Exact zero-knowledge proofs of linear relations with hidden products

Abstract

This invention discloses an accurate zero-knowledge proof method for linear relations with hidden products, which transforms linear relations with hidden products on incomplete splitting rings into linear relations on the same surface; transforms the accompanying additional conditions into component-wise product relations on the same surface; and transforms the secret evidence on the same surface into element x on the same surface using an inverse NTT transformation. i The process involves selecting a uniformly random matrix and several vectors; generating a first-stage commitment and sampling vectors from a discrete Gaussian distribution to determine the public vector; selecting first challenge information; generating new commitments, blinding elements, and redundant terms using the first challenge information; randomly sampling second challenge information c from the challenge space C; determining the vector used for blinding using c; verifying whether the vector satisfies preset conditions and checking whether a series of equations hold true. If all equations hold true, the proof is accepted; otherwise, it is rejected.

Description

Technical Field

[0001] This invention relates to the fields of quantum-resistant cryptography and privacy-preserving cryptography, and in particular to an exact zero-knowledge proof method for linear relationships with hidden products. Background Technology

[0002] Lattice cryptography is one of the most important post-quantum cryptosystems. Linear relations and product relations are two of the most common operations. Accurate zero-knowledge proofs of these two relations are crucial for constructing many lattice-based privacy-preserving cryptographic schemes. Significant progress has been made in lattice-based zero-knowledge proof research both domestically and internationally, enabling efficient proofs of pure linear and pure product relations. Accurate zero-knowledge proofs of linear relations with nested product relations are core components for designing privacy-preserving cryptographic schemes such as anonymous certificates, dynamic group signatures, and group encryption. However, zero-knowledge proofs for these relations are typically complex, and only a few schemes have been proposed so far. Wang Huaxiong et al. proposed a lattice-based scheme by permuting binary vectors with fixed weights, ensuring that the weights remain unchanged after the transformation. Xu Qiuliang et al. used bit decomposition to transform matrix-vector multiplication into bit-by-bit multiplication, constructing a more efficient lattice-based scheme. However, these schemes are all based on standard lattice designs, resulting in large system parameters, long key sizes, and significant robustness errors. To reduce these robustness errors to negligible levels, the protocol needs to be run hundreds and nearly ten times respectively, leading to high communication overhead and making practical applications difficult. Currently, an efficient and even practical scheme based on modular lattices has been proposed abroad. However, this scheme requires the underlying polynomial ring to be completely split. This restriction is incompatible with secure digital signature schemes based on standard ring / modular lattice construction models, and cannot be used for the design of efficient lattice-based anonymous certificates, dynamic group signatures, and group encryption. Therefore, there is currently a lack of efficient lattice-based zero-knowledge proof methods that can be used for the design of privacy-preserving cryptographic schemes.

[0003] Modular lattices offer advantages such as compressed system parameters / key size and faster computation, making them the preferred choice for designing efficient and even practical quantum-resistant cryptographic schemes based on lattices. However, designing quantum-resistant cryptographic schemes based on modular lattices is generally more complex than designing based on standard lattices. Moreover, due to the difference in algebraic structure between incompletely split rings and fully split rings, lattice-based linear relational zero-knowledge proof methods with product relationships built on fully split rings cannot be directly transferred to corresponding designs on incompletely split rings. Therefore, overcoming current design bottlenecks requires exploring new design paths. Summary of the Invention

[0004] Therefore, it is necessary to propose an exact zero-knowledge proof method for linear relationships with hidden products to address the above problems.

[0005] This invention provides a method for proving exact zero-knowledge relationships with hidden products in linear relationships, the method comprising:

[0006] Incomplete splitting ring The linear relationship with hidden product is transformed into Linear relationship on;

[0007] Transform the attached additional conditions into The component-wise product relation; the additional conditions are the hidden product and the evidence norm restriction;

[0008] The Secret evidence Inverse NTT transform On Elements x i ,exist Select a uniformly random matrix and several vectors above;

[0009] The proof end randomly samples vectors and elements from the error distribution χ to generate the commitment for the first stage; and samples vectors from the discrete Gaussian distribution to determine the public vector.

