124] Among them, s i is a finite field Z of size q q A random number randomly selected from the above is recorded as the random offset, c is the committed ciphertext, g is the generator, and h is the base; ^ represents the power, that is, 2^i is 2 to the power of i;

[0125] Then, in a finite field Z of size q q Randomly select the first mask list u0,…, u i ,…,u λ 、Second mask list b0',…, b i ' ,…,b λ ' and the third mask list s0',…, s i ' ,…,s λ ', calculate commitment B using the following formula i ' and the cross term D i :

[0126] B i '= (g^b i ') (h^s i '), i∈{0,…,λ}

[0127] D i = (g^( b i ⋅b i ')) (h^u i );

[0128] Then use the following formula to calculate the hash value e:

[0129] e=hash(g,h,C,B0,…,B λ ,B0',…,B λ ',D0,…,D λ )

[0130] Wherein, hash() represents a hash function;

[0131] Finally, generate the proof script π, satisfying the following formula:

[0132]

[0133] t i = b i '+ b i ·e,z i = s i '+s i ·e,w i = s i (et i ) + u i;

[0134] Among them, t i is the first proof auxiliary information, z i is the second proof auxiliary information, w i is the third proof auxiliary information.

[0135] The recipient performs range proof according to the proof script π during the calculation process, including:

[0136] The recipient calculates the starting source commitment B0 and the hash value e, and the formulas are as follows:

[0137] B0' = C / ∏ i=1 λ B i (2^i) ;

[0138] e' = hash(g, h, C, B0, …, B λ , B0', …, B λ ', D0, …, D λ );

[0139] If and only if the following formula holds, the verification is correct:

[0140] (B i ) e B i ' = (g^t i )(h^z i ), (B i ^(e - t i ))D i = (h^w i ), i ∈ {1, …, λ}.

[0141] For all commitments sent to the recipient, the sender needs to provide corresponding range proofs. It should be noted that since it is necessary to ensure that after multiple commitment calculations, 2ρ + m < q, this requires 2 λ ⋅N < q, where N is the number of times of performing the maximum exclusive OR calculation.

[0142] An apparatus for constructing an exclusive OR homomorphic non-interactive commitment protocol provided by an embodiment of the present invention includes one or more processors for implementing the method for constructing an exclusive OR homomorphic non-interactive commitment protocol in the above embodiment.

[0143] The embodiment of the construction device of a heterogeneous non-interactive commitment protocol of the present invention can be applied to any device with data processing capabilities, and the arbitrary device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located to read the corresponding computer program instructions in the non-volatile memory into the memory and run it. From the hardware level, it is a hardware structure diagram of any device with data processing capabilities where the construction device of a heterogeneous non-interactive commitment protocol of the present invention is located. In addition to the processor, memory, network interface, and non-volatile memory, the manufacturing of any device with data processing capabilities where the device in the embodiment is located can also include other hardware according to the actual function of the arbitrary device with data processing capabilities, which will not be described in detail.

[0144] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0145] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0146] An embodiment of the present invention further provides a readable storage medium having a program stored thereon. When the program is executed by a processor, a method for constructing a XOR-homomorphic non-interactive commitment protocol in the above embodiment is implemented.

