Modular-based non-set membership attribute zero-knowledge proof method

Abstract

The application discloses a non-set member attribute zero-knowledge proof method based on a module, which comprises the following steps: determining a proof task; selecting a uniform random matrix and a plurality of vectors on a ring to form a commitment key; encoding elements in a set and secret elements into a polynomial form, and establishing a target polynomial; equivalently converting the proof task into a form of verifying correct calculation of the polynomial on the module; generating a first-stage commitment, and determining a corresponding blind opening value and a first redundant item; randomly sampling first challenge information by a verification end; generating a second-stage commitment and a second redundant item; randomly sampling second challenge information by the verification end again; determining a vector and an element for blinding; verifying whether the generated vector satisfies a preset condition by the verification end, checking whether a series of equations are established, and if all the equations are established, accepting the proof; and verifying the claim of the proving end according to information generated in the proof process by the verification end.

Description

Technical Field

[0001] This invention relates to the fields of quantum-resistant cryptography and privacy-preserving cryptography, and in particular to a zero-knowledge proof method for non-set membership attributes based on modular lattices. Background Technology

[0002] Zero-knowledge proofs of non-set membership attributes allow the prover to demonstrate to the verifier that it knows a secret element does not belong to a given (public or private) set, without revealing any additional useful information. This can be used for privacy-preserving cryptographic techniques such as anonymous authentication, electronic voting, group signatures, and group encryption. Many schemes based on different difficulty assumptions have been proposed. Li Jiangtao et al. constructed a general aggregator under the strong large integer factorization difficulty assumption, and then proposed a non-set membership attribute proof method based on the aggregator. This scheme requires a trusted party to maintain the aggregator, and the system's security depends on the honesty of the trusted party. Song Xiaodong proposed a proof method based on the large integer factorization difficulty and the deterministic discrete logarithm assumption, which involves checking a blacklist by publishing some elements. Liu Yuding et al. proposed an identity-based trapdoor mercury commitment under the large integer factorization difficulty assumption, and then constructed a zero-knowledge set to prove the "yes" or "no" of membership attributes. Zhu Yixiao proposed a privacy-preserving set membership proof method using an attribute-hidden inner product encryption algorithm, which can inadvertently prove membership and non-membership attributes. Yin Hongjian proposed a zero-knowledge proof method for dual set membership relations based on the strong discrete logarithm assumption for blockchain smart contract member identity authentication. Yi Longyang et al. proposed a privacy-preserving cross-chain transaction verification method using a zero-knowledge proof technique for set membership based on discrete logarithms.

[0003] However, these schemes are all designed based on number theory assumptions, making their security extremely vulnerable in the future quantum computing environment. To address this, Yan Di et al. explored related technologies, proposing a set membership proof based on the binary shortest vector problem (a type of encoding problem) using the idea of ​​choosing one from many. However, this method is inefficient and only supports set membership proofs. Furthermore, from a design principle perspective, combining quantum-resistant aggregators and inequality zero-knowledge proof techniques can design quantum-resistant zero-knowledge proofs for non-set membership attributes. However, existing foreign attempts show that this design is mainly theoretical, with low efficiency; moreover, the security of the scheme relies excessively on the honesty of a trusted third party, making practical application difficult. Therefore, a secure and efficient quantum-resistant zero-knowledge proof method for non-set membership attributes is currently lacking.

[0004] Lattice cryptography is the most promising post-quantum cryptosystem. Modular lattices have advantages such as small parameter / key size and high operating efficiency, and almost all standard candidate algorithms for post-quantum cryptography based on lattices are designed based on modular lattices. Currently, there are successful cases abroad of using the structural advantages of modular lattices to build practical quantum-resistant zero-knowledge proof methods for simple arithmetic relations, but there are no effective methods for proving non-set membership attributes. Summary of the Invention

[0005] Therefore, it is necessary to propose a zero-knowledge proof method for non-set member attributes based on lattices to address the above problems.

[0006] This invention provides a zero-knowledge proof method for non-set membership attributes based on lattices. The method is as follows:

[0007] Given a set and secret elements The task of proof is determined as follows: ;

[0008] In the ring Select a uniformly random matrix above and several vectors Generate a commitment key;

[0009] set Elements and secret elements Encode it into polynomial form and establish the target polynomial. ;

[0010] The proof task is equivalent to verifying the correct computation of a polynomial on a lattice.

