Computer-implemented system and method for data exchange

Abstract

The invention relates to a computer-implemented method for implementing zero-knowledge certification or verification of a statement (S), in which a certifier certifies to a verifier that the statement is true, while keeping the witness (W) of the statement secret. The invention also relates to a peer-to-peer method employed by a verifier verifying an attestation.

Description

[0001] This application is a divisional application of the PCT national phase application with a filing date of March 18, 2019 and national application number 201980020781.1. Technical Field

[0002] The present specification generally relates to computer-implemented methods and systems suitable for implementation in a computer processor (e.g., a node of a blockchain network) or a group of such processors. An improved method for generating proofs is provided, which enables efficient zero-knowledge verification of statements. The method is suitable for incorporation into an existing discrete logarithm-based zero-knowledge proof protocol for circuit satisfiability that does not require the use of bilinear pairing-friendly elliptic curves. The present invention is particularly suitable for, but not limited to, trustless fair exchange of data between data on two different blockchains. One of the parties can prove knowledge of a key or statement without revealing the statement, so as to produce a secure trustless exchange between the participants. In particular, the exchanged data implements a private key that determines an address on a blockchain network. Background Art

[0003] In this document, the term "blockchain" is used to include all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and their variations.

[0004] The term "user" in this article may refer to a human-based or processor-based resource. Blockchain is a peer-to-peer electronic ledger implemented as a computer-based decentralized, distributed system composed of blocks, which in turn consist of transactions.

[0005] Each transaction is a data structure that encodes the transfer of control of digital assets between participants in a blockchain system and includes at least one input and at least one output. Each block contains a hash of the previous block so that blocks are chained together to create a permanent, unchangeable record of all transactions that have been written to the blockchain since its inception. Transactions contain small programs called scripts embedded in the transaction's inputs and outputs that specify how and who can access the transaction's outputs.

[0006] Furthermore, in this document, reference is made to the structure of known zero-knowledge proof protocols and systems using arithmetic circuits. Blockchain provides a decentralized and permissionless global mechanism that implements a solution capable of resolving the fair exchange problem between two mutually distrusted parties without the need for third-party arbitration or escrow. The fair exchange of data or information in the exchange of economic rewards or information such as digital goods is embodied in a protocol called zero-knowledge contingent payment (ZKCP). [Maxwell 2016] In ZKCP, the specified data is transferred from the seller to the buyer only if the payment is confirmed, and the payment from the buyer to the seller is completed only if the specified data is valid according to the sales conditions. The details of this protocol are known [Campanelli 2017] , but it is essentially based on a combination of hashed time-locked contracts (HTLCs) and zero-knowledge proofs, which simultaneously verify that certain encrypted information (the "digital good") is valid / correct, and that the "password" to decrypt this information is the data that must be revealed on the blockchain in order to request payment.

[0007] The central component of a ZKCP protocol is a zero-knowledge proof of a series of subordinate statements about the validity or correctness of data / information, the validity of a key, and its corresponding hash value. This complex compound statement requires an efficient zero-knowledge proof system for general computation: essentially, this enables one party to run an arbitrary program with secret inputs, and then prove to another party that the program accepted the inputs as valid and that the program was executed correctly — without revealing any information about the secret inputs or the execution of the program. In known ZKCP examples, the general zero-knowledge proof system employed has been based on the Pinocchio protocol [Parno 2016] and C++ libsnark library [Libsnark 2016] The Succinct Non-Interactive Arguments of Knowledge (SNARKs) framework is implemented in . Zero-knowledge SNARKs (zkSNARKs) provide a way to prove the validity of arbitrary computations that can be expressed as arithmetic circuits with zero knowledge. The two main distinguishing properties of zkSNARKs are that they are non-interactive (the prover sends the proof to the verifier in one go) and succinct (the proof is small and easy to verify). However, they have significant limitations:

[0008] -Proof generation is extremely computationally demanding.

[0009] -The proof key is very large and scales with the circuit size.

[0010] - They depend on strong and untested cryptographic assumptions (i.e., knowledge of the exponential and pairing-based assumptions).

[0011] - For any given program (circuit), they require a Common Reference String (CRS) computed by a third party that must be trusted to remove the setup parameters. Any party that knows the setup parameters has the ability to create a forged proof.

[0012] To date, no attempts have been made to construct a zkSNARK to prove statements involving arbitrary cryptographic elliptic curve key operations, but it is assumed that such a zkSNARK would consist of arithmetic circuits with hundreds of thousands or millions of gates, and therefore proof generation time would take minutes and the size of the proving key would be hundreds of megabytes. Technical Background

[0014] The basic system for interactive zero-knowledge proofs can use a ∑ (Sigma) protocol, which includes many communication steps between the prover and the verifier. In general, the ∑ protocol includes 3 moves: the prover sends an initial commitment (a) to the verifier, then the verifier responds with a random challenge (x), and finally the prover answers with a final response or "opening" (z). The verifier then accepts or rejects the statement based on the transcript (a, x, z).

[0015] The ∑ protocol can be used to prove knowledge of a witness (w) known only to the prover or to prove a statement about a witness (w) known only to the prover. The protocol is zero-knowledge if no information about the witness or the secret is revealed to the verifier other than the fact that the statement about the witness is true. [Bootle 2015] .

[0016] At the heart of many interactive zero-knowledge protocols is a commitment scheme, which is used for arithmetic circuit satisfiability. Commitments enable a prover to commit to a secret value in advance, and later verifiably reveal (disclose) the secret value. A commitment scheme has two main properties. First, it is hidden - the commitment keeps the value secret. Second, it is binding - only the commitment to the original committed value is disclosed. Pedersen commitment [Bootle 2015] The scheme involves two elliptic curve generator points: a set of primes of order p known to all parties G and F in . The field of prime numbers generated by the committer The secure random number r in , and then computes (via elliptic curve addition / multiplication) the commitment to the secret value s:

[0017] Com(s, r) = s×G+r×F

[0018] Here, × represents the elliptic curve point multiplication.

[0019] The promiser can fully disclose the promise (i.e., the promise can be verified) at a later stage by providing the values ​​s and r. The promiser can also disclose the promise in response to a specific challenge value as part of the ∑ protocol, without revealing the secret s or the random number r.

[0020] Pedersen commitments are additively homomorphic, which means that adding two commitments together (on an elliptic curve) results in a commitment to the sum of the values ​​of the commitments, i.e.:

[0021] (s1×G+r1×F)+(s2×G+r2×F)=(s1+s2)×G+(r1+r2)×F

[0022] The proof of satisfiability of arithmetic circuits can be implemented in "zero knowledge". ) is a virtual construction of arithmetic gates connected by wires (forming a directed acyclic graph) that can perform arbitrarily complex calculations, where the calculations are limited to integer operations and must not have data-dependent loops or mutable states.

[0023] Each gate has two input lines and one output line, and performs a multiplication (×) or addition (+) operation on the inputs. Figure 1 (a) shows a left line input (w L ) and right line input (w R ) and a line output (w O ) is a schematic diagram of the multiplication gate, and Figure 1 (b) shows a schematic diagram of a simple arithmetic circuit having three gates, three input lines ((w1, w2, w3), one output line (w6) and two internal lines (w5, w6).

[0024] In practice, a complete circuit has free input and output wires that define external (circuit) input values ​​and output values. A legal assignment is to restrict the values ​​of the wires to those that satisfy the circuit, i.e., to assign a value to each wire where the output of each gate correctly corresponds to the product or sum of the inputs (i.e., the gates are consistent).

