Cryptographic method for certifying that a vector is binary

Abstract

Some implementations aim to have the prover use a vector commitment scheme to demonstrate to the verifier that the principal vector is a binary vector. The verification may include a principal commitment to the principal vector and generate a first proof that confirms that another vector is orthogonal to the principal vector, consisting of a randomized vector and the product of the principal vector minus 1 in each component.

Description

Technical Field

[0001] The subject of this disclosure relates to a cryptographic method by which a prover verifies that a principal vector is a binary vector, a cryptographic method by which a verifier verifies a proof, a system, and a computer storage medium. Background Technology

[0002] A commitment scheme promises a secret message to the sender (e.g., the proving party or the committing party), which remains secret until the commitment is made public. In a non-interactive commitment, the commitment and public phases can each consist of a single message from the committing party to the proving party. Commitment schemes have two characteristics: Concealment and Binding The former means a commitment string. No information about the promised message will be disclosed. The latter means that no adversary should be able to calculate the promises that could be made public for two different messages.

[0003] One example of a commitment scheme is the Pedersen commitment. In the generator... Cyclic group or prime order In the context of random numbers The sender selects And calculate Regarding the message Make a commitment. During the public phase, the sender discloses... and Due to uniform randomness ,promise Perfectly hidden At the same time, no efficient committing party is able to conceive of a commitment. It can be achieved by revealing different perspectives The commitment was made public in two different ways. , making Unless it can calculate discrete logarithms Pedersen's commitment naturally extends to messages. The commit is made using a vector. For this to be done, the committer needs to include generators. The publicly available parameters, and calculation .

[0004] Vector commitments allow the prover to make a commitment to a domain by generating a short commitment string. News on The commitment is made using a vector. Subsequently, the committing party can concisely reveal... The coordinates of each element. Here, conciseness means that the partially disclosed information (also known as the proof) should have a constant size (e.g., independent of the dimension of the committed vector), but still convince the verifier that the disclosed coordinates are correct. As with standard commitments, vector commitment schemes preferably satisfy two security properties: (i) Binding The feature assertion states that no efficient adversary can be generated in the same location. (ii) A commitment made publicly about two different values; hide The hidden property guarantees that a subset of the revealed components will not reveal any information about messages at unrevealed locations. Vector commitments enable significant savings in storage and bandwidth by storing only commitments to a constant size vector rather than commitments to individual coordinates, and by enabling the provable and concise disclosure of individual locations.

[0005] Other concise vector commitments can be based on the RSA assumption, or similar Diffie-Hellman assumptions in pairwise friendly groups.

[0006] A limitation of all known vector commitments with brief proofs is that there is no efficient way to generate the committed vector. Small, e.g., short proofs of elements within a given range (e.g., below and / or above a threshold), such as binary. One solution to this problem is concise non-interactive proofs (SNARKs) for general purposes, universally applicable to all NP languages. While SNARKs can provide proofs of constant size, they require the proposition to be represented as an arithmetic circuit. The arithmetic circuit must then compute a public algorithm for the committed scheme (and thus the computational group). This involves exponential operations (in the arithmetic circuit), which leads to complex arithmetic circuits. In turn, this requires large common reference strings (CRS) and makes proof generation very expensive, because in pairwise SNARKs that provide the minimum proof size, both the CRS size and the computational cost of the proof side increase at least linearly with the number of multiplication gates in the arithmetic circuit. Summary of the Invention

[0007] There is a need for an improved method for verifying that a principal vector is a binary vector by a prover. The appended claims describe a verification method, system, and computer-readable medium. Specific embodiments of the invention are set forth in the dependent claims. In one embodiment, a commitment for the principal vector is computed. The prover can then verify the binary nature by showing that auxiliary vectors are orthogonal to the principal vector (e.g., by showing that their dot product is zero). The auxiliary vectors comprise the Hadamard product of the principal vector and a randomized vector. The proof can be verified based on the principal commitment and a first auxiliary commitment. The first auxiliary commitment can be computed for the auxiliary vectors, although in reverse order of the principal vector.

[0008] A second proof can be computed to show that the first auxiliary commitment is indeed computed in reverse order for the Hadamard product of the principal vector and the randomized vector. This second proof can be obtained by aggregating the randomization disclosure of vector elements in the principal commitment and the first auxiliary commitment.

