Coding-based polynomial commitment method suitable for block chain capacity expansion

Abstract

The invention discloses a coding-based polynomial commitment method suitable for blockchain capacity expansion, which does not need credible initialization and improves the efficiency of a prover by reducing coding time. The polynomial commitment method specifically executes the following operations of: outputting a group of public parameters by taking a safety parameter and a polynomial variable number as inputs through a parameter generation algorithm; executing a polynomial commitment algorithm by a prover to commitment the target polynomial, inputting coefficients and common parameters of the target polynomial, and outputting a commitment value; a verifier is enabled to confirm that assignment of a target polynomial at a certain group of points is correct through a polynomial commitment opening algorithm, the polynomial commitment opening algorithm is an interactive argument protocol participated by a prover and the verifier, and coefficients of the target polynomial are used as input of the prover. The common parameter, the commitment value, the polynomial assignment point and the assignment result of the target polynomial serve as common input of the prover and the verifier, and the verifier outputs receiving or refusing.

Description

Technical Field

[0001] The embodiments of the present application relate to the fields of blockchain and information security technology, and in particular to a coding-based polynomial commitment method suitable for blockchain expansion. Background Art

[0002] Blockchain is a distributed ledger technology that can share a transparent and tamper-proof ledger between nodes in a computer network, providing a trustless and decentralized platform for performing transactions and exchanging information. With its transparency and immutability, blockchain technology has attracted widespread attention in various applications. However, when it comes to large-scale applications, blockchain still faces scalability issues due to transaction processing speed and network throughput limitations. Layer-2 protocols can achieve capacity expansion without changing the underlying blockchain by moving transactions or data processing off the main chain and processing them off-chain. In recent years, Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (zk-SNARK) has played an important role in the development of Layer-2 protocols.

[0003] zk-SNARKs is a cryptographic technique that allows a prover to generate a proof of the correctness of a complex computation that can be verified by any verifier. Although the original computation may be very complex, the resulting proof is short and can be efficiently transmitted and stored. At the same time, the verifier can quickly confirm the validity of the proof, requiring far less computational resources than repeating the original computation. zk-SNARKs allows the prover to generate a short, efficiently verifiable proof of the validity of a blockchain transaction, playing a key role in Layer-2 solutions such as zk-Rollup. Generally speaking, zk-SNARKs can be constructed using the Polynomial Commitment Scheme (PCS), and the efficiency of the PCS has an important impact on key performance indicators of zk-SNARKs, such as prover speed, proof size, and verifier speed.

[0004] Based on the above analysis, studying the polynomial commitment method and improving and enhancing its performance will play an important role in improving the overall performance of the blockchain expansion solution.

[0005] In order to further promote blockchain to a larger scale, scholars have been committed to studying the polynomial commitment method with high efficiency in recent years, and based on it to achieve blockchain expansion. However, the existing research schemes still face two problems: the first is the reliance on trusted initialization, and the second is the difficulty in balancing the efficiency of the prover and the size of the proof. Summary of the invention

[0006] In order to overcome the above technical defects, the embodiment of the present application provides a polynomial commitment method based on coding suitable for blockchain expansion, and its specific scheme is as follows:

[0007] S1, using the security parameter and the number of polynomial variables as input through the parameter generation algorithm, outputting a set of common parameters for the operation of subsequent algorithms;

[0008] S2. The prover executes the polynomial commitment algorithm to commit to the target polynomial, with the input being the coefficients and public parameters of the target polynomial and the output being the commitment value;

[0009] S3. The polynomial commitment opening algorithm is used to convince the verifier that the assignment of the target polynomial at a certain set of points is correct. The polynomial commitment opening algorithm is an interactive argumentation protocol involving the prover and the verifier. The coefficients of the target polynomial are used as the input of the prover, and the public parameters, commitment values, polynomial assignment points and the assignment results of the target polynomial are used as the common input of the prover and the verifier. The verifier outputs acceptance or rejection.