[0025] For a given arithmetic circuit, the prover can prove to the verifier that they know the legal assignment for the circuit without revealing the wire values ​​by first committing to each wire value in the legal assignment (using a Pedersen commitment), and then executing a specific ∑ protocol with the verifier for each gate in the circuit (which can be executed in parallel) using the wire values ​​as witnesses. These ∑ protocols exploit the homomorphic properties of Pedersen commitments, as described below.

[0026] To generate a proof (proof that the circuit is satisfied), initially the prover performs a i Generate commitments (i=1,...,n, where n is the number of threads) and send them to the verifier:

[0027] W i =Com(w i , r i )

[0028] For each "addition" gate in the circuit ( Figure 1 (b) shows a), execute ∑ zero Protocol: This involves proving (with zero knowledge) that w L +w R -w O = 0 (i.e., the addition gate is satisfied: input line w L and w R Equal to the output line w O ). This includes the following steps:

[0029] 1. The prover generates a commitment to zero: B = Com(0, r B ) and sends it to the validator.

[0030] 2. The validator responds with a random challenge value:

[0031] 3. The prover then calculates the opening value: z = x(r L +r R -r O )+r B and send it to the validator.

[0032] 4. As w L +w R -w O = 0, the verifier checks that Com(0, z) = x × (W L +W R -W O )+BB represents a curve point, similar to a public key; B=rx F+0x G r B Indicates the corresponding paired private key.

[0033] For each "multiplication" gate (such as Figure 1 (a)), execute ∑ prod Protocol: This involves proving (with zero knowledge) that for each multiplication gate w L ·w R =w O (i.e., the multiplication gate is satisfied).

[0034] 1. The prover generates 5 random blind values:

[0035] 2. The prover calculates C1 = Com(t1, t3), C2 = Com(t2, t5) and C3 = t1 × W R +t4×F, and then send them to the verifier.

[0036] 3. The validator responds with a random challenge value:

[0037] 4. The prover calculates the public value:

[0038] e1=w L x+t1

[0039] e2=w R x+t2

[0040] z1=r L x+t3

[0041] z2=r R x+t5

[0042] z3=(r O -w L r R )x+t4

[0043] and send them to the validator.

[0044] 5. Then as w L ·w R =w O The verifier checks the following equation:

[0045] Com(e1,z1)=x×W L +C1

[0046] Com(e2,z2)=x×W R +C2

[0047] e1×W R +z3×F=x×W O +C3.

[0048] ∑ zero Protocol and prod The protocol can be run in parallel to verify each gate in the circuit, and the same verifier challenge value (x) can be used for all gates.

[0049] For example, consider Figure 1Circuit in (b): In order for the prover to prove to the verifier with zero knowledge that they know a legal assignment (i.e., the line value satisfies the circuit), the prover initially sends the verifier a line commitment (W1, ..., W6) and a ∑ agreement commitment for each gate (which is one additional commitment for each addition gate and five for each multiplication gate).

[0050] The validator then responds with a random challenge And the prover computes the public value for each gate (one for each addition and five for each multiplication) and sends it back to the verifier. The verifier then performs a Σ protocol check to verify that:

[0051] w1·w2=w4

[0052] w4·w5=w6

[0053] w2+w3=w5

[0054] And therefore, commitments W1, ..., W6 correspond to satisfied line values ​​w1, ..., w6.

[0055] If the prover wants to show that, in addition to satisfying the circuit, a particular wire also has a particular value, they can fully disclose the commitment to the relevant wire. In this example, the prover can additionally send the values ​​w6 and r6 to the verifier (who can then confirm that W6 = Com(w6, r6)) to demonstrate that w6 is the actual output from a particular legal assignment.

[0056] Figure 1 The example in (b) is a trivial circuit. In practice, useful circuits consist of many more gates. Of particular interest is the arithmetic circuit for the SHA-256 hash function - this circuit enables a prover to demonstrate that they know the pre-image (input) to the SHA-256 function that hashes a particular (output) value, without revealing the pre-image. One of the most efficient implementations of the circuit for the SHA-256 algorithm consists of 27,904 arithmetic gates. [Zcash 2016] To then prove knowledge of the SHA-256 preimage would require sending about 5MB of data from both the initial commitment and the opening round of the protocol described above, and would require about 200,000 elliptic curve operations (taking a few seconds of processor time each) for both the prover and the verifier.

[0057] Several methods have been developed to significantly improve the performance of the parallel Σ protocol method for proving the satisfiability of arithmetic circuits. [Bootle 2016][Groth 2009]Involves batching commitments to circuit line values ​​to significantly reduce the size of the data that must be sent from the prover to the verifier (i.e., reduce communication complexity). These methods achieve communication complexity from Reduce to or The proof system.

[0058] Again, as a comparison to prove the satisfiability of the same SHA circuit, the protocol [Bootle 2016] The proof key is only 5KB in size and the key generation time is 180ms. The proof is 24KB in size and takes about 4 seconds to generate, and the proof also takes about 4 seconds to verify.

[0059] These methods are not fully described here except for explaining the main vector batching protocol adopted in the following steps. This follows the same properties as the standard Pedersen commitment, but for n elements (m=m1, ..., m n ) requires only sending a single group element:

[0060] 1. The prover and verifier agree on the group elements

[0061] 2. The prover generates n random numbers

[0062] 3. The prover calculates point K i =x i ×F(for i=1,...,n). These values ​​form the proof key PrK sent to the verifier.

[0063] 4. The prover generates a random value:

[0064] 5. The prover calculates the commitment:

[0065]

[0066] and send it to the validator. Summary of the invention

[0067] In general, the present invention is a computer-implemented method for performing zero-knowledge proof or verification of a statement. A prover can use the method herein to prove to a verifier that a statement is true while keeping the witness for the statement secret.

[0068] In particular, a witness may be access data that, when obtained, enables a verifier to access data protected by the witness. The blockchain network and its functionality may be used to protect the protected data. More particularly, a witness may be access data that enables the determination of a private key of an address on the blockchain network.

[0069] These statements are compound statements that involve both arithmetic circuit satisfiability and subordinate statements about the validity of the public key (key statement proofs).

[0070] Our method can be used in known circuit satisfiability protocols, such as existing discrete logarithm-based zero-knowledge proof protocols. This method is particularly suitable for protocols that do not require the use of bilinear pairing-friendly elliptic curves.

[0071] In this method, the prover sends a data set to the verifier, which includes a statement that for a given function circuit output and elliptic curve point, the function circuit input is equal to the corresponding elliptic curve point multiplier. The statement can be the private key of the prover's address on the blockchain network.

[0072] The data includes individual line commitments and / or batches of commitments, inputs and outputs of the circuit for the statement. The prover may include in the data the specification of the or each elliptic curve used in the statement, or may have shared the specification of the or each elliptic curve used in the statement in advance. The prover then sends a public in response to a challenge from the verifier. Alternatively, the prover additionally includes a proof key.

[0073] Using the data received from the prover, the verifier is able to determine that the circuit is satisfied and verify the statement, thereby determining that the prover holds witness to the statement. Elliptic curve points can also be calculated. Upon receiving the data, the verifier determines by calculation that the data complies with the statement. The present invention is particularly suitable for zero-knowledge proofs of the equivalence of hash preimages and elliptic curve private keys.

[0074] The method is particularly suitable for atomic swaps between two blockchains with limited script functionality, which may make one party vulnerable or in an unfair position. The method can make up for the lack of script functionality, such as hashed time-locked contracts (HTLCs). Therefore, according to the present invention, a method and system are provided.