[0009] The advantage of this implementation is that the primary commitment, secondary commitment, first proof, and second proof each have dimensions independent of the dimension of the primary vector. In one implementation, for a suitable elliptic curve (e.g., a KSS18 curve) selection, a proof of binary validity fits 87 bytes, while a complete proof of the validity of the FHE ciphertext fits 225 bytes, for example, using a BLS12-446 curve.

[0010] In one implementation, the master commitment is computed by directly evaluating the commitment function of the vector commitment scheme over the master vector. This is not strictly necessary; for example, using a vector commitment scheme with additive homomorphic properties, the commitment function can be applied to any linear combination of the master vector and vectors known to the verifier. Alternatively, the master commitment can also be computed by evaluating the commitment function as the sum of the master vector and vectors known to the verifier. The verifier may obtain the previously directly applied commitment from alternative commitments and known vectors, but applying the commitment function to the master vector itself is typical.

[0011] Similarly, for auxiliary commitments, the commitment function can be applied to any linear combination of the auxiliary vector and the public vector (especially the randomized vector). Two typical options are to apply the commitment function directly to the auxiliary vector, or to the auxiliary vector minus the randomized vector; in one implementation, one of these options is computed by the prover and shared with the verifier, while the verifier computes the other commitment itself.

[0012] For convenience, most of the implementations described in detail herein will assume that the primary commitment is obtained by applying a commitment function to the primary vector, and the secondary commitment is obtained by applying a commitment function to the secondary vector, but other options may be made in this regard.

[0013] Proofs and commitments can be represented as group elements. A bilinear mapping can be constrained between the first and second groups. Reversing the order has the effect that when the bilinear mapping is applied to the corresponding commitments in the first and second groups respectively, the dot product of the two vectors is computed in the exponent. This can be applied to primary and secondary commitments. This can be the secondary commitment computed by the prover, or a second secondary commitment. The second secondary commitment can be computed from the first secondary commitment, for example, using the additive homomorphism property of the vector commitment scheme.

[0014] In one implementation, the scheme for proving the binary nature of a vector is zero-knowledge and / or non-interactive.

[0015] The binary nature of proof vectors can be applied in many situations. For example, it can be used to verify that the number of commitments is less than a threshold, to verify the validity of a ring LWE ciphertext, and to verify vectors. It is ternary.

[0016] In one implementation, the system (e.g., the device) is configured to verify and / or validate a method.

[0017] The implementation of this method can be carried out on a computer as a computer-implemented method, or on dedicated hardware, or a combination of both. The executable code of the implementation of this method can be stored on a computer program product. Embodiments of the computer program product include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium, which, when the program product is executed on a computer, performs an implementation of the method.

[0018] In one embodiment, the computer program includes computer program code that, when run on a computer, is adapted to perform all or part of the steps of the embodiment of the method. Preferably, the computer program is implemented on a computer-readable medium.

[0019] Another aspect of the subject of this disclosure is a method for making computer programs available for download. Attached Figure Description

[0020] Further details, aspects, and embodiments will be described by way of example only with reference to the accompanying drawings. Elements in the drawings are illustrated for simplicity and clarity only and are not necessarily drawn to scale. In the drawings, elements corresponding to those already described may have the same reference numerals. In the drawings,

[0021] Figure 1 An embodiment of the implementation of the verification system is illustrated schematically.

[0022] Figure 2 An embodiment of the proof system implementation is illustrated schematically.

[0023] Figure 3 An embodiment of the proof method is illustrated schematically.

[0024] Figure 4a A computer-readable medium having a writable portion according to an embodiment is schematically illustrated, the writable portion including a computer program.

[0025] Figure 4b A representation of a processor system according to an implementation scheme is shown schematically.

[0026] List of reference numerals

[0027] The following list of figure labels and abbreviations corresponds to Figure 1 , Figure 2 , Figure 3 , Figure 4a and Figure 4b The accompanying drawings are provided to facilitate understanding and should not be construed as limiting the claims.

