Zero knowledge range proving method based on weighted norm linear relation

Abstract

The invention discloses a zero-knowledge range proving method based on a weighted norm linear relation, which comprises the following steps of: generating a bit decomposition table according to a given data range, proving an aggregation number and the bit decomposition table according to a given range, and selecting an optimal bit decomposition scheme; then, the value of the data to be proved is taken for bit decomposition, and an arithmetic circuit relation integrating reciprocal proof is constructed based on the bit decomposition; through multi-step reduction, a weighted norm linear relation can be obtained, finally, through a weighted norm linear relation reduction protocol without filling, generation and verification of the certification are completed, and a verifier returns a conclusion of accepting or rejecting the certification according to the conclusion. According to the method, proving vectors with any length are supported by the native device without depending on zero filling; and meanwhile, the optimal bit decomposition scheme can be automatically selected according to the proving aggregation number, so that the performance of aggregation proving is remarkably improved. The performance of the method is superior to that of the latest technology, and the method can be widely applied to encryption currency scenes such as Mono and the like and privacy calculation tasks of general arithmetic circuits.

Description

Technical Field

[0001] The present invention relates to the field of inner product proof and zero-knowledge range proof in the field of data privacy protection, and in particular to a zero-knowledge range proof method based on weighted norm linear relationship. Background Art

[0002] In recent years, blockchain technology, owing to its distributed storage, immutability, and high robustness, has been widely adopted in numerous fields, including finance, logistics, and the Internet of Things. However, while all data in a blockchain system is transparently recorded on the chain, this openness and transparency, while helping to maintain trust in the system, inevitably exposes a large amount of sensitive information, posing a significant threat to user privacy. To address this challenge, both academics and industry are exploring how to effectively protect private data while ensuring data openness and security.

[0003] Currently, the most mainstream privacy protection solution is to integrate zero-knowledge proof technology into blockchain systems, allowing data holders to prove that their data meets specific conditions without revealing the details to the outside world. Among these, zero-knowledge proofs based on inner product relations have attracted considerable attention due to their advantages, such as logarithmic proof size, support for aggregated proofs, and batch verification. As early as 2016, the halving technique proposed by Bootle et al. significantly reduced the complexity of inner product operations in proofs, making this type of proof particularly suitable for blockchain environments with limited storage and computing resources. For this reason, various blockchain applications, including privacy-preserving cryptocurrencies like Monero and Zether, employ some form of inner product-based proof to privately verify user data.

[0004] Weighted norm linear proofs, a typical variant of inner-product proofs, have also demonstrated their efficiency and flexibility in constructing zero-knowledge range proofs. The current optimal protocol, Bulletproofs++ (BP++), is built on this proof principle and offers significant advantages in terms of keeping proof size small and efficient proof generation and verification. However, BP++ inherits the proof structure of the binary trick and cannot natively support cases where the proof vector length is not a power of two. The current main solution is to pad the vector with zeros to make its length a power of two, but this inevitably increases the problem size and imposes additional computational and storage burdens. Furthermore, the design of BP++'s range proof scheme did not fully consider the impact of the proof aggregation number on the bit decomposition technique. In practical applications, multiple range proofs can often be aggregated for unified proof generation and verification. However, the existing BP++ scheme maintains the same bit decomposition operation when handling different aggregation numbers, leaving room for further optimization and overall performance improvement.

[0005] Given the above background, how to design a new zero-knowledge range proof scheme that can natively support proof vectors of arbitrary length (without relying on zero padding) and fully optimize proof aggregation performance is a technical problem that needs to be solved. Summary of the Invention

[0006] The present invention aims to address the shortcomings of the existing technology in terms of proof vector length constraint and proof aggregation efficiency, and proposes a zero-knowledge range proof method based on weighted norm linear relationship.