[0011] The proof involves randomly sampling short vectors from uniform and discrete Gaussian distributions with coefficients of -1, 0, and 1, and from truncated rings. Randomly sample elements from the middle to generate the commitment for the first stage, and determine the corresponding blinding open value and the first redundant term;

[0012] The verification end randomly samples the first challenge information;

[0013] The proof end generates a second-stage commitment and a second redundant item based on the first challenge information;

[0014] The verification end randomly samples the second challenge information again;

[0015] The proof end determines the blinding vector and blinding elements based on the second challenge information;

[0016] The verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are true. If all equations are true, the proof is accepted; otherwise, the proof is rejected.

[0017] In the above scheme, the ring Select a uniformly random matrix above and several vectors The commitment key is constructed by selecting a uniformly random matrix. and vectors ,in .

[0018] In the above scheme, the set Elements and secret elements Encode it into polynomial form and establish the target polynomial. Specifically, this includes: [the set] and secret elements Encode into a set and elements Establish the objective polynomial .

[0019] In the above scheme, the proof end randomly samples short vectors from uniform and discrete Gaussian distributions with coefficients of -1, 0, 1, and from the truncated ring... Randomly sample elements to generate the first-stage commitment and determine the corresponding blinding open value and the first redundant term. Specifically, this includes selecting a uniformly random vector on the proof side. and elements , determine The promise: Next, determine And the first redundant item .

[0020] In the above scheme, the random sampling of the first challenge information at the verification end specifically includes: random sampling at the verification end. .

[0021] In the above scheme, the proof end generates a second-stage commitment and a second redundancy based on the first challenge information, specifically including: the proof end determines the commitment to... promise Subsequently, the second extra item was determined. .

[0022] In the above scheme, the verification end randomly samples the second challenge information again, specifically including: the verification end randomly selects a challenge. Then randomly select a challenge. .

[0023] In the above scheme, the proof end determines the vectors and elements used for blinding based on the second challenge information, specifically including: the proof end uses... Determine the blinding vector Next, determine the blinding value. .

[0024] In the above scheme, the verification end verifies whether the generated vector satisfies preset conditions and checks whether a series of equations are true. If all equations are true, the proof is accepted; otherwise, the proof is rejected. Specifically, the verification end verifies... It is short, that is ,verify ;right ,Sure And verify whether all of the following equations are true:

[0025] 1)

[0026] 2)

[0027] 3)

[0028] 4)

[0029] If at least one equation is false, the verification end rejects the proof; otherwise, the verification end accepts the proof.

[0030] The embodiments of the present invention have the following beneficial effects:

[0031] This invention is the first to achieve zero-knowledge proof of non-set membership attributes based on lattices. It employs a design different from aggregator-based methods, specifically using a polynomial-based proof method that requires no trusted setup. Furthermore, the design cleverly utilizes the NTRU assumption, making the proof of secret elements... The problem is transformed into "proving the public elements". "The problem", avoid through The fact that the secret input is not leaked enhances the security of the scheme and greatly simplifies the design of the protocol. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] in:

[0034] Figure 1The flowchart illustrates a zero-knowledge proof method for non-set member attributes based on a lattice, as provided in this embodiment of the invention. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] This invention provides a zero-knowledge proof method for non-set membership attributes based on lattices, such as... Figure 1 As shown, this method is implemented through the following steps:

[0037] Step 101: Given a set and secret elements The task of proof is determined as follows: ;

[0038] Specifically, Prove using zero-knowledge proof .

[0039] Step 102: In the ring Select a uniformly random matrix above and several vectors This constitutes the commitment key;

[0040] Specifically, a uniformly random matrix is ​​selected. and vectors ,in .

[0041] Step 103: Set Elements and secret elements Encode it into polynomial form and establish the target polynomial. ;

[0042] Specifically, the set and secret elements Encode into a set and elements Thus, by appropriately encoding the set of integers to be proved, the encoded elements are displayed in the ring. The calculation is not affected by zero factors.

[0043] Establish the objective polynomial .

[0044] Step 104: Transform the proof task into the equivalent form of verifying the correct computation of the polynomial on the lattice;

[0045] Specifically, the problem to be proven is equivalently transformed into "without leaking..." Proof under any information premise ".

[0046] The proof task is further transformed into:

[0047] Knowing the secret Make ;

[0048] Know a secret Make ,here It is public.