[0075] It is therefore desirable to provide a computer-implemented method for achieving zero-knowledge proof or verification of a statement (S), thereby achieving a fair exchange of data between a prover and a verifier. Such an exchange may be referred to as an atomic swap. A prover (nominal Alice) has access to first data on a first blockchain, and a verifier (nominal Bob) has access to second data present on a second blockchain, and the prover and the verifier agree to exchange the data. Nominally, the prover may be referred to as Alice, and the verifier may be referred to as Bob. The exchange of data is also referred to as an atomic swap.

[0076] A computer-implemented method for implementing zero-knowledge proof or verification of a statement (S) may be provided, thereby implementing data exchange between a prover and a verifier, wherein the prover has access to first data on a first blockchain and the verifier has access to second data on a second blockchain, the method comprising:

[0077] The prover generates a key pair for the second blockchain and sends the public key (P A ) is sent to the verifier and the private key of the key pair is retained (s A );

[0078] The prover receives the validator public key (P B ), the verifier has generated a key pair for the first blockchain and retains the private key of the key pair (s B );

[0079] The prover sends a data set to the verifier, which includes a zero-knowledge proof statement (S), one or more commitments, an input (P x ) and functional circuit output (h);

[0080] The prover creates the first blockchain transaction Tx A , the transaction Tx A Transfer access to the first data to the public key address (P c ), and broadcast the transaction on the first blockchain network, the address is input (P x ) and the public key of the verifier (P B ) and limit

[0081] P C =P B +P x

[0082] The prover verifies the second blockchain transaction Tx B , the transaction is to confirm the first blockchain transaction Tx AThe transaction is then created by the verifier on the second blockchain network and broadcast on the second blockchain network after being included in the first blockchain, and the transaction transfers access to the second data to the prover's public key address (P A ), the public key address (P A ) is accessible by the prover using:

[0083] The prover's public key address (P A )'s valid signature(s) A ),as well as

[0084] The value of the function circuit input used to determine the function circuit output (h),

[0085] And the prover confirms the second blockchain transaction Tx B is included on the second blockchain and by providing its signature (s A ) and the value (x) of the function circuit input as the function circuit output (h),

[0086] This enables the verifier to observe the value (x) that is the input to the functional circuit used to determine the output (h) of the functional circuit and verify it by using P C The private key provides a signature to access the first data, the P C The private key is s from the homomorphic property of elliptic curve point multiplication B +x.

[0087] The method includes: the prover generates a key pair for the second blockchain, and the public key (P A ) is sent to the verifier, and the private key (s A ); The prover receives the public key (P B ), the verifier has generated a key pair for the first blockchain and retains the private key (s B ); The prover sends a data set to the verifier, which includes a zero-knowledge proof statement (S), one or more commitments, an input (P x ) and the function circuit output (h). The elliptic curve specification may be included in the data set. The method also includes: the prover creates a first blockchain transaction Tx A , the transaction Tx A Send the first data to the public key address (P c ), and broadcast the transaction on the first blockchain network, the address is input (P x ) and the public key of the verifier (P B ) and limit

[0088] P C =P B +P x

[0089] The prover verifies the second blockchain transaction Tx B , the transaction is to confirm the first blockchain transaction Tx A The transaction is then created by the verifier on the second blockchain network and broadcasted on the second blockchain network after being included in the first blockchain, and the transaction sends the second data to the public key address (P A ), the public key address (P A ) can be accessed by the prover using the following: the prover’s public key address (P A )'s valid signature(s) A ), and the value of the functional circuit input original image used to determine the functional circuit output (h), and the prover confirms the second blockchain transaction Tx B is included on the second blockchain and by providing its signature (s A ) and the value of the functional circuit input as the functional circuit output (h), thereby enabling the verifier to observe the value (x) as the functional circuit input used to determine the functional circuit output (h), and to verify the verifier by using P C The private key provides a signature to access the first data, the P C The private key is s from the homomorphic property of elliptic curve point multiplication B +s.

[0090] The statement may consist of only one arithmetic circuit for a functional circuit. The functional circuit may implement a hash function. The hash function may be a SHA-256 hash function.

[0091] Therefore, it is also desirable to provide a computer-implemented method, which is a computer-implemented method for implementing zero-knowledge proof or verification of a statement, in which a prover proves to a verifier that the statement is true while keeping a witness (W) of the statement secret. The proof may be an explicit proof.

[0092] The method includes: a prover sends a data set to a verifier. The data set includes a statement having an arithmetic circuit, the arithmetic circuit having m gates and n wires, the arithmetic circuit being configured to implement a functional circuit and determine whether, for a given functional circuit output (h) and an elliptic curve point (P), a functional circuit input (s) to the functional circuit or a wire in the functional circuit is equal to a corresponding elliptic curve point multiplier (s). The functional circuit may be a circuit that implements the function of a hash function. The preimage of the hash function circuit or a wire in the functional circuit may be equal to the corresponding elliptic curve point multiplier.

[0093] The data also includes individual line commitments and / or batches of commitments. The or each commitment may be an encrypted line input and output for a gate of a circuit. The data also includes inputs. The inputs operate as key disclosures for lines [elliptic curve points (P)] of an arithmetic circuit. Either the prover or the verifier may name the line. The input or key disclosure may be for the first line in the circuit. The data also includes functional circuit outputs. The specification of the or each elliptic curve used in the statement may be included in the data.

[0094] After sending the data, the prover receives the challenge value from the verifier and replies with a public statement. The public statement can be a value statement according to the ∑ (sigma) protocol. The public value can be for each gate of the circuit that enables the verifier to determine that the statement is true and calculate the elliptic curve point.

[0095] As an alternative to waiting for a challenge, the prover may additionally send a proof key to the verifier. The proof key may be generated from data that is part of the proof. The proof key may be a hash value of one or more random numbers used in the proof.

[0096] The data sent to the verifier enables the verifier to determine that the circuit is satisfied, and to compute the elliptic curve point and verify the statement, thereby determining that the prover has a witness to the statement.

[0097] The disclosure of the data set sent and / or the challenge sent to the verifier can act like a key created independently of the verifier. The challenge from the verifier is similar to confirming the prover's identity and the integrity of the key.

[0098] The input or key disclosure may be to the first wire in the arithmetic circuit. However, it is preferred to select a random wire, since proving knowledge of an intermediate wire is more difficult than proving knowledge of the first wire. Furthermore, selecting an arbitrary wire other than the first wire is more robust and prevents a malicious third party from discovering evidence or witnessing.

[0099] It is also desirable to provide a complementary computer-implemented method, which is a computer-implemented method for implementing zero-knowledge proof or verification of a statement, in which the verifier verifies that the statement is true by analyzing data received from the prover without knowing the witness (w) to the statement. Clearly, the method of the present invention extends to peer-to-peer actions taken by the verifier in a plug-socket manner. The present invention extends to full cooperation between the prover and the verifier.

[0100] The prover can send a separate line commitment and communicate with the verifier using the ∑ (Sigma) protocol to prove knowledge of the witness. Upon receiving a separate line commitment from the prover, the verifier can communicate with the prover using the ∑ protocol to confirm that the prover has knowledge of the witness.

[0101] In addition to or as an alternative to waiting for a challenge value, the prover may also send a random value to the verifier to enable the verifier to determine that the statement is true and calculate an elliptic curve point. Upon receiving the data from the prover, the verifier may alternatively receive a random value to enable the verifier to determine that the statement is true and calculate an elliptic curve point. The random value may be a function of at least one commitment. The function may be a hash function.

