Zero-knowledge proving method based on public verifiable hidden security

Abstract

The invention discloses a zero-knowledge proving method based on public verifiable hidden security. The zero-knowledge proving method comprises the following steps: a verifier generates a commitment cled and a challenge for an initial random seed and sends the commitment cled and the challenge to a prover; the prover initializes a zero-knowledge proof instance, executes zero-knowledge proof of 1-bit challenge in parallel, generates a signature and sends the signature to the verifier; the verifier verifies the signature and the challenge result, and the verifier accepts the certification if the verification succeeds; and if the verification fails, calling a responsibility investigation program, and generating an evidence certificate of the malicious behavior. According to the method, under the condition that the reputation of participants is sensitive, the calculation efficiency of existing zero-knowledge proof can be greatly improved while the extremely high cheating detection rate can be ensured, the calculation overhead is reduced, and the time cost is saved.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to a zero-knowledge proof method based on public verifiable hidden security. Background Art

[0002] The concept of zero-knowledge proof was proposed by Goldwasser, Micali, and Rackoff in 1985. This cryptographic concept enables a prover to prove to a verifier that he knows a certain piece of information (such as a secret or a fact) without revealing any additional content other than the correctness of the information. Although zero-knowledge proofs and their protocols have been widely used in various fields, such as secure multi-party computing and blockchain. However, existing zero-knowledge proof protocols are not universally applicable or inefficient in some scenarios. For example, the zero-knowledge proof protocol based on the Schnorr protocol structure is efficient only when proving relatively limited statements; general zero-knowledge protocols designed for blockchain applications, such as zk-SNARK and Bulletproof protocols, become computationally expensive when processing complex statement representations.

[0003] Based on this situation, if the public verifiable covert (PVC) security model is combined with the zero-knowledge proof system, it can significantly improve the efficiency while ensuring a high cheating recognition rate, and this combined proof system can be well applied to certain scenarios of secure multi-party computing. The characteristics of these scenarios are as follows:

[0004] Reputation-sensitive parties: If the parties involved in the computation have a strong sense of reputation (e.g., large enterprises, financial groups, and online platforms), although they may be motivated to cheat to gain an advantage, they also need to consider the risk of being caught and publicly exposed. In these scenarios, there is a significant probability (e.g., 93.75%) that cheating will be detected and publicly exposed, which is sufficient to deter malicious behavior.

[0005] Repeated subprotocols: Many existing zero-knowledge protocols are constructed by repeating subprotocols sequentially or in parallel. Typically, the subprotocols involved need to be repeated multiple times to prevent malicious parties from making malicious guessing queries. However, for reputation-conscious parties, if they are concerned that cheating will be detected and publicly exposed, the number of subprotocol repetitions can be significantly reduced (e.g., from 40 to 4).

[0006] Therefore, based on these, if a universal conversion scheme can be proposed to convert the conventional Sigma protocol with 1-bit challenge into a zero-knowledge protocol with PVC security, the scheme can be more universally applicable. Summary of the invention

[0007] To achieve the above objectives, the present invention provides a zero-knowledge proof method based on public verifiable hidden security, comprising:

[0008] The verifier generates a commitment c to the initial random seed seed and sent to the prover;

[0009] The prover initializes a zero-knowledge proof instance, executes the zero-knowledge proof of the 1-bit challenge in parallel, generates a signature, and sends the signature to the verifier;

[0010] The verifier verifies the signature and the challenge result. If the verification is successful, the verifier accepts the proof; if the verification fails, the accountability program is called and a certificate of evidence of malicious behavior is generated.

[0011] Preferably, the method further comprises an initialization process, wherein the initialization process comprises:

[0012] Before the protocol is executed, both the verifier and the prover have a 1-bit challenge Sigma protocol π for NP problems and a common NP proposition x, and agree on the security parameter μ, the number of challenge bits λ used in the protocol, and the prover's public key pk.

