Non-set member attribute zero-knowledge proving method based on modular lattice

Abstract

The invention discloses a non-set member attribute zero-knowledge proving method based on a modular lattice. The method comprises the following steps: determining a proving task; selecting a uniform and random matrix and a plurality of vectors on the ring # imgabs0 # to form a commitment key; coding elements and secret elements in the set into a polynomial form, and establishing a target polynomial; equivalently converting a proving task into a form of verifying correct calculation of a polynomial on a modular lattice; generating a commitment of a first stage, and determining a corresponding blind opening value and a first redundant item; the verification end randomly samples the first challenge information; generating a commitment and a second redundant term of a second stage; the verification end randomly samples second challenge information again; determining vectors and elements for blinding; the verification end verifies whether the generated vector meets a preset condition or not, checks whether a series of equations are established or not, and accepts certification if all equations are established; and the verification end verifies the claim of the certification end according to the information generated in the certification process.

Description

Technical Field

[0001] The present invention relates to the field of quantum-resistant cryptography and privacy-preserving cryptography technology, and in particular to a module-based non-set member attribute zero-knowledge proof method. Background Art

[0002] Zero-knowledge proof of non-set membership attributes allows the prover to prove to the verifier that it knows that a secret element does not belong to a given (public or private) set without leaking any additional useful information. It can be used for privacy-preserving cryptographic techniques such as anonymous identity authentication, electronic voting, group signatures, and group encryption. Many schemes based on different difficulty assumptions have been proposed. Li Jiangtao et al. constructed a universal aggregator under the strong assumption of large integer decomposition difficulty, and then proposed a non-set membership attribute proof method based on the aggregator. The scheme requires a trusted party to maintain the aggregator, and the security of the system depends on the honesty of the trusted party. Song Xiaodong proposed a proof method for checking the blacklist by publishing some elements based on the assumption of large integer decomposition difficulty and deterministic discrete logarithm. Liu Yuding et al. proposed an identity-based trapdoor mercury commitment under the assumption of large integer decomposition difficulty, and then constructed a zero-knowledge set to realize the proof of the membership attribute "yes" or "no". Zhu Yixiao proposed a privacy-preserving set membership proof method using the attribute-hiding inner product encryption algorithm, which can inadvertently prove membership and non-membership attributes. Yin Hongjian proposed a dual set membership zero-knowledge proof method for blockchain smart contract member identity authentication based on the strong discrete logarithm assumption. Yi Longyang et al. proposed a privacy-preserving cross-chain transaction verification method using set membership zero-knowledge proof technology based on discrete logarithms.

[0003] However, these schemes are designed based on number theory assumptions, and their security will become extremely fragile in the future quantum computing environment. To this end, Yan Di and others conducted relevant technical explorations and proposed a proof of set membership attributes based on the binary shortest vector problem (a type of coding problem) using the idea of ​​choosing one out of many, but this method is inefficient and only supports proof of set membership attributes. In addition, from a design principle point of view, a quantum-resistant zero-knowledge proof of non-set membership attributes can be designed by combining quantum-resistant aggregators and zero-knowledge proof technology of inequalities. However, existing technical attempts abroad have shown that this design is mainly of theoretical significance and the scheme is not efficient; moreover, the security of the scheme is overly dependent on the honesty of a trusted third party, and it is difficult to apply in practice. Therefore, there is currently a lack of secure and efficient zero-knowledge proof methods for quantum-resistant non-set membership attributes.

[0004] Lattice cryptography is the most promising post-quantum cryptographic system. Modular lattices have the characteristics of small parameter / key size and high operating efficiency. Almost all standard candidate algorithms for post-quantum cryptography based on lattices are designed based on modular lattices. At present, there are successful cases abroad that use the structural advantages of modular lattices to construct practical quantum-resistant zero-knowledge proof methods for simple arithmetic relations, but there is no effective method for proving non-set membership attributes. Summary of the invention

[0005] Based on this, it is necessary to propose a zero-knowledge proof method for non-set member attributes based on modular lattices to address the above problems.