[0010] The technical solution of this application includes three algorithms as follows:

[0011] 1) Parameter generation algorithm: This algorithm takes the security parameter and the number of polynomial variables as input and outputs a set of common parameters for subsequent algorithm operations;

[0012] 2) Polynomial commitment algorithm: This algorithm is executed by the prover to make a commitment to a multilinear polynomial. Its input includes the coefficients and public parameters of the multilinear polynomial, and the output is the commitment value. The specific steps are as follows: First, arrange the coefficients of the target polynomial into multiple vectors of equal length, and expand each vector with a random value. Then, each expanded vector is regarded as a new univariate polynomial, and each polynomial is encoded as a Reed-Solomon code (RS code), thereby obtaining a matrix in which each column is an RS codeword. Finally, the Merkle tree is used to commit to the matrix column by column, and the root node of the Merkle tree is output as the commitment value.

[0013] 3) Polynomial Commitment Opening Algorithm: This algorithm is an interactive argumentation protocol jointly participated by the prover and the verifier, which aims to convince the verifier that the assignment of the target polynomial at a certain set of points is correct. The prover's input includes the coefficients of the target polynomial, and the common input of the prover and the verifier includes public parameters, commitment values, polynomial assignment points, and the assignment results of the target polynomial. After a series of interactions, the verifier outputs acceptance or rejection. Specifically, in this process, the prover and the verifier first jointly call the batch fast RS code proximity interactive oracle proof to test whether each column in the matrix corresponding to the commitment value is an RS codeword. Subsequently, the prover and the verifier perform multiple rounds of interactive operations. In each round, the prover decomposes the polynomial into polynomials of lower dimension, and then performs consistency tests on the polynomials before and after the decomposition and the polynomial assignment results, and commits to the decomposition results through the Merkle tree. Finally, the decomposition results in each round are verified through the batch fast RS code proximity interactive oracle proof to ensure that the decomposition results are correct RS codewords.

[0014] Furthermore, the above-mentioned coding-based polynomial commitment method also performs the following steps when used to achieve blockchain expansion:

[0015] S4. In zk-Rollup, the aggregator calculates a large number of transaction results on the blockchain off-chain and updates the blockchain status;

[0016] S5. Use the constructed SNARK to generate a short proof of the correctness of the updated state, and submit the generated proof to the smart contract on the blockchain.

[0017] S6. By verifying the above-generated proof in the smart contract, on-chain users can confirm the validity of a large number of transactions and achieve blockchain expansion.

[0018] The embodiments of the present application adopt the above technical solution to achieve the following technical effects:

[0019] First, the problem of existing polynomial commitment methods relying on trusted initialization is solved, and the security and versatility of the scheme are improved. Since the parameter generation algorithm in this scheme only requires public values ​​as input, there is no need to rely on a trusted third party for parameter generation; second, the problem of the difficulty in balancing the efficiency of the prover and the proof size of the existing polynomial commitment method is solved. Under the premise of maintaining an acceptable proof size, the computational overhead of the prover of the scheme is reduced, and the practicality of the scheme is improved. First, since RS codes have an efficient proximity test protocol, the PCS constructed based on RS codes has a smaller proof size. This scheme effectively solves the problem of the prover efficiency of PCS based on RS codes. The main reason for the low efficiency of the existing PCS prover based on RS codes is that the coefficients of the polynomial need to be encoded as a whole, and the encoding efficiency of RS codes is usually low. To address this problem, this scheme arranges the coefficients of the polynomial into multiple shorter vectors, and by encoding these shorter vectors in parallel, the encoding time is significantly reduced, thereby improving the prover efficiency of PCS. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings exemplarily illustrate the embodiments and constitute a part of the specification, and together with the text description of the specification, are used to explain the exemplary implementation of the embodiments. The embodiments shown are for illustrative purposes only and do not limit the scope of the claims. In all drawings, the same reference numerals refer to similar but not necessarily identical elements.