[0013] Preferably, the verifier generates a commitment c to the initial random seed seed The process of sending it to the prover includes:

[0014] The verifier first selects an initial random seed, and uses the initial random seed to generate a binary string of length λ and a series of sub-random seeds, where each bit of the binary string is a challenge bit, and the challenge bit and a sub-random seed correspond to a challenge instance;

[0015] The verifier then generates a commitment c to the initial random seed seed and sent to the prover.

[0016] Preferably, the process of the prover initializing the zero-knowledge proof instance includes:

[0017] The prover generates an initial message a for each challenge bit e using the given Sigma protocol, commits to all initial messages, and then generates the commitment c a Sent to the validator.

[0018] Preferably, the process of executing zero-knowledge proof of 1-bit challenge in parallel includes:

[0019] The prover continues to execute the given Sigma protocol under each challenge bit and generates two candidate answers z0 and z1, corresponding to the possible values ​​0 and 1 of the challenge bit respectively;

[0020] The verifier then uses the oblivious transfer protocol to send the corresponding challenge bit e to the prover and receives the corresponding candidate answer z e In reply.

[0021] Preferably, the process of generating a signature and sending the signature to the verifier includes:

[0022] The prover uses the private key sk and the key information in the protocol to generate a signature σ and adds the signature σ to all the initial messages {a j} j∈λ and its corresponding solution commitment {decom j} j∈λ Sent to the verifier together.

[0023] Preferably, the process of the verifier verifying the signature and the challenge result includes:

[0024] The verifier uses the public key pk to verify the validity of the prover's signature and check the initial message and the corresponding decommitment;

[0025] If a signature or commitment fails to be verified, the verifier terminates the protocol and outputs a rejection, calling the accountability program to generate the corresponding cheating certificate;

[0026] If all the challenge answers to the zero-knowledge proof are correct, the verifier accepts the proof.

[0027] Preferably, the process of calling the accountability program and generating a certificate of evidence of malicious behavior includes:

[0028] When the verifier finds that the prover's response does not meet expectations, it calls the accountability procedure, randomly selects an erroneous instance, and generates a certificate of evidence of malicious behavior, which is used for accountability or as evidence;

[0029] The content of the certificate includes: NP statement x, the number of challenge bits λ in the protocol, the signature σ of the prover, the random seed seed, and the commitment c to the random seed. seed 、Decommitment to random seeds seed , the index of a randomly selected faulty instance, the set of all initial messages of the prover {a j} j∈λ Communication records with all instances j} j∈λ .

[0030] Preferably, the method further comprises: judging whether the generated evidence certificate is legal and whether the prover has made a correct proof;

[0031] The process of judging whether the generated evidence certificate is legal and whether the prover has performed the proof correctly includes:

[0032] Signature verification: If the signature σ in the certificate is illegal, the certificate is illegal;

[0033] Commitment verification: If the certificate's commitment to the random seed c seed Cannot use its corresponding solution commitment decom seed If it is unlocked, the certificate is invalid;

[0034] Instance verification: Use the random seed seed to generate each sub-random seed and the corresponding challenge bit e, use the random seed seed, the error instance index and the corresponding communication record to re-simulate the execution of each instance, and obtain the challenge answer generated by the simulation If the message sent by the verifier during the simulation is different from the message sent by the verifier in the message record corresponding to the instance, the certificate is invalid; if they are all the same, the answer to the challenge is verified based on the NP statement x and the prover's initial message a and the challenge bit e Is it correct? If it is correct, the certificate is legal and there is no malicious behavior; otherwise, the certificate is legal and the certifier did not perform the correct certification.

[0035] Compared with the prior art, the present invention has the following advantages and technical effects:

[0036] This invention introduces the PVC security model into the zero-knowledge proof system for the first time, which improves the computational efficiency of zero-knowledge proof while ensuring security to a great extent, and provides a basis for subsequent research.

[0037] Compared with the traditional zero-knowledge proof scheme, the present invention significantly reduces the number of repeated executions of the sub-protocol and significantly improves the efficiency.