[0006] The embodiment of the present invention provides a zero-knowledge proof method for non-set member attributes based on a module, the method comprising:

[0007] Given a set S = {x1,…,x k} and the secret element x, the proof task is determined as

[0008] In the ring Select uniformly random matrices B0 and several vectors Generate commitment key;

[0009] Encode the elements in the set S and the secret element x into polynomial form and establish the target polynomial f(x);

[0010] Transform the proof task into a form of verifying the correct computation of polynomials on a modular lattice;

[0011] The proof side randomly samples short vectors from uniform distribution and discrete Gaussian distribution with coefficients -1, 0, 1, and from the truncated ring Randomly sample elements in , generate first-stage commitments, and determine the corresponding blinded opening values ​​and first excess items;

[0012] The verification end randomly samples the first challenge information;

[0013] The proving end generates a second-stage commitment and a second redundant item according to the first challenge information;

[0014] The verification end randomly samples the second challenge information again;

[0015] The proving end determines a blinding vector and a blinding element according to the second challenge information;

[0016] The verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are established. If all the equations are established, the proof is accepted, otherwise the proof is rejected.

[0017] In the above scheme, the ring Select uniformly random matrices B0 and several vectors Constructing the commitment key, specifically including: selecting a uniformly random matrix and d+δ+3 vectors Where i=0,…,d+δ-1.

[0018] In the above scheme, the encoding of the elements in the set S and the secret element x into a polynomial form to establish the target polynomial f(x) specifically includes: encoding the set S = {s1, ..., x k} and the secret element x are encoded into the set and elements Build the target polynomial

[0019] In the above scheme, the prover randomly samples short vectors from uniform distribution and discrete Gaussian distribution with coefficients of -1, 0, and 1, and Randomly sample elements in the , generate the first stage commitment, and determine the corresponding blinded opening value and the first redundant term, specifically including: the prover selects a uniformly random vector and elements Confirm Commitment: Next, confirm and the first redundant term

[0020] In the above solution, the verification end randomly samples the first challenge information, specifically including: the verification end randomly samples

[0021] In the above solution, the proving end generates the second stage commitment and the second redundant item according to the first challenge information, specifically including: the proving end determines Commitment Then, determine the second redundant term

[0022] In the above solution, the verification end randomly samples the second challenge information again, specifically including: the verification end randomly selects a challenge Then uniformly randomly select a challenge

[0023] In the above solution, the proving end determines the vector and element for blinding according to the second challenge information, specifically including: the proving end uses Determine the blinding vector The blinding value h=x′+c′x is then determined.

[0024] In the above scheme, the verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are established. If all the equations are established, the proof is accepted, otherwise the proof is rejected. Specifically, the verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are established. is short, i.e. verify For i∈[0,d+δ-1], determine And verify whether the following equations are all true:

[0025] 1)

[0026] 2)

[0027] 3)

[0028] 4)

[0029] If at least one of the equations does not hold, the verification end refuses to accept the proof; otherwise, the verification end accepts the proof.

[0030] The embodiments of the present invention have the following beneficial effects:

[0031] The present invention realizes for the first time a lattice-based zero-knowledge proof of non-set membership attributes, using a design different from that based on an aggregator. Specifically, it uses a proof method based on correct calculation of polynomials, which does not require any trusted setup. At the same time, the NTRU assumption is cleverly used in the design, so that the "problem of proving the secret element u≠0" is transformed into the "problem of proving the public element u2=uu1≠0", avoiding the leakage of any additional information of the secret input through the u value, thereby enhancing the security of the scheme and greatly simplifying the design of the protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] in:

[0034] Figure 1 A flowchart of a zero-knowledge proof method for non-set member attributes based on a module is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] The embodiment of the present invention provides a zero-knowledge proof method for non-set member attributes based on a module, such as Figure 1 As shown, the method is implemented by the following steps:

[0037] Step 101: Given a set S = {x1,…,x k} and the secret element x, the proof task is determined as

[0038] Specifically, Prove it with zero-knowledge proof

[0039] Step 102: In the ring Select uniformly random matrices B0 and several vectors Constitute the commitment key; specifically, select a uniformly random matrix and d+δ+3 vectors Where i=0,…,d+γ-1.

[0040] Step 103: Encode the elements in the set S and the secret element x into a polynomial form to establish a target polynomial f(x);

[0041] Specifically, the set S = {x1, ..., x k} and the secret element z are encoded into the set and elements In this way, by appropriately encoding the set of integers to be proved, the encoded elements can be Calculations in are not affected by zero factors.

[0042] Build the target polynomial

[0043] Step 104: converting the proof task into a form of verifying the correct calculation of the polynomial on the module lattice;

[0044] Specifically, the problem to be proved is equivalently transformed into "proving f(x)≠0 without leaking any information about x".