[0007] The present invention is achieved through the following technical solutions:

[0008] A zero-knowledge range proof method based on weighted norm linear relationship includes the following steps:

[0009] Step 1: Pre-calculate at most Alternative bit decomposition schemes form a bit decomposition table, where A and B are both integers and A <B;

[0010] Step 2: Select the optimal bit decomposition scheme based on the given range proof aggregation number and the bit decomposition table in step 1;

[0011] Step 3: Based on the optimal bit decomposition scheme in Step 2, the private data to be proven (such as the transaction amount of cryptocurrency, location data, etc.) is bit-decomposed. Each data decomposition results in a bit vector, which is used to construct the arithmetic circuit relationship of the integrated reciprocal proof. The arithmetic circuit relationship of the integrated reciprocal proof is then reduced to an internal arithmetic circuit relationship, and then reduced to a weighted norm linear relationship.

[0012] Step 4, executing a weighted norm linear relationship reduction protocol without padding;

[0013] In step 5, the prover sends the witness vector after several rounds of reduction to the verifier, and the verifier then checks whether the weighted norm linear relationship still holds. If so, the verifier accepts the proof; otherwise, the verifier rejects the proof.

[0014] In the above technical solution, the algorithm for precalculating the median decomposition solution in step 1 is as follows:

[0015] Symbol definition: is a cyclic group of prime order, For Finite fields with the same order, denoted by {a:b}={a,a+1,…,b-1}, (a,b) is a vector containing the same elements as {a:b}; each bit decomposition scheme is represented by N d Units set and basis vectors Composition, remember is the bit decomposition space, then Constitute a bit decomposition; define For collection The set after removing duplicate elements, where n * is the number of bit set types, for in original collection The number of times it appears in the ; the total number of multiplicities of a bit decomposition scheme is defined as: in Representing a collection The cardinality, is the characteristic function, when When the characteristic function takes the value of 1, otherwise it takes the value of 0. d Under this condition, the bit decomposition scheme with smaller total multiplicity is better;

[0016] Step 1.1: Determine N d The value range of: first find the minimum integer N that satisfies N N ≥BA, then we can choose: 1≤N d ≤N; the bit decomposition table finally generated in step 1 satisfies each N d There is a corresponding optimal bit decomposition solution;

[0017] Step 1.2: Calculate all true factors of (BA-1) and construct a bit decomposition scheme for each true factor c, where:

[0018]

[0019] S i ={0,1,…,c}(0≤i <N d );

[0020]

[0021] Step 1.3: For each N d ∈[1,N], construction:

[0022]

[0023] Afterwards, N d and Substitute into the following integer linear programming problem and use the Cplex solver to efficiently solve the basis vector b:

[0024] Given N d and Solution

[0025] constraint: The algorithm ensures that the solver in this sub-step can output a feasible solution, that is, construct a bit decomposition solution;

[0026] Step 1.4: Execute the double loop, the outer loop traverses N d , the traversal range is [2,N], the inner traversal is n * , the starting value is n * =2, the upper bound is n * =N d ; In each traversal, first the current N d and n * Substitute into the following exponential cone optimization problem and solve it using the Mosek solver

[0027] Minimize:

[0028] constraint:

[0029]

[0030] in x2>0}∪{(x1,0,x3)|x1≥0,x3≤0} is an exponential cone; then, let And N d and Substitute as input the integer linear programming problem Try to solve it, if you can find the corresponding basis vector, then you have solved the current N d and n * A feasible bit decomposition under ; otherwise, the current solution result Eliminate from the exponential cone constraint and continue solving until a bit decomposition solution with corresponding basis vectors is found; then calculate the total number of multiplicities m of this feasible bit decomposition * , and compare m * and , where:

[0031]

[0032] If m * If it is smaller, stop d Search; otherwise, let n * Add 1 and continue iterating; if you traverse to n * =N d If the exit condition is still not met, select N d Among all feasible solutions, m * The smallest one is selected as the best one; finally, step 1.4 will be used for each N d ∈[2,N] returns an optimal bit decomposition solution;

[0033] Step 1.5: The bit decomposition solutions obtained in steps 1.2, 1.3 and 1.4 are divided into the total number of multiplicities m. * (The smaller the better) is the sorting index, and a complete bit decomposition table is constructed. The table has d ∈[1,N] contains an optimal entry.