[0010] The verification end randomly selects the first challenge information;

[0011] The proof end generates new commitments, blinding elements, and redundant items based on the first challenge information;

[0012] The verification terminal randomly samples the second challenge information c from the challenge space C;

[0013] The proof end determines the blinding process through the second challenge information c. vector

[0014] The verification vector at the verification end Check whether the preset conditions are met and whether a series of equations are true. If all equations are true, the proof is accepted; otherwise, it is rejected.

[0015] In the above scheme, the linear relationship with hidden products on the incomplete splitting ring is transformed into... The linear relationship on the above specifically includes: the incomplete splitting loop The linear relationship with hidden product. Transform into The upper shape is like The linear relationship.

[0016] In the above scheme, the additional conditions are transformed into The component-wise product relation includes: the hidden product m3 = m1 * m2 and the evidence norm constraint m1, m2 ∈ {-1, 0, 1}. d Transform into The upper shape is like The component-wise product relationship, i = 0, ..., d-1, matrix M is formed by B i D i The constructed public matrix, vector and It is the coefficient vector of the ring elements m1, m2 and m3; It is by The public vector is obtained by adding a suitable zero vector to the coefficient vector; It is by The secret vector formed.

[0017] In the above scheme, the proof end randomly samples vectors and elements from the error distribution χ to generate the first-stage commitment, and samples vectors from the discrete Gaussian distribution to determine the public vector. Specifically, this includes: the proof end randomly sampling vectors from the error distribution χ. and elements Generate pairs of x i The commitment of g, and from the discrete Gaussian distribution D σ Upsampling vector Sure

[0018] In the above scheme, the verification end randomly selects the first challenge information, specifically including: the verification end randomly selects the first challenge information. and

[0019] In the above scheme, the proof end generates new commitments, blinding elements, and redundant terms based on the first challenge information, specifically including: generating a pair of... and The commitment, and the determination of the first redundant item v0;

[0020] The proof end is determined The NTT inverse mapping, through element g blinding And determine the second redundant item.

[0021] In the above scheme, the verification vector at the verification end The system checks whether preset conditions are met and verifies a series of equations. If all equations are true, the proof is accepted; otherwise, it is rejected. This includes verification at the verification end. It's short, yes. Sure and And verify whether all of the following equations are true:

[0022] 4)

[0023] 5)

[0024] 6)

[0025] If any equation is false, the verifier rejects the proof; otherwise, the verifier accepts the proof.

[0026] The embodiments of the present invention have the following beneficial effects:

[0027] This invention provides the first accurate zero-knowledge proof for linear relations with hidden products and small norm secret evidence on incompletely split rings, solving the problem that current techniques are only applicable to fully split rings and cannot meet some practical application requirements. Specifically, by cleverly using coefficient embedding and element rotation algorithms, the linear relations with hidden products and small norm constraints on incompletely split rings are transformed into... The linear relationships and component-wise product relationships on the modular lattice make it highly compatible with efficient and accurate zero-knowledge proof frameworks based on lattices. Furthermore, the method of this invention is designed based on commitment schemes for modular small integer solutions and modular fault-tolerant learning problems, which can effectively resist attacks from quantum computers. Due to the full utilization of the algebraic structure of the modular lattice, the parameters / key size is small, and the proof overhead is low. Therefore, this invention is a quantum-resistant accurate zero-knowledge proof applicable to linear relationships with hidden products on incompletely split rings. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] in:

[0030] Figure 1 A flowchart is provided for an embodiment of the present invention to demonstrate an accurate zero-knowledge proof method for linear relationships with hidden products;

[0031] Figure 2 The flowchart provides another method for accurate zero-knowledge proof of linear relationships with hidden products in this invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] This invention provides an exact zero-knowledge proof method for linear relationships with hidden products, such as... Figure 1 As shown, the method includes:

[0034] Step 101: Incomplete splitting loop The linear relationship with hidden product is transformed into Linear relationship on;

[0035] Specifically, the incomplete splitting ring The linear relationship with hidden product. Transform into The upper shape is like The linear relationship.

