Construction method of universal compiler based on updatable and verifiable CRS model

Abstract

The invention belongs to the technical field of zero-knowledge proof, and particularly relates to a universal compiler based on an updatable CRS model. By using an efficient updatable verifiable random function or updatable verifiable unpredictable function defined by the invention, the updatable knowledge reliability of SNARK can be improved to updatable simulation extractability by the compiler. According to the invention, the result is further expanded, another compiler is provided, and the NIZK with a weaker security concept, called as updatable reliability, can be improved into updatable simulation extractability. The invention specifically implements these compilers and compares them with other related work. The result shows that the compiler is more efficient and can be used in various application scenes.

Description

Technical Field

[0001] The present invention belongs to the technical field of zero-knowledge proof, and specifically relates to a method for constructing a general compiler based on an updateable and verifiable CRS model, and further relates to a method for constructing a compiler based on an updateable and verifiable random function or an updateable and verifiable unpredictable function. Background Art

[0002] Zero-knowledge proofs (ZKP) and non-interactive zero-knowledge arguments (NIZK) are core tools in modern cryptography and play an important role in cryptographic theory. These technologies have been widely used in various practical applications, such as anonymous credentials, verifiable computation, group signatures, and privacy-respecting cryptocurrencies. Zero-knowledge proof systems allow one party (the prover) to prove to another party (the verifier) ​​that he knows a witness that meets a specific relationship without revealing specific information. A typical zero-knowledge proof needs to meet three basic properties: completeness, reliability, and zero-knowledge. Completeness ensures that an honest prover can always convince an honest verifier; reliability ensures that a malicious prover cannot convince an honest verifier with a non-negligible probability; zero-knowledge ensures that the generated proof does not leak any information about the witness.

[0003] The most attractive non-interactive zero-knowledge proof system at present is the zero-knowledge succinct non-interactive argument of knowledge (zk-SNARKs). Recent research has focused on how to construct efficient zk-SNARKs for Boolean circuits and arithmetic circuits. The zk-SNARKs proposed by Groth is currently the most efficient proof system for the arithmetic circuit-satisfaction problem. Its proof consists of only three bilinear group elements, and the verifier only needs to check a pairing equation. In addition to simplicity, zk-SNARKs also need to satisfy completeness, knowledge reliability, and zero knowledge. Knowledge reliability is stronger than basic reliability. It ensures that if the adversary generates a valid proof, there is an efficient extractor that can extract the witness from the proof.

[0004] Non-interactive zero-knowledge proof systems usually work under the Common Reference String (CRS) model, where both the prover and the verifier have access to a common reference string generated by an honest party. If the generator of the CRS model is untrustworthy, it may lead to attacks that undermine zero-knowledge or soundness. Therefore, the trusted setting becomes an obstacle in the application of NIZK proof systems. Bellare et al. first studied how much security can be achieved when the CRS generator is untrustworthy, and proposed new concepts such as Subversive Witness Indistinguishability (S-WI), Subversive Soundness (S-SND), and Subversive Zero-Knowledge (S-ZK). In this subversive model, security is still guaranteed even if the CRS is generated maliciously. However, S-SND is not compatible with standard zero-knowledge. To overcome the defects, Groth et al. proposed an updateable CRS model in which anyone can update the CRS. They defined Updateable Knowledge Soundness (U-KS) and Updateable Zero-Knowledge (U-ZK) to ensure that zero-knowledge and knowledge soundness can be guaranteed as long as the initial CRS or an update is honest.

[0005] However, ensuring soundness or knowledge soundness is not sufficient for practical applications of NIZKs. These properties may still allow a valid attacker to generate another valid proof, leading to the so-called man-in-the-middle attack. Therefore, NIZK systems require stronger security requirements such as simulation soundness (SS) and simulation extractability (SE). These requirements ensure that soundness and knowledge soundness are maintained even if the adversary is able to adaptively select multiple instances and obtain proofs generated by the simulator. Simulation soundness and simulation extractability can be universally added to any NIZK. The most famous compiler is It works in the standard zero-knowledge model. Summary of the invention

[0006] The purpose of the present invention is to provide a method for constructing a universal compiler based on an updateable and verifiable CRS model, aiming to solve the security problems caused by the possible destruction of trusted settings in traditional NIZK and zk-SNARK systems. By introducing updateable verifiable random functions (uVRF) and verifiable unpredictable functions (uVUF) as building blocks, the present invention can improve the security and efficiency of the system while ensuring updatability and zero-knowledge. Compared with traditional methods, the framework of the present invention does not rely on the homomorphic nature of public keys, which further improves its scope of application and flexibility in practical applications.