[0028] 100 proof system

[0029] 110 Proof Equipment

[0030] 113 Processor System

[0031] 114 Memory

[0032] 115 Communication Interface

[0033] 120 Verification Equipment

[0034] 123 Processor System

[0035] 124 memory

[0036] 125 Communication Interface

[0037] 200 proof system

[0038] 210 Main Vector Source

[0039] 211 Principal Vector

[0040] 212 Randomized Vectors

[0041] 213 Randomized Vectors

[0042] 219 Committed Vector

[0043] 220 Commitment Units

[0044] 221 Main Commitment

[0045] 222 First Auxiliary Commitment

[0046] 230 Proof Unit

[0047] 231 Proof of Orthogonality

[0048] 232 Equality Proof

[0049] 1000, 1001 Computer-readable media

[0050] 1010 writable portion

[0051] 1020 Computer Program

[0052] 1110 Integrated Circuits

[0053] 1120 Processing Unit

[0054] 1122 Memory

[0055] 1124 Application-Specific Integrated Circuit

[0056] 1126 Communication Components

[0057] 1130 Interconnection Components

[0058] 1140 Processor System Detailed Implementation

[0059] Although the subject matter of this disclosure allows for many different forms of implementation, one or more particular embodiments are shown in the accompanying drawings and will be described in detail herein. It should be understood that this disclosure should be regarded as an example of the principles of the subject matter of this disclosure and is not intended to limit it to the particular embodiments shown and described.

[0060] In the following text, for ease of understanding, several elements of the implementation scheme are described in operation. However, it will be clear that the corresponding elements are configured to perform the functions described herein.

[0061] Furthermore, the subject matter of this disclosure is not limited to these embodiments, but includes every other combination of features described herein or recited in mutually different dependent claims.

[0062] Figure 1 An embodiment of the proof device 110 and an embodiment of the verification device 120 are illustrated schematically. The proof device 110 and the verification device 120 may be part of the proof system 100.

[0063] The proving device 110 is configured to cryptographically prove to a verifying device that a vector is a binary vector using a vector commitment scheme. The vector commitment scheme includes at least one commitment function that takes a vector as input and produces a commitment as output. The vector commitment scheme may include more than one (e.g., two) commitment functions, each taking a vector as input and producing a commitment as output; however, the commitment values ​​are generated in different groups. For example, a first commitment function may produce group elements in a first group, while a second commitment function may produce group elements in a second group. A bilinear mapping may be defined between the first and second groups. The vector commitment scheme may have additional properties, such as additive homomorphism. According to this property, a new commitment can be computed for the sum of the first and second vectors based on the commitments of the second and first vectors, without knowing the first vector. The commitment scheme allows the prover to partially disclose a position in the committed vector by computing a proof (e.g., in the form of group elements). element at The verifier can verify whether the proof demonstrates that the committed vector has the value at that position.

[0064] Verification device 120 is configured to verify cryptographic evidence provided by the proving device. The proving device is also called the proving party, and the verification device is also called the verifying party.

[0065] One implementation of the cryptographic method described in this paper is particularly advantageous because the size of the cryptographic proof is independent of the dimension of the vector whose binary nature is being proven. This property is sometimes referred to as simplicity or conciseness, meaning the proof is concise. Since the proof size is independent of the vector dimension, the size of each dimension decreases as the vector dimension increases. The vector can have arbitrary lengths; as an example, the implementation can be applied to vectors with at least 10, 100, 1000, 10000 elements (e.g., bits), etc.

[0066] System 100 can be used independently, but there are many applications where proving whether a vector is binary can serve as a primitive. For example, many mathematical objects can be represented as bit vectors (e.g., as bit sequences). The properties of a mathematical object can then be verified by proving the properties of the vector, for example, by revealing one or more bits, by calculating the inner product (e.g., dot product) of the vector or its parts and proving the result, performing other linear operations, etc. For good security, the binary nature of the vector should also be proven. Otherwise, the prover might attempt to cheat by promising a non-binary vector.

[0067] Two specific applications have been discussed in some detail, but many more are possible. For example, a binary proof vector can be used to prove that a number known to the prover is within a specific range, such as less than a certain upper limit. To do this, the number is converted to a binary vector, and then appropriate linear operations can be performed on it; for example, the most significant bit can be exposed. Once the verifier is convinced that the promised vector contains an integer... of If the bit representation is correct, then the verifier will know. Less than .

[0068] If the proving party can commit to a non-binary vector, then the proving party can cheat by convincing the verifier that the proving party's number is less than the limit, provided the proving party's number is not less than the limit. Another application is in advanced cryptographic systems such as multi-party computation and homomorphic encryption. In homomorphic encryption, complex mathematical operations can be performed on encrypted data without compromising the encryption. Encryption schemes that allow computation on their encrypted data are known in themselves, but they are subject to certain limitations. For example, homomorphic encryption devices can homomorphically encrypt data. Homomorphic computation devices can perform algorithms (e.g., software programs, arithmetic steps) on data without decrypting it. Existing methods for verifying whether received data is indeed correctly encrypted against homomorphic computation devices are flawed; for example, the computational cost of SNARK proofs is very high. Using one implementation, the data can be converted into a binary vector, which can then be used to prove the validity of the homomorphically encrypted data. By using a non-interactive proof that the committed vector is binary, we can obtain a concise proof to convince the homomorphic computation device that the ciphertext is correctly formatted.

