Linear relation accurate zero-knowledge proving method with hidden product

Abstract

The invention discloses an accurate zero-knowledge proof method for a linear relation with a hidden product. The method comprises the following steps: converting a linear relation with the hidden product on an incomplete split ring # imgabs0 # into a linear relation on # imgabs1 #; an attached additional condition is converted into a gradual component product relation on # imgabs2; the secret evidence # imgabs4 # on the # imgabs3 # is inversely transformed into # imgabs6 # elements xi on the # imgabs5 # through NTT, and a uniform and random matrix and a plurality of vectors are selected on the # imgabs7 #; generating a commitment of the first stage, sampling a vector from discrete Gaussian distribution, and determining a public vector; selecting first challenge information; generating a new commitment, a blind element and a redundant item through the first challenge information; randomly sampling second challenge information c from the challenge space C; and c, determining a vector # imgabs9 # for blinding # imgabs8 # to verify whether the vector # imgabs10 # meets a preset condition or not through c, checking whether a series of equations are established or not, if all equations are established, accepting certification, and otherwise, refusing to accept.

Description

Technical Field

[0001] The present invention relates to the field of quantum-resistant cryptography and privacy-preserving cryptography technology, and in particular to an accurate zero-knowledge proof method for a linear relationship with a hidden product. Background Art

[0002] Lattice cryptography is one of the most important post-quantum cryptographic systems. Linear relations and product relations are the two most common operations. Accurate zero-knowledge proofs of these two relations are the key to building many privacy-preserving cryptographic schemes based on lattices. At present, important progress has been made in the research of zero-knowledge proofs based on lattices at home and abroad, and pure linear relations and pure product relations have been efficiently proved. Accurate zero-knowledge proofs of linear relations embedded with product relations are the core components of designing privacy-preserving cryptographic schemes such as anonymous certificates, dynamic group signatures, and group encryption. However, zero-knowledge proofs of such relations are usually more complicated, and only a few schemes have been proposed. Wang Huaxiong et al. proposed a lattice-based scheme by permuting binary vectors with fixed weights, and the weights of the transformed vectors will remain unchanged. Xu Qiuliang et al. used the idea of ​​bit decomposition to transform matrix-vector products into bit-bit products, and constructed a more efficient lattice-based scheme. However, these schemes are all based on standard lattice design, with large system parameters and long key sizes, and large robustness errors. In order to reduce the robustness error to a negligible level, the protocol needs to be repeated hundreds and nearly ten times respectively. The communication overhead of the proof is very large, making it difficult to apply in practice. At present, a highly efficient and even practical scheme based on modular lattices has been proposed abroad, but this scheme requires that the underlying polynomial ring used is completely split. This limitation is incompatible with the secure digital signature scheme under the standard model based on rings / modular lattices, and cannot be used for the design of efficient lattice-based anonymous certificates, dynamic group signatures, and group encryption. Therefore, there is currently a lack of efficient lattice-based zero-knowledge proof methods that can be used in the design of privacy-preserving cryptographic schemes.

[0003] Modular lattices have the advantages of compressing system parameters / key size and accelerating calculations, and are the first choice for designing efficient and even practical quantum-resistant cryptographic schemes based on lattices. However, quantum-resistant cryptographic schemes based on modular lattices are usually more complicated than those based on standard lattices. Moreover, due to the difference in algebraic structure between incomplete split rings and complete split rings, the lattice-based accurate zero-knowledge proof method for linear relations with product relations constructed on complete split rings cannot be directly migrated to the corresponding design on incomplete split rings. Therefore, to break through the current design bottleneck, it is necessary to explore new design paths. Summary of the invention

[0004] Based on this, it is necessary to propose an accurate zero-knowledge proof method for linear relations with hidden products to address the above problems.

[0005] An embodiment of the present invention provides a method for accurately proving a linear relationship with a hidden product, the method comprising:

[0006] Will not completely split the ring The linear relationship with hidden product on The linear relationship on

[0007] Transform the additional conditions into The component-wise product relation on ; the additional conditions are hidden product and evidence norm restrictions;

[0008] The Secret evidence on Through NTT inverse transformation on element x i ,exist Select uniformly random matrices and several vectors from above;

[0009] The prover randomly samples vectors and elements from the error distribution χ to generate the first-stage commitment, and samples vectors from the discrete Gaussian distribution to determine the public vector.

[0010] The verification end randomly selects the first challenge information;

[0011] The proving end generates a new commitment, a blinding element and a redundant item through the first challenge information;

[0012] The verification end randomly samples second challenge information c from the challenge space C;

[0013] The proving end determines the second challenge information c for blinding Vector

[0014] The verification end verifies the vector Whether the preset conditions are met and a series of equations are checked to see if they hold. If all the equations hold, the proof is accepted, otherwise it is rejected.