[0102] The random value or challenge may be replaced to improve the convenience and efficiency of the process. There is also a risk associated with the verifier generating a non-random challenge in an attempt to extract information about the witness. Moreover, replacing the challenge value with a random value provided by the prover converts the method from an interactive method to a non-interactive method. The prover can generate a proof that can be independently and publicly verified offline. The random value may be the output from a hash function. Replacing the random value (x) with the output from one or more committed hash values ​​utilizes the Fiat-Shamir principle.

[0103] The random value can be calculated by hashing the concatenation of all commitments generated by the prover and sent to the verifier.

[0104] Commitments can be:

[0105] W i =Com(w i , r i )

[0106] in

[0107] Com is a commitment to functional circuits,

[0108] w i is the line value,

[0109] r i is a random number that is different for each line commitment, and

[0110] i is the line name,

[0111] so that

[0112] Com(w, r) = w×G+r×F

[0113] in

[0114] F and G are elliptic curve points.

[0115] The input to line l in the arithmetic circuit can be:

[0116] ko=r l x F,

[0117] in

[0118] ko is the public input of the key,

[0119] r l is a random number, and

[0120] F is a point on the elliptic curve.

[0121] The line may be the first line in the circuit.

[0122] The verifier can confirm that the circuit is satisfied and is able to compute the public key for line l via elliptic curve point subtraction:

[0123] pk l =Com(w l , r l )-ko l

[0124] The prover can send batches of line commitments and generate random numbers to compute the elliptic curve point for each line, thus forming the proving key.

[0125] The batch commitment to the witness can be

[0126]

[0127] in

[0128] r is a random number generated by the prover,

[0129] The prover calculates the line value w i The commitment of a vector w (for i=1,...,n), where w n will be made public by the key,

[0130] K i is the computed elliptic curve point,

[0131] w i is the line value, where w n The key is made public.

[0132] F is a point on the elliptic curve.

[0133] The input to line n in the arithmetic circuit is:

[0134]

[0135] in

[0136] ko n is the public input of the key,

[0137] r is a random number, and

[0138] F is a point on the elliptic curve.

[0139] The input may be for the first line.

[0140] The verifier can calculate the public key of the key statement line through elliptic curve arithmetic:

[0141] pk n =Com(w)-ko n

[0142] Additionally, the prover may send a fully public commitment to at least one line. The method may use a Pedersen commitment. The statement may use only one arithmetic circuit for the functional circuit. The functional circuit may implement a hash function, and preferably a SHA-256 hash function.

[0143] The method can be used by a prover to implement a zero-knowledge contingent transaction (which can be a zero-knowledge contingent transaction) for data (e.g., an encryption key), wherein the prover contacts the verifier to confirm the data to be provided (which can be a vanity address) and the data to be received, and establishes a communication channel with the verifier (the channel can be public), and the prover receives the elliptic curve public key pk from the verifier B , the verifier has obtained a secure random secret key sk B Generate the elliptic curve public key pk B ,in

[0144] pk V =sk V ×G, and G is an elliptic curve point,

[0145] The prover ensures that a lock value i is provided for the data such that

[0146] data = pk V +i×G

[0147] The prover can perform a search for the desired pattern in the Base58 encoded address derived by changing i. The prover sends its public key pk to the verifier. P and the output f(i) from the functional circuit, where pk P =i×G, and the function circuit input (eg, pre-image) is the locked value i.

[0148] The prover can send a statement proof to the verifier, which proves to the verifier that the input to the functional circuit is consistent with pk PThe corresponding private key enables the verifier to verify the proof and confirm that pk=pk V +pk P The corresponding addresses match the agreed-upon pattern, thereby determining that knowledge of the lock value i enables the derivation of the complete private key for the data, and determining that the lock value i is a functional circuit input to the functional circuit.

[0149] The prover may receive a transaction Tx1 from the verifier, which contains an output containing the data to be received, which is accessible via a signature from the prover and the function circuit input i. The transaction may be a hashed time-locked function.

[0150] The prover can sign and broadcast a transaction on the blockchain where the transaction is mined into blocks, enabling the prover to access data from the output of transaction Tx1 by providing a second transaction Tx2, which provides its signature and value i to unlock the transaction, which is then leaked on the blockchain, thereby enabling the verifier to identify the locked value I and access the data provided by the prover, where

[0151] sk=sk B +i,

[0152] Where pk = sk × G

[0153] The data to be provided by the prover may include a vanity address.

[0154] Transactions can be completely atomic and trustless: the buyer can only pay if he provides a valid value i that is publicly revealed on the blockchain. Due to the splitting of the private key, the value exposed on the blockchain is useless to anyone else and does not compromise the security of the full private key.

[0155] A computer-implemented method may involve a prover performing a trustless fair exchange of data with a verifier (without a third-party centralized exchange). This may be described as a cross-chain atomic swap or atomic transaction, as in this context refers to the fair exchange property: either both parties complete their transaction or neither completes the transaction. This exchange may be performed between blockchains that support scripting functions that implement hashed and time-locked contracts.

[0156] The prover has access to first data on a first blockchain, and the verifier has access to second data existing on a second blockchain, and the prover and the verifier agree to exchange the data. The method includes: the prover generates a key pair for the second blockchain, sends the public key to the verifier, and retains the private key; the prover receives the verifier's public key for the first blockchain, the verifier has generated a key pair for the first blockchain and retains the private key; the prover sends a statement, one or more commitments, input or key disclosure and function circuit output and elliptic curve specification.

[0157] The prover can create the first blockchain transaction Tx A , the transaction Tx A The first data is sent to a public public key address, and the transaction is broadcasted on the first blockchain network, wherein the address is defined by the sum of the input and the public key of the verifier. After no exchange is made within 24 hours of the exchange, the prover can access the data.

[0158] The prover can verify the second blockchain transaction Tx B , the transaction is to confirm the first blockchain transaction Tx A The transaction is created by the verifier on the second blockchain network after being included in the first blockchain and broadcasted on the second blockchain network, the transaction sends the second data to the prover's public key address, which is accessible by the prover using a valid signature for the prover's public key address and a value that is an input to the functional circuit used to determine the output of the functional circuit. The verifier can access the data after no exchange is performed within 24 hours of the exchange.

[0159] The prover confirms the second blockchain transaction Tx B The second data is included on the second blockchain and accessed by providing its signature and the value of the function circuit input as the function circuit output, thereby enabling the verifier to observe the value of the function circuit input used to determine the function circuit output and access the first data by providing a signature using the private key (for P C , which is the homomorphic property of elliptic curve point multiplication s B +s).

[0160] As described above, each action of the prover requires a counterpart action of the verifier to verify the proof. The present invention extends to methods or actions performed by the verifier. Thus, there is provided a computer-implemented method for achieving zero-knowledge proof or verification of a statement, in which the prover proves (preferably explicitly) to the verifier that the statement is true, while keeping the witness to the statement secret, the method comprising: the verifier receives from the prover: a statement having an arithmetic circuit, the arithmetic circuit having m gates and n wires configured to implement a function circuit (preferably a hash function), and determining whether, for a given function circuit, and preferably a specified function circuit, output, and elliptic curve point, the function circuit input or preimage of the function is equal to the elliptic curve point multiplier. The verifier also receives: individual wire commitments and / or batches of commitments for the wires of the circuit, which are encrypted wire inputs and outputs; inputs or key disclosures for the wires in the arithmetic circuit (preferably wires other than the first wire); and the function circuit output (h). The verifier may also receive a specification of the elliptic curve or each elliptic curve used in the statement. The verifier may send a challenge value to the prover and then receive the disclosure. The disclosure may be made in accordance with the ∑ protocol and contain the values ​​of each gate of the circuit that enable the verifier to determine that the statement is true and compute the elliptic curve point. Additionally or alternatively, the verifier may receive a proof key from the prover.