[0038] The malicious behavior certificate generation and disclosure mechanism in the present invention provides concrete evidence for accountability, which makes the present invention widely applicable to secure computing between reputation-sensitive parties, such as multi-party computing between large enterprises or business groups.

[0039] The present invention proposes a universal conversion that can be used to convert the general Sigma protocol with 1-bit challenge into a zero-knowledge proof protocol under PVC security. This conversion makes our scheme highly universal. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0041] Figure 1 The figure is a schematic diagram of a method flow of an embodiment of the present invention. DETAILED DESCRIPTION

[0042] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0043] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] First, the technical terms involved in the following embodiments are explained.

[0045] Publicly verifiable covert security: Publicly verifiable covert (PVC) security is a security concept that is often used in secure multi-party computing and related privacy protection protocols. It combines the concepts of privacy and public verifiability, and aims to provide a security mechanism that ensures the privacy of participants, allowing malicious behaviors that deviate from the protocol to be detected with a high probability (that is, ensuring that when a participant or attacker attempts to disrupt the protocol, the attack behavior will be detected by other parties with a high probability), and ensuring that malicious behavior can be publicly verified when it is detected. It can ensure that the security of the protocol can be achieved without relying on a trusted third party and serve as a deterrent to malicious behavior.

[0046] Zero-knowledge proofs: Zero-knowledge proofs is a cryptographic concept that allows one party (called a prover) to prove to another party (called a verifier) ​​that he knows a certain piece of information (such as a secret or a fact) without revealing any additional content other than the correctness of the information. In other words, the prover can "prove" that he has the authenticity of a certain piece of information, but in the entire process, the verifier will not get any actual content of the information.

[0047] Oblivious Transfer (OT) is an important cryptographic protocol that is widely used in secure computing and privacy protection. The core idea of ​​the 2-choose-1 oblivious transfer used in the present invention is that the sender has two secrets, and the receiver can obtain one of the secrets. In this process, the sender cannot know which secret the receiver chooses to obtain, and the receiver cannot obtain the unselected secret.

[0048] Sigma Protocol with 1-bit Challenge: Sigma Protocol with 1bit Challenge, Sigma protocol is a specific type of zero-knowledge proof protocol. The name of the Sigma protocol comes from its structure, which is similar to the Greek letter "Σ". It is an interactive verification protocol with three stages, including:

[0049] Commitment phase: The prover selects a random number and generates a commitment value, which is sent to the verifier.

[0050] Challenge phase: The verifier sends a randomly selected challenge to the prover.

[0051] Response phase: The prover calculates a response based on the content of the challenge and sends it to the verifier. The verifier then checks whether the response is consistent with the commitment, thereby verifying whether the prover's statement is correct.

[0052] In the Sigma protocol based on 1-bit challenges, the verifier's challenge contains only one bit, either 0 or 1.

[0053] Commitment: In cryptography, commitment is a basic cryptographic primitive that allows a person to "commit" to a value and ensure that the commitment is kept confidential (until revealed) and cannot be tampered with. The function of the commitment is like a "sealed envelope". You put a secret in it, and after the seal is sealed, others cannot see the contents of the envelope until you decide to reveal it. Others can see the contents of the envelope, and you cannot modify the contents.

[0054] The present invention is mainly aimed at secure multi-party computing in situations where the participants are sensitive to their own reputation, and provides an efficient zero-knowledge proof protocol construction scheme that can be used in computing. The scheme can convert the conventional Sigma protocol with 1-bit challenge into a zero-knowledge proof protocol under PVC security. The converted protocol has high computing efficiency and the ability to generate publicly verifiable cheating certificates for discovered cheating behaviors. The disclosure of cheating certificates will damage the reputation of the participants, thereby deterring the participants from cheating attempts.

[0055] like Figure 1 As shown, this embodiment provides a zero-knowledge proof method based on public verifiable hidden security, which specifically includes the following steps:

[0056] Initialization: Before the protocol is executed, both the verifier and the prover should have a 1-bit challenge Sigma protocol π for NP problems. Both parties should have a common NP proposition x and agree on the security parameter μ, the prover's public key pk, and the number of challenge bits λ used in the protocol.