[0034] In the above technical solution, the algorithm for selecting the optimal bit decomposition solution in step 2 is as follows:

[0035] Press N d Traverse the bit decomposition table constructed in step 1 from small to large. For each entry, if its corresponding optimal bit decomposition solution satisfies:

[0036]

[0037] where n a is the number of aggregated proofs, N v If the dimension of the commitment vector in the arithmetic circuit is N, the traversal is terminated immediately and the current bit decomposition solution is returned; otherwise, the next N d .

[0038] In the above technical solution, the weighted norm linear relationship reduction protocol described in step 4 without padding is as follows:

[0039] Define the weighted norm linear relationship as follows:

[0040]

[0041] The linear part is represents the inner product between vectors c and l, and the weighted norm part is Represents the weighted inner product of vector n and itself; In the weighted norm linear relationship reduction protocol without padding, each round will input Output the new half vector in through In round reduction, the length of all vectors is reduced to 1;

[0042] Definition I o (n) is an indicator function, indicating whether n is an odd number (when n is an odd number, the value is 1, otherwise it is 0); similarly, I e (n) is an indicator function, indicating whether n is an even number; I ＞1 (n) is an indicator function, indicating whether n is greater than 1; I≤1 (n) is an indicator function, indicating whether n is not greater than 1; Python notation is used to represent vector slices, such as a [m:n:s] = The complete reduction algorithm is as follows: Input: Output: Both the prover and the verifier calculate:

[0043]

[0044] The prover computes:

[0045]

[0046] The prover sends to the verifier: C X ,C R ;

[0047] Validators from Randomly select a challenge value x;

[0048] The verifier sends x to the prover.

[0049] Both the prover and the verifier calculate:

[0050]

[0051] The prover computes:

[0052]

[0053] The relevant parameters in the above algorithm are explained as follows:

[0054] l′(n′): represents half the length of vector l (vector n) (rounded up);

[0055] l s (n s ): If the length of vector l (vector n) is an odd number, the value is 1, otherwise the value is 0;

[0056] h L : represents the vector h from the index l s Start with a vector slice with a stride of 2;

[0057] h R :Represents the vector h self-index (l s +1) starts with a vector slice with a step size of 2;

[0058] g L : represents the vector g self-index n s Start with a vector slice with a stride of 2;

[0059] gR :Represents the vector g self-index (n s +1) starts with a vector slice with a step size of 2;

[0060] C X ,C R : represents the commitments corresponding to the witness vector after it is divided into two parts;

[0061] s: If the length of vector n is an odd number, the value is μ, otherwise it is 1;

[0062] ←: Indicates that the value on the right side of the arrow is assigned to the parameter on the left side.

[0063] Another aspect of the present invention provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned method.

[0064] Another aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions, which are used to implement the above method when executed.

[0065] Another aspect of the present invention provides a computer program product, which includes computer executable instructions. When the instructions are executed, they are used to implement the above method.

[0066] The advantages and beneficial effects of the present invention are:

[0067] The present invention innovatively designs a weighted norm linear relationship reduction algorithm for odd-length vectors, realizing "no padding" processing for inputs of arbitrary length, avoiding the extra computational and storage overhead caused by zero padding. In addition, the present invention further improves performance by solving convex optimization problems to automatically select the optimal bit decomposition scheme under different proof aggregation levels. Compared with the current optimal solution BP++, the present invention can achieve shorter proof generation time, proof verification time, and proof size in the scenario of aggregated range proof. In actual scenarios, the zero-knowledge range proof proposed by the present invention can be applied to tasks such as transaction generation and verification of cryptocurrencies such as Monero, privacy computing of general arithmetic circuits, and is superior to the existing solution BP++. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 The overall process diagram of the present invention is given.

