Designated verifier zero-knowledge proof method based on CL homomorphic encryption

Abstract

The present invention discloses a zero-knowledge proof method for a designated verifier based on CL homomorphic encryption, and relates to the technical field of zero-knowledge proof. The method includes a setting phase, a proof phase, and a verification phase. A public reference string and a verification key are generated in the setting phase. In the proof phase, a proof is generated based on the public reference string and the verification key and sent to a verifier. The verifier decrypts the proof in the verification phase, and performs linear calculation in plain text to complete the verification process. The present invention adopts CL homomorphic encryption, which has the ability to resist discrete logarithm attacks, thereby improving the security of the scheme. In addition, the present invention removes the bilinear pairing operation in the verification phase and instead completes the verification by decryption. This improvement enhances the versatility of the scheme. At the same time, the zkSNARK protocol of the designated verifier is adopted, so that the present invention can be effectively applied to scenarios where access control of the proof is required.

Description

Technical Field

[0001] The present invention relates to the field of zero-knowledge proof technology, and in particular to a designated verifier zero-knowledge proof method based on CL homomorphic encryption. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Zero-Knowledge Proof (ZKP) is a cryptographic technique proposed by S. Goldwasser, S. Micali and C. Rackoff in the early 1980s. It allows the prover to prove the authenticity of a statement to the verifier without revealing any additional information. Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zkSNARK) is a type of efficient zero-knowledge proof scheme that is simple and non-interactive and is widely used in the fields of blockchain and privacy computing.

[0004] The existing Pinocchio scheme is an implementation of the publicly verifiable zkSNARK scheme, which relies on homomorphic encryption modulo integer exponentiation and bilinear pairing operations to achieve zero-knowledge proofs. However, the scheme has some significant disadvantages: first, the homomorphic encryption modulo integer exponentiation may have security vulnerabilities in some cases, making it difficult to meet higher security requirements; second, the verification process relies on bilinear pairing operations, and the security of bilinear pairing has strict requirements on mathematical structure and computing environment. For most constructions, the choice of prime domain is limited by the matching order group of the existence of secure bilinear mappings, which limits its versatility in a wider range of applications; third, since the Pinocchio scheme is publicly verifiable, it means that anyone can verify the proof, however, in some scenarios, the proof is required to be only for a specific verifier. For example, during a transaction, the two parties involved in the transaction create a proof to prove the validity of the transaction, but they do not want to inform the third party of the transaction, or the proof may be some kind of paid content, and the prover just wants to allow paid members to access the proof. The Pinocchio scheme cannot be applied to these scenarios.

[0005] In summary, the existing Pinocchio scheme cannot be applied to certain scenarios that require limiting the scope of validators, and has poor versatility and low security. Summary of the invention

[0006] In view of the shortcomings of the existing schemes, the purpose of the present invention is to provide a designated verifier zero-knowledge proof method based on CL homomorphic encryption, which changes the traditional integer power modulus homomorphic encryption method into CL homomorphic encryption, which can resist discrete logarithm attacks, thereby improving the security of the scheme. At the same time, the bilinear pairing operation is removed in the verification stage, and the verification is completed by decryption to enhance the versatility of the scheme, and the zkSNARK protocol of the designated verifier is adopted, so that it can be effectively applied to scenarios where access control of the proof is required.

[0007] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0008] The first aspect of the present invention provides a designated verifier zero-knowledge proof method based on CL homomorphic encryption, including a setting phase, a proof phase and a verification phase:

[0009] Setup phase: Select the corresponding parameters, generate the public key and private key through the public-private key generation algorithm of the CL encryption algorithm, reduce the satisfiability problem of the arithmetic circuit to the QAP problem, and generate the public reference string and verification key;

[0010] Proof phase: define an arithmetic function, the prover substitutes the input into the arithmetic function to obtain all intermediate variable values, constructs a variable polynomial, generates a quotient polynomial based on the variable polynomial and calculates the quotient polynomial, uses the encryption parameters in the public reference string to calculate the encrypted variable polynomial and quotient polynomial, and converts and assigns values ​​to the encrypted variable polynomial to obtain the encrypted variable constraint polynomial and variable value consistency polynomial, calculates the offset terms of each variable polynomial and quotient polynomial respectively, generates a proof based on the encrypted quotient polynomial, variable polynomial, variable constraint polynomial, variable value consistency polynomial and offset term, and sends it to the verifier;

[0011] Verification phase: The verifier decrypts the encrypted variable polynomial, variable constraint polynomial, variable value consistency polynomial and quotient polynomial, and performs variable polynomial constraint check, variable consistency check and valid calculation check in plain text.