[0161] The verifier then determines that the circuit is satisfied and computes the elliptic curve point (P) and verifies the statement, thereby determining that the prover holds a witness to the statement (w).

[0162] This can be achieved by proving with zero knowledge that the prover knows the value of each gate of the statement circuit using the Sigma protocol (if the proof is interactive) or using the proof key (if the Fiat-Shamir heuristic is used). The verifier can receive Σ_zero and Σ_prod commitments for each gate from the prover, reply with a challenge value, receive the public value from the prover, and check the commitment. The verifier can confirm that the circuit is satisfied by computing the public key for line l via elliptic curve point subtraction. The verifier can confirm that each public key for each line matches the key(s) specified in the statement. The verifier can determine that the fully public lines match the values ​​that can be specified in the statement to complete the verification.

[0163] It is also desirable to provide a computer-readable storage medium comprising computer-executable instructions that, when executed, configure a processor to perform a method performed by a prover, a verifier, or a cooperating prover and verifier.

[0164] It is also expected to provide an electronic device, the electronic device comprising: an interface device; one or more processors coupled to the interface device; a memory coupled to the one or more processors, the memory having computer executable instructions stored thereon, the computer executable instructions configuring the one or more processors to perform the method claimed herein when executed. It is also expected to provide a node of a blockchain network, the node being configured to perform the method claimed. It is also expected to provide a blockchain network having a node, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0165] The above has been used in the technical background section Figure 1 (a) and Figure 1 (b) Describes the basic system for interactive zero-knowledge proofs.

[0166] Aspects of the invention will become apparent from and elucidated with reference to the embodiments described herein. Embodiments of the invention will now be described by way of example only and with reference to the accompanying drawings, in which:

[0167] Figure 1 (a) is a schematic diagram of a multiplication gate having left and right line inputs and one line output;

[0168] Figure 1 (b) is a schematic diagram of an arithmetic circuit having three gates, three input lines, one output line, and two internal lines;

[0169] Figure 2 is a schematic diagram of a composite circuit for a statement, the composite circuit comprising arithmetic circuits for a hash function and an elliptic curve multiplication;

[0170] Figure 3 yes Figure 1 Alternative schematic diagrams of arithmetic circuits for the compound statements of (a)-(b), where only one arithmetic circuit is required;

[0171] Figure 4 is a schematic diagram of an arithmetic circuit having four gates and five wires, wherein the public key of the wire is revealed or disclosed from the wire commitment having the public value of the key;

[0172] Figure 5 is a schematic representation of data exchanged between a prover and a verifier for proof of a statement S, the statement having a circuit description and a first line having a corresponding public key;

[0173] Figure 6 is an alternative schematic representation of the data exchanged between the prover and the verifier; and

[0174] Figure 7 Is verified by the verifier Figure 4Schematic diagram of the checks that are performed when the circuit is satisfied, where the input line has the required public key and the hash value of the output line has the required value. DETAILED DESCRIPTION

[0175] Overview

[0176] The present invention enables efficient zero-knowledge verification of compound statements involving both arithmetic circuit satisfiability and subordinate statements about the validity of public keys (key statement proofs). Public key elliptic curve specifications are employed in homomorphic commitment functions to prove circuit satisfiability. This enables proving public key statements corresponding to private keys used as circuit inputs and / or outputs in an efficient manner.

[0177] The proof size and computational expense of generating proofs for statements involving both circuit satisfiability and elliptic curve key pairs can be greatly reduced. The method in this paper can be easily incorporated into existing discrete logarithm-based zero-knowledge proof protocols for circuit satisfiability without the need to use bilinear pairing-friendly elliptic curves.

[0178] Two applications of this method are described in relation to fair exchange transactions between two parties on a blockchain. The first application involves zero-knowledge contingent payments for trustless sales of outsourced vanity addresses, which requires a zero-knowledge proof of equality of a SHA256 hash preimage and an elliptic curve secret key. The second application involves improving the security of cross-chain atomic swaps, which requires proving that a SHA256 hash preimage is equal to an unknown private key (using a supplied public key) multiplied by a supplied nonce.

[0179] General solution

[0180] The present invention relates to a method that enables proving a specific class of compound statements involving a relationship with an elliptic curve public / private key pair (based on elliptic curve point multiplication).

[0181] Using zkSNARKs to prove statements involving arbitrary cryptographic elliptic curve key operations is considered impractical, and therefore the method uses information about the elliptic curve public key extracted directly from the 'homomorphic hiding' (or commitment scheme) used in constructing proofs for general circuit satisfiability. The specific type of elliptic curve involved in the method's statements is the same as the elliptic curve used in the circuit commitment scheme.

[0182] However, SNARK methods involve pairing operations and therefore require special bilinear pairing-friendly elliptic curves. Since the elliptic curves used on some blockchains are not compatible with bilinear pairing-friendly elliptic curves, the use of zk-SNARKs is excluded.

[0183] Therefore, the method of the present invention is compatible with alternative protocols for proving satisfiability of arithmetic circuits that do not rely on pairing and have fewer cryptographic assumptions. Overall, the method of the present invention is more efficient than zkSNARKS because less computation is required and the size of proofs for trustless exchange applications is reduced.

[0184] For example, the composite circuit representing the following "Statement 1" Figure 2 The schematic diagram of contains subcircuits for both hash functions and elliptic curve multiplication. Figure 2 , the schematic has three inputs: a secret key "s" with a corresponding paired public key "P" and a value "h" that is a hash value of the secret key "s". The schematic contains two arithmetic circuits, where the first arithmetic circuit performs hashing on the secret key and the second arithmetic circuit performs elliptic curve multiplication on the secret key. The output of the circuit is compared to the input.

[0185] Note that the inner gate is only used for illustration purposes. The circuit checks that the output of the hash is equal to the elliptic curve (EC) public key. Only the input "h", "P" and the output are fully revealed to the verifier. All other values ​​are encrypted.

[0186] Statement 1

[0187] “Given the output h of a hash function (H) and an elliptic curve point P (public key),

[0188] Then the hash preimage s (i.e., h = H(s)) is equal to the elliptic curve point multiplier (the private key, i.e., P = s × G, where G is the elliptic curve generator point)"

[0189] This method enables the prover to prove that particular statement with zero knowledge. Examples of applications that benefit from this method are described below in relation to trustless exchange of data and anonymous and secure cross-chain atomic swaps.

[0190] For example, verification of the truth of statement 1 is deterministic using the following pseudocode function, which takes inputs "h", "P", and "s" and outputs "1" if the statement is true and "0" otherwise:

[0191]

[0192] in accordance with Figure 2 , verifying “Statement 1” with zero-knowledge (i.e., the prover keeps the value of “s” secret from the verifier using a zkSNARK system) would require arithmetic circuits for both hash functions and elliptic curve point multiplication.

[0193] While arithmetic circuits for the SHA-256 hash function are widely used and optimized, and typically contain fewer than 30,000 multiplication gates, there are no known examples in the literature of arithmetic circuits that implement cryptographic elliptic curve point multiplication. Even if such circuits were known, they would be impractical due to their size and complexity and the fact that they contain many more gates.