[0147] The readable storage medium may be an internal storage unit of any device with data processing capability in any of the aforementioned embodiments, such as a hard disk or a memory. The readable storage medium may also be an external storage device, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the readable storage medium may also include both an internal storage unit of any device with data processing capability and an external storage device. The readable storage medium is used to store computer programs and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0148] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for constructing a non-interactive commitment protocol of XOR homomorphic nature, characterized in that: include: Generate a commitment key ck using a key generation algorithm and transmit it to the sender and receiver; The sender generates the commitment ciphertext c and the auxiliary information d according to the commitment information m and the commitment key ck, and sends the commitment ciphertext c to the receiver; Based on the commitment calculation circuit, the sender and the receiver perform commitment calculation together to obtain the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m'; The receiver performs commitment verification based on the commitment key ck, the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', and obtains the verification result; The commitment calculation circuit is based on which the sender and the receiver perform commitment calculation together to obtain the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', including: The commitment calculation circuit includes a commitment XOR gate, a commitment and public plaintext AND gate, and a commitment and public plaintext XOR gate. In each gate, the sender calculates the auxiliary information and the plaintext according to the input of the gate, and the receiver calculates the commitment ciphertext according to the input of the gate, thereby obtaining the output of the gate. The commitment XOR gate is the first ciphertext calculation function g executed by the receiver xor and the first auxiliary information calculation function f performed by the sender xor And the plaintext XOR operation ⊕; The commitment and the public plaintext are ANDed by a second ciphertext calculation function g executed by the receiver. pand and the second auxiliary information calculation function f performed by the sender pand and plaintext and operation composition; The commitment and the public plaintext are XORed by the third ciphertext calculation function g executed by the receiver pxor and the third auxiliary information calculation function f performed by the sender pxor And the plaintext XOR operation ⊕; In the commitment XOR gate, the first ciphertext calculation function g xor is the multiplication operation; The first auxiliary information calculation function f xor Specifically include: First, calculate the output mask r of the commitment XOR gate z1 , the calculation formula is r z1 =r x1 +r y1 , r x1 is the first input mask of the XOR gate, r y1 is the second input mask of the commitment XOR gate; and calculates the output offset ρ of the commitment XOR gate z1 , the calculation formula is ρ z1 =2ρ x1 + 2ρ y1 +m x1 m y1 , ρ x1 is the first input offset of the committed XOR gate, ρ y1 is the second input offset of the XOR gate; m x1 and m y1 are the commitment information in the two inputs of the commitment XOR gate respectively; thus obtaining the auxiliary information d in the output of the commitment XOR gate z1 , satisfying d z1 =(ρ z1 ,r z1 ); In the commitment and public plaintext AND gate, the second ciphertext calculation function g pand For exponential operation, specifically c z2 =c y2 ^h x1 ,h x1 For the commitment and public plaintext, the public plaintext held by both the receiver and the sender in the AND gate input, c y2 The commitment ciphertext in the AND gate input is the commitment and public plaintext, c z2 The commitment ciphertext in the output of the AND gate is the commitment and public plaintext; ^ represents the power; The second auxiliary information calculation function f pand Specifically include: First, calculate the output mask r of the commitment and public plaintext AND gate z2 , the calculation formula is r z2 =r y2 ×h x1 , r y2 is the input mask of the AND gate for commitment and public plaintext, h x1 The public plaintext held by both the receiver and the sender in the input of the commitment and public plaintext AND gate; and the output offset ρ of the commitment and public plaintext AND gate is calculated z2 , the calculation formula is ρ z2 =ρ y2 , ρ y2 is the input offset of the commitment and public plaintext AND gate; thus obtaining the auxiliary information d in the output of the commitment and public plaintext AND gate z2 , satisfying d z2 =(ρ z2 ,r z2 ); In the XOR gate between the commitment and the public plaintext, the second ciphertext calculation function g pand Specifically include: c z3 =c y3 g^h x2 Among them, h x2 The public plaintext held by both the receiver and the sender in the XOR gate input is the commitment and the public plaintext, c y3 Find the commitment ciphertext in the XOR gate input for the commitment and the public plaintext, c z3 Find the commitment ciphertext in the output of the XOR gate input for the commitment and the public plaintext, g is the generator; The third auxiliary information calculation function f pxor Specifically include: First, calculate the output mask r of the XOR gate between the commitment and the public plaintext z3 , the calculation formula is r z3 =r y3 , r y3 Find the input mask of the XOR gate for the commitment and the public plaintext; and calculate the output offset ρ of the AND gate for the commitment and the public plaintext z3 , the calculation formula is ρ z3 =ρ y3 +h x2 ,h x2 Find the public plaintext held by both the receiver and the sender in the XOR gate input for the commitment and the public plaintext, ρ y3 The input offset of the XOR gate for the commitment and the public plaintext is obtained; thus, the auxiliary information d in the output of the AND gate for the commitment and the public plaintext is obtained. z3 , satisfying d z3 =(ρ z3 ,r z3 ).

2. The method for constructing a XOR-homomorphic non-interactive commitment protocol according to claim 1, characterized in that: The key generation algorithm specifically includes: First, we use the security parameter λ to randomly generate the modulus q and the generator g on the group G, where g∈G; then we use the security parameter λ to randomly generate the modulus q and the generator g on the group G, where g∈G; q A random number α is randomly selected as the trapdoor td, and the base h is calculated at the same time. The calculation formula is h=g α ; Finally, the commitment key ck is set to ck=(G,q,g,h), and the commitment key ck and trapdoor td are output.