[0012] Furthermore, the public reference string generated in the setup phase contains a polynomial in ciphertext form obtained by the CL encryption algorithm.

[0013] Furthermore, the verification key generated in the setup phase contains private parameters, including a secret value, a decryption private key, and a constraint factor, and the verification key is held by a designated verifier.

[0014] Furthermore, the verification key generated in the setup phase is a non-public key.

[0015] Furthermore, when the satisfiability problem of arithmetic circuits is reduced to the QAP problem, the QAP problem consists of three sets of polynomials and a target polynomial, and a QAP string is constructed according to the QAP problem.

[0016] Furthermore, a variable polynomial is constructed according to the intermediate variable values ​​and the QAP string.

[0017] Furthermore, an arithmetic function is defined, including defining the number of variables therein, defining the index of the public input and output parts, and defining the index of the prover's secret part.

[0018] Furthermore, the specific steps for converting and assigning values ​​to the encrypted variable polynomials in the proof phase are as follows:

[0019] The encrypted variable polynomial is converted into an encrypted variable constraint polynomial and an encrypted variable value consistency polynomial, and the encrypted variable polynomial, the encrypted variable constraint polynomial and the variable value consistency encryption polynomial are respectively assigned and calculated using the intermediate variable values ​​to obtain the encrypted variable polynomial, the encrypted variable constraint polynomial and the encrypted variable value consistency polynomial.

[0020] Furthermore, the offset item in the proof phase means that due to the addition of coefficient values ​​and zero-knowledge random factors in the generated proof, the verifier cannot directly decrypt it, and must use the offset item sent by the prover to complete the decryption, and the offset item will not leak the coefficient value and zero-knowledge random factor.

[0021] Furthermore, the verification phase performs variable polynomial constraint checks, variable consistency checks, and valid calculation checks in plain text form, which means decrypting the ciphertext into plain text and completing the verification process through linear calculations in plain text form.

[0022] One or more of the above technical solutions have the following beneficial effects:

[0023] The present invention discloses a designated verifier zero-knowledge proof method based on CL homomorphic encryption, which improves the security and versatility of the existing Pinocchio scheme by improving the encryption method and the verification process, and is also applicable to scenarios where access control of proofs is required.

[0024] The present invention changes the traditional integer power modulus homomorphic encryption method into CL homomorphic encryption, thereby improving the security of the scheme. At the same time, the bilinear pairing operation is removed in the verification stage, and the verification process is completed by decryption to improve the versatility of the scheme.

[0025] The present invention does not use bilinear pairing operation in the verification stage, but uses CL decryption algorithm for decryption before verification, so that the zkSNARK scheme can be applied to more scenarios and improve its versatility. Since the scheme provided by the present invention requires decryption operation during the verification process, it means that the verification key needs to contain the decryption key, so the verification key cannot be made public to avoid cheating by the prover, and the verifier holding the verification key must be honest, so the scheme provided by the present invention is a zkSNARK scheme for specifying verifiers, which can be applied to some scenarios where the scope of verifiers needs to be limited.

[0026] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0028] Figure 1 This is a structural diagram of a zero-knowledge proof method for a designated verifier based on CL homomorphic encryption in an embodiment of the present invention;

[0029] Figure 2 This is a framework diagram of the various stages of the zero-knowledge proof of a designated verifier based on CL homomorphic encryption in an embodiment of the present invention;

[0030] Figure 3 This is a flow chart of a zero-knowledge proof method for a designated verifier based on CL homomorphic encryption in an embodiment of the present invention;

[0031] Figure 4 Schematic diagram of the front-end and back-end of the designated verifier zero-knowledge proof method based on CL homomorphic encryption in an embodiment of the present invention. DETAILED DESCRIPTION

[0032] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0033] Example:

[0034] The embodiment of the present invention provides a designated verifier zero-knowledge proof method based on CL homomorphic encryption, aiming to improve the security and versatility of the existing Pinocchio scheme.

[0035] The existing Pinocchio scheme uses integer exponentiation modulo homomorphic encryption, and the verification process relies on bilinear pairing operations, which has problems such as low security and limited versatility. In addition, the Pinocchio scheme is a public verifiability scheme and cannot be applied to certain scenarios that require access control of proofs. In order to solve the above problems, the present invention adopts the zkSNARK scheme and changes the traditional integer exponentiation modulo homomorphic encryption method to CL encryption.