[0069] Figure 2 The commonly used symbols and corresponding descriptions in the present invention are given.

[0070] Figure 3The flowchart of generating the bit decomposition table according to the present invention is given.

[0071] Figure 4 The flowchart of sub-step 1.4 of generating the bit decomposition table according to the present invention is given. This sub-step uses two optimization solvers to solve some alternative bit decomposition schemes.

[0072] Figure 5 The comparison of the proof sizes between the range proof protocol proposed by the present invention and the BP++ scheme is given. Each item in the "Proof Range" column is in the form of "n a ×n b ", indicating aggregating n a proofs of the range . The proof size is in bytes. After compression, each elliptic curve point occupies 33 bytes, and each element in the finite field occupies 32 bytes.

[0073] Figure 6 The comparison of the proof generation time consumption between the range proof protocol proposed by the present invention and the BP++ scheme is given. The aggregated range is [0, 2 64 ).

[0074] Figure 7 The comparison of the verification time consumption between the range proof protocol proposed by the present invention and the BP++ scheme is given. The aggregated range is [0, 2 64 ).

[0075] For those of ordinary skill in the art, without creative efforts, other related drawings can be obtained based on the above drawings. Detailed implementation manners

[0076] To enable those skilled in the art of the present technology to better understand the solution of the present invention, the technical solution of the present invention will be further described below in conjunction with specific embodiments.

[0077] Embodiment 1:

[0078] A zero-knowledge range proof method based on weighted norm linear relationship includes the following steps:

[0079] Step 1, pre-calculate at most alternative bit decomposition schemes for the given data range [A, B) to form a bit decomposition table, where both A and B are integers and A < B. This step corresponds to Figure 1 the process S101 in Figure 3 as shown. Figure 2 The symbols involved in the present invention and their corresponding descriptions are given. In this step, there are three different ideas for constructing the bit decomposition scheme for the data range [A, B), corresponding to Figure 3After all alternatives are constructed, the prover and verifier in the system need to use the total number of multiplicities m of bit decomposition. * (The smaller the better) is the indicator, for each N d Select an optimal bit decomposition. In this embodiment, the commonly used range [0,2 64 )Example construction of optimal bit decomposition.

[0080] Step 1.1, corresponding to Figure 3 Process S301 in: Determine N d The value range of . First find the minimum integer N that satisfies N N ≥BA, then we can choose: 1≤N d ≤N. The bit decomposition table generated in step 1 should satisfy the following for each N d There is a corresponding optimal bit decomposition solution. 64 ), we can get N = 16, so the selection of the bit decomposition scheme only needs to consider 1 ≤ N d ≤16 is sufficient.

[0081] Step 1.2, corresponding to Figure 3 Process S302 in FIG: Calculate all true factors of (BA-1) and construct a bit decomposition scheme for each true factor c, where:

[0082]

[0083] S i ={0,1,…,c}(0≤i <N d ),

[0084]

[0085] For the range [0,2 64 ), brute force 2 64 It may take too long to calculate all the true factors of -1, so you can consider first calculating the true factors of 2. 64 Factoring -1 yields 2 64 The prime factors of -1 are: {3, 5, 17, 257, 641, 65537, 6700417}. Then, any number of elements in the above prime factors can be multiplied together to get 2. 64 -1 is a true factor. Due to the large number of true factors, we will not list all the constructed bit decomposition schemes here. In fact, in this step, the same N d There may be multiple different bit decomposition schemes. The following only lists the same N in this step. d But m * Here is the minimal bit decomposition information, omitting the display of bit sets and basis vectors:

[0086] N <![CDATA[m * ]]> 1 18446744073709551615 2 4294967295 3 2800529 4 65535 5 9615 6 1923 7 641 8 255 10 85 12 51 16 15

[0087] It can be observed that the bit decomposition scheme constructed in this step cannot cover N d All values ​​in [1,16].