[0007] The present invention proposes a method for constructing a universal compiler based on an updateable and verifiable CRS model, and the specific steps are as follows:

[0008] (1) Construct an updateable verifiable random function (uVRF) and a verifiable unpredictable function (uVUF);

[0009] (1.1) Construction of Updatable Verifiable Random Function (uVRF): Function Family F (·) (·):{0,1} * →{0,1} * It is a family of updateable verifiable random functions Φ = (KGen, Upk, Vpk, P, V), as follows:

[0010] (1.1.1) Key generation: (sk0, pk0, ζ0)←KGen(1 λ ), enter the security parameter 1 λ After that, the key pair (sk0, pk0) and the correctness proof ζ0 are output, where sk0 is the private key and pk0 is the public key;

[0011] (1.1.2) Key update: (pk i ,ζ i )←Upk(pk i-1 ), enter a valid verification key pk i-1 After that, output the updated verification key pk i And the correctness proof of the update processζ i ;

[0012] (1.1.3) Key verification: Enter the verification key pk i and all proofs After that, check the validity of the updated key. If the verification key pk i If it is updated correctly, it returns 1, otherwise it returns 0;

[0013] (1.1.4) Generate evaluation value: (y,ζ)←P(sk i ,x), input x and secret key sk i After that, output the evaluation value and proof of correctnessζ;

[0014] (1.1.5) Verify the evaluation value: {0,1}←V(pk i ,x,y,ζ), verify the evaluation value Is it correct?

[0015] (1.2) The definition of the updateable verifiable unpredictable function (uVUF) is the same as that of the updateable verifiable random function (uVRF), except that the updateable pseudo-randomness of uVRF is replaced by updateable unpredictability;

[0016] (2) In the updatable model, a compiler using the verifiable unpredictable function uVUF as a building block is used to convert NIZKs and SNARKs of updatable non-black-box knowledge soundness U-nBB-KS and updatable witness indistinguishability U-WI into NIZKs and SNARKs of U-nBB-SE and U-ZK.

[0017] (3) The compiler obtained by improving the compiler and public key encryption scheme described in step (2) is used to upgrade NIZKs that satisfy updatable soundness (US) and updatable witness indistinguishability (U-WI) to NIZKs that satisfy updatable black-box simulation extractability (U-BB-SE) and U-ZK, so as to improve security and encryption effect and ensure that attackers cannot successfully simulate or crack the proof.

[0018] The existing Lamassu framework uses a renewable signature scheme that is resistant to existential forgery (such as Schnorr signatures or ECDSA)Σ and a strongly unforgeable one-time signature schemeΣ OT (e.g., Groth's one-time signature scheme or Boneh-Boyen signature) to achieve simulated extractability. In the calculation, first run Σ and Σ OT The key generation algorithm is then used to calculate a signature to authenticate Σ OT The public key of the recipient will be used to verify the proof later.

[0019] The present invention builds an alternative to the Lamassu framework by adding the public key of uVRF / uVUF to the public reference string (CRS), thereby bypassing the use of Schnorr signatures in the proof process. This shortens the length of the proof and speeds up the calculation of the proof, and avoids the homomorphism requirement of the public key. The present invention gives NIZKsΠ that satisfy U-nBB-KS and U-WI, and its corresponding language Where R L For NP relations, we define a new language L':

[0020]

[0021] NIZKs for language L' Meet U-nBB-SE and U-ZK;

[0022] The construction idea of ​​language L' is as follows: On the one hand, the prover P witnesses ω so that to achieve the proof. In this case, there is no need to obtain a satisfying assignment for the second clause in the “or” statement. Then, using the strong unforgeable one-time signature scheme Σ OT On the other hand, given the private key of the updateable VUF scheme Φ as a trapdoor, the simulator Sim verifies the one-time signature scheme Σ OT The public key pk of Φ is used to obtain a verification evaluation-proof pair (y,ζ). Since Φ is updateable and at least one honest update is performed, it can be assumed that no end user knows the actual private key.