[0015] In the above scheme, the linear relationship with hidden product on the incomplete split ring is converted into The linear relationship on Linear relations with hidden products on Convert to The upper shape linear relationship.

[0016] In the above scheme, the additional conditions are converted into The component-by-component product relationship on the , specifically including: the hidden product m3 = m1 * m2 and the evidence norm restriction m1, m2 ∈ {-1, 0, 1} d Convert to The upper shape The component-by-component product relationship, i = 0, ..., d-1, the matrix M is composed of B i ,D i The public matrix, vector and is the coefficient vector of ring elements m1, m2 and m3; Is The public vector is obtained by adding the appropriate 0 vector to the coefficient vector; Is The secret vector of composition.

[0017] In the above scheme, the proving end randomly samples vectors and elements from the error distribution χ to generate the commitment of the first stage, and samples vectors from the discrete Gaussian distribution to determine the public vector, which specifically includes: the proving end randomly samples vectors from the error distribution χ and elements Generate a pair x i and g's commitment, and from the discrete Gaussian distribution D σ Upsample vector Sure

[0018] In the above solution, the verification end randomly selects the first challenge information, specifically including: the verification end randomly selects the first challenge information and

[0019] In the above solution, the proving end generates a new commitment, a blinding element and a redundant item according to the first challenge information, specifically including: generating and Commitment and determine the first excess term v0;

[0020] The proving end determines The NTT inverse mapping is blinded by element g And determine the second redundant term

[0021] In the above solution, the verification end verification vector Whether the preset conditions are met and whether a series of equations are established. If all the equations are established, the proof is accepted, otherwise it is rejected. Specifically, it includes: Verification end verification It's short, yes. Sure and And verify that the following equations are all true:

[0022] 4)

[0023] 5)

[0024] 6)

[0025] If one of the equations does not hold, the verifier rejects the proof; otherwise, the verifier accepts the proof.

[0026] The embodiments of the present invention have the following beneficial effects:

[0027] This invention realizes the accurate zero-knowledge proof of linear relations with hidden products and small-norm secret evidence on incomplete split rings for the first time, solving the problem that the current technology is only applicable to complete split rings and cannot meet some practical application requirements. Specifically, by cleverly using coefficient embedding algorithm and element rotation algorithm, the linear relations with hidden products and small-norm constraints on incomplete split rings are transformed into The linear relationship and component-by-component product relationship on the lattice make it compatible with the efficient and accurate zero-knowledge proof framework based on the lattice. In addition, the method of the present invention is designed based on the commitment scheme of the modular small integer solution problem and the modular fault-tolerant learning problem, which can effectively resist the attack of quantum computers. Since the algebraic structure of the modular lattice is fully utilized, the parameter / key size is small, and the proof overhead is small, the present invention is quantum-resistant and suitable for accurate zero-knowledge proof of linear relationships with hidden products on incomplete split rings. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0029] in:

[0030] Figure 1 A flowchart of a method for accurate zero-knowledge proof of a linear relationship with hidden products is provided for an embodiment of the present invention;

[0031] Figure 2 A flowchart of another method for accurate zero-knowledge proof of a linear relationship with hidden products is provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0033] The embodiment of the present invention provides an accurate zero-knowledge proof method for a linear relationship with a hidden product, such as Figure 1 As shown, the method includes:

[0034] Step 101: Incomplete Split Ring The linear relationship with hidden product on The linear relationship on

[0035] Specifically, the incomplete split ring Linear relations with hidden products on Convert to The upper shape linear relationship.

[0036] Step 102: Convert the additional conditions into The component-wise product relation on ; the additional conditions are hidden product and evidence norm restrictions;

[0037] Specifically, the hidden product m3 = m1*m2 and the evidence norm restriction m1,m2∈{-1,0,1} d Convert to The upper shape The component-by-component product relationship, i = 0, ..., d-1, the matrix M is composed of B i ,D i The public matrix, vector and is the coefficient vector of ring elements m1, m2 and m3; Is The public vector is obtained by adding the appropriate 0 vector to the coefficient vector; Is Step 103: The secret vector Secret evidence on Through NTT inverse transformation on element x i ,exist Select uniformly random matrices and several vectors from above;

[0038] Step 103: The prover randomly samples vectors and elements from the error distribution χ to generate the commitment of the first stage, and samples vectors from the discrete Gaussian distribution to determine the public vector;

[0039] Specifically, the prover randomly samples a vector from the error distribution χ and elements Generate a pair x i and g's commitment, and from the discrete Gaussian distribution D σ Upsample vector Sure

[0040] Step 104: The verification end randomly selects first challenge information;

[0041] Specifically, the verification end randomly selects the first challenge information and

[0042] Step 105: Generate new commitments, blinding elements and redundant items using the first challenge information.