[0194] like Figure 2 As shown, the method operates using the complete arithmetic circuit for a single hash function. Figure 2 Schematic diagram with arithmetic circuits for compound statement 1 using key statement proof and only one arithmetic circuit for the hash function. The circuit checks if the output of the hash is correct and if the public key is equal to the input of the EC encryption (key statement proof). The values ​​highlighted in blue (i.e., input "h", "P", and output "1") are revealed to the verifier, and all other values ​​are encrypted.

[0195] use Figure 3 The prover can unambiguously prove through circuit satisfiability that the secret key "s" hashes to "h", and the corresponding public key "P" of the key pair is equal to "s×G", where G is the elliptic curve generator point. The secret key "s" is the original graph of the hash, or the input to the function, and is not revealed to the verifier when proving the statement.

[0196] It is worth noting that verifying that “s×G” is equal to “P” can be extracted from the circuit proof at negligible additional computational cost by employing the required elliptic curve in the commitment scheme as part of the proof protocol. Such an operation is called “key statement proof” and uses a commitment disclosure procedure called “key disclosure”.

[0197] Technical Effects

[0198] Known zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs) are implementations of a generalized proof system for the satisfiability of arithmetic circuits. In the SNARK framework, a statement encoded as an arithmetic circuit is transformed into a construction called a quadratic arithmetic program (QAP), which consists of a set of polynomial equations. The statement is then proved by demonstrating the validity of this set of equations at a single point. The main advantage of the SNARK approach is that the verifier only needs to perform a few elliptic curve (pairing) operations (taking a few milliseconds), and the proof is very small (288 bytes) and is independent of the circuit size.

[0199] The very small proof and verification times achieved by the SNARK method come at the expense of a trusted setup, nonstandard cryptographic assumptions, and a heavier computational burden on the prover. The SNARK method also requires the use of elliptic curve bilinear pairings. However, the use of computationally feasible bilinear pairings requires the use of special "pairing-friendly" elliptic curves. This precludes the use of many standard cryptographic elliptic curve parameter sets. Statements involving general elliptic curve point multiplications must then use explicit circuits (which can be very large).

[0200] By way of comparison with the ∑ protocol method described in the previous section for proving SHA circuit satisfiability, using the SNARK (Pinocchio) framework, it will take about 10 seconds to generate the proof key and the proof key size will be about 7MB, and the proof will also take about 10 seconds to generate. However, the proof size is 288B and only takes about 5 milliseconds to verify. [Bootle2016] .

[0201] Additionally, incorporating explicit elliptic curve multiplication (key statements) into the circuit multiplies both the proof key size and proof generation time by at least an order of magnitude.

[0202] The present invention implements zero-knowledge proofs of statements involving both elliptic curve public-private key relationships and general arithmetic circuit satisfiability. In addition to proving the satisfiability of arithmetic circuits, this can be done with negligible computational cost and avoids the need to create explicit arithmetic circuits for elliptic curve point multiplication operations which would greatly increase the computational cost of the proof.

[0203] Implementation

[0204] Implementations of the present invention are described below for batched and un-batched commitment based zero-knowledge proof systems.

[0205] In the example, there are two parties involved in the zero-knowledge proof protocol: the prover (P) and the verifier (V). The goal of the protocol is for the prover to convince the verifier of a given statement while keeping the information about the witness of the statement secret. is true. This statement is represented by an arithmetic circuit with m gates and n wires. and about (one or more) elliptic curve public keys pk l The key statement may be composed of subordinate assertions of, the (one or more) elliptic curve public keys corresponding to one (or more) circuit line values, where the subscript l is the line index of the key statement. In addition, the statement may also include assertions about fully public (public) line values ​​(i.e., public inputs / outputs of the circuit).

[0206] The elliptic curve public key(s) specified in the statement are matched to the target elliptic curve specification (which is defined by the complete set of elliptic curve parameters: ) corresponding to.

[0207] about Figure 4 describes batched and unbatch commitments, Figure 4 is a representative arithmetic circuit with four gates and five wires. The input wire (w1) causes its public key to be leaked or published from the wire commitment W1 with the 'key public' value ko1.

[0208] Implementation – Separate Line Promise

[0209] by Figure 4 For example, 'key disclosures' are separate commitments for each wire in the circuit, created by the prover and sent to the verifier. These key disclosures follow a known Σ protocol for satisfiability of arithmetic circuits. Figure 5 The data exchanged between the prover and the verifier is shown.

[0210] Satisfiability is achieved through a number of steps including the following:

[0211] 1. Each line i (i=1, ..., n) of the circuit is committed to a Pedersen commitment:

[0212] W i =Com(w i , r i )

[0213] in,

[0214] Com(w, r) = w×G+r×F

[0215] 2. For circuit line l that requires proof of its corresponding public key (key statement proof), the prover will also send the key public key:

[0216] ko k =r k ×F

[0217] 3. Optionally, if circuit line j needs to be revealed publicly (fully public line), the prover sends a fully public tuple:

[0218] (w j , r j )

[0219] 4. Then use the Σ protocol to prove with zero knowledge that each gate of the circuit is satisfied, which involves the prover computing and sending the Σ for each gate. zero and∑ prodThe prover sends the public values ​​(z and e) and the verifier checks the commitment.

[0220] 5. Once the verifier confirms that the circuit is satisfied, the verifier calculates the public key of line l through elliptic curve point subtraction:

[0221] pk l =Com(w l , r l )-ko l

[0222] 6. Then, the verifier confirms each pk l The key(s) specified in the statement are matched (and the fully public line matches the specified value) to complete the verification.

[0223] Implementation details – separate line promises

[0224] continue Figure 4 , provides an explicit example of separate commitment and verification of a detailed example, which describes verifying the satisfiability of a simple arithmetic circuit using both a key statement proof in one of the lines and a complete revelation of the other line.

[0225] like Figure 4 The circuit shown With 5 lines w i (i=1,...,5) and 4 gates g j (j=1, ..., 4) Gates 1 and 3 are addition gates, and gates 2 and 4 are multiplication gates.

[0226] The prover and verifier agree on a statement that includes the circuit, the value of line 5, and the public key of line 1, along with the elliptic curve and commitment specification. The statement that the prover wants to prove to the verifier is true. yes:

[0227] “I know that satisfying circuits The assignment of (i.e., the line value that satisfies all gates Here, line 1 has the public key P (i.e., P=w1×G), and line 5 has the value h (i.e., w n =h)”

[0228] The values ​​of lines 1 to 4 are not revealed. Then, the prover and the verifier Figure 6 , and as follows:

[0229] 1. The prover generates 5 random blinding values ​​(r1, ..., r5), then computes 5 line commitments (W1, ..., W5) and sends these to the verifier.

[0230] 2. The prover calculates the public key for line 1: ko1 = r1 × F, and sends it to the verifier.

[0231] 3. The prover sends the full public information for line 5 (w5, r5) to the verifier.

[0232] 4. For the addition gates (g1 and g3), the prover generates a commitment to zero (using a random nonce r B1 and r B3 ): B1 = Com (0, r B1 ) and B3 = Com(0, r B3 ) and send them to the validator.