[0023] The present invention obtains the private key (sk) corresponding to the public key (pk) by setting crs. When updating, or by some knowledge assumptions, a new private key is extracted. This is sufficient to generate a satisfying assignment for the second clause in the "or" statement. NIZKs The construction method is as follows:

[0024]

[0025] Generate keys: Generate NIZKs Π's crs Π And its correctness proof Π , generate the public and private keys (pk Φ ,sk Φ ) and its correctness proof Φ ;

[0026] ·implement

[0027] · Return (crs0, ζ0, ts0) = ((crs Π,0 ,pk Φ,0 ),(ζ Π,0 ,ζ Φ,0 ),sk Φ,0 / , here ts0 is used as a trapdoor for evaluation

[0028] Generation of values;

[0029]

[0030] Update key: Update the crs generated above Π and (pk Φ ,sk Φ ) is updated and the corresponding correctness proof is generated;

[0031] As long as at least one of the two operations, either generation or update, is honest, the key is safe:

[0032] ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 );

[0033] ·implement

[0034]

[0035] ·Return(crs i ,ζ i ,ts i )=((crs Π,i ,pk Φ,i ),(ζ Π,i ,ζ Φ,i ),(sk Φ,i ));

[0036]

[0037] Verification key: for crs Π and key pk Φ Verify correctness;

[0038] ·make

[0039] ·like If yes, it returns 1, otherwise it returns 0;

[0040]

[0041] Generate proof: Generate zero-knowledge proof π using witness ω Π , and use the one-time encryption scheme Σ OT sign;

[0042] ·Let crs i =(crs Π,i ,pk Φ,i );if Then return ⊥;

[0043] ·(pk OT ,sk OT )←Σ OT .KGen(1 λ ), pk OT ,sk OT They are public and private keys respectively;

[0044] ·

[0045] · σ OT is a private key pair using a one-time encryption scheme signature;

[0046] Return π=(π Π ,pk OT ,σ OT );

[0047]

[0048] Verification Proof: Verify zero-knowledge proof π Π and its signature σ OT Correctness;

[0049] ·Let crs i =(crs Π,i ,pk Φ,i );π=(π Π ,pk OT ,σ OT );

[0050] ·like If yes, it returns 1, otherwise it returns 0;

[0051]

[0052] Simulate proof generation: Use the trapdoor ts to generate the evaluation value (y,ζ) instead of the witness ω to generate the proof;

[0053] ·Let crs i =(crs Π,i ,pk Φ,i );

[0054] ·(pk OT ,sk OT )←∑ OT .KGen(1 λ ); (y,ζ)←Φ.P(ts i ,pk OT );

[0055] ·

[0056] ·

[0057] Return π=(π Π ,pk OT ,σ OT );

[0058]

[0059] Extract witness: Extract witness ω using the random number set by the adversary;

[0060] ·Let crs i =(crsΠ,i ,pk Φ,i );π=(π Π ,pk OT ,σ OT );

[0061] ·return In the present invention, step (2) constructs a scheme based on updatable knowledge soundness (U-KS), and further, obtains a NIZK with simulated extractability (SE) from any NIZK that only guarantees updatable soundness (US). Specifically, the present invention includes a public key pk of an updatable encryption scheme Ω that satisfies IND-CPA (indistinguishability under chosen ciphertext attack) in CRS. Ω , the corresponding private key sk Ω Used as a trapdoor by the black box extractor. Expand the relation in step (2) so that the new relation Contains the encryption of the witness w in the original relation, as follows:

[0062]

[0063] However, this is not enough to obtain U-SE. This is because if the opponent gets (y,ζ) by chance, then he can In this case, the adversary only needs to use (y,ζ) and a false witness ω to prove

[0064] c=Ω.Enc(pk Ω ,ω,r)∧Φ.V(pk Φ ,m,(y,ζ))=1

[0065] That's it.