[0043] Specifically, the proving end determines and The commitment (here we can use the "intermediate value" and ” instead), and determine the first redundant term v0; determine Blind with g And determine the second redundant term

[0044] Step 106: The verification end randomly samples second challenge information c from the challenge space C;

[0045] Step 107: The proving end determines the second challenge information c for blinding Vector

[0046] Step 108: The verification end verifies the vector Whether the preset conditions are met and a series of equations are checked to see if they hold. If all the equations hold, the proof is accepted, otherwise it is rejected.

[0047] This invention realizes the accurate zero-knowledge proof of linear relations with hidden products and small-norm secret evidence on incomplete split rings for the first time, solving the problem that the current technology is only applicable to complete split rings and cannot meet some practical application requirements. Specifically, by cleverly using coefficient embedding algorithm and element rotation algorithm, the linear relations with hidden products and small-norm constraints on incomplete split rings are transformed into The linear relationship and component-by-component product relationship on the lattice make it compatible with the efficient and accurate zero-knowledge proof framework based on the lattice. In addition, the method of the present invention is designed based on the commitment scheme of the modular small integer solution problem and the modular fault-tolerant learning problem, which can effectively resist the attack of quantum computers. Since the algebraic structure of the modular lattice is fully utilized, the parameter / key size is small, and the proof overhead is small, the present invention is quantum-resistant and suitable for accurate zero-knowledge proof of linear relationships with hidden products on incomplete split rings.

[0048] The embodiment of the present invention also provides an accurate zero-knowledge proof method for a linear relationship with a hidden product;

[0049] About parameter settings and symbol description:

[0050] The positive integer d is a power of 2 (e.g., d = 128), l|d, the prime number q-1≡2lmod(4l), μ, λ are security parameters, σ is the parameter of the discrete Gaussian distribution, n0 = 2(d 2 +d), β=σ√2(μ+λ+n0 / l+3)d.

[0051] v i,j =(i+2)d / l+j,η i,j =(d+i+2)d / l+j, where i=0,…,d-1, j=1,…,d / l.

[0052] Defined as

[0053] D σ is a discrete Gaussian distribution with parameter σ;

[0054] χ is a uniform distribution with elements located at {-1,0,1};

[0055] The coefficients of the challenge space are on {-1,0,1}, and the coefficients are selected to satisfy Pr(0)=1 / 2; Pr(1)=Pr(-1)=1 / 4.

[0056] is a rejection sampling technique, defined as: for a set whose norm is at most T Assume ρ′ is a probability distribution that V satisfies, set σ=11T,M=3, and use the rejection sampling technique, according to Produced The distribution and direct distribution from ρ′ and The statistical distance of the distribution of the samples is no more than 2 -100 / M.

[0057] ring The elements of the vector are represented by lowercase italic letters, and vectors are represented by lowercase italic letters with arrows, for example, a and ring The elements of the vector are represented by lowercase italic bold letters, and vectors are represented by lowercase italic bold letters with arrows, for example, a and

[0058] ring The matrices on the ring are represented by capital italic letters, such as A; The matrices above are represented by uppercase italic bold letters, such as A.

[0059] NTT is the exponential transformation.

[0060] τ(·) is the coefficient embedding algorithm used to extract The coefficient vector of

[0061] rot(·) is a rotation algorithm, defined as if c = a*b, then here

[0062] like Figure 2 As shown, the specific embodiments of the present invention are described as follows:

[0063] (1) Conversion relationship: The target relationship is in is secret and satisfies m1,m2∈{-1,0,1} d (i.e., small norm) and and It is public.

[0064] right Using the coefficient embedding algorithm, we get here The three matrices constitute.

[0065] Next, Use the coefficient embedding algorithm, and for i=0,…,d-1, let B i =rot(X i ), set up The i-th column is The rest are all zero vectors, and then let B i ′=A3B i , the original target relationship is transformed into here is public, It is secret and satisfying and

[0066] (2) Preliminary preparation and commitment key generation:

[0067] Will Secret evidence on Each l-length vector is transformed into n0 / l elements x on i ,Right now Select a uniform random matrix and n0 / l+3 vectors Here i=1,…,n0 / l+3.

[0068] (3) Construct a proof protocol and execute it as follows:

[0069] (3a) Determine the commitments for the first phase:

[0070] The prover selects a uniformly random vector and Confirm and g's promise:

[0071] Next, determine the public vector

[0072] (3b) Select the first set of challenges:

[0073] The first challenge of random sampling on the verification end and

[0074] (3c) Determine the commitments for the second phase:

[0075] The prover confirms the commitment

[0076] Then, determine the first redundant term

[0077] Re-confirm and the second excess

[0078] (3e) Select the second set of challenges: The verifier randomly selects the second challenge information

[0079] (3f) Determine the blinding vector and blinding value: The prover uses Determine the blinding vector

[0080] (3g) Verifying public credentials: Verification by the verification end is short, i.e. Verify that the constant term of h is 0; for i∈[1,n0 / l+3], determine and And verify whether the following equations are all true:

[0081] 7)

[0082] 8)

[0083] 9)

[0084] If one of the equations does not hold, the verifier rejects the proof. Otherwise, the verifier accepts the proof, believing that the prover knows the incomplete split ring. The three secret elements m1, m2, m3 on the matrix satisfy m3 = m1*m2 and m1, m2∈{-1,0,1} d Make the linear relationship holds, where the matrix A and the vector It is public.