[0036] The embodiment of the present invention selects CL homomorphic encryption as the basic technology, mainly based on its advantages in security and versatility. The CL homomorphic encryption algorithm can prove IND-CPA security under the subgroup membership difficulty assumption and has strong anti-attack capabilities, which makes it excellent in protecting data privacy. In addition, the design flexibility of the CL homomorphic encryption algorithm enables it to support decryption operations, which is a feature that the ElGamal encryption algorithm does not have.

[0037] Compared with traditional encryption algorithms (such as ElGamal encryption algorithm), CL encryption has a is of unknown order and in the subgroup The above discrete logarithm is easy to solve. This structure enables CL encryption to effectively support decryption without relying on complex bilinear pairing operations. And this feature allows verification to be achieved through decryption during the verification phase, thereby improving the versatility of the scheme and making it adaptable to more application scenarios.

[0038] The reason for choosing CL homomorphic encryption instead of other algorithms is the security, flexibility and adaptability it provides. By introducing CL homomorphic encryption, the scheme not only improves security, but also removes the reliance on bilinear pairing during the verification process, making the entire protocol more concise and efficient. In addition, the non-public verification key feature of CL encryption enables this scheme to effectively limit the scope of verifiers, and is suitable for specific scenarios that require access control, thereby meeting the needs of specific applications. In addition, since the scheme provided by the present invention requires decryption operations during the verification process, this means that the verification key needs to contain a decryption key, so the verification key cannot be made public to avoid cheating by the prover, and the verifier holding the verification key must be honest, so the scheme provided by the present invention is a zkSNARK scheme for designated verifiers. CL homomorphic encryption provides the necessary technical support for implementing the zkSNARK scheme for designated verifiers, ensuring that effective verification can be performed while protecting privacy, and is suitable for certain scenarios where the scope of verifiers needs to be limited.

[0039] The embodiments can be implemented through modular structures, such as Figure 4As shown in Figure 1, the modular structure is divided into a front-end module and a back-end module. The front-end module consists of two parts: calculation and arithmetic. The calculation part converts the problem to be proved into a mathematical calculation problem, and the arithmetic part converts the calculation problem into an arithmetic circuit suitable for zero-knowledge proof protocol processing. Common conversion methods are: Or Plonkish arithmetic. The backend module consists of a constraint system, an information theory compiler, a proof system, a cryptographic compiler, and a demonstration system. The circuit form after arithmetic processing usually needs to conform to a certain constraint system, such as the rank 1 constraint system (i.e. ); The information theoretic compiler is responsible for compiling and optimizing the constraint system into a low-level, executable computational model; The proof system is the core part of the back-end module and generates zero-knowledge proofs based on constraints; The cryptographic compiler is responsible for processing and optimizing the cryptographic algorithms used in the proof system; The demonstration system ensures that the generated proof can be effectively verified, and the verifier cannot obtain the secret information in the proof through the verification process.

[0040] like Figure 1 , Figure 2 , Figure 3 As shown, the proof method of the present invention includes a setting phase, a proof phase and a verification phase:

[0041] Setup phase:

[0042] Step 1.1: Select the corresponding parameters.

[0043] Specifically, from Select a random number from the field: ， make .

[0044] For unknown order groups , there is a discrete logarithm that is easy to solve and the generator is of Subgroup , and an unknown order, the generator is Subgroup ,make .

[0045] Step 1.2: Generate parameters through the public and private key generation algorithm of the CL encryption algorithm , private key and the public key : .

[0046] Step 1.3: Reduce the satisfiability problem of arithmetic circuits to the QAP problem and generate a public reference string and verification key.

[0047] In this embodiment, the public reference string includes a polynomial in ciphertext obtained by the CL encryption algorithm. The verification key includes private parameters, including a secret value, a decryption private key, and a constraint factor. The verification key is held by a designated verifier, and the verification key generated in the setup phase is a non-public key.

[0048] Specific:

[0049] Step 1.3.1: Reduce the satisfiability problem of arithmetic circuits to the QAP problem. A Boolean combinatorial circuit with one output is satisfiable if it has a set of satisfiable assignments such that the output of the combinatorial circuit is 1. The QAP problem consists of three sets of polynomials: and the target polynomial Composition, construct QAP string: , whose size is , the polynomial order is .

[0050] Step 1.3.2: Perform CL encryption separately and generate a public reference string : .in, is the order, random number Used to convert variable polynomials into variable constraint polynomials, is an additional random number used to calculate the variable consistency polynomial, s is a random number, Respectively based on The encryption algorithm.