[0066] The present invention finds (y, ζ) with negligible probability and redefines the relationship As shown below:

[0067]

[0068] In this way, from the NIZKsΠ that satisfy US and U-WI, we can get the NIZKs that satisfy U-BB-SE and U-ZK Its construction method is as follows:

[0069]

[0070] Generate key: Generate NIZKsΠ crs Π And its correctness proof Π , generate the public and private keys (pk Φ ,sk Φ ) and (pkΩ ,sk Ω ) and its correctness proof Φ and Ω ;

[0071] ·implement

[0072]

[0073] · Return (crs0, ζ0, ts0, te0) = ((crs Π,0 ,pk Φ,0 ,pk Ω,0 ),(ζ Π,0 ,ζ Φ,0 ,ζ Ω,0 ),(sk Φ,0 ),(sk Ω,0 )), where ts0 and te0 are used as trapdoors to generate evaluation values ​​and extract witnesses respectively;

[0074]

[0075] Update the key: Update the above generated content and generate the corresponding correctness proof; as long as one of the generation or update is honest, the key is safe;

[0076] ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 ,pk Ω,i-1 );

[0077] ·implement

[0078]

[0079] ·Return(crs i ,ζ i ,ts i ,te i )=((crs Π,i ,pk Φ,i ,pk Ω,i ),(ζ Π,i ,ζ Φ,i ,ζ Ω,i ),(sk Φ,i ),(sk Ω,i ));

[0080]

[0081] Verify the key: verify the correctness of the CRS and key;

[0082] ·make

[0083] ·like

[0084]

[0085] If yes, it returns 1, otherwise it returns 0;

[0086]

[0087] Generate proof: Generate a zero-knowledge proof using the witness ω and encrypt it with a one-time scheme;

[0088] ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 ,pk Ω,i-1 );if Then return ⊥;

[0089] ·(pk OT ,sk OT )←∑ OT .KGen(1 λ ),c=Ω.Enc(pk Ω,i-1 ,ω,r);

[0090] ·

[0091] ·

[0092] Return π=(π Π ,pk OT ,σ OT ,c);

[0093]

[0094] Verify the proof: verify the correctness of the proof generated above;

[0095] ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 ,pk Ω,i-1 );π=(π Π ,pk OT ,σ OT ,c);

[0096] ·like

[0097]

[0098] If yes, it returns 1, otherwise it returns 0;

[0099]

[0100] Simulate proof generation: Use trapdoor ts instead of witness ω to generate a simulated proof;

[0101] ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 ,pk Ω,i-1 );

[0102] ·(pk OT ,sk OT )←Σ OT .KGen(1 λ ); (y,ζ)←Φ.P(ts i ,pk OT ); c = Ω.Enc(pk Ω,i-1 ,(y,ζ),r);

[0103] ·

[0104] ·

[0105] Return π=(π Π ,pk OT ,σ OT ,c);

[0106]

[0107] Extract witness: Use trapdoor te to extract witness ω;

[0108] ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 ,pk Ω,i-1 );π=(π Π ,pk OT ,σ OT ,c);

[0109] · Return ω←Ω.Dec(te i ,c).

[0110] The beneficial effects of the present invention are as follows: the present invention constructs an updateable verifiable random function (uVRF) and an updateable verifiable unpredictable function (uVUF), shows examples of constructing the above functions, and proposes a framework that uses uVUF as a building block in an updateable model. The compiler constructed by the framework can convert NIZKs and SNARKs of U-nBB-KS and U-WI into NIZKs and SNARKs of U-nBB-SE and U-ZK. In addition, the present invention also improves the above compiler, using a public key encryption scheme to upgrade any NIZK that only guarantees reliability to a NIZK with analog extractability. BRIEF DESCRIPTION OF THE DRAWINGS

[0111] Figure 1 FIG. 1 is a flow chart of the compiler of the present invention. DETAILED DESCRIPTION

[0112] The present invention is further described below by way of embodiments in combination with the accompanying drawings so that those skilled in the art can better understand the technical and functional features of the present invention. However, the protection scope of the present invention is not limited to the following embodiments.

[0113] Example 1: uVUF based on BLS framework

[0114] BLS is a signature scheme based on bilinear pairings. T ,e,g,h)By instantiating BLS, we can create an updateable VUF. As shown below, let H:Z p →G2 is a family of hash functions {H k} k The hash function is uniformly randomly selected in . Note that the prover outputs an empty proof ζ = ⊥, because y itself can serve as a proof.