[0045] The proof task is further transformed into:

[0046] Know the secret So that f(x) = u;

[0047] Know a secret So that uu1=u2≠0, where u2 is public.

[0048] Step 105: The proof end randomly samples short vectors from uniform distribution and discrete Gaussian distribution with coefficients -1, 0, and 1, and from the truncated ring Randomly sample elements in , generate first-stage commitments, and determine the corresponding blinded opening values ​​and first excess items;

[0049] Specifically, the preliminary preparations: Written

[0050] Similarly, for i∈[0,k] and i≠i * , a i x i Written

[0051] Given The blind opening of f u ,f x′ ,f i (Note: The following vector is used by the prover and the challenge c in step 108 is precomputed as Here i=0,1,…,d-1, prove that “knowing the secret So that f(x) = u" is equivalent to proving the secret x, u and ψ i Make

[0052] Here ψ i By the proof end, f u ,f i Substitute it into the equation on the left and expand it to get and The calculated value has nothing to do with the challenge c.

[0053] The prover selects a uniformly random vector and elements Confirm Commitment: Next, confirm and the first redundant term

[0054] Step 106: The verification end randomly samples the first challenge information;

[0055] Specifically, the verification end randomly samples

[0056] Step 107: The proving end generates a second-stage commitment and a second redundant item according to the first challenge information;

[0057] Specifically, the proving end determines Commitment Then, determine the second redundant term

[0058] Step 108: The verification end randomly samples the second challenge information again;

[0059] Specifically, the verification end randomly selects a challenge Then uniformly randomly select a challenge from

[0060] Step 109: The proving end determines a blinding vector and a blinding element according to the second challenge information;

[0061] Specifically, the proving end uses Determine the blinding vector The blinding value h=x′+c′x is then determined.

[0062] Step 110: The verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are established. If all the equations are established, the proof is accepted; otherwise, the proof is rejected.

[0063] Specifically, the verification end verifies is short, i.e. verify For i∈[0,d+δ-1], determine And verify whether the following equations are all true:

[0064] 1)

[0065] 2)

[0066] 3)

[0067] 4)

[0068] If at least one of the equations does not hold, the verification end refuses to accept the proof; otherwise, the verification end accepts the proof.

[0069] Parameter settings and symbol description:

[0070] S is a given set, k is the number of elements in the set S, that is, the degree of the target polynomial; definition δ=d-1.

[0071] The positive integer n is a power of 2 (for example, n=128), l|n, and the prime number q-1≡2lmod(4l).

[0072] ρ∈(0,1) is the control factor used to truncate the elements of the polynomial ring.

[0073] μ, λ are safety parameters, σ is the parameter of discrete Gaussian distribution, β = σ√2(μ+λ+2d)n.

[0074] Defined as

[0075] They are defined as The set of elements whose degree in X is less than n / l, ρn / l, (1-ρ)n / l.

[0076] D σ is a discrete Gaussian distribution with parameter σ;

[0077] χ is a uniform distribution with elements located at {-1,0,1};

[0078] The coefficients of the challenge space are on {-1,0,1}, and the coefficients are selected to satisfy Pr(0)=1 / 2; Pr(1)=Pr(-1)=1 / 4.

[0079] is a rejection sampling technique, defined as: for a set whose norm is at most T Assume ρ′ is a probability distribution that V satisfies, set σ=11T,M=3, and use the rejection sampling technique, according to Produced The distribution and direct distribution from ρ′ and The statistical distance of the distribution of the samples is no more than 2 -100 / M.

[0080] ring The elements on the vector are represented by lowercase bold letters, and vectors are represented by bold letters with arrows, for example, a and

[0081] ring The matrices above are represented by uppercase italic bold letters, such as A.

[0082] For each i∈[0,k], define

[0083] is the binary decomposition of i, that is And i j ∈{0,1}.

[0084] is a counter, determine if i j = 1, so that there is exactly δ i j satisfies i j =1;

[0085] is the binary decomposition of i that satisfies i j =1 bits (marked in order of appearance);

[0086] Assume i * is δ i The index of

[0087] set up For i * The binary representation of gets the corresponding all-1 vector.

