Efficient information interaction calculation method based on R1CS model

Abstract

The invention belongs to the technical field of block chains, and particularly relates to a calculation method for efficient information interaction based on an R1CS model. The method is mainly used for the block chain technology, the defect of efficiency of zero-knowledge proof protocols proposed by people such as Shafi Goldwasser is researched and analyzed, a new information interaction calculation method is proposed by integrating a single variable and a check protocol, the method is applied to an information interaction process, and the efficiency of the information interaction is improved. The inconvenience and potential threat vulnerabilities caused by the fact that an original information interaction protocol needs to carry out unified modeling and recording on a rank-one constraint system to achieve information interaction are solved. The information interaction protocol mainly comprises three participants, namely a prover, a verifier and a rank-one constraint system. The method does not need to verify random points of a plurality of matrixes, and further improves the operation speed of the system. And in the aspect of actual operation time, the constant-level time is reduced. In particular, the time is reduced by 2 / 3.

Description

Technical Field

[0001] The present invention belongs to the technical field of zero-knowledge proof, and specifically relates to a computational method for efficient information interaction based on an R1CS model. Background Art

[0002] Blockchain is a distributed ledger formed by connecting different data in chronological order through different hash values ​​loaded in the header, and using cryptography to ensure that it cannot be tampered with or forged. In a broad sense, blockchain technology is a new distributed infrastructure and computing paradigm. It uses a public chain data structure to store and verify important data, uses distributed nodes and a unified consensus mechanism to generate block data, and uses cryptography to ensure the security and tamper-proof nature of data transmission and access. Its chain structure can also be used to trace transaction data, and data can be programmed and operated through smart contracts composed of automated script codes.

[0004] Zero-knowledge proof is an unavoidable topic in blockchain. Because blockchain is a distributed storage, it is particularly important to prove one's identity without leaking account secrets. For example, when a patient goes to the hospital for treatment, the patient hopes to prove his or her identity to the hospital without leaking his or her private information (such as ID number), just like completing a transaction without leaking one's identity during the transaction process of blockchain. The completeness and reliability of the zero-knowledge proof algorithm determines whether the blockchain can work properly and whether it is safe.

[0005] In the field of SNARG, many well-known processes have been designed, such as the Groth16 algorithm, which generates a proof size of three group elements, and it has been proved in the Groth16 paper that it is impossible to complete the proof using only one group element. Then the construction process of the Groth16 algorithm requires a third-party trusted setting to build an SRS (Structured reference string), i.e. a public trusted string, for the prover and verifier. The introduction of a third-party trusted setting is still a major flaw of the algorithm.

[0006] For the Spartan algorithm, its construction process is based on the traditional multivariate sumcheck protocol and multilinear polynomial commitment. Its improvement process does not require the third-party trusted setup required by Groth16, but the proof time and size are too large, from O(log 2 n) to O(n) 0.5 ) are not recommended.

[0007] Marlin belongs to Algebraic Holographic Proof (AHP), which means that all proofs generated by the prover are polynomials or specified polynomial degrees. Marlin also requires a third-party trusted setup, but their setup is "universal", that is, generated once and used every time. For a fixed-size circuit, only one SRS needs to be generated. The proof size of Marlin is O(|x|+logn), where x is the size of the circuit input.

[0008] Fractal goes a step further and can still be transparent and completely secure in a random oracle model. The time spent by the verifier is O(|x|+log 2 n), prove that the size is O(log 2 n). Summary of the invention

[0009] The purpose of the present invention is to provide a computational method for efficient information interaction based on the R1CS model.

[0010] The present invention proposes a computational method for efficient information interaction based on the R1CS model, which aims to solve the efficiency problem caused by the setting of the interaction process between the prover and the verifier in the traditional information interaction protocol. By introducing multi-variables and checking protocols plus random point selection, the steps of checking the three public information matrices in the rank-one constraint system one by one are improved. After the three public information matrices are merged, only one check is performed, which reduces the running time at a constant level and improves the efficiency by about three times. The three public information matrices are represented by A, B, and C respectively.