3. The method for constructing a XOR-homomorphic non-interactive commitment protocol according to claim 1, characterized in that: The key generation algorithm also generates a trapdoor td, and transmits the trapdoor td to the sender. ~ The sender uses the trapdoor algorithm to modify the calculated commitment information m' to generate pseudo auxiliary information d ~ , based on the commitment key ck, the calculated commitment ciphertext c', and the pseudo auxiliary information d ~ And the target plaintext m ~ After the commitment verification is performed, the verification result is obtained.

4. The method for constructing a XOR-homomorphic non-interactive commitment protocol according to claim 1, characterized in that: The step of generating the commitment ciphertext c and the auxiliary information d according to the commitment information m and the commitment key ck includes: First, from a size of 2 λ The finite field Z2 λ Randomly select an offset ρ and a finite field Z of size q q The mask r is randomly selected, and λ is the security parameter; then, the commitment ciphertext c is calculated, and the calculation formula satisfies c=g 2ρ+m h r , and calculate the auxiliary information d, the calculation formula satisfies d=(ρ,r), where q is the modulus, g is the generator, and h is the base.

5. The method for constructing a XOR-homomorphic non-interactive commitment protocol according to claim 1, characterized in that: The commitment verification is performed according to the commitment key ck, the calculated commitment ciphertext c', the calculated auxiliary information d' and the calculated commitment information m', including: The commitment verification specifically verifies whether the following formula is satisfied: d'=(ρ',r') Among them, q is the modulus, g is the generator, ρ' is the calculated offset, r' is the calculated mask, and h is the base.

6. The method for constructing a XOR-homomorphic non-interactive commitment protocol according to claim 3, characterized in that: The trapdoor algorithm is used to modify the calculated commitment information m' to generate pseudo auxiliary information d ~ ,include: First, from a size of 2 λ The finite field Z2 λ Randomly select a pseudo offset ρ ~ ; Next, calculate the pseudo mask r ~ , the calculation formula is r ~ =(2ρ+m-2ρ ~ +m ~ )α -1 +r, where ρ is the offset, r is the mask, λ is the security parameter, and α is a random number equal to the trapdoor value, thereby obtaining pseudo auxiliary information d ~ , satisfying d ~ =(ρ ~ ,r ~ ).

7. The method for constructing a XOR-homomorphic non-interactive commitment protocol according to claim 1, characterized in that: The sender completes the proof without disclosing the commitment information m, thereby generating a proof script π, and transmits the proof script π to the recipient. The recipient performs a range proof according to the proof script π during the calculation process.

8. The method for constructing a XOR-homomorphic non-interactive commitment protocol according to claim 7, characterized in that: The sender completes the proof without disclosing the commitment information m, thereby generating a proof script π, including: First, extract the bits of the offset commitment information x bit by bit to obtain the first bit list b0,…,b i ,…,b λ , x=2ρ+m, ρ is the offset, λ is the safety parameter; Next, calculate the starting source commitment B0 and source commitment B1,…, B i ,…,B λ , the calculation formula is as follows: B0 = c / ∏ i=1 λ B i (2^i) ,i∈{1,…,λ} B i =(g^b i ) (h^s i ) Among them, s i is a finite field Z of size q q A random number randomly selected from the above is recorded as the random offset, c is the committed ciphertext, g is the generator, h is the base; ^ represents the power; Then, in a finite field Z of size q q Randomly select the first mask list u0,…, u i ,…,u λ 、Second mask list b0',…, b i ' ,…,b λ ' and the third mask list s0',…, s i ' ,…,s λ ', calculate commitment B using the following formula i ' and the cross term D i : B i '= (g^b i ') (h^s i ') ,i∈{0,…,λ} D i = (g^( b i ⋅b i ')) (h^u i ); Then use the following formula to calculate the hash value e: e=hash(g,h,C,B0,…,B λ ,B0',…,B λ ',D0,…,D λ ) Wherein, hash() represents a hash function; Finally, generate the proof script π, satisfying the following formula: t i = b i '+ b i ·e,z i = s i '+ s i ·e ,w i = s i (e-t i ) + u i ; Among them, t i is the first proof auxiliary information, z i is the auxiliary information of the second proof, w i Auxiliary information for the third proof; The recipient performs range proof according to the proof script π during the calculation process, including: The recipient calculates the starting source commitment B0 and hash value e; The verification is correct if and only if the following formula holds: (B i ) e B i '= (g^t i ) (h^z i ),(B i ^(e- t i ))D i = (h^w i ),i∈{1,…,λ}。

Images