[0036] Step 102: Transform the attached additional conditions into The component-wise product relation; the additional conditions are the hidden product and the evidence norm restriction;

[0037] Specifically, the hidden product m3 = m1 * m2 and the evidence norm are restricted to m1, m2 ∈ {-1, 0, 1}. d Transform into The upper shape is like The component-wise product relationship, i = 0, ..., d-1, matrix M is formed by B i D i The constructed public matrix, vector and It is the coefficient vector of the ring elements m1, m2 and m3; It is by The public vector is obtained by adding a suitable zero vector to the coefficient vector; It is by The secret vector is constructed. Step 103: The... Secret evidence Inverse NTT transform On Elements x i ,exist Select a uniformly random matrix and several vectors above;

[0038] Step 103: The proof end randomly samples vectors and elements from the error distribution χ to generate the commitment for the first stage, and samples vectors from the discrete Gaussian distribution to determine the public vector;

[0039] Specifically, the proof end randomly samples a vector from the error distribution χ. and elements Generate pairs of x i The commitment of g, and from the discrete Gaussian distribution D σ Upsampling vector Sure

[0040] Step 104: The verification end randomly selects the first challenge information;

[0041] Specifically, the verification terminal randomly selects the first challenge information. and

[0042] Step 105: Use the first challenge information to generate new commitments, blinding elements, and redundant items.

[0043] Specifically, the proof end determines the... and The commitment (here, "intermediate value" can be used) and (replace), and determine the first redundant term v0; determine Blinding with g And determine the second redundant item.

[0044] Step 106: The verification end randomly samples the second challenge information c from the challenge space C;

[0045] Step 107: The proof end determines the information to be used for blinding through the second challenge information c. vector

[0046] Step 108: The verification vector at the verification end Check whether the preset conditions are met and whether a series of equations are true. If all equations are true, the proof is accepted; otherwise, it is rejected.

[0047] This invention provides the first accurate zero-knowledge proof for linear relations with hidden products and small norm secret evidence on incompletely split rings, solving the problem that current techniques are only applicable to fully split rings and cannot meet some practical application requirements. Specifically, by cleverly using coefficient embedding and element rotation algorithms, the linear relations with hidden products and small norm constraints on incompletely split rings are transformed into... The linear relationships and component-wise product relationships on the modular lattice make it highly compatible with efficient and accurate zero-knowledge proof frameworks based on lattices. Furthermore, the method of this invention is designed based on commitment schemes for modular small integer solutions and modular fault-tolerant learning problems, which can effectively resist attacks from quantum computers. Due to the full utilization of the algebraic structure of the modular lattice, the parameters / key size is small, and the proof overhead is low. Therefore, this invention is a quantum-resistant accurate zero-knowledge proof applicable to linear relationships with hidden products on incompletely split rings.

[0048] This invention also provides an accurate zero-knowledge proof method for linear relationships with hidden products;

[0049] Regarding parameter settings and symbol explanations:

[0050] Positive integer d is a power of 2 (e.g., d = 128 can be taken), l|d, prime number q⁻¹≡2lmod(4l), μ, λ are safety parameters, σ is the parameter of the discrete Gaussian distribution, n₀ = 2(d 2 +d), β=σ√2(μ+λ+n0 / l+3)d.

[0051] v i,j =(i+2)d / l+j,η i,j = (d+i+2)d / l+j, where i=0,…,d-1,j=1,…,d / l.