[0049] Step 105: Prove that short vectors are randomly sampled from uniform and discrete Gaussian distributions with coefficients of -1, 0, 1, and from the truncated ring... Randomly sample elements from the middle to generate the commitment for the first stage, and determine the corresponding blinding open value and the first redundant term;

[0050] Specifically, preliminary preparations: Written .

[0051] Similarly, for and ,Will Written .

[0052] Given Blinding Open (Note: The following vector is used in the proof.) and the challenges in step 108 Pre-calculated as ),here This proves that "those who know the secret" Make "This is equivalent to proving the secret." and Make .

[0053] here By the proof end Substituting into the left-hand side of the equation and expanding and rearranging, we get the result, which is derived from... The calculated value, and the challenge Irrelevant.

[0054] The proof side selects a uniformly random vector and elements , determine The promise: Next, determine And the first redundant item .

[0055] Step 106: The verification end randomly samples the first challenge information;

[0056] Specifically, the verification terminal randomly samples... .

[0057] Step 107: The proof end generates a second-stage commitment and a second redundancy based on the first challenge information;

[0058] Specifically, the proof end determines the... promise Subsequently, the second extra item was determined. .

[0059] Step 108: The verification end randomly samples the second challenge information again;

[0060] Specifically, the verification end randomly selects a challenge. Then, randomly select a challenge from... .

[0061] Step 109: The proving end determines the blinding vector and blinding elements based on the second challenge information;

[0062] Specifically, the proof end uses Determine the blinding vector Next, determine the blinding value. .

[0063] Step 110: The verification end verifies whether the generated vector meets the preset conditions and checks whether a series of equations are true. If all equations are true, the proof is accepted; otherwise, the proof is rejected.

[0064] Specifically, the verification terminal verifies It is short, that is ,verify ;right ,Sure And verify whether all of the following equations are true:

[0065] 1)

[0066] 2)

[0067] 3)

[0068] 4)

[0069] If at least one equation is false, the verification end rejects the proof; otherwise, the verification end accepts the proof.

[0070] Parameter settings and symbol explanations:

[0071] It is a given set. It is a set The number of elements in the polynomial, i.e., the degree of the target polynomial; defined. .

[0072] Powers of 2 (if possible) ), , prime number .

[0073] It is a control factor used to truncate elements of a polynomial ring.

[0074] These are safety parameters. For the parameters of a discrete Gaussian distribution, .

[0075] Defined as ;

[0076] Defined respectively middle Number of times less A collection of elements.

[0077] For parameters The discrete Gaussian distribution;

[0078] For the element located at Uniform distribution;

[0079] For the coefficient in The challenge space above, the coefficient selection satisfies .

[0080] It is a rejection sampling technique, defined as: for norms at most 1 set ,set up yes A probability distribution that satisfies the given conditions is set. Then, the rejection sampling technique is used, according to The generated Distribution and directly from The statistical distance of the distribution of the middle sample is no greater than .

[0081] ring Elements are represented by lowercase italic letters, and vectors are represented by italic letters with arrows, for example, .

[0082] ring The matrix above is represented by uppercase italic letters, such as .

[0083] For each ,definition ;

[0084] for Binary decomposition, i.e. and .

[0085] For a counter, determine if the following conditions are met. The number of such that there are exactly indivual satisfy ;

[0086] for In binary decomposition, satisfying The position (marked in order of appearance);

[0087] set up for The index makes ;

[0088] set up For the reason The corresponding all-1 vector is obtained from the binary representation of the vector.

[0089] This invention is the first to achieve zero-knowledge proof of non-set membership attributes based on lattices. It employs a design different from aggregator-based methods, specifically using a polynomial-based proof method that requires no trusted setup. Furthermore, the design cleverly utilizes the NTRU assumption, making the proof of secret elements... The problem is transformed into "proving the public elements". The problem (here) (any secret non-zero element), avoid through The fact that the secret input is not leaked enhances the security of the scheme and greatly simplifies the design of the protocol.

[0090] Furthermore, the method of this invention is designed based on the commitment scheme of the modular small integer solution problem and the modular fault-tolerant learning problem, as well as the NTRU assumption, which can effectively resist attacks from quantum computers. By fully utilizing the algebraic structure of modular lattices, the method achieves small parameters / key size and low proof overhead, thus providing a quantum-resistant and efficient zero-knowledge proof of non-set membership attributes.