[0115] KGen(bg):

[0116] Choose sk0 = x←Z p And let pk0 = g x ,ζ0=(g x ,g x ,h x )

[0117] Return (pk0, ζ0, sk0)

[0118] Upk(pk i-1 ):

[0119] Select sk′ i =x′←Z p And let pk i =pk i-1 ·g x′,ζ i =(pk i ,g x′ ,h x′ )

[0120] ·Return(pk i ,ζ i )

[0121]

[0122] ·Order j =(ζ j,1 ,ζ j,2 ,ζ j,3 ), check pk i =ζ i,1 ,ζ 0,1 =ζ 0,2 and e(ζ 0,2 ,h)=e(g,ζ 0,3 )

[0123] For j = 1, ..., i, check e(ζ j,2 ,h)=e(g,ζ j,3 ) and ζ j,1 =ζ j,2 ·ζ j-1,1

[0124] If all checks pass, it returns 1, otherwise it returns 0

[0125] P(sk i ,m):

[0126] ·return

[0127] V(pk i ,m,y,π):

[0128] If y=e(g,π),e(g m ·pk i ,π)=e(g,h), then it returns 1, otherwise it returns 0.

[0129] Embodiment 2: Compiler based on the above uVUF structure

[0130] The compiler we implement here is a basic version that converts NIZKs of U-nBB-KS and U-WI into NIZKs of U-nBB-SE and U-ZK. The implementation of the improved version is similar to it, so I will not repeat it. The compilation process of this compiler involves three schemes, namely, NIZKsΠ that satisfies US and U-WI, one-time encryption scheme∑ OT and the uVUF scheme Φ constructed above, which we introduce one by one below.

[0131] For the instance of NIZKsΠ, we set the security parameter λ and use it to determine the parameters (d, m, l, bp), where here, is a group of prime order p, with generators and and is a non-degenerate bilinear map. d represents the degree of the QAP, m is the number of input variables, and l is the public part of it.

[0132] KGen(R,aux R ):

[0133] In finite fields Randomly select x,y,z

[0134] ·ζ0←(G x ,G y ,G z ,G x ,G y ,G z ,H x ,H y ,H z )

[0135] ·

[0136] Return (crs0,ζ0)

[0137] Ucrs(R,aux R ,crs i-1 ):

[0138] ·make

[0139] In finite fields Randomly select α, β, γ

[0140] ·

[0141] ·

[0142] ·Return(crs i ,ζ i )

[0143]

[0144] ·make

[0145] make

[0146] Check the correctness of the proof:

[0147] due

[0148] For 2≤i≤n:

[0149]

[0150] · Check index should be y j Correctness:

[0151] For 1≤j≤6:e(G 0,j,0 ,H)=e(G,H 0,j,0 )

[0152] For 1≤j≤5:e(G,H 0,j+1,0 )=e(G 0,1,0 ,H 0,j,0 )

[0153] For 8≤j≤12:e(G 0,j,0 ,H)=e(G 0,6,0 ,H 0,j-6,0 )

[0154] · Check that the index should be x i y j Correctness:

[0155] There should be e(G 1,0,0 ,H)=e(G,H 1,0,0 )

[0156] For 1≤i≤d,1≤j≤6,8≤j≤12:e(G i,j,0 ,H)=e(G i-1,j,0 ,H 1,0,0 )

[0157] For 1≤i≤d,1≤j≤6:e(G i,j,0 ,H)=e(G,H i,j,0 )

[0158] · Check that the index should be x i y j z k Correctness:

[0159] There should be e(G 0,0,1 ,H)=e(G,H 0,0,1 )

[0160] For 1≤k≤3d:e(G 0,1,k ,H)=e(G 0,1,0 ,H 0,0,k )

[0161] For 0≤i≤d,j=0,1,2,k=1≤k≤3d:e(G i,j,0,H 0,0,k )=e(G,H i,j,k )

[0162] For 0≤i≤d,1≤j≤6,1≤k≤3d,(i,j)≠(d,4):

[0163] e(G i,j,k ,H)=e(G i,j,0 ,H 0,0,k )

[0164] For d+1≤i≤2d,1≤j≤6,1≤k≤3d:

[0165] e(G i,j,k ,H)=e(G i-d,0,k ,H d,j,0 )

[0166] e(G 0,1,3d ,H 0,0,3d )=e(G 0,1,0 ,H 0,0,6d )

[0167] For 0≤i≤d,1≤j≤4:e(G i,j,0 ,H 0,0,6d )=e(G i,j,6d ,H)

[0168] Return {0,1}: If all checks pass, it returns 1, otherwise it returns 0

[0169] Derive(crs,QAP): The crs in this scheme needs to be processed as crs QAP , can be used for the following proof and verification; here we take crs0 as an example to show the processing process

[0170] ·make QAP formed as an arithmetic circuit

[0171] Order i (X,Y)=w i (X)Y 2 +u i (X)Y 3 +v i (X)Y 4 ,i=0,…,m

[0172] Order m+j (X,Y)=t(X)Y j+1 ,j=1,2,3

[0173] ·Evaluate polynomial n1(X,Y),…,n 3d-m+e(X,Y) such that: for all i = {l+1,…,m+3}, k∈{1,…,3d-m+l}, there is s i (X,Y)·n k (X,Y) in X d Y 4 The coefficient on is 0; for all polynomials k∈{1,…,3d-m+l} has p(X,Y)·Y 2 ·n k (X,Y) in X d Y 4 The coefficients on are non-zero

[0174] ·make

[0175] ·

[0176] Return to crs QAP

[0177]

[0178] ·make

[0179] make

[0180] ·exist Randomly select r from above and calculate A←G a(x,y) ,B←H b(x,y) ,C←G c(x,y,z) ,in

[0181]

[0182] Return π=(A,B,C)

[0183]

[0184] ·make

[0185] ·examine

[0186] Check that e(A,H)=e(G,B)

[0187] Return {0,1}: If all checks pass, it returns 1, otherwise it returns 0

[0188] For the one-time encryption scheme Σ OT Our construction is as follows:

[0189] KGen OT (pp)

[0190] ·choose p is a large prime number

[0191] f = g x ,h=g y ,c=f t ·h s

[0192] ·Return(sk OT ,pk OT )=((x,y,t,s),(f,h,c)

[0193] Sign OT (sk OT ,m)

[0194] · Order sk OT =(x,y,t,s), select

[0195] z=[x(tr)+ys-H(m)]y -1 modp

[0196] Return σ OT =(r,z)

[0197] Vrfy OT (pk OT ,m,σ OT )

[0198] ·Let pk OT =(f,h,c),σ OT =(r,z)

[0199] If c = g H(m) ·f r ·h z , returns 1, otherwise returns 0

[0200] The three scheme examples are divided into three scenarios according to NIZKs. The construction method combination can get the construction instance. There are two points worth noting, namely the construction of the arithmetic circuit and the extraction of the witness ω. When constructing the arithmetic circuit, the verification can be passed if either the witness ω or the proof (y, ζ) of uVUF is true, that is, In this way, the simulator can generate a proof through (y,ζ); since the compiler implements non-black box simulation extractability, the extractor can obtain the value of the random number in the above scheme, and based on these random numbers, it can reversely calculate the witness ω to complete the extraction.