[0069] In cryptography, proving that a vector is a binary vector can involve multiple stages.

[0070] During the initialization phase, the proving and verifying devices share common parameters. Typically, cryptographic methods do not perform their computations on natural numbers, but rather on various finite groups or rings. During the initialization phase, the proving and verifying parties establish shared parameters. In non-interactive zero-knowledge proofs, a set of trusted common parameters is usually generated by a trusted party and made available to both the proving and verifying parties. These shared parameters are sometimes referred to as a public reference string (CRS) or public parameters. The shared parameters can be obtained (e.g., generated) by the trusted party and sent to both the proving and verifying parties. The shared parameters can be jointly generated by the proving and verifying parties, possibly with the participation of the trusted party. Note that most implementations use a trusted party. Preferably, after delivery to the proving and verifying parties, the trusted party removes all private randomness used to generate the CRS.

[0071] Typically, the initialization phase only needs to be executed once. This phase is often implicit. For example, this phase can be executed as part of another cryptographic method performed by the prover and verifier. Then, parameters of the other cryptographic method can be used for the verification method according to the implementation scheme. For example, shared parameters can be implicitly known, for example, they can be part of the computer software provided at the prover and verifier.

[0072] For example, shared parameters may include one or more groups, such as a first group, a second group, and a third group. For example, shared parameters may include a bilinear mapping from the first and second groups to the third group. For example, shared parameters may include a set of generators for said groups (particularly the first and second groups).

[0073] During the commitment phase, the prover's commitment vector The prover computes a commitment based on a commitment scheme using vectors and shared parameters. A commitment allows the prover to commit to a value (in this case, a vector) while keeping it hidden from other parties, particularly the verifier. The commitment is sent to the verifier, which allows the prover to later reveal the committed value or a portion thereof; this is also known as publicizing the commitment. Commitments can be used to, for example, prevent the prover from committing to a value (e.g., a vector) too early. The prover can then change its value. However, a commitment can also be part of other proofs. For example, in one implementation, the prover confirms to the verifier that the committed vector is binary, without having to disclose any part of the vector.

[0074] The commitment phase may include computing one or more commitments and computing one or more proofs; for example, a proof that the committed vector has certain properties. Commitments and proofs are shared with the verifier, for example, by being sent to the verifier via a computer network. Computing proofs and commitments can be separated into their own phases, such as a commitment phase and a proof phase.

[0075] During the verification phase, the verifier can verify, for example, whether a proof containing a commitment is correct. Interestingly, this allows the prover to prove facts about a vector without revealing any other information about that vector. This so-called zero-knowledge property is particularly desirable in cryptography.

[0076] For example, during the commitment phase, the proving device can compute a principal commitment to a specific vector of interest (e.g., a principal vector). This commitment might allow the proving party to later reveal one or more values ​​of the principal vector. The verifying party can then verify that the commitment does indeed correspond to the revealed values. Interestingly, the proving device can also compute one or more proofs of the verifiable properties of the principal vector. Such proofs can also be verified using commitments. For example, the proving device can prove that the principal vector and... The defined vectors are orthogonal; vectors Randomize this.

[0077] To aid this proof, the proving device can compute one or more auxiliary commitments that commit to other vectors associated with the principal vector. For example, an auxiliary commitment could be the Hadamard product of the principal vector and a randomized vector. One insight of the inventors is that reversing the order of these vectors allows subsequent verification to use a bilinear mapping. The proving device can generate further proofs. For example, the proving device can prove that the principal commitment defined above, as well as one or more auxiliary commitments, are actually derived from the same principal vector.

[0078] Primary and secondary commitments are typically obtained by applying the commitment function of a vector commitment scheme to the primary and secondary vectors, respectively. Most implementations assume this typical approach. However, the homomorphic nature of commitment schemes makes this unnecessary; given a valid commitment, the verifier can use homomorphism to derive additional commitments. This is particularly useful for secondary commitments. Secondary commitments can be obtained by applying the commitment function of a vector commitment scheme to the secondary vector, or by applying the commitment function to the secondary vector minus the randomized vector. In the former case, the verifier can derive the latter commitment; in the latter case, the verifier can derive the former commitment.