[0021] Figure 1 A flowchart of the coding-based polynomial commitment method in this application;

[0022] Figure 2 A comparison chart of the efficiency characteristics of the polynomial commitment method proposed in this application and the existing coding-based polynomial commitment method;

[0023] Figure 3 This is a specific efficiency comparison chart of the polynomial commitment method proposed in this application and the existing coding-based polynomial commitment method. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0025] It should be noted that the descriptions involving "first", "second", etc. in the embodiments of the present application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0026] In the description of the present application, it should be understood that the numerical labels before the steps do not indicate the order in which the steps are executed, but are only used to facilitate the description of the present application and to distinguish each step, and therefore should not be understood as a limitation on the present application.

[0027] First, the following terms are explained:

[0028] Polynomial: A polynomial is an algebraic expression composed of the product of constants and variables raised to powers through addition and subtraction operations. According to the number of variables, polynomials can be divided into univariate polynomials and multivariate polynomials. A univariate polynomial contains only one variable, and its form is a linear combination of a series of variable powers, such as common quadratic equations and cubic equations. The main feature of this type of polynomial is that the power of the variable can be any non-negative integer. Multilinear polynomials involve multiple variables, but the exponent of each variable in each term does not exceed 1, that is, each variable is linear. Multilinear polynomials are suitable for representing simple linear relationships between different variables, and are widely used in fields such as multivariate linear regression, linear algebra, and tensor operations in computer science.

[0029] Polynomial Commitment Scheme, referred to as PCS. In the field of cryptography, the polynomial commitment scheme is an important tool used to prove the value of the committed polynomial at a certain point. For example, PCS is widely used to construct zero-knowledge proofs and verifiable secret sharing.

[0030] Merkle tree: Merkle tree is a tree data structure used to verify data integrity. The Merkle tree is constructed by first dividing the data into multiple small blocks and calculating the hash value for each block as a leaf node. Then, the hash values ​​of two adjacent leaf nodes are combined layer by layer to calculate their hash values, which are used as the parent nodes of the two leaf nodes. This process is iterated upward until only one top-level hash value, the root node, remains. This structure can efficiently verify the integrity and consistency of data blocks because only the path hash value related to it needs to be checked.

[0031] Merkle tree commitment protocol: The Merkle tree commitment protocol includes the following three algorithms: MT.Com, MT.Open, and MT.Verify. MT.Com takes a set of vectors as output and outputs the root node of the Merkle tree constructed by the set of vectors; MT.Open takes the original image corresponding to a leaf node of the Merkle tree as input and outputs the path from the leaf node to the root node; MT.Verify takes the root node of a Merkle tree, the original image corresponding to a leaf node of the Merkle tree, and the path from the leaf node to the root node as input, and judges the consistency of the above input values. If they are consistent, it outputs 1, otherwise it outputs 0.

[0032] zk-Rollup: zk-Rollup is a solution for blockchain Layer-2 expansion, which aims to reduce the on-chain data processing burden by packaging a large number of transactions into a single transaction and submitting it to the blockchain. It can significantly reduce the cost and confirmation time of each transaction. Due to its efficiency and security, zk-Rollup is widely regarded as an important tool to solve the blockchain expansion problem.

[0033] zk-SNARK: zk-SNARKs is a cryptographic technique that allows a prover to generate a proof of the correctness of a complex computation that can be verified by any verifier. Although the original computation may be very complex, the resulting proof is short and can be efficiently transmitted and stored. At the same time, the verifier can quickly confirm the validity of the proof, requiring far less computing resources than repeating the original computation. zk-SNARKs allow provers to generate a short, efficiently verifiable proof of the validity of blockchain transactions, playing a key role in Layer-2 solutions such as zk-Rollup. In zk-Rollup, by batch-verifying a large number of transactions off-chain and only providing proofs of transaction correctness generated by zk-SNARKs to the chain, the time to process transactions on the chain can be greatly reduced, increasing the throughput of transactions. Improving the efficiency of zk-SNARKs can directly reduce the consumption and latency of computing resources, thereby reducing operating costs, enabling more nodes to participate in the network, and increasing the degree of decentralization. A more efficient proof generation and verification process can not only speed up transaction processing and improve user experience, but also reduce the cost of each transaction and promote the large-scale application of blockchain technology. Improving the efficiency of zk-SNARKs will provide strong support for the further development of Layer-2 expansion technology to meet the needs of a wider range of users and applications.