Claims

1. A method for constructing a universal compiler based on an updateable and verifiable CRS model, characterized in that The specific steps are as follows: (1) Construct an updateable verifiable random function (uVRF) and a verifiable unpredictable function (uVUF); (1.1) Construction of Updatable Verifiable Random Function (uVRF): Function Family F (·) (·):{0,1} * →{0,1} * is a family of updateable verifiable random functions Φ = (KGen, Upk, Vpk, P, V), as follows: (1.1.1) Key generation: (sk0, pk0, ζ0) ← KGen (1 λ ), enter the security parameter 1 λ After that, the key pair (sk0, pk0) and the correctness proof ζ0 are output, where sk0 is the private key and pk0 is the public key; (1.1.2) Key update: (pk i ,ζ i )←Upk(pk i-1 ), enter a valid verification key pk i-1 After that, output the updated verification key pk i And the correctness proof of the update processζ i ; (1.1.3) Key verification: Enter the verification key pk i and all proofs After that, check the validity of the updated key. If the verification key pk i If it is updated correctly, it returns 1, otherwise it returns 0; (1.1.4) Generate evaluation value: (y,ζ)←P(sk i ,x), input x and secret key sk i After that, output the evaluation value and proof of correctnessζ; (1.1.5) Verify the evaluation value: {0,1}←V(pk i ,x,y,ζ), verify the evaluation value Is it correct? (1.2) The definition of the updateable verifiable unpredictable function (uVUF) is the same as that of the updateable verifiable random function (uVRF), except that the updateable pseudo-randomness of uVRF is replaced by updateable unpredictability; (2) In the updatable model, a compiler using the verifiable unpredictable function uVUF as a building block is used to convert the NIZKs and SNARKs of updatable non-black-box knowledge soundness U-nBB-KS and updatable witness indistinguishability U-WI into NIZKs and SNARKs of U-nBB-SE and U-ZK; (3) The compiler obtained by improving the compiler and public key encryption scheme described in step (2) is used to upgrade NIZKs that satisfy the updatable reliability US and the updatable witness indistinguishability U-WI to NIZKs that satisfy the updatable black-box simulation extractability U-BB-SE and U-ZK, so as to improve security and encryption effect and ensure that attackers cannot successfully simulate or crack the proof.

2. The construction method according to claim 1, characterized in that By adding the public key of uVRF / uVUF to the Common Reference String (CRS), an alternative to the Lamassu framework is constructed. Given NIZKsΠ that satisfy U-nBB-KS and U-WI, the corresponding language Where R L For NP relations, we define a new language L': NIZKs for language L' Meet U-nBB-SE and U-ZK; The construction idea of ​​language L' is as follows: On the one hand, the prover P witnesses ω so that to implement the proof; in this case, there is no need to obtain a satisfying assignment for the second clause in the "or" statement; then, a strong unforgeable one-time signature scheme ∑ OT To authenticate the proof; on the other hand, given the private key of the updateable VUF scheme Φ as a trapdoor, the simulator Sim verifies the one-time signature scheme ∑ OT The public key pk of Φ is used to obtain a verification evaluation-proof pair (y,ζ). Since Φ is updateable and at least one honest update is performed, it is assumed that no end user knows the actual private key.