[0051] Step 1.3.3: Generate verification key: , the verification key is non-public.

[0052] Proof phase:

[0053] Step 2.1: Define an arithmetic function.

[0054] Define an arithmetic function , define the number of variables, that is, the total number of variables is , the number of input and output variables is , define the index of the common input and output part as , the prover secret part index is .

[0055] Step 2.2: The prover substitutes the input into the arithmetic function to obtain the values ​​of all intermediate variables and construct the variable polynomial.

[0056] Specifically, step 2.2.1: Select random factors .

[0057] Step 2.2.2: Input Substitute into the function to get all the intermediate variable values , construct the variable polynomial based on the intermediate variable value and the QAP string generated in step 1:

[0058] .

[0059] Step 2.3: Generate a quotient polynomial based on the variable polynomial and calculate the quotient polynomial, use the encryption parameters in the public reference string to calculate the encrypted variable polynomial and quotient polynomial, and convert and assign values ​​to the encrypted variable polynomial to obtain the encrypted variable constraint polynomial and variable value consistency polynomial, and calculate the offset terms of each variable polynomial and quotient polynomial respectively, wherein each variable polynomial includes a variable polynomial, a variable constraint polynomial and a variable value consistency polynomial.

[0060] Specifically, the specific steps for converting and assigning values ​​to the encrypted variable polynomials in the proof phase are as follows:

[0061] Step 2.3.1: Calculate the quotient polynomial .

[0062] Step 2.3.2: Transform the encrypted variable polynomial to obtain the encrypted variable constraint polynomial and the encrypted variable value consistency polynomial, as shown below.

[0063] The encrypted variable polynomial is Transform to obtain variable constraint polynomial:

[0064] .

[0065] The encrypted variable polynomial is Transform to obtain variable value consistency polynomial:

[0066] .

[0067] Step 2.3.3: Use the intermediate variable value to respectively perform assignment calculations on the encrypted variable polynomial, the encrypted variable constraint polynomial and the variable value consistency encryption polynomial, directly calculate the variable value consistency encryption polynomial, and obtain the encrypted variable polynomial, the encrypted variable constraint polynomial and the encrypted variable value consistency polynomial.

[0068] Specifically, use the intermediate variable value Encrypted variable polynomial Assign values ​​to get the encrypted variable polynomial:

[0069] .

[0070] Use Value Constrain polynomials on encrypted variables (perform Polynomial of conversion) Assign values ​​to obtain the encrypted variable constraint polynomial:

[0071] .

[0072] Calculate the variable value consistency encryption polynomial (i.e. Transformed polynomial):

[0073] .

[0074] Calculate the offset term of the encrypted variable constraint polynomial Do the same calculation.

[0075] Using encrypted parameters from a public reference string Calculate the encrypted quotient polynomial and quotient polynomial offset term , 。

[0076] Step 2.4: Generate a proof based on the encrypted quotient polynomial, variable polynomial, variable constraint polynomial, variable value consistency polynomial, and offset term and sent to the verifier.

[0077] In this embodiment, the offset item generated in step 2.3.3 of the proof phase means that due to the addition of coefficient values ​​and zero-knowledge random factors in the generated proof, the verifier cannot directly decrypt it and needs to use the offset item sent by the prover to complete the decryption, and the offset item will not leak the coefficient values ​​and zero-knowledge random factors.

[0078] Verification phase: The verifier decrypts the encrypted variable polynomial, variable constraint polynomial, variable value consistency polynomial and quotient polynomial, and performs variable polynomial constraint check, variable consistency check and valid calculation check in plain text. The proof produced by the prover is valid only when all three checks are met.

[0079] The verifier computes the variable polynomial , and the polynomial for the variables and

[0080] Do the same calculation.

[0081] Using Authentication Key The private key in and the offset term provided in the proof Encrypted variable polynomials, encrypted variable constraint polynomials, and variable value consistency encryption polynomials Decrypt them separately and get:

[0082] .

[0083] The prover verifies the key The random number parameters in the following checks are performed:

[0084] Variable polynomial constraint checking:

[0085] .

[0086] Variable value consistency check:

[0087] .

[0088] Valid calculation check:

[0089] .

[0090] In this embodiment, performing variable polynomial constraint checks, variable consistency checks, and valid calculation checks in plain text during the verification phase means that the Pinocchio scheme no longer uses the method of performing bilinear pairing verification in cipher text form, but instead decrypts the cipher text into plain text and completes the verification process through linear calculation in plain text form.