[0011] The construction method is implemented by a construction system based on a rank-one constraint system, wherein the construction system includes a prover, a verifier, an indexer, and a rank-one constraint system, wherein:

[0012] The prover is an untrusted object from the perspective of the verifier that is granted the right to prove and calculate in the proof process. P represents the prover. The prover's job is to calculate the required solution vector z = (x, w) and prove the authenticity of its solution to the verifier through an interactive protocol.

[0013] The verifier is the object that is granted the verification right in the proof process, and V represents the verifier; the verifier works by receiving the required solution vector z=(x,w) and verifying the authenticity of the prover's solution through interactive protocol and random point selection;

[0014] The indexer is a trusted third party in the proof process. It is responsible for indexing the public information matrices A, B, and C shared by the prover and the verifier, and giving the verifier the corresponding index during the process of the verifier verifying the matrix, helping the verifier to obtain the value of the matrix with lower complexity. I represents the indexer.

[0015] The rank-one constraint system (R1CS) is composed of public information matrices A, B, C and vector z, and is symbolically represented as R1CS = (A, B, C, z); specifically, {Az*Bz = Cz}, where public information A, B, C are all shared by the prover and the verifier, and vector z is exclusively owned by the prover in the zero-knowledge proof protocol; the protocol of the present invention does not require that vector z is exclusively owned by the prover;

[0016] The construction method is specifically performed as follows:

[0017] (1). The prover constructs a low-degree extension 1 of the public information matrix {A, B, C};

[0018] The public information matrix is ​​the matrix A, B, C shared by the prover and the verifier; they are regarded as the gate circuit components of the rank-one constraint system, and both the prover and the verifier can view the values ​​of the elements at random positions in the public information matrix A, B, C; when the verifier views the elements in the public information matrix A, B, C, the indexer will help the verifier generate the corresponding matrix index because it is necessary to reduce the time complexity;

[0019] (1.1) Low-level extension build

[0020] Prover P inputs 1: I1 = triple (A, B, C)

[0021] Prover P outputs 1: O1 = six-tuple

[0022] in: are the low-degree extensions corresponding to the public information matrices A, B, and C respectively; satisfying the following conditions:

[0023] For any i,j,1≤i≤n,1≤j≤b, we have:

[0024] (1.2) Low-level extension construction method

[0025] Known A n*n : n*n matrix; construct low-degree bivariate polynomials of degree n-1 for x and y So that: That is, the element of matrix A in row i and column j is equal to The value at (x=i, y=j);

[0026] Then there is Satisfies the following formula: That is, n of the original matrix A 2 elements, converted into a polynomial n 2 coefficients; among which a ij By 2 The constant term coefficient is composed of:

[0027] It is known that the value of the matrix A is uniquely determined by A[i][j](1≤i≤n,1≤j≤b), then a is uniquely determined by A[i][j]. ij :

[0028] Substitute each item in A[i][j] into the above formula Then we get the following formula:

[0029]

[0030] Get an idea about a ij n 2 There are n linear equations of this kind. We can use Gaussian elimination or Cramer's rule to find the corresponding a ij ;

[0031] (2) The verifier verifies the prover's low-level extension 1;

[0032] (2.1) Verify low-level extension 1 process;

[0033] Verifier input: six-tuple

[0034] Validator output: Nine-tuple

[0035]

[0036] In the formula It means that under all public information matrices A, B, and C, there is a low-degree extension that is consistent with the value of the original matrix at the corresponding point (1≤i≤n, 1≤j≤b);

[0037] (2.2) implement the oblivious transfer protocol;

[0038] By using the oblivious transfer protocol, the verifier and the prover meet the following requirements:

[0039] (2.2.1) The verifier can know the values ​​of each of the n points in the matrix with the subscript (x, y);

[0040] (2.2.2) The prover does not know the locations of the subscripts of the n points known by the verifier;

[0041] In this way, the verifier can know M(i, j) without the prover knowing, reducing the possibility of the prover forging the proof.