[0088] Step 1.3, corresponding to Figure 3 Process S303 in: For each N d ∈[1,N], construction:

[0089]

[0090] Afterwards, N d and Substitute into the following integer linear programming problem and efficiently solve the basis vector b using a solver such as Cplex:

[0091] Given Solution

[0092] constraint: The algorithm ensures that the solver in this sub-step can output a feasible solution, that is, construct a bit decomposition solution.

[0093] For the range [0,2 64 ), the following lists some of the information of the bit decomposition scheme constructed in this step, in which the display of the bit set and the basis vector is omitted (if the same N d The following bit decomposition solutions are not better than those in step 1.2, so they are not listed):

[0094] N <![CDATA[m * ]]> 9 234 11 78 13 38 14 28 15 22

[0095] The bit decomposition scheme constructed in steps 1.2 and 1.3 is already able to cover N d All values ​​in [1,16].

[0096] Step 1.4, corresponding to Figure 3 The process S304 in the embodiment, and each sub-step of S304 is as follows Figure 4 As shown:

[0097] Step 1.4.1, corresponding to Figure 4 Process S401 in: Execute double loop, outer layer traverses N d , the traversal range is [2,N], the inner traversal is n * , the starting value is n * =2, the upper bound is n * =N d .

[0098] Step 1.4.2, corresponding to Figure 4Process S402 in: In each traversal, first the current N d and n * Substitute into the following exponential cone optimization problem and solve it using Mosek and other solvers

[0099] Minimize:

[0100] constraint:

[0101]

[0102] in is an exponential cone.

[0103] Step 1.4.3, corresponding to Figure 4 Process S403 in: And N d and Substitute as input the integer linear programming problem Try to solve it.

[0104] Step 1.4.4, corresponding to Figure 4 Process S404 in 1.4.3: Determine whether the basis vector in 1.4.3 has a solution.

[0105] Step 1.4.5, corresponding to Figure 4 Process S405 in: The basis vector has a solution. Calculate the total number of multiplicities m of the corresponding bit decomposition solution * .

[0106] Step 1.4.6, corresponding to Figure 4 Process S406 in: There is no solution for the basis vector. Eliminate from the exponential cone constraints and continue solving until a bit decomposition solution with corresponding basis vectors is found.

[0107] Step 1.4.7, corresponding to Figure 4 Process S407: Determine whether the in

[0108]

[0109] Step 1.4.8, corresponding to Figure 4 In the process S408: the judgment in step 1.4.7 is "yes". Stop the N d Search, let N d The value of is increased by one.

[0110] Step 1.4.9, corresponding to Figure 4In the process S409: Step 1.4.7 is judged as "No". Let n * The value of is increased by 1.

[0111] Step 1.4.10, corresponding to Figure 4 Process S410: Determine whether n in step 1.4.9 * >N d If yes, go to step 1.4.8; otherwise, go to step 1.4.2.

[0112] Step 1.4.11, corresponding to Figure 4 Process S411: Determine whether N in step 1.4.8 d >N. If yes, all sub-steps of characterization step 1.4 have been completed; otherwise, skip to step 1.4.2.

[0113] For the range [0,2 64 ), the following is N d =9 as an example to illustrate the construction of median decomposition in step 1.4: d =9,n * =2Substitute into the exponential cone problem It can be solved From this we can construct the bit set S i ={0:174}(i∈{0:8}),S8={0:22}. Substitute as input the integer linear programming problem Try to solve it and get the basis vector b=(1,174,30276,5268024,916636176,159494694624,27752076864576,4818841072903832,838488366986797736), thus constructing N d = 9. The total number of multiplicities of this decomposition is m. * =173+21=194, and The calculated value is 270. Since 194 < 270, we can stop N at this time. d =9, start searching for N d =10 bit decomposition.