[0052] Defined as

[0053] D σ It is a discrete Gaussian distribution with parameter σ;

[0054] χ represents a uniform distribution of elements in the range {-1, 0, 1};

[0055] Let {p} be the challenge space for coefficients in {-1,0,1}. The coefficients are chosen to satisfy Pr(0) = 1 / 2 and Pr(1) = Pr(-1) = 1 / 4.

[0056] It is a rejection sampling technique, defined as: for sets with a norm of at most T Let ρ′ be a probability distribution satisfied by V, and set σ = 11T, M = 3. Then, using the rejection sampling technique, according to... The generated The distribution and directly from ρ′ and The statistical distance of the distribution of the middle sample is no greater than 2. -100 / M.

[0057] ring Elements are represented by lowercase italic letters, and vectors are represented by lowercase italic letters with arrows, for example, a and ring Elements are represented by lowercase italic letters, and vectors are represented by lowercase italic letters with arrows, for example, 'a' and 'b'.

[0058] ring Matrices on a ring are represented by uppercase italic letters, such as A; The matrix above is represented by uppercase italic letters, such as A.

[0059] NTT stands for exponential transformation.

[0060] τ(·) is a coefficient embedding algorithm used to extract... coefficient vector

[0061] rot(·) is a rotation algorithm, defined as follows: if c = a * b, then here

[0062] like Figure 2 As shown, specific embodiments of the present invention are described below:

[0063] (1) Transformation relation: The target relation is in It is secret and satisfies m1,m2∈{-1,0,1} d (i.e., the small norm) and and It is public.

[0064] right Using coefficient embedding algorithm here Three matrices constitute.

[0065] Next, regarding Using a coefficient embedding algorithm, and for i = 0, ..., d-1, let... B i =rot(X) i ), set up The i-th column is All others are zero vectors, let B be a zero vector. i =A3B i The original target relationship is transformed into here It is public. It is secret, and it satisfies and

[0066] (2) Preliminary preparation and commitment key generation:

[0067] Will Secret evidence Each long vector is transformed using the NTT inverse mapping to... n0 / l elements x i ,Right now Select a uniformly random matrix and n0 / l+3 vectors Here, i = 1, ..., n0 / l + 3.

[0068] (3) Construct the proof protocol and execute it according to the following steps:

[0069] (3a) Define the commitments for the first phase:

[0070] The proof side selects a uniformly random vector and Determine And g's promise:

[0071] Next, determine the public vector.

[0072] (3b) Select the first challenge:

[0073] The first challenge of random sampling at the verification end and

[0074] (3c) Define the commitments for the second phase:

[0075] Proof of commitment

[0076] Subsequently, the first redundant item was determined.

[0077] Confirm again Second extra item

[0078] (3e) Selecting the second challenge: The verification end randomly selects the second challenge information.

[0079] (3f) Determine the blinding vector and blinding value: The proof uses... Determine the blinding vector

[0080] (3g) Verify public credentials: Verification terminal verification It is short, that is Verify that the constant term of h is 0; for i∈[1,n0 / l+3], determine and And verify whether all of the following equations are true:

[0081] 7)

[0082] 8)

[0083] 9)

[0084] If any equation is false, the verifying end rejects the proof. Otherwise, the verifying end accepts the proof, believing that the proving end does indeed know about the incomplete splitting ring. The three secret elements m1, m2, m3 satisfy m3 = m1 * m2 and m1, m2 ∈ {-1, 0, 1} d Make linear relationship This holds true, where matrix A and vector A are both valid. It is public.

[0085] The protocol described above is a general protocol for designing various cryptographic techniques and can be directly used to construct lattice-based anonymous credentials and certificates. Furthermore, this protocol can also be directly used as a sub-protocol for user joining a group when designing anonymity schemes such as lattice-based dynamic group signatures, group encryption schemes, and secret handshakes.