[0079] In many cases, the ability to prove a vector is binary without revealing the complete vector itself is useful. Often, mathematical objects can be encoded as binary vectors, such as bit sequences. The properties of the mathematical object can then be verified by computing the dot product of the vector or a portion thereof (e.g., by revealing specific elements of the vector), computing other operations (perhaps linear operations on the vector), etc. However, for this method to be secure, the verifier should be certain that the vector is binary. For example, to prove that a known number falls within a specific range (e.g., less than an upper limit), the verifier can encode that number as a binary vector and commit to it. This is achieved by verifying the last bit of the binary vector... Each element is exposed to zero, for example Using the most significant bits and a proof of constant size (e.g., conciseness), the prover can prove that the integer is less than 1 / 2. However, if the prover could cheat by promising a non-binary vector, it might appear that the number is less than the bound, but it is not.

[0080] Another application is as a primitive in other cryptographic schemes where data is shared in encrypted form while operations are still performed on the data, such as homomorphic encryption. For example, data can be homomorphically encrypted using a homomorphic encryption device. The data can then be sent to a homomorphic computing device. The homomorphic computing device performs computations on the encrypted data without decrypting it (e.g., without knowing the plaintext of the data). The still-encrypted computation result can be sent back to the encryption device. There, the encrypted computation result can be decrypted. Homomorphic encryption relies on data being correctly provided according to the specific rules of a particular homomorphic encryption scheme. Computational devices typically cannot verify whether data has been correctly encrypted, for example, because they cannot decrypt the data. Interestingly, using one implementation, this is possible. The encryption device can convert the data and / or encryption randomness into a binary vector and then prove that the provided encrypted data correctly reflects the plaintext data according to the rules. This again relies on the ability to efficiently prove that the vector is binary.

[0081] The verification device 110 may include a processor system 113, a memory 114, and a communication interface 115. The verification device 120 may include a processor system 123, a memory 124, and a communication interface 125. Memory 114 and 124 may be, for example, electronic memory, magnetic memory, etc. Memory may include local memory (e.g., local hard disk drive or electronic memory). Memory 114 and 124 may include non-local memory (e.g., cloud storage). In the latter case, memory 114 and 124 may include a storage interface to non-local memory. Memory may include multiple discrete sub-memories that collectively constitute memory 114 and 124. Memory may include volatile writable portions (e.g., RAM), non-volatile writable portions (e.g., Flash), and non-volatile non-writable portions (e.g., ROM).

[0082] In various implementations of communication interfaces 115 and / or 125, a variety of alternatives may be selected for the communication interface. For example, the interface may be a network interface to a local area network or wide area network (e.g., the Internet), a storage interface to an internal or external data storage device, an application programming interface (API), etc.

[0083] Memory 114 and 124 can be non-transitory memory. For example, memory 114 and 124 can store data when powered on, such as volatile memory devices (e.g., random access memory (RAM)). For example, memory 114 and 124 can store data when powered on or when not powered on, such as non-volatile memory devices (e.g., flash memory).

[0084] Devices 110 and 120 can communicate internally, communicate with each other via a computer network, and communicate with other devices, external storage, input devices, output devices, and / or one or more sensors. The computer network can be the Internet, an intranet, a LAN, a WLAN, etc. Devices 110 and 120 include a connection interface configured to communicate as needed, either within or outside system 100. For example, the connection interface may include a connector, such as a wired connector (e.g., an Ethernet connector, an optical connector, etc.) or a wireless connector (e.g., an antenna, such as a Wi-Fi, 4G, or 5G antenna).

[0085] Communication interface 115 can be used to send or receive digital data, such as promises and proofs, vectors (e.g., binary vectors). Communication interface 125 can be used to send or receive digital data, such as promises and proofs.

[0086] The proof device 110 and the verification device 120 may have a user interface, which may include well-known elements such as one or more buttons, a keyboard, a display, a touchscreen, etc. The user interface can be configured to accommodate user interactions used to initiate cryptographic protocols. The user interface can also be configured for higher-level protocols, such as initiating homomorphic computations on encrypted data, e.g., neural network evaluations. As part of the higher-level protocol, a vector can be generated along with proof that the vector is binary. Other properties of the vector can also be verified with proofs, such as that the encrypted data is effectively encrypted according to a homomorphic encryption scheme. The user interface is optional, as the proof and verification devices can operate automatically.