[0034] The three main efficiency indicators in zk-SNARKs are prover time, verifier time, and proof size. A typical construction of zk-SNARKs is a combination of "Polynomial Interactive Oracle Proof (PIOP) + Polynomial Commitment Schemes (PCS)". PIOP is a multi-round interactive proof. In each round, the verifier sends a challenge to the prover to query the value of the polynomial at a certain point, and the prover replies with a polynomial oracle in each round. PCS allows the prover to commit to a polynomial and convince the verifier of the value of the polynomial at a certain set of public points. By using PCS to instantiate the polynomial oracle in PIOP, zk-SNARKs can be constructed. Generally speaking, the efficiency of PCS has an important impact on the performance of zk-SNARKs.

[0035] Most of the existing zk-SNARKs with good performance are constructed based on PCS that relies on trusted initialization. Directly applying such zk-SNARKs in blockchain Layer-2 extensions will destroy the decentralized nature of blockchain. During the trusted initialization phase, the system generates a set of public reference strings, which will be used in the subsequent proof and verification process. Trusted initialization usually requires a trusted third party to generate these parameters and ensure the security and correctness of the generation process. The main problem here is the trust assumption: if the process of generating public parameters during the initialization phase is maliciously manipulated, the attacker may generate false proofs without being discovered. This means that the security of the entire system depends on the absolute integrity and confidentiality of the initialization phase. In addition, trusted initialization is usually a one-time process that is difficult to change or update once completed, which makes the system lack flexibility in the face of potential security threats. To alleviate these problems, the community is exploring trustless solutions, such as using multi-party computing technology to disperse trust, but these methods also bring additional complexity and computational costs. Therefore, although trusted initialization provides the basic guarantee for the efficiency of zk-SNARKs, its inherent trust and security challenges remain an issue that requires continued attention and resolution, especially in decentralized applications such as blockchain Layer-2 expansion.

[0036] In addition, prover efficiency is the main performance bottleneck in current zk-SNARKs, especially in scenarios such as blockchain Layer-2 expansion that require large-scale computing. Although PCS that relies on trusted initialization has a smaller proof size, a large number of elliptic curve operations result in low prover efficiency. PCS based on coding construction can provide relatively fast proof generation without the need for trusted initialization, so it has received widespread attention in academia. However, since this type of PCS is difficult to balance between prover time and proof size, zk-SNARKs constructed using it still cannot meet the efficiency requirements in current blockchain expansion. The main computational bottleneck of PCS constructed based on RS code is the encoding time. For a polynomial of size, PCS based on RS code has a verification time and proof size of level, and its proof size is usually acceptable, generally hundreds of kilobytes. However, since the time to encode the polynomial coefficients in the commitment process is, its proof time remains at level. Linear time-encodable error-correcting codes, such as Generalized Spielman (GS) codes or Expand Accumulate (EA) codes, can also be used to construct polynomial commitments, and the encoding and proof times achieved are usually several times or even dozens of times faster than RS-code-based polynomial commitments. However, unlike RS codes, GS codes and EA codes lack efficient proximity testing protocols, resulting in the final verification time and proof size being maintained at a level that is usually several megabytes in size, which is unacceptable for blockchain Layer-2 expansion.

[0037] In order to further promote the application of blockchain on a larger scale, scholars have been committed to studying the polynomial commitment method with higher efficiency in recent years, and based on it to achieve blockchain expansion. However, the existing research schemes still face two problems.

[0038] The first is the problem of reliance on trusted initialization. Existing PCS with better performance rely on public reference strings to reduce the size of proofs, but this inevitably brings about the problem of reliance on trusted initialization: during initialization, a trusted third party or the use of a secure multi-party computing protocol is required to complete the establishment of a public reference string. This means that the security of the entire system depends on the absolute integrity and confidentiality of the initialization phase. In addition, trusted initialization is usually a one-time process that is difficult to change or update once completed. How to safely and efficiently complete the update and upgrade of the public reference string remains a difficult problem.