[0042] (2.3) The indexer generates the index of the matrix M: Used in the verification process of step (2.4); this index will be used by the verifier during verification to reduce the complexity of verification;

[0043] (2.4) Using the index generated in step (2.3) By the following theorem:

[0044]

[0045] Construct the corresponding polynomial T(k):

[0046]

[0047] Since T(k) is a univariate polynomial, a low-degree expansion of T(k) can be constructed. In fact, we have: In fact, represents the low-degree expansion of the corresponding matrix, and Represents the sum of the corresponding constructed polynomials over the range k∈K; completes the low-degree expansion of the matrix to the polynomial Transition proof; that is, the problem of proving low-degree extension is transformed into the problem of proving the existence of polynomials;

[0048] Based on the problems with polynomials and univariate and checking protocols, the following conclusions are drawn:

[0049] For those who meet the above conditions There exists a corresponding low-degree polynomial The following conditions must be met:

[0050] The left formula is the polynomial calculated by low-degree expansion The right formula is constructed is the new function, d is The value at the corresponding point, and |K| is the number of elements in the set K; apply the single variable and check protocol to check the corresponding function again and Satisfy the above equation, and send a holographic interactive oracle proof based on the Reed-Soloman protocol. The prover sends the point of the corresponding function on the corresponding value, and the verifier further randomly selects points for inspection;

[0051] (3) The prover constructs low-degree extension 2: denoted as

[0052] (3.1) Construction process

[0053] Prover input I1: six-tuple

[0054] Prover output O1: nine-tuple

[0055] (3.2) Calculate and construct new vectors Az, Bz, Cz;

[0056] (3.2.1) Construct a low-degree expansion of the vector z

[0057] Expressed as n-tuple: (z1,z2,...,z n );where z i Represents the size of the coefficient before z raised to the power of i; n-tuples provide a compact way to store and process polynomial approximations of vector z;

[0058] (3.2.2) Follow the steps in (3.2.1) With step (1.1) Construct low-level extensions corresponding to Az, Bz, and Cz

[0059] Corresponding formula: M∈{A,B,C}, A,B,C are public information matrices. M represents any value in matrices A,B,C;

[0060] (4) Verifier Verification Low Extension 2:

[0061] (4.1) Verification process

[0062] Verifier input I4: nine-tuple

[0063] Verifier output O4:

[0064]

[0065] (4.2) Verification steps

[0066] (4.2.1) Univariate and inspection protocols

[0067] If you have Based on the univariate and inspection protocol proposed by Carsten Lund et al., there are two low-degree polynomials and So that:

[0068] Among them: c is a constant given by the prover, that is, a specific value; is the corresponding content previously constructed based on matrices A, B, and C, that is, the following formula: Where r M The verifier still randomly selects an element on F*. The verifier chooses r A ,r B ,r C It can then be sent to the prover, allowing the prover to calculate the corresponding value c.

[0069] The validator will be based on the total domain F of the protocol * , select a random point r y , given a point r y , r y Send it to the prover, and then the prover will y Corresponding value Sent to the verifier, who then constructs an equation based on the corresponding value

[0070] Note that one of the prerequisites for this equation to hold is that all elements in matrices A, B, and C are a finite field F selected in advance by the protocol. * Elements on , and H is F * The previous multiplication subgroup;

[0071] (5). Prover constructs low-degree extension 3;

[0072] (5.1) Construction process

[0073] Prover input I3: six-tuple

[0074] The prover outputs O3:

[0075] (5.2) Calculation process

[0076] Pre-definition: H = {1,2,3,...n}

[0077] By calculation, we get:

[0078] (5.2.1)

[0079] (5.2.2) n is the row and column value of the A, B, C matrices,

[0080] (5.2.3) We get h1(x).

[0081] (6). Verifier verifies low extension 3;

[0082] (6.1) Verifier input and output:

[0083] Validator input:

[0084] Validator output:

[0085] (6.2) Based on the idea of ​​random point selection, select r x And verify:

[0086]

[0087] The following conditions must be met to pass the verification:

[0088] (6.2.1)G(r x )=h1(r x )*V H (r x ), called cond_1,

[0089] (6.2.2) Called cond_2,

[0090] (6.2.3)ver_3=cond_1∧cond_2,

[0091] At this point, the main content of the agreement is completed.