[0087] The execution of devices 110 and 120 can be implemented in a processor system. Devices 110 and 120 may include functional units for implementing aspects of the implementation scheme. These functional units may be part of the processor system. For example, the functional units shown herein may be implemented, in whole or in part, as computer instructions stored in the device's memory and executable by the processor system.

[0088] The processor system may include one or more processor circuits, such as a microprocessor, CPU, GPU, etc. Devices 110 and 120 may include multiple processors. The processor circuits may be implemented in a distributed manner (e.g., as multiple sub-processor circuits). For example, devices 110 and 120 may use cloud computing.

[0089] Typically, the proof device 110 and the verification device 120 each include a microprocessor that executes appropriate software stored on the device; for example, the software may have been downloaded and / or stored in a corresponding memory, such as volatile memory (such as RAM) or non-volatile memory (such as Flash).

[0090] Instead of using software to implement functionality, devices 110 and / or 120 may also be implemented wholly or partially in the form of programmable logic (e.g., as a field-programmable gate array (FPGA)). The devices may be implemented wholly or partially as so-called application-specific integrated circuits (ASICs), such as integrated circuits (ICs) customized for their specific applications. For example, the circuitry may be implemented in CMOS, for example, using a hardware description language (such as Verilog, HDL, etc.). Specifically, the proof device 110 and the verification device 120 may include circuitry, for example, for cryptographic and / or arithmetic processing.

[0091] In hybrid implementations, functional units are implemented in part as hardware (e.g., as coprocessors, such as cryptographic and / or mathematical coprocessors) and in part as software stored and executed on the device.

[0092] Figure 2 An embodiment of the implementation of the proof system 200 is illustrated schematically.

[0093] The proof system 200 is configured to implement a scheme using vector commitment to verify the principal vector 211 by a proof direction verifier. It is a binary vector cryptographic method. For example, system 200 can be implemented in device 110.

[0094] The main vector 211 can be obtained from the main vector source 210. Typically, the main vector source 210 can be part of another cryptographic method. For example, a cryptographic object can be converted into a binary vector. By proving the properties of the vector, these properties can be efficiently verified to the verifier. This implementation can be used to efficiently prove that the main vector is binary. The main vector can also be obtained from, for example, memory or received from a third party.

[0095] Besides the main vector, various other vectors can be used, such as those that randomize computations or aggregate them into a single value. Randomization vectors 212 and 213 are shown. Typically, randomization vectors are not secret and are available, either to the prover or provided to the verifier. In principle, a consensus scheme between the prover and verifier can be adapted to select the randomization vector. Preferably, the randomization vector is selected by the prover system, as this allows for a non-interactive scheme. To prevent dishonest provers from improperly controlling randomization, randomization vectors can be generated from hash values, for example, by applying a cryptographic hash function to data containing one or more previously obtained protocol parts (e.g., one or more previously obtained vectors, commitments, proofs, etc.). This has the added advantage that the verifier can generate randomization vectors themselves without having to receive them, thereby reducing transmission costs.

[0096] In one implementation, the randomization vector is chosen by the verifier or derived from the output of a hash function (e.g., applied to previously computed commitments). Security is enhanced if the verifier cannot choose the randomization vector before committing to it. This can be achieved by generating the randomization vector from a hash function.

[0097] Randomized vectors (such as hash functions) can be modeled as random oracles. This is not required, but it is convenient for proving mathematical properties.

[0098] For example, in one implementation, the randomized vector scalars that can be selected from the verifier The randomized vector can be obtained, or derived from the output of a hash function (e.g., by the prover). It can then be obtained by applying multiple polynomial functions to a scalar. For example, the prover can reconstruct the randomized vector as... The polynomial can be chosen by the protocol designer or the validator. The polynomial can be reused in multiple iterations of the protocol. This has the advantage of reducing the amount of data sent by the validator. For example, the validator can choose a random scalar. This is then sent to the prover, who can then reconstruct the randomized vector. In one implementation, the polynomial is chosen as follows: .

[0099] One or more randomized vectors can be used to compute auxiliary commitments, although some cannot. For example... Figure 2 As indicated in the text, as a randomized vector 212 is the input to commitment unit 220, while the randomization vector 213 is not. Both randomized vectors 212 and 213 can be obtained by hashing previous commitments (e.g., commitments 221 and 222 discussed below).