[0039] The second is the problem of the difficulty in balancing prover efficiency and proof size. Although coding-based PCS does not rely on trusted initialization, it is difficult to balance prover efficiency and proof size. Existing RS-code-based PCS can produce smaller proofs, but the long encoding time of RS codes leads to low prover efficiency. Although PCS based on linear-time encodable error-correcting codes has a faster prover, the generated proof is relatively large. How to design an efficient polynomial commitment method based on coding to balance prover efficiency and proof size, or even take both into account, is still a difficult problem.

[0040] To solve the above problems, the present invention proposes a polynomial commitment method based on coding suitable for blockchain expansion. To facilitate those skilled in the art to understand the technical solution provided in the embodiment of the present application, the relevant technology is described below:

[0041] See also Figure 1 , the polynomial commitment method based on coding applicable to blockchain expansion in the embodiment of the present application includes:

[0042] S1. Take the security parameter and the number of polynomial variables as input through the parameter generation algorithm and output a set of public parameters.

[0043] S2. The prover executes the polynomial commitment algorithm to commit to the target polynomial, with the input being the coefficients and public parameters of the target polynomial and the output being the commitment value.

[0044] S3. The polynomial commitment opening algorithm is used to convince the verifier that the assignment of the target polynomial at a certain set of points is correct. The polynomial commitment opening algorithm is an interactive argumentation protocol involving the prover and the verifier. The coefficients of the target polynomial are used as the input of the prover, and the public parameters, commitment values, polynomial assignment points and the assignment results of the target polynomial are used as the common input of the prover and the verifier. The verifier outputs acceptance or rejection.

[0045] Furthermore, the polynomial commitment algorithm is executed in S2 to commit to the target polynomial, specifically including:

[0046] The coefficients of the target polynomial are decomposed into a matrix and expanded by random values. Then, each row of the expanded matrix is ​​regarded as a new polynomial, and the RS codes of these new polynomials are committed using the Merkle tree, and the committed value is finally output.

[0047] Furthermore, in S3, the polynomial commitment opening algorithm is used to convince the verifier that the assignment of the target polynomial at a certain set of points is correct, including:

[0048] The prover and the verifier first jointly use the batch fast RS code proximity interactive oracle proof for preliminary testing. Then the prover calculates according to the verifier's challenge and decomposes and verifies the polynomial through multiple rounds of iterations. The calculation results in each iteration are committed through the Merkle tree. Finally, further verification and testing are performed through the batch fast RS code proximity interactive oracle proof to ensure the correctness of the results.

[0049] Specifically, the steps in S1-S3 above may be:

[0050] set up Is the prover, is a verifier. Given a finite field Indicated by L A multiplicative coset on . A variable with number μ, dimension upper bound d, size N = d μ , defined in The polynomial on is expressed as use represents a multilinear polynomial, represents its coefficient vector, represents a univariate polynomial with the same set of coefficients, express The set of all values ​​assigned on L. Given a code rate ρ∈(0,1), RS code Representing a collection In addition, for any multilinear polynomial with the number of variables μ Assume N = 2 μ =mm', where m and m' are positive integers. And for any Make exist Make For the Merkle tree commitment protocol MT=(MT.Com, MT.Open, MT.Verify), MT.Com takes a set of vectors as output and outputs the root node of the Merkle tree constructed by the set of vectors; MT.Open takes the original image corresponding to a leaf node of the Merkle tree as input and outputs the path from the leaf node to the root node; MT.Verify takes the root node of a Merkle tree, the original image corresponding to a leaf node of the Merkle tree, and the path from the leaf node to the root node as input, and judges the consistency of the above input values. If they are consistent, it outputs 1, otherwise it outputs 0.

[0051] The parameter generation algorithm, polynomial commitment algorithm, and polynomial commitment opening algorithm included in the multilinear polynomial commitment method based on RS code are as follows:

[0052] Parameter generation algorithm: pp←Gen(1 λ ,μ): Input safety parameter 1λ and the number of multilinear polynomial variables μ, output common parameters Where m′=O(logN) is a power of 2, m=N / m′ is an integer, L0 is a multiplicative coset and |L0|=O(m).