[0092] The beneficial effect of the present invention is that the present invention aims to solve the speed problem in the traditional construction method that the efficiency cannot reach the O(n) complexity. By introducing a single variable and a check protocol and a multi-random point selection check scheme as a building block, the present invention can improve the operating efficiency of the system while ensuring security. The traditional Fractal inspection method requires the low-degree extension of the three matrices A, B, and C (i.e., the main components of the rank-one constraint system) to be checked one by one, while the content of the present invention uses a single variable and a check protocol to unify the random point selection of the three matrices into one check, which greatly reduces the time required in the present invention and improves the operating efficiency of the constant level. Compared with the traditional method, the present invention does not need to verify the random point selection of multiple matrices, which further improves the operating speed of the system. In terms of actual running time, the time of constant level is reduced. Specifically, 2 / 3 of the time is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] Figure 1 Flow chart of the protocol of the present invention. DETAILED DESCRIPTION

[0094] The present invention is further described below through specific implementations so that those skilled in the art can better understand the technical and functional characteristics of the present invention, but the protection scope of the present invention is not limited to the following embodiments.

[0095] In this embodiment, the main content is the mathematical matrix selection and the corresponding example display.

[0096] Embodiment 1: For the following embodiments, F represents a finite field where all elements are located, L represents a subset of F, A, B, C, and x are components of the rank-one constraint system, A, B, and C are matrices, and x is a component vector of the rank-one constraint system. N is the number of rows and columns of A, B, and C. It is a low-degree expansion of matrices A, B, and C. is the index constructed by indexer I based on matrices A, B, and C. r_x, r_y, r_A, r_B, and r_C are the selected elements in the finite field F. ver_1, ver_2, and ver_3 are the judgments output by the verifier at each verification stage. If the check is passed, the judgment is 1, and if it fails, the judgment is 0.

[0097] L in the embodiment may be Any subset of (i.e. the original set).

[0098] The calculation method of efficient information interaction based on the R1CS model has the following specific steps:

[0099] (1) The prover constructs a low-degree extension 1 of the public information matrix {A, B, C}:

[0100] (1.1) Low-level extension build

[0101] ·choose

[0102] A, B, C, x, n, satisfy Ax*Bx=Cx:

[0103] A=a ij ,in

[0104] B=b ij ,in

[0105] C=c ij ,in Where x[i] represents the value of the x subscript at index i,

[0106] x=(x i )=i! +i 3 +i 2 +i+1(modp=7),n=p-1=6,

[0107] ·return

[0108] In the formula is a new value calculated based on A, B, C and Lagrange bivariate interpolation formula

[0109] Based on low-scaling computing value.

[0110] ·return

[0111]

[0112] Encode the public information matrix A, B, C to generate the corresponding And the auxiliary matrix K M .

[0113] · For the auxiliary matrix K M ,K M Records the subscripts of all non-zero elements of the matrix M. In this embodiment, K A ={i 2 |i∈[1,n],i∈Z}. Similarly, we can get K B ,K C .

[0114] Take matrix A as an example, Where R k Refers to the subscript of the i-th non-zero element in matrix A. For example, for matrix A, in this embodiment:

[0115]

[0116] (2) The verifier verifies the prover's low-level extension 1;

[0117] Based on the oblivious transfer protocol, obtain In a ij ,b ij ,c ij The values ​​of the n positions of , that is, take out n different (i, j) pairs, and get the corresponding (i, j) pairs

[0118] An example of a (i,j) set is as follows: i＝1,2,...n,j＝i+1

[0119] ·Selection of sites r A =1,r B =2,r C =3

[0120] Calculate the polynomial So that:

[0121] Calculate polynomials So that:

[0122] Return to r x ,r y ,r A ,r B ,r C ,

[0123] (3) The prover constructs low-degree extension 2: denoted as

[0124]

[0125] ·calculate

[0126] ·calculate

[0127] ·return

[0128]

[0129] Calculate and verify:

[0130] If true, return ver1=1. If false, return ver1=0.

[0131] (4) Verifier Verification Low Extension 2:

[0132]

[0133] Formula-based Build

[0134] Calculate the corresponding make:

[0135] ·return

[0136]

[0137] Based on the FRI protocol described above, Perform a low-degree polynomial test to check the distance between the two

[0138] is δ-close, i.e. the degree is lower than a specified value.

[0139] Pick a random point r y =2, visit And verify that the following equation holds:

[0140]

[0141] If true, return ver2=1, if false, return ver2=0.