[0114] For the range [0,2 64 ), the following lists some of the information of the bit decomposition scheme constructed in this step, in which the display of the basis vector is omitted (if the same N d The following bit decomposition solutions are not better than those in steps 1.2 and 1.3, so they are not listed):

[0115]

[0116] Step 1.5, corresponding to Figure 3 Process S305 in step 1.2: Collect all candidate solutions obtained in step 1.3 and 1.4, and calculate the total number of multiplicities m. * (The smaller the better) is the sorting index, and a complete bit decomposition table is constructed. d ∈[1,N] contains an optimal entry.

[0117] For the range [0,2 64 The final bit decomposition table is as follows, omitting the display of basis vectors:

[0118]

[0119] Step 2, corresponding to Figure 1 Process S102 in: Prove the aggregation number n according to the given range a and the bit decomposition table in step 1, select the optimal bit decomposition scheme. Specifically, press N d Traverse the bit decomposition solution table constructed in step 1 from small to large. For each entry, if its corresponding optimal bit decomposition solution satisfies:

[0120]

[0121] where n a is the number of aggregated proofs, N v If the dimension of the commitment vector in the arithmetic circuit is 1, the traversal is terminated immediately and the current bit decomposition scheme is returned. Otherwise, continue to try the next N d .

[0122] Step 3, corresponding Figure 1In step S103, based on the optimal bit decomposition scheme from step 2, the private data to be proven (e.g., cryptocurrency transaction amounts, location data, etc.) is bit-decomposed. Each bit decomposition yields a bit vector, which is used to construct the arithmetic circuit relationship for the integrated reciprocal proof. This arithmetic circuit relationship is then reduced to an internal arithmetic circuit relationship, and then to a weighted norm linear relationship. This step is based on the original BP++ scheme. Please refer to Section 6 of the original BP++ paper (Eagen, L., Kanjalkar, S., Ruffing, T., Nick, J.: Bulletproofs++: Next Generation Confidential Transactions via Reciprocal Set Membership Arguments[C] / / 2024 Eurocrypt(LNCS14655). Springer, 2024: 249-279) for the construction method of the arithmetic circuit relationship of the integrated reciprocal proof and the method of reducing it to the internal arithmetic circuit relationship. Please refer to Section 5 of the BP++ paper for the specific method of reducing the internal arithmetic circuit relationship to the weighted norm linear relationship.

[0123] Step 4, corresponding Figure 1 Process S104 in the embodiment: Execute the weighted norm linear relationship reduction protocol without padding. The definition is as follows:

[0124]

[0125] The reduction protocol recursively executes several rounds of reduction algorithms, each round of which halves the length of all vectors in the weighted norm linear relationship. The reduction stops when the vector length is 1. In the reduction algorithm, each round inputs Output the new half vector in through In the round of reduction, all vector lengths are reduced to 1. Similar to BP++, the unpadding weighted norm linear relationship reduction algorithm proposed in this paper also follows the "half-by-half" principle. However, unlike BP++, this paper categorizes and discusses the cases where the initial vector lengths l,n are odd or even, and accordingly modifies the parameters in the original algorithm to support initial vectors l,n of arbitrary lengths.

[0126] Definition I o (n) is an indicator function, indicating whether n is an odd number (when n is an odd number, the value is 1, otherwise it is 0); similarly, I e (n) is an indicator function, indicating whether n is an even number; I ＞1(n) is an indicator function, indicating whether n is greater than 1; I ≤1 (n) is an indicator function, indicating whether n is not greater than 1; Python notation is used to represent vector slices, such as The complete reduction algorithm is as follows:

[0127] enter:

[0128] Output:

[0129] Both the prover and the verifier calculate:

[0130]

[0131] The prover calculates:

[0132]

[0133] The prover sends to the verifier: C X ,C R ;

[0134] Validators from Randomly select a challenge value x;

[0135] The verifier sends x to the prover.