[0233] 5. For the multiplication gates (g2 and g4), the prover will generate commitments as follows:

[0234] For Gate 2:

[0235] C 12 =Com(t 12 , t 32 ),

[0236] C2=Com(t 22 , t 52 ),as well as

[0237] C3=t 12 ×W1+t 42 ×F

[0238] For Gate 4:

[0239] C 14 =Com(t 14， t 34 ),

[0240] C2=Com(t 24， t 54 ),as well as

[0241] C3=t 14 ×W3+t 44 ×F

[0242] Among them, t xx The value is a random blinding nonce. The prover sends these commitments to the verifier.

[0243] 6. The verifier then generates a random challenge value x and sends it to the prover. Alternatively, the prover can use the Fiat-Shamir heuristic to generate the value x by hashing the concatenation of all commitments.

[0244] 7. For the addition gates (g1 and g3), the prover computes the following public and sends it to the verifier:

[0245] z1=x(r1+r1-r2)+r B1

[0246] z3=x(r2+r1-r4)+r B3

[0247] 8. For the multiplication gates (g2 and g4), the prover computes the following public and sends it to the verifier:

[0248] e 12 =w1x+t 12

[0249] e 22 =w2x+t 22

[0250] z 12 =r1x+t 32

[0251] z 22 =r2x+t 52

[0252] z 32 =(r3-w1r2)x+t 42

[0253] e 14 =w3x+t 14

[0254] e 24 =w4x+t 24

[0255] z 14 =r3x+t 34

[0256] z 24 =r4x+t 54

[0257] z 34 =(r5-w3r4)x+t 44

[0258] 9.Finally, the verifier checks for equality. If these pass, the proof is verified.

[0259] exist Figure 7 The verification performed by the verifier is outlined in , where the checks in the inner box will verify that the circuit is satisfied and that the first line has the required public key and line 5 has the required value.

[0260] Figure 5 and6 The challenge “x” in provides an interactive proof where communication goes back and forth between the prover and the verifier.

[0261] This interaction may be convenient when zero-knowledge contingent payments (ZKCP) occur, as the seller and buyer may not be available or online at the same time. In addition, the buyer (verifier) ​​may want the proof to be publicly verifiable, for example it may be part of an advertisement for a digital good.

[0262] Furthermore, proofs are strictly zero-knowledge only in the perfect special-honest verifier model: that is, the verifier is assumed to generate truly random numbers as challenges, rather than choosing challenge values ​​to try and extract information about the witness.

[0263] To address these issues, the Fiat-Shamir heuristic is applied, which replaces the random challenge value "x" with the output of the hash value of the commitment made by the prover. In the random oracle model (where the output of the cryptographic hash function is considered truly random), the prover cannot cheat, and the verifier can check the generated challenge value.

[0264] Therefore, this example can be improved by converting the interactive proof system into a non-interactive proof system using the Fiat-Shamir heuristic, and the prover can generate a proof that can be independently and publicly verified offline.

[0265] More specifically, the challenge value (x) is replaced with a value computed by hashing (using, e.g., SHA-256) the concatenation of all commitments generated by the prover (i.e., all line commitments for sum gates and product gates, and all B and C1, C2, C3 commitments, respectively).

[0266] Implementation – Batched Vector Commitments

[0267] Commitment to vector [Bootle 2016,Groth 2009] A batched circuit satisfiability compression proof system uses the method described below, wherein the method is capable of extracting key statement proofs from batches of circuit line commitments.

[0268] To avoid repetition, the entire process is not described, and the following steps focus on the generation of batched line commitments and demonstrate that they contain a specified public key. In the following steps, batched commitments are generated as follows, where line l will be provided with the key public-n lines are batched together in a vector commitment. 1. The prover generates n-1 random numbers

[0269] 2. The prover calculates the elliptic curve point Ki =x i ×G (for i=1,...,n-1).

[0270] These values ​​plus K n =G forms the proof key PrK which is sent to the verifier.

[0271] 3. The prover generates a random value:

[0272] 4. The prover calculates the line value w i The commitment of a vector w (for i=1,...,n), where w n To be public by key:

[0273]

[0274] and send it to the validator.

[0275] 5. The prover also sends the public key for the vector commitment:

[0276]

[0277] 6. The verifier calculates the public key of the key statement line through elliptic curve arithmetic:

[0278] pk n =Com(w)-ko n SUMMARY OF THE INVENTION

[0280] Proofs of equality of hash preimages and elliptic curve private keys can be used in numerous applications. Two applications are described below that outline specific examples of constructing zero-knowledge proofs of key statements for application.

[0281] For the purpose of the example application, the following statement is a more specific version of statement 1 above, where

[0282]

[0283] “Given a SHA-256 hash function (H) with public output h and a public point P on the secp256k1 elliptic curve, then the secret preimage s of the hash (i.e., h = H(s)) is equal to the elliptic curve point multiplier (i.e., the corresponding private key, i.e., P = s × G)”

[0284] In the example provided, the statement is represented by a single arithmetic circuit for the SHA-256 hash function. (with n lines w i (i=1, ..., n) and m gates) and the input line (w1) is the private key of the public point P and the output line (wn ) is equal to h, that is:

[0285] Through the line AND w1×G=P AND w n To satisfy

[0286] Therefore, to fully verify the statement, the prover must use a commitment scheme based on secp256k1 to demonstrate to the verifier that they know a satisfying assignment for the SHA256 circuit, and then only provide the key public for line 1 (ko1) and the full public for line n (w n , r n ). The verifier will not get the value of the input line (w1) nor the output line w except the fully public one. n Any other line value other than .

[0287] Application I

[0288] Since deriving vanity addresses with significant patterns can be computationally expensive (for example, the address shown above requires generating approximately 10 13 different public keys), so the search is often outsourced, and there are several online marketplaces for delegating and selling vanity addresses. This can be done securely using the homomorphic properties of point multiplication over elliptic curves. [JoelKatz 2012] .

[0289] While outsourcing this generation is safe, the sale of vanity addresses is not trustless. Either the buyer gets the required value before the seller gets paid, or the seller gets paid before releasing the required value, or they both have to trust the escrow service. The present invention can be employed to enable trustless sales of vanity addresses via ZKCP. The steps taken between the buyer / verifier and the seller / prover are as follows.

[0290] 1. The buyer and seller reach consensus on the desired vanity mode (Str) and price, and establish a communication channel that does not need to be protected.

[0291] 2. The buyer generates a secure random secret key sk B And the corresponding elliptic curve public key, where the public key pk B =sk B ×G

[0292] 3. The buyer will pk B Send to seller.

[0293] 4. Then, the seller changes i from pk = pk B+i×G performs a search for the desired pattern in the Base58 encoded address derived from

[0294] 5. When an address with the desired pattern is found, the seller saves the value i, signals the buyer, and then sends them pk s =i×G and SHA256 hash H(i).

[0295] 6. The seller also provides the buyer with the original image for H(i) corresponding to pk s , as described in the example above.

[0296] 7. The buyer verifies the certificate and also confirms that pk=pk B +pk s The corresponding address matches the agreed-upon pattern. At this point (by virtue of the proof), the buyer knows that the learned value i will allow them to derive the full private key (sk) for the vanity address. B +i), and the particular value i is hashed to h=H(i).

[0297] 8. The buyer then constructs a hashed time lock contract (HTLC) transaction Tx1, which contains an output that includes the agreed-upon fee (a). This output can be unlocked in two ways:

[0298] i. Unlock at any time using the signature and hash preimage i from the seller.

[0299] ii. Unlocking with a signature from the buyer after a specified time by using, for example, the CHECKLOCKTIMEVERIFY (OP_CLTV) script opcode, which can be used to prevent the output from being spent before a specified time or block height.