[0142] Select r A =1,r B =2,r c =3∈L

[0143] Return to r A =1,r B =2,r C =3

[0144] (5). Prover constructs low-degree extension 3;

[0145]

[0146] Define H = {1,2,3...n}.

[0147] ·Calculation can be obtained:

[0148] ·

[0149] ·V H (x)=(x-1)(x-2)...(xn), where n is the row and column value of matrices A, B, and C;

[0150] G(x)=h1(x)*V H (x), we get h1(x)

[0151] ·calculate

[0152] ·return

[0153] (6). Verifier verifies low extension 3;

[0154]

[0155] A. Based on the FRI protocol, verify: The distance RS[F,L,(6|H|-7) / (|L|)] is δ close. (Goal: Verify is indeed a low-degree polynomial)

[0156] B. Select point r z =3∈L, test:

[0157] C. Yes In ry Take the value, calculate and verify:

[0158] D. In r x Calculation and verify that:

[0159] If both AD pass, then output ver=1, otherwise output ver=0.

[0160] This concludes the agreement.

Claims

1. A computational method for efficient information interaction based on the R1CS model, characterized in that: The construction method is based on multivariate and checking protocols, improves the steps of checking three public information matrices one by one in the rank-one constraint system, and only performs one check after merging the three public information matrices, and the three public information matrices are represented by A, B, and C respectively; The construction method is implemented by a construction system based on a rank-one constraint system, wherein the construction system includes a prover, a verifier, an indexer, and a rank-one constraint system, wherein: The prover is an untrusted object from the perspective of the verifier that is granted the right to prove and calculate in the proof process. P represents the prover. The prover's job is to calculate the required solution vector z = (x, w) and prove the authenticity of its solution to the verifier through an interactive protocol. The verifier is the object that is granted the verification right in the proof process, and V represents the verifier; the verifier works by receiving the required solution vector z=(x,w) and verifying the authenticity of the prover's solution through interactive protocol and random point selection; The indexer is a trusted third party in the proof process. It is responsible for indexing the public information matrices A, B, and C shared by the prover and the verifier, and giving the verifier the corresponding index during the process of the verifier verifying the matrix, helping the verifier to obtain the value of the matrix with lower complexity. I represents the indexer. The rank-one constraint system (R1CS) is composed of public information matrices A, B, C and vector z, and is symbolically represented as R1CS = (A, B, C, z); specifically, {Az*Bz = Cz}, where public information A, B, C are all shared by the prover and the verifier, and vector z is exclusively owned by the prover in the zero-knowledge proof protocol; the protocol does not require that vector z is exclusively owned by the prover; The construction method is specifically performed as follows: (1). The prover constructs a low-degree extension 1 of the public information matrix {A, B, C}; The public information matrix is ​​the matrix A, B, C shared by the prover and the verifier; they are regarded as the gate circuit components of the rank-one constraint system, and both the prover and the verifier can view the values ​​of the elements at random positions in the public information matrix A, B, C; when the verifier views the elements in the public information matrix A, B, C, the indexer will help the verifier generate the corresponding matrix index because it is necessary to reduce the time complexity; (1.1) Low-level extension build Prover P inputs 1: I1 = triple (A, B, C) Prover P outputs 1: O1 = six-tuple in: are the low-degree extensions corresponding to the public information matrices A, B, and C respectively; satisfying the following conditions: For any i,j,1≤i≤n,1≤j≤b, we have: (1.2) Low-level extension construction method Known A n*n : n*n matrix; construct low-degree bivariate polynomials of degree n-1 for x and y So that: That is, the element of matrix A in row i and column j is equal to The value at (x=i, y=j); Then there is Satisfies the following formula: That is, n of the original matrix A 2 elements, converted into a polynomial n 2 coefficients; among which a ij By 2 The constant term coefficient is composed of: It is known that the value of the matrix A is uniquely determined by A[i][j](1≤i≤n,1≤j≤b), then a is uniquely determined by A[i][j]. ij : Substitute each item in A[i][j] into the above formula Then we get the following formula: Get an idea about a ij n 2 There are n linear equations of this kind. We can use Gaussian elimination or Cramer's rule to find the corresponding a ij ; (2) The verifier verifies the prover's low-level extension 1; (2.1) Verify low-level extension 1 process; Verifier input: six-tuple Validator output: Nine-tuple