[0136] Both the prover and the verifier calculate:

[0137] The prover computes:

[0138]

[0139] The relevant parameters in the above algorithm are explained as follows:

[0140]

[0141]

[0142] In addition, it should be noted that the remaining undefined symbols in this algorithm, such as v X ,v Y , are all intermediate variable values ​​(temporary values) and have no actual physical meaning.

[0143] Step 5, corresponding Figure 1 In process S105, the prover sends the reduced vector of l,n to the verifier, and then the verifier checks whether the weighted norm linear relationship holds. If so, the verifier accepts the proof; otherwise, the verifier rejects the proof.

[0144] The above is an exemplary description of the present invention. It should be noted that, without departing from the core of the present invention, any simple deformation, modification or other equivalent replacement that can be made by other skilled in the art without expending creative labor falls within the scope of protection of the present invention.

Claims

1. A zero-knowledge range proof method based on weighted norm linear relationship, characterized in that: The following steps are involved: Step 1: Pre-calculate at most Alternative bit decomposition schemes form a bit decomposition table, where A and B are both integers and A <B; Step 2: Select the optimal bit decomposition scheme based on the given range proof aggregation number and the bit decomposition table in step 1; Step 3: Based on the optimal bit decomposition scheme in Step 2, the private data values ​​within the scope to be proven are decomposed. Each data decomposition yields a bit vector, which is used to construct the arithmetic circuit relationship for the integrated reciprocal proof. This arithmetic circuit relationship is then reduced to an internal arithmetic circuit relationship, which is then further reduced to a weighted norm linear relationship. Step 4, executing a weighted norm linear relationship reduction protocol without padding; In step 5, the prover sends the witness vector after several rounds of reduction to the verifier, and the verifier then checks whether the weighted norm linear relationship still holds. If so, the verifier accepts the proof; otherwise, the verifier rejects the proof.

2. The zero-knowledge range proof method based on weighted norm linear relationship according to claim 1, characterized in that: The algorithm for precalculating the median decomposition solution in step 1 is as follows: Symbol definition: is a cyclic group of prime order, For Finite fields with the same order, denoted by {a:b}={a,a+1,…,b-1}, (a,b) is a vector containing the same elements as {a:b}; each bit decomposition scheme is represented by N d Units set and basis vectors Composition, remember is the bit decomposition space, then Constitute a bit decomposition; define For collection The set after removing duplicate elements, where n * is the number of bit set types, for in original collection The number of times it appears in the ; the total number of multiplicities of a bit decomposition scheme is defined as: in Representing a collection The cardinality, is the characteristic function, when When the characteristic function takes the value of 1, otherwise it takes the value of 0. d Under this condition, the bit decomposition scheme with smaller total multiplicity is better; Step 1.1: Determine N d The value range of: first find the minimum integer N that satisfies N N ≥BA, then we can choose: 1≤N d ≤N; the bit decomposition table finally generated in step 1 satisfies each N d There is a corresponding optimal bit decomposition solution; Step 1.2: Calculate all true factors of (BA-1) and construct a bit decomposition scheme for each true factor c, where: S i ={0,1,…,c}(0≤i<N d ); Step 1.3: For each N d ∈[1,N], construction: Afterwards, N d and Substitute into the following integer linear programming problem and use the Cplex solver to efficiently solve the basis vector b: Given N d and Solution constraint: The algorithm ensures that the solver in this sub-step can output a feasible solution, that is, construct a bit decomposition solution; Step 1.4: Execute the double loop, the outer loop traverses N d , the traversal range is [2,N], the inner traversal is n * , the starting value is n * =2, the upper bound is n * =N d ; In each traversal, first the current N d and n * Substitute into the following exponential cone optimization problem and solve it using the Mosek solver Minimize: constraint: in is an exponential cone; then, let And N d and Substitute as input the integer linear programming problem Try to solve it, if you can find the corresponding basis vector, then you have solved the current N d and n * A feasible bit decomposition under ; otherwise, the current solution result Eliminate from the exponential cone constraint and continue solving until a bit decomposition solution with corresponding basis vectors is found; then calculate the total number of multiplicities m of this feasible bit decomposition * , and compare m * and , where: If m * If it is smaller, stop d Search; otherwise, let n * Add 1 and continue iterating; if you traverse to n * =N d If the exit condition is still not met, select N d Among all feasible solutions, m * The smallest one is selected as the best one; finally, step 1.4 will be used for each N d ∈[2,N] returns an optimal bit decomposition solution; Step 1.5: The bit decomposition solutions obtained in steps 1.2, 1.3 and 1.4 are divided into the total number of multiplicities m. * As the sorting index, construct a complete bit decomposition table, which has d ∈[1,N] contains an optimal entry.