[0085] The protocol described above is a general protocol for designing a variety of cryptographic techniques, which can be directly used to construct lattice-based anonymous credentials and anonymous certificates. In addition, the protocol can also be used directly as a sub-protocol for users to join a group when designing lattice-based dynamic group signatures, group encryption schemes, and secret handshakes and other anonymous schemes.

[0086] The key technical point of the present invention is to cleverly use the coefficient embedding algorithm and element rotation algorithm to transform the linear relationship with hidden product and small norm condition constraints on the incomplete split ring into Specifically, first, Using the coefficient embedding algorithm, the ring The relationship between Convert to The relationship on the coefficient vector and Then use the coefficient embedding algorithm on m3, combined with the element rotation algorithm, to extract the coefficient vector in m3 = m1*m2 and and through The operation of the elements will and Separate, thereby The linear relationship with hidden product and transformation into The technique is a good way to extract accurate elements of linear relations with hidden products and is well suited for operations on incompletely split rings.

[0087] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0088] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for accurate zero-knowledge proof of linear relations with hidden products, characterized in that: The method comprises: Will not completely split the ring The linear relationship with hidden product on The linear relationship on Transform the additional conditions into The component-wise product relation on ; the additional conditions are hidden product and evidence norm restrictions; The Secret evidence on Through NTT inverse transformation on element x i ,exist Select uniformly random matrices and several vectors from above; The prover randomly samples vectors and elements from the error distribution χ to generate the first-stage commitment, and samples vectors from the discrete Gaussian distribution to determine the public vector. The verification end randomly selects the first challenge information; The proving end generates a new commitment, a blinding element and a redundant item through the first challenge information; The verification end randomly samples second challenge information c from the challenge space C; The proving end determines the second challenge information c for blinding Vector The verification end verifies the vector Whether the preset conditions are met and a series of equations are checked to see if they hold. If all the equations hold, the proof is accepted, otherwise it is rejected.

2. The method for accurate zero-knowledge proof of linear relations with hidden products according to claim 1, characterized in that: The linear relationship with hidden product on the incomplete split ring is transformed into The linear relationship on Linear relations with hidden products on Convert to The upper shape linear relationship.

3. The method for accurate zero-knowledge proof of linear relationship with hidden product according to claim 1 or 2, characterized in that: The additional conditions are converted into The component-by-component product relationship on the , specifically including: the hidden product m3 = m1 * m2 and the evidence norm restriction m1, m2 ∈ {-1, 0, 1} d Convert to The upper shape The component-by-component product relationship, i = 0, ..., d-1, the matrix M is composed of B i , D i The public matrix, vector and is the coefficient vector of the ring elements m1, m2 and m3; Is The public vector is obtained by adding the appropriate 0 vector to the coefficient vector; Is The secret vector of composition.

4. The method for accurate zero-knowledge proof of linear relations with hidden products according to claim 3, characterized in that: The proving end randomly samples vectors and elements from the error distribution χ to generate the commitment of the first stage, and samples vectors from the discrete Gaussian distribution to determine the public vector, specifically including: the proving end randomly samples vectors from the error distribution χ and elements Generate x i and g's commitment, and from the discrete Gaussian distribution D σ Upsample vector Sure 5. The method for accurate zero-knowledge proof of linear relations with hidden products according to claim 4, characterized in that: The verification end randomly selects the first challenge information, specifically including: the verification end randomly selects the first challenge information and 6. The method for accurate zero-knowledge proof of linear relations with hidden products according to claim 5, characterized in that: The proving end generates a new commitment, a blinding element and a redundant item according to the first challenge information, specifically including: generating and Commitment and determine the first excess term v0; The proving end determines The NTT inverse mapping is blinded by element g And determine the second redundant term 7. The method for accurate zero-knowledge proof of linear relations with hidden products according to claim 6, characterized in that: The verification end verifies the vector Whether the preset conditions are met and whether a series of equations are established. If all the equations are established, the proof is accepted, otherwise it is rejected. Specifically, it includes: Verification end verification It's short, yes. Sure and And verify that the following equations are all true: 1) 2) 3) If one of the equations does not hold, the verifier rejects the proof; otherwise, the verifier accepts the proof.

Images