[0057] Step 1: Commitment and challenge generation;

[0058] The verifier (V) first selects an initial random seed seed and uses the seed to generate a string of binary characters of length λ and a series of sub-random seeds. Each bit of the binary string is a challenge bit, and each challenge bit and sub-random seed corresponds to a challenge. The verifier then generates a commitment c to the initial random seed. seed And send it to the prover (P).

[0059] Step 2: Initialize the zero-knowledge proof instance;

[0060] The prover generates an initial message a for each challenge bit e using the given Sigma protocol, and commits to all the initial messages, generating the commitment c a Sent to the validator.

[0061] Step 3: Execute zero-knowledge proof of 1-bit challenge in parallel;

[0062] The prover continues to execute the given Sigma protocol under each challenge bit, generating two candidate answers z0 and z1, corresponding to the possible values ​​0 and 1 of the challenge bit respectively. After that, the verifier uses the oblivious transfer protocol to send the corresponding challenge bit e to the prover and receives the corresponding candidate answer z e In reply.

[0063] Step 4: Generate a signature

[0064] The prover (P) generates a signature σ using his private key sk and all key information in the protocol, and adds the signature to all the initial messages {a j} j∈λ and its corresponding solution commitment {decom j} j∈λ Sent to the verifier together.

[0065] Step 5: Verify the signature and challenge result;

[0066] The verifier (V) uses the public key pk to verify the validity of the prover's signature and checks the initial message and the corresponding solution commitment. If a signature or commitment fails to be verified, the verifier terminates the protocol and outputs a rejection, calling the accountability program to generate the corresponding cheating certificate. If all the challenge answers of the zero-knowledge proof are correct, the verifier accepts the proof.

[0067] Step 6: Malicious detection and evidence generation;

[0068] If the verifier finds that the prover's response does not meet expectations, the verifier can call the accountability procedure, randomly select an erroneous instance, and generate a certificate of evidence of malicious behavior, which contains the following: NP statement x, the number of challenge bits λ in the protocol, the prover's signature σ, the random seed seed, and the commitment to the random seed c seed 、Decommitment to random seeds seed , the prover's initial message set {a j} j∈λ Communication records with all instances j} j∈λ , the certificate can be used for accountability or as evidence.

[0069] In addition, to further enhance the security of the protocol, this embodiment also proposes a judgment algorithm for judging whether the generated cheating certificate is legal and whether the prover has performed the correct proof. The steps are as follows:

[0070] 1.Signature verification:

[0071] If the signature σ in the certificate is invalid, then the certificate is invalid.

[0072] 2. Commitment Verification:

[0073] If the certificate's commitment to the random seed c seed Cannot use its corresponding solution commitment decom seed If it is unlocked, the certificate is invalid.

[0074] 3. Example verification:

[0075] Use the random seed seed to generate each child random seed and the corresponding challenge bit e.

[0076] Re-simulate the execution of each instance using a random seed to obtain the challenge answers generated by the simulation If the message sent by the verifier during the simulation is different from the message sent by the verifier in the message record corresponding to the instance, the certificate is invalid. If they are all the same, the answer to the challenge is verified based on the NP statement x and the prover's initial message a and the challenge bit e. Is it correct? If it is correct, the certificate is legal and there is no malicious behavior; otherwise, the certificate is legal and the certifier did not perform the correct certification (there is cheating).

[0077] The above are only preferred specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A zero-knowledge proof method based on publicly verifiable hidden security, characterized in that: include: The verifier generates a commitment c to the initial random seed seed and sent to the prover; The prover initializes a zero-knowledge proof instance, executes the zero-knowledge proof of the 1-bit challenge in parallel, generates a signature, and sends the signature to the verifier; The verifier verifies the signature and the challenge result. If the verification is successful, the verifier accepts the proof; if the verification fails, the accountability program is called and a certificate of evidence of malicious behavior is generated.