3. The zero-knowledge range proof method based on weighted norm linear relationship according to claim 1, characterized in that: The algorithm for selecting the optimal bit decomposition solution in step 2 is as follows: Press N d Traverse the bit decomposition solution table constructed in step 1 from small to large. For each entry, if its corresponding optimal bit decomposition solution satisfies: where n a is the number of aggregated proofs, N v If the dimension of the commitment vector in the arithmetic circuit is N, the traversal is terminated immediately and the current bit decomposition solution is returned; otherwise, the next N d .

4. The zero-knowledge range proof method based on weighted norm linear relationship according to claim 1, characterized in that: The weighted norm linear relationship reduction protocol described in step 4 without padding is as follows: Define the weighted norm linear relationship as follows: The linear part is represents the inner product between vectors c and l, and the weighted norm part is Represents the weighted inner product of vector n and itself; In the weighted norm linear relationship reduction protocol without padding, each round will input Output the new half vector where ρ′=ρ 2 , through In round reduction, the length of all vectors is reduced to 1; Definition I o (n) is an indicator function, indicating whether n is an odd number; e (n) is an indicator function, indicating whether n is an even number; I ＞1 (n) is an indicator function, indicating whether n is greater than 1; I ≤1 (n) is an indicator function, indicating whether n is not greater than 1; Use Python notation to represent vector slices, such as The complete reduction algorithm is as follows: enter: Output: Both the prover and the verifier calculate: L s ←I o (l),n s ←I o (n); The prover calculates: The prover sends to the verifier: C X ,C R ; Validators from Randomly select a challenge value x; The verifier sends x to the prover. Both the prover and the verifier calculate: The prover calculates: return(h′,g′,u,C′,c′,ρ′;l′,n′). The relevant parameters in the above algorithm are explained as follows: l′(n′): represents half the length of vector l (vector n) (rounded up); l s (n s ): If the length of vector l (vector n) is an odd number, the value is 1, otherwise the value is 0; h L : represents the vector h from the index l s Start with a vector slice with a stride of 2; h R :Represents the vector h self-index (l s +1) starts with a vector slice with a step size of 2; g L : represents the vector g self-index n s Start with a vector slice with a stride of 2; g R :Represents the vector g self-index (n s +1) starts with a vector slice with a step size of 2; C X ,C R : represents the commitments corresponding to the witness vector after it is divided into two parts; s: If the length of vector n is an odd number, the value is μ, otherwise it is 1; ←: Indicates that the value on the right side of the arrow is assigned to the parameter on the left side.

5. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the zero-knowledge range proof method based on weighted norm linear relationship as described in claim 1.

6. A computer-readable storage medium, characterized in that: Computer-executable instructions are stored, and when the instructions are executed, they are used to implement the zero-knowledge range proof method based on weighted norm linear relationship as claimed in claim 1.

7. A computer program product, characterized in that: The computer program product includes computer-executable instructions, which are used to implement the zero-knowledge range proof method based on weighted norm linear relationship as claimed in claim 1 when executed.

Images