[0300] 9. The buyer then signs the transaction and broadcasts it to the blockchain where it is mined as a block.

[0301] 10. Once confirmed, the seller can claim the fee on the output of Tx1 by providing transaction Tx2, which provides its signature and value i to unlock the hash lock, which is then exposed on the blockchain.

[0302] 11. The buyer can calculate the final vanity address private key sk = sk B +i, where pk = sk × G

[0303] 12. If the buyer fails to provide the value i before the specified OP_CLTV time, the seller can provide his signature to reclaim the fee (to prevent losing fees due to an uncooperative buyer).

[0304] The transaction is thus completely atomic and trustless: the buyer can only pay if he provides a valid value i that is publicly disclosed on the blockchain. Due to the splitting of the private key, this value is useless to anyone else and the security of the full private key is not compromised.

[0305] General Applications

[0306] The present invention is applicable to zero-knowledge proof or verification of a statement (S), in which the prover proves the statement to the verifier that it is true while keeping the witness (w) of the statement secret. The secret can be processed by a function such as a hash function, but the secret additionally includes cryptographic elliptic curve key operations, such as the validity of the statement about the public key. In the above example, the method of the present invention has been used to implement a trustless ZKCP for vanity addresses. This can also be applied to, for example: the derivation of passwords; the verification of valid machine-readable documents, such as passports or identity cards; or other such confidential transactions.

[0307] It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the invention as defined by the appended claims.

[0308] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The words "comprises" and "comprising" and the like do not exclude the presence of elements or steps other than those listed in any claim or in the specification as a whole. In this specification, "comprises" means "including or consisting of" and "comprising" means "comprising or consisting of".

[0309] The singular reference of an element does not exclude the plural reference of such elements and vice versa.The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer.

[0310] In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0311] References[Campanelli 2017]Campanelli,Matteo,et al."Zero-knowledgecontingent payments revisited:Attacks and payments for services."Commun.ACM(2017).[Maxwell 2016] https: / / github.com / zcash-hackworks / pay-to-sudoku

[0312] [Parno 2016]Parno,Bryan,et al."Pinocchio:Nearly practical verifiablecomputation."Security and Privacy(SP),2013IEEE Symposium on.IEEE,2013.

[0313] [Libsnark 2016] https: / / github.com / scipr-lab / libsnark

[0314] [Bootle 2015]Bootle,Jonathan,et al."Efficient zero-knowledge proofsystems."Foundations of Security Analysis and Design VIII.Springer,Cham,2015.1-31.

[0315] [Groth 2009]Groth,Jens."Linear Algebra with Sub-linear Zero-KnowledgeArguments."CRYPTO.Vol.5677.2009.

[0316] [Bootle 2016]Bootle,Jonathan,et al."Efficient zero-knowledgearguments for arithmetic circuits in the discrete log setting."AnnualInternational Conference on the Theory and Applications of CryptographicTechniques.Springer,Berlin,Heidelberg,2016.

[0317] [SEC 2010]Standards for Efficient Cryptography(SEC)(CerticomResearch, http: / / www.secg.org / sec2-v2.pd 。

Claims

1. A computer-implemented method for performing zero-knowledge proof or verification of a statement (S) to enable the exchange of data between a prover and a verifier, wherein: The prover has access to first data on a first blockchain, and the verifier has access to second data on a second blockchain, and the method includes: The prover generates a key pair for the second blockchain and sends the public key (P A ) is sent to the verifier and the private key of the key pair is retained (s A ); The prover receives a public key (PB) of a validator for a first blockchain, the validator having generated a key pair for the first blockchain and retaining a private key (s B ); The prover sends a data set to the verifier, wherein the data set includes a zero-knowledge proof statement (S), one or more commitments, an input (P x ) and a functional circuit output (h), wherein the data also includes a vanity address; The prover creates the first blockchain transaction Tx A , the first blockchain transaction Tx A Transfer access to the first data to the public key address (P c ), and broadcast the transaction on the first blockchain network, the address is input (P x ) and the public key of the verifier (P B ) and limit P C =P B +P x The prover verifies the second blockchain transaction Tx B , the second blockchain transaction Tx B Is confirming the first blockchain transaction Tx A The transaction is then created by the verifier on the second blockchain network and broadcasted on the second blockchain network after being included in the first blockchain, and transfers access to the second data to the prover's public key address (P A ), the public key address (P A ) is accessible to the prover using: The public key address of the prover (P A )'s valid signature(s) A ),as well as The value of the function circuit input (x) used to determine the function circuit output (h), And the prover confirms the second blockchain transaction Tx B is included on the second blockchain and by providing its signature (s A ) and the value (x) of the function circuit input as the function circuit output (h), This enables the verifier to observe the value (x) that is the input to the functional circuit used to determine the output (h) of the functional circuit and verify it by using P C The private key provides a signature to access the first data, the P C The private key is s from the homomorphic property of elliptic curve point multiplication B +x.

2. The computer-implemented method of claim 1 , wherein: Obtain the vanity address from a third party.

3. The computer-implemented method of claim 1 , wherein: The vanity address includes a string of characters that identifies a party.

4. A computer-implemented method for performing zero-knowledge proof or verification of a statement (S) according to claim 1, wherein: The prover proves to the verifier that the statement is true while keeping a witness (w) of the statement secret, the method comprising: The prover sends the following to the verifier: a statement (S) represented by an arithmetic circuit having m gates and n wires, the arithmetic circuit being configured to implement a functional circuit and determine, for a given functional circuit output (h) and an elliptic curve point (P), whether a functional circuit input (s) of the wire to the functional circuit is equal to a corresponding elliptic curve point multiplier (s); Individual line commitments and / or batch commitments for lines of a circuit; Functional circuit output (h); and Proof Key (PrK), This enables the verifier to determine that the circuit is satisfied and compute the elliptic curve point (P) and verify the statement, thereby determining that the prover possesses a witness to the statement (w).

5. The computer-implemented method of claim 4, wherein: The prover sends a random value (x) to the verifier so that the verifier can determine that the statement is true and calculate an elliptic curve point (P).

6. The computer-implemented method of claim 4, wherein: The commitment W i yes: W i =Com(w i ,r i ) in Com is a commitment to functional circuits, w i is the line value, r i is a random number that is different for each line commitment, and i is the line name, so that Com(w, r) = w×G+r×F in F and G are elliptic curve points.

7. The computer-implemented method of claim 2, wherein: The prover sends batches of line commitments and generates random numbers to compute an elliptic curve point for each line, forming a proof key (PrK).

8. The computer-implemented method of claim 6, wherein: The input to line n in the arithmetic circuit is: in ko n is the public input of the key, r is a random number, and F is a point on the elliptic curve.

9. The computer-implemented method of claim 1 , wherein: The prover additionally sends a fully public commitment to at least one line of the functional circuit.

10. The computer-implemented method of claim 1, wherein: The statement uses only one arithmetic circuit for the functional circuit.

11. The computer-implemented method of claim 1 , wherein: The functional circuit implements a hash function, and preferably, implements a SHA-256 hash function.

12. A computer-readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the computer-implemented method of claim 1.

13. An electronic device, comprising: Interface devices; one or more processors coupled to the interface device; A memory coupled to the one or more processors, the memory having computer executable instructions stored thereon, the computer executable instructions configuring the one or more processors to perform the computer implemented method according to claim 1 when executed.

14. A node of a blockchain network, the node being configured to execute the computer-implemented method according to claim 1.

15. A blockchain network having the node according to claim 14.

Images