[0091] The purpose of the present invention is to provide a designated verifier zkSNARK protocol based on CL homomorphic encryption, which improves the security and versatility of the existing Pinocchio scheme by improving the encryption method and verification process, and can be applied to scenarios where access control of proofs is required. In order to achieve the above purpose, the present invention changes the traditional integer power modulus homomorphic encryption method to CL encryption, thereby improving the security of the scheme, and at the same time removes the bilinear pairing operation in the verification stage, and completes the verification process by decryption to improve the versatility of the scheme.

[0092] The CL homomorphic encryption-based designated verifier zkSNARK scheme provided by the present invention includes three phases: setup phase, proof phase, and verification phase. The present invention provides a more detailed description of the process of improving the traditional Pinocchio scheme, and the specific steps are as follows:

[0093] First, let’s describe the process of implementing zero-knowledge proof with zkSNARK. zkSNARK cannot be used directly to solve any computational problem, and the problem needs to be converted into the correct form before it can be processed. The present invention belongs to the zkSNARK solution based on the QAP problem, and the conversion steps are as follows:

[0094] The first step is to convert the problem to be proved or the source program into an algebraic circuit.

[0095] The second step is to transform the algebraic circuit into a rank-1 constrained system (i.e. ), It is a vector group consisting of three vectors: , the solution vector Satisfy the constraints: ,in The purpose of the transformation is to convert circuit constraints into vector operation constraints to improve verification efficiency.

[0096] The third step is to Transformed into a QAP problem for arithmetic circuit calculation expression, it can generally be implemented through Lagrange's theorem. The QAP problem consists of three sets of polynomials. and the target polynomial For an arithmetic function , the function is elements as input, elements as output, that is, a total of Input and output elements, yes A valid assignment of input to output exists if and only if there exists a coefficient Make Divisible ,in This process essentially converts constraints based on matrix operations into constraints on polynomials.

[0097] The fourth step is to implement zkSNARK based on the QAP problem.

[0098] The core of the above conversion process is to convert the circuit problem into a polynomial problem. Polynomials have a very good property that the calculation result of any polynomial at any point can be regarded as a representation of its unique identity, that is, as long as a random point on the polynomial can be proved, the polynomial can be proved.

[0099] for ,in, is the root set. If the prover wants to prove this equation, he only needs to ask the verifier to send a random number Challenging the above equation, that is However, if there is only one Make , then the probability that the verifier can find this error in a challenge is only In this way, the verifier needs to challenge multiple times to reduce the probability of verification errors, but this embodiment hopes to identify the prover's cheating behavior with only one challenge.

[0100] Let’s define , exist Established on yes The root set of Factoring: ,say is the target polynomial (also called the zero polynomial), is the quotient polynomial.

[0101] When proving, the prover calculates And sent to the verifier, and because To make the parameters public, validators can calculate , then the verifier only needs one random check , you can judge Is it in is equal to zero: .

[0102] However, the above proof process still has defects. In the case of Then choose a random value , and calculate , because the equation is valid, it can still pass the verification of the verifier.

[0103] This problem is due to the public However, if the verifier gives This problem can be solved if the value is not disclosed as if it is placed in a black box, so encryption technology is considered to be used for hiding. In addition, the hidden value must still be able to be calculated, which is why homomorphic encryption technology is used.

[0104] For unknown order groups , there is a discrete logarithm that is easy to solve and the generator is of Subgroup , and an unknown order, the generator is Subgroup , When instantiating a group, the subgroup The order The generated set of integers in the interval, CL homomorphic encryption consists of three algorithms: :

[0105] Public and private key generation algorithm ;

[0106] Encryption Algorithm ;

[0107] Decryption algorithm .

[0108] It should be noted that in homomorphic encryption, exponentiation will destroy the homomorphic property, making the encrypted value unable to be decrypted correctly. Therefore, homomorphic encryption does not allow the exponentiation of the encrypted value again.

[0109] Let's use a specific example to illustrate the polynomial encryption method. Suppose In fact, the prover knows the polynomial means knowing the coefficients of the polynomial, that is, Because homomorphic encryption does not allow exponentiation of encrypted values, we must give of arrive Encrypted value of power: , then the encryption polynomial to be calculated is: .

[0110] The following is a preliminary concise non-interactive knowledge proof scheme. If the prover wants to prove that the polynomial order is , number of variables The polynomial , the solution is as follows:

[0111] Step A1: Parameter setting stage:

[0112] Step A1.1: Select a random number as a secret value.

[0113] Step A1.2: Setup .

[0114] Step A1.3: Calculation .

