A zero-knowledge proof method based on public verifiable hidden security

Abstract

The present invention discloses a zero-knowledge proof method based on public verifiable hidden security, comprising: a verifier generates a commitment c to an initial random seed seed The prover then initializes a zero-knowledge proof instance, executes the zero-knowledge proof for the 1-bit challenge in parallel, generates a signature, and sends the signature to the verifier. The verifier verifies the signature against the challenge result; if verification succeeds, the verifier accepts the proof. If verification fails, the accountability program is invoked and a certificate is generated proving malicious behavior. This invention significantly improves the computational efficiency of existing zero-knowledge proofs while ensuring a very high cheating detection rate in scenarios where the reputation of the participating parties is sensitive, reducing computational overhead and saving time.

Description

Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to a zero-knowledge proof method based on public verifiable hidden security. Background Art

[0002] The concept of zero-knowledge proof was proposed by Goldwasser, Micali, and Rackoff in 1985. This cryptographic concept enables a prover to prove to a verifier that they know a specific piece of information (such as a secret or a fact) without revealing any additional information other than the correctness of the information. Although zero-knowledge proof and its protocols have a wide range of applications in various fields, such as secure multi-party computation and blockchain, existing zero-knowledge proof protocols are not universally applicable or are inefficient in some scenarios. For example, the zero-knowledge proof protocol based on the Schnorr protocol structure is only efficient when proving a relatively limited number of statements; general zero-knowledge protocols designed for blockchain applications, such as zk-SNARK and Bulletproof protocols, become computationally expensive when processing complex statement representations.

[0003] Based on this situation, if the public verifiable covert (PVC) security model is combined with the zero-knowledge proof system, it can significantly improve the efficiency while ensuring a high cheating detection rate. This combined proof system is well suited for certain scenarios of secure multi-party computing. The characteristics of these scenarios are as follows:

[0004] Reputation-sensitive participants: If all parties involved in the computation are highly reputation-conscious (e.g., large enterprises, financial institutions, and online platforms), while they may be motivated to cheat to gain an advantage, they also need to consider the risk of being caught and publicly exposed. In these scenarios, a significant probability (e.g., 93.75%) of being detected and publicly exposed is sufficient to deter malicious behavior.

[0005] Repeated Subprotocols: Many existing zero-knowledge protocols are constructed by repeating subprotocols sequentially or in parallel. Typically, the subprotocols involved need to be repeated multiple times to prevent malicious parties from making malicious guessing queries. However, for reputation-conscious parties concerned about cheating being detected and publicly exposed, the number of subprotocol repetitions can be significantly reduced (e.g., from 40 to 4).

[0006] Therefore, based on these, if a universal conversion scheme can be proposed to convert the conventional Sigma protocol with 1-bit challenge into a zero-knowledge protocol with PVC security, the scheme can be made more universally applicable. Summary of the Invention

[0007] To achieve the above objectives, the present invention provides a zero-knowledge proof method based on public verifiable covert security, comprising:

[0008] The verifier generates a commitment c to the initial random seed seed and sent to the prover;

[0009] The prover initializes a zero-knowledge proof instance, executes the zero-knowledge proof of the 1-bit challenge in parallel, generates a signature, and sends the signature to the verifier;

[0010] The verifier verifies the signature and the challenge result. If the verification is successful, the verifier accepts the proof; if the verification fails, the accountability program is called and a certificate of evidence of malicious behavior is generated.

[0011] Preferably, the method further includes an initialization process, and the initialization process includes:

[0012] Before the protocol is executed, both the verifier and the prover have a 1-bit challenge Sigma protocol π for NP problems and a common NP proposition x, and reach an agreement on the security parameter μ, the number of challenge bits λ used in the protocol, and the prover's public key pk.

[0013] Preferably, the verifier generates a commitment c to the initial random seed seed The process of sending it to the prover includes:

[0014] The verifier first selects an initial random seed and uses it to generate a binary string of length λ and a series of sub-random seeds. Each bit of the binary string is a challenge bit, and each challenge bit and sub-random seed correspond to a challenge instance.

[0015] The verifier then generates a commitment c to the initial random seed seed and sent to the prover.

[0016] Preferably, the process of the prover initializing the zero-knowledge proof instance includes:

[0017] The prover generates an initial message a for each challenge bit e using the given Sigma protocol, commits to all initial messages, and then generates the commitment c a Sent to the validator.

[0018] Preferably, the process of executing zero-knowledge proof of 1-bit challenge in parallel includes:

[0019] The prover continues to execute the given Sigma protocol under each challenge bit, generating two candidate answers z0 and z1, corresponding to the possible values ​​0 and 1 of the challenge bit respectively;

[0020] The verifier then uses the oblivious transfer protocol to send the corresponding challenge bit e to the prover and receives the corresponding candidate answer z e In reply.