In the formula It means that under all public information matrices A, B, and C, there is a low-degree extension that is consistent with the value of the original matrix at the corresponding point (1≤i≤n, 1≤j≤b); (2.2) implement the oblivious transfer protocol; By using the oblivious transfer protocol, the verifier and the prover meet the following requirements: (2.2.1) The verifier can know the values ​​of each of the n points in the matrix with the subscript (x, y); (2.2.2) The prover does not know the locations of the subscripts of the n points known by the verifier; Thus, the verifier can know M(i,j) without the prover knowing, which reduces the possibility of the prover forging the proof; (2.3) The indexer generates the index of the matrix M: Used in the verification process of step (2.4); this index will be used by the verifier during verification to reduce the complexity of verification; (2.4) Using the index generated in step (2.3) By the following theorem: Construct the corresponding polynomial T(k): Since T(k) is a univariate polynomial, a low-degree expansion of T(k) can be constructed. In fact, we have: In fact, represents the low-degree expansion of the corresponding matrix, and Represents the sum of the corresponding constructed polynomials over the range k∈K; completes the low-degree expansion of the matrix to the polynomial Transition proof; that is, the problem of proving low-degree extension is transformed into the problem of proving the existence of polynomials; Based on the problems with polynomials and univariate and checking protocols, the following conclusions are drawn: For those who meet the above conditions There exists a corresponding low-degree polynomial The following conditions must be met: The left formula is the polynomial calculated by low-degree expansion The right formula is constructed is the new function, d is The value at the corresponding point, and |K| is the number of elements in the set K; apply the single variable and check protocol to check the corresponding function again and Satisfy the above equation, and send a holographic interactive oracle proof based on the Reed-Soloman protocol. The prover sends the point of the corresponding function on the corresponding value, and the verifier further randomly selects points for inspection; (3) The prover constructs low-degree extension 2: denoted as (3.1) Construction process Prover input I1: six-tuple Prover output O1: nine-tuple (3.2) Calculate and construct new vectors Az, Bz, Cz; (3.2.1) Construct a low-degree expansion of the vector z Expressed as n-tuple: (z1, z2, …, z n );where z i Represents the size of the coefficient before z raised to the power of i; n-tuples provide a compact way to store and process polynomial approximations of vector z; (3.2.2) Follow the steps in (3.2.1) With step (1.1) Construct low-level extensions corresponding to Az, Bz, and Cz Corresponding formula: A, B, C are public information matrices. M represents any value in matrices A, B, C; (4) Verifier Verification Low Extension 2: (4.1) Verification process Verifier input I4: nine-tuple Verifier output O4: (4.2) Verification steps (4.2.1) Univariate and inspection protocols If you have Then the univariate and check protocol, there are two low-degree polynomials and So that: Among them: c is a constant given by the prover, that is, a specific value; is the corresponding content previously constructed based on matrices A, B, and C, that is, the following formula: Where r M It is still an element on F* randomly selected by the verifier; the verifier chooses r A ,r B ,r C It can then be sent to the prover, allowing the prover to calculate the corresponding value c; The validator will be based on the total domain F of the protocol * , select a random point r y , given a point r y , r y Send it to the prover, and then the prover will send r y The corresponding value Sent to the verifier, who then constructs an equation based on the corresponding value One of the prerequisites for this equation to hold is that all elements in the public information matrix A, B, and C are a finite field F selected in advance by the protocol. * Elements on , and H is F * The previous multiplication subgroup; (5). Prover constructs low-degree extension 3; (5.1) Construction process Prover input I3: six-tuple The prover outputs O3: (5.2) Calculation process Pre-definition: H = {1,2,3,...n} By calculation, we get: (5.2.1) (5.2.2) n is the row and column value of the A, B, C matrices, (5.2.3) We get h1(x). (6). Verifier verifies low extension 3; (6.1) Verifier input and output: Validator input: Validator output: (6.2) Based on the idea of ​​random point selection, select r x And verify: The following conditions must be met to pass the verification: (6.2.1)G(r x )=h1(r x )*V H (r x ), called cond_1, (6.2.2) Called cond_2, (6.2.3)ver_3=cond_1∧cond_2, At this point, the main content of the agreement is completed.

Images