[0115] Step A1.4: For ,calculate have to .

[0116] Step A1.5: Calculation .

[0117] Step A1.6: Generate a public reference string:

[0118] .

[0119] Step A1.7: Generate verification key: .

[0120] Step A2: Proof phase:

[0121] Step A2.1: Calculate the function The corresponding variable value .

[0122] Step A2.2: Compute the quotient polynomial ,in similar.

[0123] Step A2.3: Use the encrypted value and variable values calculate , similarly, calculate and .

[0124] Step A2.4: Calculation .

[0125] Step A2.5: Use calculate .

[0126] Step A2.6: Generate Proof ,Will Sent to the validator.

[0127] Step A3: Verification Phase:

[0128] Step A3.1: Use private key and the prover provided Come to To decrypt: ,because The discrete logarithm is easy to solve, so we can get The value of, similarly, decryption is .

[0129] Step A3.2: Perform a valid calculation check: .

[0130] However, there is a problem with the above scheme: there is no guarantee that the prover actually used Provided in One way to solve this problem is to perform the same operation on another "transformed" encrypted value, acting like a checksum in arithmetic, to ensure that the result is the encrypted version of the original value.

[0131] The above method is through The exponential knowledge hypothesis (also called -PKE assumption) is implemented, -PKE hypothesis means that given , without knowing It is difficult to construct and ,in .

[0132] use -This construction of the PKE assumption can restrict the prover to only use The encrypted The prover can only assign the coefficients of the polynomial to the encrypted Value. -PKE assumption (embodied in the scheme as The scheme after conversion is as follows:

[0133] Step B1: Parameter setting stage:

[0134] Step B1.1: Select a random number as a secret value.

[0135] Step B1.2: Setup .

[0136] Step B1.3: Calculation .

[0137] Step B1.4: For ,calculate have to .

[0138] Step B1.5: Calculation have to .

[0139] Step B1.6: Calculation .

[0140] Step B1.7: Generate a public reference string: .

[0141] Step B1.8: Generate verification key: .

[0142] Step B2: Proof phase:

[0143] Step B2.1: Calculate the function The corresponding variable value .

[0144] Step B2.2: Calculate the quotient polynomial ,in similar.

[0145] Step B2.3: Use the encrypted value and variable values calculate , similarly, calculate and .

[0146] Step B2.4: Use the encrypted value and variable values calculate , similarly, calculate and .

[0147] Step B2.5: Calculation .

[0148] Step B2.6: Use calculate .

[0149] Step B2.7: Generate Proof and sent to the verifier.

[0150] Step B3: Verification phase:

[0151] Step B3.1: Use the private key and the prover provided Come to To decrypt: ,because The discrete logarithm is easy to solve, so we can get The value of, similarly, decryption is .

[0152] Step B3.2: Use the private key and the prover provided Come to To decrypt: ,because The discrete logarithm is easy to solve, so we can get The value of, similarly, decryption is .

[0153] Step B3.3: Use Perform polynomial constraint checking:

[0154] .

[0155] Step B3.4: Perform a valid calculation check: .

[0156] After solving the above problems, the solution still has some problems related to variables, operands and outputs. ,say is the left operand, is the right operand, For output, the above scheme has the following two problems: (1) the non-interchangeability of operands and outputs; (2) the consistency of variables across operands.

[0157] Commutativity means that the prover can modify the computation process and effectively prove some other unrelated computation results. For example, since all operands of the variable polynomial constraint use the same , so the prover can reuse the same operand polynomial, i.e. , or completely exchange the operand polynomials, that is , in this case the prover is proving some unrelated polynomials, but it can still be verified. The solution to this problem is to use different polynomials for different operands. Value, that is, introduction .

[0158] The variable in the cross-operand variable consistency problem refers to the variable in the source program to be proved. The cross-operand variable means that a variable appears in the left operand, right operand or output at the same time. For example, for the variable , the source program is , which can be converted into a polynomial expression In the previous scheme, the validity of the operand polynomials is checked separately, and there is no mandatory requirement to use the same variable values ​​in the corresponding variable polynomials, which means that the variables in the left operand The value of the right operand can be The values ​​of are different.

[0159] The solution to the problem of variable consistency across operands is to enforce variable value equality between operands by using an additional random number A variable polynomial is created between all operands as a checksum. Specifically, the consistency polynomial is To restrict the prover to assign the same value to the same variable with different operands, that is, if and only if the coefficients of all operands are the same , equation Established.