[0021] Preferably, the process of generating a signature and sending the signature to the verifier includes:

[0022] The prover uses the private key sk and the key information in the protocol to generate a signature σ and adds the signature σ to all the initial messages {a j} j∈λ and its corresponding solution commitment {decom j} j∈λ Sent to the verifier together.

[0023] Preferably, the process of the verifier verifying the signature and the challenge result includes:

[0024] The verifier uses the public key pk to verify the validity of the prover's signature and check the initial message and the corresponding decommitment;

[0025] If a signature or commitment fails to be verified, the verifier aborts the protocol and outputs a rejection, calling the accountability program to generate the corresponding cheating certificate;

[0026] If all the answers to the zero-knowledge proof's challenges are correct, the verifier accepts the proof.

[0027] Preferably, the process of calling the accountability program and generating a certificate of evidence of malicious behavior includes:

[0028] When the verifier finds that the prover's response does not meet expectations, it calls the accountability procedure, randomly selects an error instance, and generates a certificate of evidence of malicious behavior. The certificate is used for accountability or as evidence;

[0029] The certificate includes: NP statement x, the number of challenge bits λ in the protocol, the prover's signature σ, the random seed seed, and the commitment c to the random seed. seed 、Decommitment to random seeds seed , the index of a randomly selected fault instance, the set of all initial messages of the prover {a j} j∈λ Communication records with all instances {trans j} j∈λ .

[0030] Preferably, the method further comprises: determining whether the generated evidence certificate is legal and whether the prover has made a correct proof;

[0031] The process of judging whether the generated evidence certificate is legal and whether the prover has made a correct proof includes:

[0032] Signature verification: If the signature σ in the certificate is illegal, the certificate is illegal;

[0033] Commitment verification: If the certificate's commitment to the random seed c seed Cannot use its corresponding solution commitment decom seed If it is unlocked, the certificate is invalid;

[0034] Instance verification: Use the random seed seed to generate each sub-random seed and the corresponding challenge bit e, and use the random seed seed, the error instance index and the corresponding communication record to re-simulate the execution of each instance to obtain the challenge answer generated by the simulation If the message sent by the verifier during the simulation is different from the message sent by the verifier in the message record corresponding to the instance, the certificate is invalid; if they are all the same, the answer to the challenge is verified based on the NP statement x and the prover's initial message a and the challenge bit e Is it correct? If so, the certificate is valid and there is no malicious behavior; otherwise, the certificate is valid and the certifier did not perform the correct certification.

[0035] Compared with the prior art, the present invention has the following advantages and technical effects:

[0036] This invention introduces the PVC security model into the zero-knowledge proof system for the first time, which greatly ensures security while improving the computational efficiency of zero-knowledge proof and provides a basis for subsequent research.

[0037] Compared with traditional zero-knowledge proof schemes, the present invention significantly reduces the number of repeated executions of sub-protocols and significantly improves efficiency.

[0038] The malicious behavior certificate generation and disclosure mechanism in the present invention provides concrete evidence for accountability, which makes the present invention widely applicable to secure computing between reputation-sensitive parties, such as multi-party computing between large enterprises or business groups.

[0039] This paper proposes a universal conversion that can be used to convert the general Sigma protocol with 1-bit challenge into a zero-knowledge proof protocol under PVC security. This conversion makes our solution highly universal. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0041] Figure 1 Schematic diagram of a method flow in an embodiment of the present invention. DETAILED DESCRIPTION

[0042] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0043] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] First, the technical terms involved in the following embodiments are explained.

[0045] Publicly verifiable covert security (PVC) is a security concept commonly used in secure multi-party computation and related privacy-preserving protocols. It combines the concepts of privacy and public verifiability to provide a security mechanism that ensures the privacy of participants, allowing malicious behavior that deviates from the protocol to be detected with a high probability (that is, when a participant or attacker attempts to subvert the protocol, the attack is likely to be detected by other parties with a high probability), and ensuring that malicious behavior, when detected, can be publicly verified. This ensures that the security of the protocol can be achieved without relying on a trusted third party and serves as a deterrent to malicious behavior.

[0046] Zero-knowledge proofs are a cryptographic concept that allows one party (called a prover) to prove to another party (called a verifier) ​​that they know a specific piece of information (such as a secret or a fact) without revealing anything beyond the correctness of that information. In other words, the prover can "prove" the authenticity of the information, but the verifier never actually obtains any of the information during the entire process.

[0047] Oblivious Transfer (OT) is an important cryptographic protocol with widespread applications in secure computing and privacy protection. The core concept of 2-choose-1 oblivious transfer, used in this paper, is that the sender possesses two secrets, and the receiver can obtain one of them. During this process, the sender cannot know which secret the receiver chooses, and the receiver cannot obtain the unselected secret.