3. The construction method according to claim 1, characterized in that By setting crs to know the private key (sk) corresponding to the public key (pk), when updating, or by some knowledge assumptions to extract the new private key, NIZKs The construction method is as follows: Generate key: Generate NIZKsΠ crs Π And its correctness proof Π , generate the public and private keys (pk Φ ,sk Φ ) and its correctness proof Φ ; ·implement · Return (crs0, ζ0, ts0) = ((crs Π,0 ,pk Φ,0 ),(ζ Π,0 ,ζ Φ,0 ),sk Φ,0 ), where ts0 is used as a trapdoor to generate evaluation values; Update key: Update the crs generated above Π and (pk Φ ,sk Φ ) to update and generate the corresponding correctness proof; as long as one of the generation or update is honest, the key is safe: ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 ); ·implement · return(crs i ,g i ,ts i )=((crs Π,i ,pk Φ,i ),(g Π,i ,g Φ,i ),(sk Φ,i )); Verification key: for crs Π and key pk Φ Verify correctness; ·Let crs i =(crs Π,i ,pk Φ,i ), ·like If yes, it returns 1, otherwise it returns 0; Generate proof: Generate zero-knowledge proof π using witness ω Π , and use the one-time encryption scheme∑ OT sign; ·Let crs i =(crs Π,i ,pk Φ,i );if Then return ⊥; ·(pk OT ,sk OT )←Σ OT .KGen(1 λ ), pk OT ,sk OT They are public and private keys respectively; · · σ OT is a private key pair using a one-time encryption scheme signature; ·return π=(π Π ,pk OT ,s OT ); Verification Proof: Verify zero-knowledge proof π Π and its signature σ OT Correctness; · Let crs i =(crs Π,i , pk Φ,i ); π = (π Π , pk OT , σ OT ); ·like If yes, it returns 1, otherwise it returns 0; Simulate proof generation: Use the trapdoor ts to generate the evaluation value (y,ζ) instead of the witness ω to generate the proof; ·Let crs i =(crs Π,i ,pk Φ,i ); ·(pk OT ,sk OT )←∑ OT .KGen(1 λ );(y,ζ)←Φ.P(ts i ,pk OT ); · · ·return π=(π Π ,pk OT ,s OT ); Extract witness: Extract witness ω using the random number set by the adversary; · Let crs i =(crs Π,i , pk Φ,i ); π = (π Π , pk OT , σ OT ); ·return 4. The construction method according to claim 1, characterized in that Step (2) constructs a scheme based on updatable knowledge soundness (U-KS), and further, obtains a NIZK of simulated extractability (SE) from any NIZK that only guarantees updatable soundness (US); the public key pk of an updatable encryption scheme Ω that satisfies the indistinguishability under chosen ciphertext attacks is included in the CRS. Ω , the corresponding private key sk Ω Used as a trapdoor by the black box extractor; expand the relationship in step (2) so that the new relationship Contains the encryption of the witness w in the original relation, as follows: However, this is not enough to obtain U-SE; if the adversary gets (y,ζ) by chance, then he can In this case, the adversary only needs to use (y,ζ) and a false witness ω to prove c=Ω.Enc(pk Ω ,ω,r)∧Φ.V(pk Φ ,m,(y,ζ))=1 That's it; Find (y,ζ) with negligible probability and redefine the relationship As shown below: In this way, from NIZKsΠ that satisfies US and U-WI, we get NIZKs that satisfies U-BB-SE and U-ZK Its construction method is as follows: Generate key: Generate NIZKsΠ crs Π And its correctness proof Π , generate the public and private keys (pk Φ ,sk Φ ) and (pk Ω ,sk Ω ) and its correctness proof Ω and Ω ; ·implement ·return (crs0,ζ0,ts0,te0)=.(crs Π,0 ,pk Φ,0 ,pk Ω,0 ),(ζ Π,0 ,ζ Φ,0 ,ζ Ω,0 ),(sk Φ,0 ),(sk Ω,0 ) / , where ts0, te0 are used as trapdoors to generate evaluation values ​​and extract witnesses respectively; Update the key: Update the above generated content and generate the corresponding correctness proof; as long as one of the generation or update is honest, the key is safe; · Let crs i-1 =(crs Π,i-1 , pk Φ,i-1 , pk Ω,i-1 ); ·implement ·return (crs i ,g i ,ts i ,the i )= ((crs Π,i ,pk Φ,i ,pk Ω,i ),(ζ Π,i ,ζ Φ,i ,ζ Ω,i ),(sk Φ,i ),(sk Ω,i )); Verify the key: verify the correctness of the CRS and key; · Let crs i-1 = (crs Π,i-1 , pk Φ,i-1 , pk Ω,i-1 ), ·like If yes, it returns 1, otherwise it returns 0; Generate proof: Generate a zero-knowledge proof using the witness ω and encrypt it with a one-time scheme; ·Let crs i-1 =(crs Π,i-1 ,pk Φ,i-1 ,pk Ω,i-1 );if Then return ⊥; ·(pk OT ,sk OT )←Σ OT .KGen(1 λ ),c=Ω.Enc(pk Ω,i-1 ,ω,r); · · ·return π=(π Π ,pk OT ,s OT ,c); Verify the proof: verify the correctness of the proof generated above; · Let crs i-1 =(crs Π,i-1 , pk Φ,i-1 , pk Ω,i-1 ); π = (π Π , pk OT , σ OT , c); ·like If yes, it returns 1, otherwise it returns 0; Simulate proof generation: Use trapdoor ts instead of witness ω to generate a simulated proof; · Let crs i-1 = (crs Π,i-1 , pk Φ,i-1 , pk Ω,i-1 ); ·(pk OT ,sk OT )←∑ OT .KGen(1 λ );(y,ζ)←Φ.P(ts i ,pk OT );c=Ω.Enc(pk Ω,i-1 ,(y,ζ),r); · · ·return π=(π Π ,pk OT ,s OT ,c); Extract witness: Use trapdoor te to extract witness ω; · Let crs i-1 =(crs Π,i-1 , pk Φ,i-1 , pk Ω,i-1 ); π = (π ∏ , pk OT , σ OT , c); · Return ω←Ω.Dec(te i ,c).

Images