[0160] Although the above consistency check is useful, there is still a certain probability that There are cases where at least two of the calculated values ​​are equal or one polynomial can divide another polynomial. In this case, the prover can decompose The values ​​of these coefficients are such that the above equation still holds even if there are at least two unequal values. As an example, a single operation , the check equation is expressed as , then for any and , the prover can make , then the verification equation becomes: , the equation still holds, and the consistency check is invalid. The solution to this problem is to use a different : .

[0161] In the Pinocchio scheme, since the scheme is publicly verifiable, that is, the verification key is public, the prover can know , which will lead to ductility problems. The ductility problem can be divided into two parts: the ductility problem of variable polynomials and the ductility problem of variable consistency polynomials. In the Pinocchio scheme, since Expand to and , which means that the prover can modify the assignment of the polynomial at will. For example, for the original , since the prover has and , then we can calculate , in this case the polynomial constraint check (i.e. Check) and consistency check (i.e. The former is called the ductility problem of variable polynomials, and the latter is called the ductility problem of variable consistency polynomials. In Pinocchio, random numbers are introduced to and compare it with The terms are multiplied to ensure non-malleability.

[0162] However, since this is a designated verifier scheme, that is, the verification key will not be made public, there will be no scalability problem, and there is no need to introduce additional random factors. .

[0163] Furthermore, we can Optimize, still using only one random factor , but choose different generators during the parameter setting phase: choose random numbers ,make ,This randomization of the generators further increases security.

[0164] Next, consider constant assignments and public inputs. In fact, the zkSNARK scheme is not for calculations, but for verifying whether the output value is the result of the correct operation of the operands, or in other words, the verifier constrains the prover to provide valid assignments for the predefined program. Consider such a constraint: , this constraint does not conform to the general construction: for the variable and the coefficient of the manipulated variable ,have Because the constant value Need to pass is expressed in the form of Can be fixed to However, due to is provided by the prover, that is, Can be set to any value, it is difficult to find a constraint to enforce this in a general construction method for , then the verifier needs to provide a way to set It should be noted that The value of this variable should always be preset to .

[0165] Regarding public inputs, if there is no way to check against the verifier’s inputs, such as knowing that the prover multiplied two values ​​but not knowing the result or value, then the usefulness of the proof is limited. Furthermore, given that these specific values ​​are hard-coded into In this case, a separate key pair needs to be generated for each verifier’s input, which limits the reusability and practicality of public parameters. Therefore, consider having the verifier specify some values ​​for the calculation (including input / output values, value), which is equivalent to changing some variables originally assigned by the prover to be assigned by the verifier. In this way, the valid calculation check will only hold when the prover and the verifier use the same input value. Specifically, for polynomial in variables, where Input and output variables, non-input and output variables, then we can The variable polynomials are divided into two groups. item: , and Similar, note that here express For the prover's item: , and similar.

[0166] The last problem to be solved is the zero-knowledge problem of the scheme. The current scheme still has obvious defects in zero-knowledge property. In fact, for a secure scheme, even if there is only one coefficient and its value is The scheme must also ensure security. A natural idea is to introduce a random factor To ensure that knowledge cannot be extracted, first consider constructing The multiplication relationship with the polynomial value, that is, the prover chooses a random value , and use it to exponentiate the value in the proof, that is, to construct This relationship, but because the verifier calculates ,and It is private to the prover and cannot be used by any verifier. and To calculate So consider building The additive relationship with the variable polynomial, that is, construct This relationship, the verifier and Build .

[0167] However, using only one The factor cannot achieve complete zero-knowledge and may leak some knowledge. For example, the verifier can make and Equal, if identified , then it means To solve this problem, we need to use a different : , we can find the following structure so that the effective computation check holds: The final solution is as follows:

[0168] Step C1: Parameter setting stage:

[0169] Step C1.1: Select a random number ,make .

[0170] Step C1.2: Select generators ,make .

[0171] Step C1.3: Setup .

[0172] Step C1.3: Set the total number of variables to , where the number of input and output variables is Function Transformed into a polynomial order , the size is The QAP polynomial form of .

[0173] Step C1.4: Set the public reference string: .

[0174] Step C1.5: Generate verification key: .

[0175] Step C2: Proof phase:

[0176] Step C2.1: Substitute input values ,implement Get all intermediate variable values .

[0177] Step C2.2: Assign all unencrypted variables polynomial values: ,right and Do the same calculation.

[0178] Step C2.3: Select a random number .

[0179] Step C2.4: Compute the quotient polynomial .