2. The method according to claim 1, characterized in that The method further comprises an initialization process, wherein the initialization process comprises: Before the protocol is executed, both the verifier and the prover have a 1-bit challenge Sigma protocol π for NP problems and a common NP proposition x, and agree on the security parameter μ, the number of challenge bits λ used in the protocol, and the prover's public key pk.

3. The method according to claim 1, characterized in that The verifier generates a commitment c to the initial random seed seed The process of sending it to the prover includes: The verifier first selects an initial random seed, and uses the initial random seed to generate a binary string of length λ and a series of sub-random seeds, where each bit of the binary string is a challenge bit, and the challenge bit and a sub-random seed correspond to a challenge instance; The verifier then generates a commitment c to the initial random seed seed and sent to the prover.

4. The method according to claim 1, characterized in that: The process of the prover initializing a zero-knowledge proof instance includes: The prover generates an initial message a for each challenge bit using the given Sigma protocol, commits to all initial messages, and then generates the commitment c a Sent to the validator.

5. The method according to claim 1, characterized in that The process of executing zero-knowledge proofs for 1-bit challenges in parallel includes: The prover continues to execute the given Sigma protocol under each challenge bit and generates two candidate answers z0 and z1, corresponding to the possible values ​​0 and 1 of the challenge bit respectively; The verifier then uses the oblivious transfer protocol to send the corresponding challenge bit e to the prover and receives the corresponding candidate answer z e In reply.

6. The method according to claim 1, characterized in that The process of generating a signature and sending the signature to the verifier includes: The prover uses the private key sk and the key information in the protocol to generate a signature σ and adds the signature σ to all the initial messages {a j } j∈λ and its corresponding solution commitment {decom j } j∈λ Sent to the verifier together.

7. The method according to claim 1, characterized in that The process of the verifier verifying the signature and the challenge result includes: The verifier uses the public key pk to verify the validity of the prover's signature and check the initial message and the corresponding decommitment; If a signature or commitment fails to be verified, the verifier terminates the protocol and outputs a rejection, calling the accountability program to generate the corresponding cheating certificate; If all the challenge answers to the zero-knowledge proof are correct, the verifier accepts the proof.

8. The method according to claim 1, characterized in that The process of calling the accountability program and generating a certificate of evidence of malicious behavior includes: When the verifier finds that the prover's response does not meet expectations, it calls the accountability procedure, randomly selects an erroneous instance, and generates a certificate of evidence of malicious behavior, which is used for accountability or as evidence; The content of the certificate includes: NP statement x, the number of challenge bits λ in the protocol, the signature σ of the prover, the random seed seed, and the commitment c to the random seed. seed 、Decommitment to random seeds seed , the index of a randomly selected faulty instance, the set of all initial messages of the prover {a j } j∈λ Communication records with all instances j } j∈λ .

9. The method according to claim 1, characterized in that: The method further comprises: determining whether the generated evidence certificate is legal and whether the prover has made a correct proof; The process of judging whether the generated evidence certificate is legal and whether the prover has performed the proof correctly includes: Signature verification: If the signature σ in the certificate is illegal, the certificate is illegal; Commitment verification: If the certificate's commitment to the random seed c seed Cannot use its corresponding solution commitment decom seed If it is unlocked, the certificate is invalid; Instance verification: Use the random seed seed to generate each sub-random seed and the corresponding challenge bit e, use the random seed seed, the error instance index and the corresponding communication record to re-simulate the execution of each instance, and obtain the challenge answer generated by the simulation If the message sent by the verifier during the simulation is different from the message sent by the verifier in the message record corresponding to the instance, the certificate is invalid; if they are all the same, the answer to the challenge is verified based on the NP statement x and the prover's initial message a and the challenge bit e Is it correct? If it is correct, the certificate is legal and there is no malicious behavior; otherwise, the certificate is legal and the certifier did not perform the correct certification.

Images