[0086] The key technical point of this invention lies in: cleverly using coefficient embedding algorithms and element rotation algorithms to transform the linear relationship with hidden product and small norm constraints on the incomplete splitting ring into... The linear relationship and component-wise product relationship. Specifically, firstly, regarding... Using a coefficient embedding algorithm, the ring Relationship Transform into Extract the coefficient vector based on the relationship above. and Then, using the coefficient embedding algorithm combined with the element rotation algorithm, we extract the coefficient vector from m3 = m1 * m2. and And through the Operations on elements will and Separate, thereby separating the ring The linear relationship with hidden product and its transformation Linear relationships and component-wise product relationships on loops. This technique achieves accurate element extraction of linear relationships with hidden products and is well-suited for operations on incompletely split loops.

[0087] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0088] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A linear relationship accurate zero-knowledge proof method with hidden product, which is applied to the technical field of quantum-resistant cryptography and privacy-preserving cryptography, characterized in that, The method comprises: Incomplete split ring Linear relationship on with hidden product is transformed into Linear relationship on transforming the accompanying additional conditions into on-component multiplication relations; the additional conditions being a hidden product and an evidence norm constraint; The Secret evidence Inverse NTT transform On element ,exist Select a uniformly random matrix and several vectors above; Prover end from error distribution The first stage commitment is generated by sampling a vector and an element from a random distribution, and the public vector is determined by sampling a vector from a discrete Gaussian distribution. The verification end randomly selects first challenge information; The proving end generates new commitment, blinding element and surplus term through the first challenge information; The verification end randomly samples the second challenge information from the challenge space ;​ The proof end passes the second challenge information determines a vector for blinding the vector ; The verification end verifies the vector whether the preset condition is met, and checks whether a series of equations is established, if all the equations are established, the proof is accepted, otherwise, the proof is rejected. the linear relation with hidden product on the incomplete split ring is transformed into the linear relation on the incomplete split ring with hidden product is transformed into the linear relation on the incomplete split ring with hidden product ​ wherein the target relation is wherein is secret and satisfies and ; and is public; To Using the coefficient embedding algorithm Here , consists of three matrices ; To Using coefficient embedding algorithm, while, Let , , set Where the first Column is The rest are all zero vectors, and let The original target relationship is transformed into Here , Is public, Is secret, and satisfies And .

2. The linear relationship accurate zero-knowledge proof method with hidden product according to claim 1, characterized in that, the additional conditions attached are transformed into a component-wise product relation over , specifically by transforming the hidden product and the witness norm constraint into a component-wise product relation over of the form , where the matrix is a public matrix constructed from and the vector is a coefficient vector of the ring element ; is a public vector obtained by adding suitable zero vectors to the coefficient vector of ; is a secret vector constructed from .

3. The linear relationship accurate zero-knowledge proof method with hidden product according to claim 2, characterized in that, The proof is based on the error distribution. Randomly sample vectors and elements to generate the first-stage commitment, and sample vectors from a discrete Gaussian distribution to determine the public vector, specifically including: the proof end from the error distribution. random sampling vector and elements Generate pairs and The commitment, and from the discrete Gaussian distribution Upsampling vector ,Sure .

4. The linear relationship accurate zero-knowledge proof method with hidden product according to claim 3, characterized in that, The verification end randomly selects the first challenge information, specifically including that the verification end randomly selects the first challenge information and .

5. The linear relationship accurate zero-knowledge proof method with hidden product according to claim 4, characterized in that, The proving end generates a new commitment, a blind element and a redundant item according to the first challenge information, specifically comprising: generating a commitment to and and determining a first redundant item ; The proving end determines the inverse mapping of NTT, by elements blinding and determines a second surplus term .

6. The linear relationship accurate zero-knowledge proof method with hidden product according to claim 5, characterized in that, The verification end verifies the vector whether the preset condition is met, and checks whether a series of equations are established, if all the equations are established, the proof is accepted, otherwise, the proof is rejected, specifically including: the verification end verifies is short, and is determined and , and verifies whether the following equations are all established: 1) 2) 3) If one equation is not established, the verification end rejects the proof; otherwise, the verification end accepts the proof.

Images