[0100] The proof system 200 includes a commitment unit 220 configured to compute vector commitments. Figure 2 The diagram shows master commitment 221. The master commitment relates to the principal vector. 211 makes a commitment. Subsequently, the prover may choose to disclose all or part of the main vector 211, and the verifier may verify that the part disclosed when calculating the commitment 221 is indeed the same as the main vector 211.

[0101] Commitment unit 220 can be used to compute further commitments that contribute to the construction of subsequent proofs. For example, commitment unit 220 is used to compute a first auxiliary commitment 222. The auxiliary commitment is not a direct commitment to the randomized vector 212, because the verifier has access to vector 212, for example, and can generate it itself. However, the first auxiliary commitment 222 can be the main vector. and randomized vectors The Hadamard product, where the elements are This is an insight that computing the primary commitment 221 and secondary commitment 222 in reverse order allows for efficient verification using bilinear mappings. The order of the first secondary commitment 222 is reversed compared to the order of the primary vector. For example, the primary commitment can be computed on vectors... Make a commitment, and the first auxiliary commitment 222 can be made to the auxiliary vector in reverse order, for example... Make a commitment. Note that the order in which the principal vector is used in the primary and secondary commitments is reversed. In this embodiment, the primary commitment uses the natural order of the principal vector, such as the order in which the principal vector is received or generated, while the secondary commitment reverses the order in which the elements of the principal vector are used. However, this can be reversed; the primary commitment can reverse the natural order, while the secondary commitment reverses it, i.e., it uses the natural order again.

[0102] In one implementation, the vector commitment scheme is homomorphic, such as additive homomorphic. This results in the verifier being able to construct additional commitments based on the received commitments (e.g., the primary commitment and the first auxiliary commitment). For example, assuming the verifier has a randomized vector 212, the verifier can construct another vector based on the first auxiliary commitment. Calculate the second auxiliary commitment.

[0103] Furthermore, the vector commitment scheme is preferably configured to allow for the position of the vector. element at Partial disclosure is allowed. This allows proofs to be constructed by computing the product and / or division of proofs within the index range of the corresponding vectors (e.g., the main vector and / or auxiliary vectors).

[0104] For example, a vector commitment scheme could be a Pedersen commitment scheme.

[0105] The proof system 200 also includes a proof unit 230. The proof unit 230 is configured to generate proofs of propositions about vectors, which can be verified using commitments to the vectors without knowing the vectors themselves.

[0106] Proof unit 230 can be used to construct orthogonality proof 231, such as the first proof. The orthogonality proof confirms to the verifier that another vector... Orthogonal to the principal vector. This indicates the sum. This means that, in When randomizing this sum, under overwhelming probability, Each of them is either 0 or 1, for example, It is random, for example, with Make choices that are irrelevant. More precisely, if One of them is not here In this case, the probability that the sum equals zero is only... .

[0107] This proof is provided by the second proof. (Equality Proof 232) further connects the primary commitment 221 and the first auxiliary commitment 222. For example, Equality Proof 232 proves that the principal vector in the Hadamard product of the commitments in the first auxiliary commitment is the principal vector committed in the primary commitment. More precisely, Equality Proof 232 can prove that the principal vector in the Hadamard product of the commitments in the first auxiliary commitment is the principal vector committed in the primary commitment. More precisely, the first auxiliary commitment is a commitment to the auxiliary vectors in reverse order, that is, a commitment to the principal vector. and randomized vectors The commitment is made by reversing the order of the Hadama product.

[0108] Interestingly, the primary commitment, secondary commitment, first proof, and second proof can each have a size independent of the dimension of the primary vector, meaning they are concise.

[0109] The proof system can also be configured to make the primary commitment and secondary commitments available to the verifier, and to make the first proof and / or the second proof, or an aggregation thereof, available to the verifier. The verifier can verify whether the orthogonality proof and / or the equality proof are consistent with the primary commitment and the first secondary commitment.

[0110] It is possible that, in a later state, the proof system can generate additional proofs. For example, the proof system can generate proofs for other properties of the principal vector. For example, the principal vector can be fully or partially disclosed. For example, linear operations can be applied to the principal vector and the results can be disclosed; for example, the dot product of the principal vector and another vector, which can be a known vector, can be computed. The result of the dot product can be revealed to the verifier and its correctness can be verified using the primary commitment and possibly other auxiliary commitments.