[0048] Sigma Protocol with 1-bit Challenge: Sigma Protocol with 1-bit Challenge, the Sigma protocol is a specific type of zero-knowledge proof protocol. The name of the Sigma protocol comes from its structure, which resembles the Greek letter "Σ". It is an interactive verification protocol with three phases, specifically including:

[0049] Commitment phase: The prover selects a random number and generates a commitment value, which is sent to the verifier.

[0050] Challenge phase: The verifier sends a randomly chosen challenge to the prover.

[0051] Response phase: The prover computes a response based on the challenge and sends it to the verifier. The verifier then checks whether the response is consistent with the commitment, thereby verifying that the prover's statement is correct.

[0052] In the Sigma protocol based on 1-bit challenges, the verifier's challenge only contains one bit, that is, 0 or 1.

[0053] Commitment: In cryptography, commitment is a basic cryptographic primitive that allows a person to "commit" to a value and ensure that this commitment is confidential (until it is revealed) and cannot be tampered with. The function of the commitment is like a "sealed envelope". You put a secret in it, and after the seal is sealed, others cannot see the contents of the envelope until you decide to reveal it. Others can see the contents of the envelope, and you cannot modify the contents.

[0054] This invention is primarily aimed at secure multi-party computation in situations where participants are sensitive to their reputation. It provides an efficient zero-knowledge proof protocol construction scheme that can be used in computations. This scheme can convert the conventional Sigma protocol with a 1-bit challenge into a zero-knowledge proof protocol under PVC security. The converted protocol has high computational efficiency and the ability to generate publicly verifiable cheating certificates for discovered cheating behaviors. The disclosure of cheating certificates will damage the reputation of the participants, thereby deterring them from cheating attempts.

[0055] like Figure 1 As shown, this embodiment provides a zero-knowledge proof method based on public verifiable hidden security, which specifically includes the following steps:

[0056] Initialization: Before the protocol is executed, both the verifier and the prover should possess a 1-bit challenge Sigma protocol π for an NP problem. Both parties should possess a common NP proposition x and agree on the security parameter μ, the prover's public key pk, and the number of challenge bits λ used in the protocol.

[0057] Step 1: Commitment and challenge generation;

[0058] The verifier (V) first selects an initial random seed seed and uses the seed to generate a string of binary characters of length λ and a series of sub-random seeds. Each bit of the binary string is a challenge bit, and each challenge bit and sub-random seed corresponds to a challenge. The verifier then generates a commitment c to the initial random seed. seed And send it to the prover (P).

[0059] Step 2: Initialize the zero-knowledge proof instance;

[0060] The prover generates an initial message a for each challenge bit e using the given Sigma protocol, and commits to all initial messages, generating the commitment c. a Sent to the validator.

[0061] Step 3: Execute zero-knowledge proof of 1-bit challenge in parallel;

[0062] The prover continues to execute the given Sigma protocol under each challenge bit and generates two candidate answers z0 and z1, corresponding to the possible values ​​0 and 1 of the challenge bit respectively. After that, the verifier uses the oblivious transfer protocol to send the corresponding challenge bit e to the prover and receives the corresponding candidate answer z e In reply.

[0063] Step 4: Generate a signature

[0064] The prover (P) generates a signature σ using its private key sk and all key information in the protocol, and adds the signature to all the initial messages {a j} j∈λ and its corresponding solution commitment {decom j} j∈λ Sent to the verifier together.

[0065] Step 5: Verify the signature and challenge result;

[0066] The verifier (V) uses the public key pk to verify the validity of the prover's signature and checks the initial message and the corresponding decommitment. If any signature or commitment fails to verify, the verifier aborts the protocol and outputs a rejection, calling the accountability program to generate the corresponding cheating certificate. If all answers to the zero-knowledge proof challenge are correct, the verifier accepts the proof.

[0067] Step 6: Malicious detection and evidence generation;

[0068] If the verifier finds that the prover's response is not as expected, the verifier can call the accountability program, randomly select an error instance, and generate a certificate of evidence of malicious behavior, which contains the following: NP statement x, the number of challenge bits λ in the protocol, the prover's signature σ, the random seed seed, and the commitment to the random seed c seed 、Decommitment to random seeds seed , the prover's initial message set {a j} j∈λ Communication records with all instances {trans j} j∈λ , the certificate can be used for accountability or as evidence.

[0069] In addition, to further enhance the security of the protocol, this embodiment also proposes a judgment algorithm for determining whether the generated cheating certificate is legitimate and whether the prover has performed the correct certification. The steps are as follows:

[0070] 1. Signature verification:

[0071] If the signature σ in the certificate is illegal, the certificate is illegal.

[0072] 2. Commitment Verification:

[0073] If the certificate's commitment to the random seed c seed Cannot use its corresponding solution commitment decom seed If it is unlocked, the certificate is invalid.