[0091] The above embodiment is a general design based on the proof of non-set membership attributes of lattices. It is itself a specific design of the anonymous blacklist scheme based on lattices, and can also serve as a core design component of cryptographic schemes such as fully dynamic group signatures and group encryption based on lattices.

[0092] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0093] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for proving non-membership of an attribute based on a mode, characterized in that, The method is applied to the field of quantum-resistant cryptography, and comprises: Given set And secret element Determine proof task as ; On the ring selecting a uniformly random matrix and several vectors constitute a commitment key; The elements in the set and the secret element are encoded into polynomial form, establishing a target polynomial ; equivalent transformation of the proof task into a form of verifying correct calculation of a polynomial on a module; The proving end randomly samples a short vector from a uniform distribution with coefficients -1, 0, 1, a discrete Gaussian distribution, and randomly samples an element from a truncated ring The proving end randomly samples a short vector from a uniform distribution with coefficients -1, 0, 1, a discrete Gaussian distribution, and randomly samples an element from a truncated ring random sampling of first challenge information by the verification end; generation of a second-stage commitment and a second redundant item by the proving end according to the first challenge information; random sampling of second challenge information by the verification end again; determination of a blinding vector and a blinding element by the proving end according to the second challenge information; verification by the verification end of whether the generated vector satisfies a preset condition and checking whether a series of equations are established, and if all the equations are established, the proof is accepted, otherwise the proof is rejected; The set Elements and secret elements Encode it into polynomial form and establish the target polynomial. ,include: The set is encoded into a collection and secret elements Encoding into a collection and elements ; establishing a target polynomial ; wherein, is a coefficient, is defined as in a set of elements of degree less than ; the equivalent transformation of the proof task into the form of verifying correct calculation of the polynomial on the module comprises: The problem to be proven is equivalently transformed into proving that any information is leaked under the premise of the transformation of the proof task into: in the know causing ; in the know causing here is public; The proving end randomly samples a short vector from a uniform distribution with coefficients -1, 0, 1, a discrete Gaussian distribution, and randomly samples an element from a truncated ring The proving end randomly samples a short vector from a uniform distribution with coefficients -1, 0, 1, a discrete Gaussian distribution, and randomly samples an element from a truncated ring Preparation: Mix Write as ; Also, to and , write as ; Given Blind opening , here , proving knowledge of the secret such that , is equivalent to proving knowledge of the secret and such that ; Here By the prover After substituting the left equation and expanding, we get The value calculated by the prover is independent of the challenge ​ The prover selects a uniformly random vector and an element , determines a commitment to : ； ； ； ； ... ； ； ... ； Next, it is determined and the first surplus term ; The proving end generates a second-stage commitment and a second redundancy based on the first challenge information, including: the proving end determining the... promise Subsequently, the second redundant item was determined. wherein is defined as in is less than a set of elements, is a given set, is a set the number of elements in the set, i.e. the degree of the target polynomial; is defined as , n is a positive integer that is a power of 2, p is a prime number ; is a security parameter. 2.The module-based non-set-member attribute zero-knowledge proof method according to claim 1, characterized in that, The in ring Selecting a uniformly random matrix And several vectors Forming a commitment key, specifically comprising: selecting a uniformly random matrix And Vectors Wherein .

3. The method of claim 1 or 2, wherein, The verification end randomly samples the first challenge information, specifically including: the verification end randomly samples .

4. The method of claim 3, wherein, The verification end randomly samples second challenge information again, specifically including: the verification end randomly selects one challenge , and then randomly selects one challenge , wherein, is defined as , wherein , wherein , wherein is a control factor used to truncate the polynomial ring element.

5. The method of claim 4, wherein, The proving end determines a vector and an element for blinding according to the second challenge information, specifically comprising: the proving end uses determines a blinding vector , and then determines a blinding value .

6. The method of claim 5, wherein, The verification end verifies whether the generated vector satisfies preset conditions and checks whether a series of equations are established, and if all the equations are established, the proof is accepted, otherwise, the proof is rejected, specifically including that the verification end verifies is short, i.e. , verifies ; to , determines and verifies whether the following equations are all established: If at least one of the equalities is not true, the verifying end rejects the proof; otherwise, the verifying end accepts the proof; wherein, .

Images