[0053] Polynomial Commitment Algorithm: Given The coefficients (f1,...,f N ), implement:

[0054] 1) The target polynomial The coefficients are divided to obtain m′ vectors of size m For j∈[m′], The coefficient is (f (j-1)·m+1 ,f (j-1)·m+2 ,…,f j·m ). Add m random entries to each vector to obtain m′ vectors of size 2m, which are then constructed into m′ univariate polynomials of size 2m.

[0055] 2) Randomly select a multilinear polynomial of size 2m calculate Concurrently

[0056] Polynomial Commitment Opening Algorithm: and implement:

[0057] 1) and right Call batch fast RS code proximity interactive oracle proof. 2) in

[0058] 3) A random vector

[0059] 4) set up For i∈[μ+1], calculate where x μ+1 = 0, and and is the only decomposition for For i∈[μ], send Where L i ={x 2 |x∈Li-1}.

[0060] 5) Consistency check: Repeat the following steps q = O(λ) times:

[0061] 5.1) β← $ L0.

[0062] 5.2) Call MT.Open to open

[0063] 5.3) Check the validity of the Merkle tree commitment through MT.Verify; for i∈[μ+1],

[0064] 6) Validity check: and Call the batch fast RS code proximity interactive oracle proof to prove in Depend on and The batch fast RS code proximity interactive oracle proof requires q′=O(λ) queries in L0, which may be repeated in the consistency check.

[0065] 7) If all consistency and validity checks pass, Output 1.

[0066] The efficiency comparison between the PCS proposed in this application and the existing multi-linear PCS based on coding is as follows: Figure 2 and Figure 3 As shown in the figure, the unit of commitment time is milliseconds, the unit of proof size is kilobytes, "-parallel" means using multi-threaded parallel operation, and "-61" means the finite field where the polynomial is located is Where p is 2 61 -1, "-255" means the finite field of the polynomial is Where p is a 255-bit prime number.

[0067] In addition, the above-mentioned encoding-based polynomial commitment method also performs the following steps when used to achieve blockchain expansion:

[0068] S4. In zk-Rollup, the aggregator calculates a large number of transaction results on the blockchain off-chain and updates the blockchain status;

[0069] S5. Then use the constructed SNARK to generate a short proof of the correctness of the updated state, and submit the generated proof to the smart contract on the blockchain.

[0070] S6. By verifying this proof in the smart contract, on-chain users can efficiently confirm the validity of a large number of transactions, achieving efficient expansion of the blockchain.

[0071] Optionally, a specific method for constructing SNARK is as follows: By using the PCS proposed in this application to instantiate the polynomial oracle in SpartanPIOP and applying the Fiat-Shamir transformation to the obtained protocol, a SNARK with higher efficiency can be constructed.

[0072] First, we introduce the notation and preliminaries. Is the prover, is a verifier. Let X be the instance of R1CS and W be the witness, where Master (X, W), Only X is mastered. For any mapping f, use Represents its multilinear expansion. For a vector use Represents the first element of a vector, using express The vector consisting of the remaining elements after removing the first element. For an R1CS instance Where A, B, C are coefficient matrices, m represents the dimension of the R1CS coefficient matrix, and n represents the number of non-zero elements in the matrix. Let s = logm, and regard the matrix A, B, C as a domain of {0,1} s ×{0,1} s , the value range is The input is the binary representation of the matrix element subscript (i,j)∈{1,...,m}×{1,...,m}, and the corresponding output is the (i,j)th element of the matrix. For an R1CS instance, And a witness W, define Z = (W, 1, io). Think of Z as a mapping: Consider (1,io) as a mapping: According to the argument in Spartan, check This is equivalent to checking whether the following equation holds:

[0073]

[0074] in is a random vector, It is a multilinear extension of eq. Defined as:

[0075]

[0076] The steps to instantiate the polynomial oracle in Spartan PIOP are as follows:

[0077] 1) Run pp←Gen(1 λ ,s), generating the parameter pp of the polynomial commitment method.