[0074] 3. Example verification:

[0075] Use the random seed seed to generate each child random seed and the corresponding challenge bit e.

[0076] Re-simulate the execution of each instance using a random seed to obtain the challenge answers generated by the simulation If the message sent by the verifier during the simulation is different from the message sent by the verifier in the message record corresponding to the instance, the certificate is invalid. If all are the same, the answer to the challenge is verified based on the NP statement x and the prover's initial message a and the challenge bit e Is it correct? If it is correct, the certificate is legal and there is no malicious behavior; otherwise, the certificate is legal and the certifier did not perform the correct certification (cheating occurs).

[0077] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A zero-knowledge proof method based on public verifiable hidden security, characterized in that: include: The verifier generates a commitment c to the initial random seed seed and sent to the prover; The prover initializes a zero-knowledge proof instance, executes the zero-knowledge proof of the 1-bit challenge in parallel, generates a signature, and sends the signature to the verifier; The verifier verifies the signature and the challenge result, and if the verification is successful, the verifier accepts the proof; If the verification fails, the accountability program is called and a certificate of evidence of malicious behavior is generated; The method further includes an initialization process, which includes: Before the protocol is executed, both the verifier and the prover have a 1-bit challenge Sigma protocol π for NP problems and a common NP proposition x, and reach an agreement on the security parameter μ, the number of challenge bits λ used in the protocol, and the prover's public key pk; The verifier generates a commitment c to the initial random seed seed The process of sending it to the prover includes: The verifier first selects an initial random seed and uses it to generate a binary string of length λ and a series of sub-random seeds. Each bit of the binary string is a challenge bit, and each challenge bit and sub-random seed correspond to a challenge instance. The verifier then generates a commitment c to the initial random seed seed and sent to the prover; The process of the prover initializing a zero-knowledge proof instance includes: The prover generates an initial message a for each challenge bit using the given Sigma protocol, commits to all initial messages, and then generates the commitment c a Sent to the validator; The process of generating a signature and sending the signature to the verifier includes: The prover uses the private key sk and the key information in the protocol to generate a signature σ and adds the signature σ to all the initial messages {a j } j∈λ and its corresponding solution commitment {decom j } j∈λ Sent to the verifier together.

2. The method according to claim 1, characterized in that The process of executing zero-knowledge proof of 1-bit challenge in parallel includes: The prover continues to execute the given Sigma protocol under each challenge bit, generating two candidate answers z0 and z1, corresponding to the possible values ​​0 and 1 of the challenge bit respectively; The verifier then uses the oblivious transfer protocol to send the corresponding challenge bit e to the prover and receives the corresponding candidate answer z e In reply.

3. The method according to claim 1, characterized in that The process of the verifier verifying the signature and challenge result includes: The verifier uses the public key pk to verify the validity of the prover's signature and check the initial message and the corresponding decommitment; If a signature or commitment fails to be verified, the verifier aborts the protocol and outputs a rejection, calling the accountability program to generate the corresponding cheating certificate; If all the answers to the zero-knowledge proof's challenges are correct, the verifier accepts the proof.

4. The method according to claim 1, wherein The process of invoking the accountability program and generating a certificate of evidence of malicious behavior includes: When the verifier finds that the prover's response does not meet expectations, it calls the accountability procedure, randomly selects an error instance, and generates a certificate of evidence of malicious behavior. The certificate is used for accountability or as evidence; The certificate includes: NP statement x, the number of challenge bits λ in the protocol, the prover's signature σ, the random seed seed, and the commitment c to the random seed. seed 、Decommitment to random seeds seed , the index of a randomly selected fault instance, the set of all initial messages of the prover {a j } j∈λ Communication records with all instances {trans j } j∈λ .

5. The method according to claim 1, wherein The method further includes: determining whether the generated evidence certificate is legal and whether the prover has made a correct proof; The process of judging whether the generated evidence certificate is legal and whether the prover has made a correct proof includes: Signature verification: If the signature σ in the certificate is illegal, the certificate is illegal; Commitment verification: If the certificate's commitment to the random seed c seed Cannot use its corresponding solution commitment decom seed If it is unlocked, the certificate is invalid; Instance verification: Use the random seed seed to generate each sub-random seed and the corresponding challenge bit e, and use the random seed seed, the error instance index and the corresponding communication record to re-simulate the execution of each instance to obtain the challenge answer generated by the simulation If the message sent by the verifier during the simulation is different from the message sent by the verifier in the message record corresponding to the instance, the certificate is invalid; if they are all the same, the answer to the challenge is verified based on the NP statement x and the prover's initial message a and the challenge bit e Is it correct? If so, the certificate is valid and there is no malicious behavior; otherwise, the certificate is valid and the certifier did not perform the correct certification.

Images