[0088] The present invention realizes the lattice-based zero-knowledge proof of non-set membership attributes for the first time, using a design different from that based on aggregators. Specifically, it uses a proof method that uses correct calculation of polynomials, which does not require any trusted settings. At the same time, the NTRU assumption is cleverly used in the design, so that the "problem of proving the secret element u≠0" is transformed into the "problem of proving the public element u2=uu1≠0" (where u1 is an arbitrary secret non-zero element), avoiding any additional information of the secret input leaked through the u value, enhancing the security of the scheme, and greatly simplifying the design of the protocol.

[0089] In addition, the method of the present invention is designed based on the commitment scheme and NTRU hypothesis of the modular small integer solution problem and the modular fault-tolerant learning problem, and can effectively resist the attack of quantum computers. Since the algebraic structure of the modular lattice is fully utilized, the parameter / key size is small, and the proof overhead is small, the present invention is a quantum-resistant and efficient zero-knowledge proof of non-set membership attributes.

[0090] The above embodiment is a general design of non-set membership attribute proof based on lattice, which is itself a specific design of anonymous blacklist scheme based on lattice, and can also serve as a core design component of cryptographic schemes such as fully dynamic group signature and group encryption based on lattice.

[0091] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0092] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A zero-knowledge proof method for non-set member attributes based on modular lattices, characterized in that: The method is: Given a set S = {x1,…,x k } and the secret element x, the proof task is determined as In the ring Select uniformly random matrices B0 and several vectors constitutes a commitment key; Encode the elements in the set S and the secret element x into polynomial form and establish the target polynomial f(x); Transform the proof task into a form of verifying the correct computation of polynomials on a modular lattice; The proof side randomly samples short vectors from uniform distribution and discrete Gaussian distribution with coefficients -1, 0, 1, and from the truncated ring Randomly sample elements in , generate first-stage commitments, and determine the corresponding blinded opening values ​​and first excess items; The verification end randomly samples the first challenge information; The proving end generates a second-stage commitment and a second redundant item according to the first challenge information; The verification end randomly samples the second challenge information again; The proving end determines a blinding vector and a blinding element according to the second challenge information; The verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are established. If all the equations are established, the proof is accepted, otherwise the proof is rejected.

2. The zero-knowledge proof method for non-set member attributes based on a module according to claim 1 is characterized in that: The loop Select uniformly random matrices B0 and several vectors Constructing the commitment key, specifically including: selecting a uniformly random matrix and d+δ+3 vectors Where i=0,…,d+δ-1.

3. The zero-knowledge proof method for non-set member attributes based on a module according to claim 1 or 2, characterized in that: The encoding of the elements in the set S and the secret element x into a polynomial form to establish a target polynomial f(x) specifically includes: encoding the set S = {x1, ..., x k } and the secret element x are encoded into the set and elements Build the target polynomial 4. The method for proving non-set member attributes based on a module according to claim 3 is characterized in that: The proof end randomly samples short vectors from uniform distribution and discrete Gaussian distribution with coefficients of -1, 0, and 1, and from the truncated ring Randomly sample elements in the , generate the first stage commitment, and determine the corresponding blinded opening value and the first redundant term, specifically including: the prover selects a uniformly random vector and elements Confirm Commitment: Next, confirm and the first redundant term 5. The method for proving non-set member attributes based on a module according to claim 4, characterized in that: The verification end randomly samples the first challenge information, specifically including: the verification end randomly samples 6. The method for proving non-set member attributes based on a module according to claim 5, characterized in that: The proving end generates the commitment and the second redundant item of the second stage according to the first challenge information, specifically including: the proving end determines Commitment Then, determine the second redundant term 7. The method for proving non-set member attributes based on a module according to claim 6, characterized in that: The verification end randomly samples the second challenge information again, specifically including: the verification end randomly selects a challenge Then uniformly randomly select a challenge from 8. The method for proving non-set member attributes based on a module according to claim 7, characterized in that: The proving end determines the vector and element for blinding according to the second challenge information, specifically including: the proving end uses Determine the blinding vector The blinding value h=x′+c′x is then determined.

9. The method for proving non-set member attributes based on a module according to claim 8, characterized in that: The verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are established. If all the equations are established, the proof is accepted, otherwise it is rejected. Specifically, the verification end verifies is short, that is verify For i∈[0,d+δ-1], determine And verify whether the following equations are all true: 1) 2) 3) 4) If at least one of the equations does not hold, the verification end refuses to accept the proof; otherwise, the verification end accepts the proof.

Images