[0078] 2) Treat the elements in W as a multilinear polynomial with s variables The prover generates a pair of Commitment And send C to the verifier.

[0079] 3) The verifier generates a random vector and send to

[0080] 4) and Run the sum-check protocol to reduce the verification of equation ① to verifying whether the following conditions hold: in It is the verifier in the sum-check protocol process from Specifically, examine The method is to Perform a calculation; check The method is to verify in The value of Towards Send and call To verify.

[0081] Then, the above interactive protocol is converted into SNARK through Fiat-Shamir transformation: According to the above process, only random vectors are sent to during the interaction process, so the above interactive protocol can be converted into a non-interactive protocol using Fiat-Shamir transformation to obtain the final constructed SNARK.

[0082] Obviously, those skilled in the art should understand that the modules or steps of the above-mentioned embodiments of the present application can be implemented by general-purpose computer devices, they can be concentrated on a single computer device, or distributed on a network composed of multiple computer devices, optionally, they can be implemented by executable program codes of computer devices, so that they can be stored in a storage device and executed by the computer device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0083] It should be noted that the above are only preferred embodiments of the present application, and the patent protection scope of the present application is not limited thereto. Any equivalent structure or equivalent process transformation made using the contents of the specification and drawings of the present application, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A polynomial commitment method based on coding suitable for blockchain expansion, characterized in that: include: S1, using a parameter generation algorithm with a security parameter and the number of polynomial variables as input, outputs a set of public parameters; S2. The prover executes the polynomial commitment algorithm to commit to the target polynomial, with the input being the coefficients and public parameters of the target polynomial and the output being the commitment value; S3. The polynomial commitment opening algorithm is used to convince the verifier that the assignment of the target polynomial at a certain set of points is correct. The polynomial commitment opening algorithm is an interactive argumentation protocol involving the prover and the verifier. The coefficients of the target polynomial are used as the input of the prover, and the public parameters, commitment values, polynomial assignment points and the assignment results of the target polynomial are used as the common input of the prover and the verifier. The verifier outputs acceptance or rejection.

2. The polynomial commitment method according to claim 1, characterized in that: The following steps are also performed to achieve blockchain expansion: S4. In zk-Rollup, the aggregator calculates a large number of transaction results on the blockchain off-chain and updates the blockchain status; S5. Use the constructed SNARK to generate a short proof of the correctness of the updated state, and submit the generated proof to the smart contract on the blockchain; S6. By verifying the above-generated proof in the smart contract, on-chain users can confirm the validity of a large number of transactions and achieve blockchain expansion.

3. The polynomial commitment method according to claim 1, characterized in that: The specific steps in S2 for the prover to execute the polynomial commitment algorithm to commit to the target polynomial are as follows: First, the coefficients of the target polynomial are arranged into multiple vectors of equal length, and each vector is expanded with a random value; Then, each expanded vector is regarded as a new univariate polynomial, and each polynomial is encoded as a Reed-Solomon code, thereby obtaining a matrix in which each column is a Reed-Solomon codeword; Finally, the Merkle tree is used to commit the matrix column by column, and the root node of the Merkle tree is output as the commitment value.

4. The polynomial commitment method according to claim 1, characterized in that: The interactive argumentation process of S3 is as follows: First, the prover and the verifier jointly call the batch fast Reed-Solomon code proximity interactive oracle proof to test whether each column in the matrix corresponding to the commitment value is a Reed-Solomon codeword; Subsequently, the prover and the verifier conduct multiple rounds of interactive operations. In each round, the prover decomposes the polynomial into polynomials of lower dimensions, and then performs consistency tests on the polynomials before and after the decomposition and the polynomial assignment results, and commits to the decomposition results through the Merkle tree. Finally, the decomposition results in each round are verified through batch fast Reed-Solomon code proximity interactive oracle proof to ensure that the decomposition results are correct Reed-Solomon codewords.

5. A computer storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the polynomial commitment method according to any one of claims 1 to 4 is implemented.

6. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the polynomial commitment method according to any one of claims 1 to 4 is implemented.

Images