[0180] Step C2.5: Set the variable value Assigned to the encrypted polynomial : , and similarly calculate and .

[0181] Step C2.6: Perform Conversion:

[0182] , and similarly calculate , .

[0183] Step C2.7: Perform Conversion:

[0184] .

[0185] Step C2.8: Calculate ,right Do the same calculation.

[0186] Step C2.9: Use calculate , .

[0187] Step C2.10: Generate Proof and sent to the verifier.

[0188] Step C3: Verification phase:

[0189] Step C3.1: Substitution And use the input and output variable values Assign the values ​​and we get: , similar.

[0190] Step C3.2: Use and right To decrypt: , solve the discrete logarithm and divide by have to The value of, similarly, decryption is .

[0191] Step C3.3: Use and right To decrypt: , solve the discrete logarithm and divide by have to The value of, similarly, decryption is .

[0192] Step C3.4: Use and right To decrypt: .

[0193] Solving the discrete logarithm yields The value of .

[0194] Step C3.5: Use and right To decrypt:

[0195] ,

[0196] Solving the discrete logarithm yields .

[0197] Step C3.6: Perform polynomial constraint check:

[0198] .

[0199] Step C3.7: Perform variable value consistency check:

[0200] .

[0201] Step C3.8: Perform a valid calculation check:

[0202] .

[0203] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0204] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

[0205] It should be understood by those skilled in the art that the embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0206] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A zero-knowledge proof method for a designated verifier based on CL homomorphic encryption, characterized in that: It includes the setup phase, the proof phase, and the verification phase: Setup phase: Select the corresponding parameters, generate the public key and private key through the public-private key generation algorithm of the CL encryption algorithm, reduce the satisfiability problem of the arithmetic circuit to the QAP problem, and generate the public reference string and verification key; When the satisfiability problem of arithmetic circuits is reduced to the QAP problem, the QAP problem consists of three sets of polynomials and the target polynomial, and a QAP string is constructed according to the QAP problem; Proof phase: define an arithmetic function, the prover substitutes the input into the arithmetic function to obtain all the intermediate variable values, constructs the variable polynomial according to the intermediate variable values ​​and the QAP string, generates the quotient polynomial according to the variable polynomial and calculates the quotient polynomial, uses the encryption parameters in the public reference string to calculate the encrypted variable polynomial and the encrypted quotient polynomial, and converts and assigns values ​​to the encrypted variable polynomial to obtain the encrypted variable constraint polynomial and the encrypted variable value consistency polynomial, calculates the offset term of the encrypted variable constraint polynomial and the offset term of the quotient polynomial respectively, generates a proof based on the encrypted quotient polynomial, the encrypted variable polynomial, the encrypted variable constraint polynomial, the encrypted variable value consistency polynomial, the encrypted variable constraint polynomial offset term, and the offset term of the quotient polynomial and sends it to the verifier; The offset item in the proof phase means that the coefficient value and zero-knowledge random factor are added to the generated proof, so the verifier cannot directly decrypt it. The offset item sent by the prover must be used to complete the decryption, and the offset item will not leak the coefficient value and zero-knowledge random factor. Verification phase: The verifier decrypts the encrypted variable polynomial, encrypted variable constraint polynomial, encrypted variable value consistency polynomial and encrypted quotient polynomial, and performs variable polynomial constraint check, variable consistency check and valid calculation check in plain text.

2. The designated verifier zero-knowledge proof method based on CL homomorphic encryption as claimed in claim 1, characterized in that: The public reference string generated in the setup phase contains the polynomial in ciphertext form obtained through the CL encryption algorithm.

3. The designated verifier zero-knowledge proof method based on CL homomorphic encryption as claimed in claim 1, characterized in that: The verification key generated in the setup phase contains private parameters, including secret value, decryption private key and constraint factor. The verification key is held by the designated verifier.

4. The designated verifier zero-knowledge proof method based on CL homomorphic encryption as claimed in claim 3, characterized in that: The verification key generated during the setup phase is a non-public key.

5. The designated verifier zero-knowledge proof method based on CL homomorphic encryption as claimed in claim 1, characterized in that: Define an arithmetic function, including defining the number of variables in it, defining the index of the public input and output parts, and defining the index of the prover's secret part.

6. The designated verifier zero-knowledge proof method based on CL homomorphic encryption as claimed in claim 1, characterized in that: The verification phase performs variable polynomial constraint checks, variable consistency checks, and valid calculation checks in plain text form, which means decrypting the ciphertext into plain text and completing the verification process through linear calculations in plain text form.

Images