[0111] In one implementation, the commitment and proof are group elements. For example, a bilinear mapping. Limited to the first group Second Group To the third group The vector commitment and proof can be elements in either the first or second group. Verification of the proof involves applying the bilinear map once or more to the proof and an expression expressed in terms of generators of another group, thereby obtaining elements in the third group. Verification of the proof can also involve applying the bilinear map once or more to the commitment and an expression expressed in terms of generators of the group, and vice versa, thereby obtaining elements in the third group. Verification involves comparing the results of the first and second applications in the third group. The vector elements of the vector can also be group elements, for example, by prime number. A natural number modulo 1.

[0112] For example, the verification of orthogonality proof 221 may include using bilinear mappings. The first application to the generators of the first proof and the second group, and the application to bilinear mappings. The second application applies to the primary commitment and the second auxiliary commitment.

[0113] Similarly, bilinear mappings can be compared. Application to the second proof, bilinear mapping Applications to the main commitment, and bilinear mapping Applications of auxiliary commitments to verify equality proofs .

[0114] Bilinear mappings can be applied to the product of selected group generators, chosen such that comparisons in the third group are balanced, e.g., equal, if the proof is correct. For example, in the case of an equality proof, if the primary commitment and the first secondary commitment both correspond to the same primary vector.

[0115] The inventors have the insight that the implementation scheme can use a system equipped with a bilinear mapping. group Any vector commitment on which: (i) the public reference string contains generators , (ii) For vectors The commitment includes group elements , (iii) in position The partial disclosure at the location includes group elements. and And it satisfies the following form of verification:

[0116] ,

[0117] in It can be calculated publicly from a public reference string; and It is a public index functions; and , It is fixed.

[0118] The provided implementation scheme is a special case of the above equation, for example, where , , , as well as .

[0119] These implementation schemes offer various advantages. The public reference string has a linear size in the dimension of the committed vector. It supports proofs of constant size, i.e., for public values... and The committed vector Satisfy inner product relation Furthermore, the proof is brief and contains only a few group elements.

[0120] For example, one implementation could be a scheme for using vector commitment to verify the principal vector by a proof-direction verifier. It is a cryptographic method using binary vectors, bilinear mapping. Limited to Group 1 and Group 2 To the third group Vector commitments are in the first and second groups. One of the elements,

[0121] - The provider calculates the principal commitment. The principal commitment is for the principal vector Make a commitment,

[0122] - The randomized vector is obtained by the proof. This randomized vector can be used by the verifier.

[0123] - The proving party calculates the first ancillary commitment. The first auxiliary commitment makes commitments to the auxiliary vector in reverse order, and the auxiliary vector includes the main vector. and randomized vectors Hadamaji,

[0124] - Generate the first proof The first proof confirms that the other vector is orthogonal to the principal vector. The other vector consists of the product of the randomized vector and the principal vector minus 1 in each component. The first proof is configured to be verified by the verifier.

[0125] The first proof can be obtained as a proof that the dot product of two vectors is zero. Let the principal vector... and randomized vectors The order of the Hadamard product is reversed so that the proof can be verified using a bilinear mapping. The bilinear mapping of the primary and secondary commitments will compute the product of polynomials in the exponent. In the product, one of the coefficients will be the dot product of the two vectors.

[0126] For example, if and Then pair Calculate the product of polynomials in the exponent. In the product, The coefficient becomes If it is included in the commitment If the order is reversed, the inner product will be... As The coefficients are obtained.

[0127] For example, one implementation could be a method for verifying the principal vector by a verifier. Cryptographic methods for binary vectors include:

[0128] - Verify the first proof, which includes applying the bilinear mapping to the first proof and the second group. The first application of the generator, verification also includes obtaining a second auxiliary commitment for another vector from the first auxiliary commitment. The verification of the first proof includes applying the bilinear mapping. The second application is applied to the primary commitment and the second auxiliary commitment, and the verification includes comparing the results of the first and second applications in the third group.

[0129] The implementation scheme can be implemented as a non-interactive zero-knowledge (NIZK) proof system. Such proof systems typically include algorithms. .

[0130] For example, the CRS-Gen algorithm can be used in the initialization phase. (Regarding security parameters...) CRS-Gen generates a common reference string on (optional) other parameter inputs. and optional simulated trapdoor ;algorithm Public reference string Proposition and witness As input, output proof Verify will Proposition and witness As input, it returns either 0 or 1. Correctness requires that honestly generated proofs are always (or at least overwhelmingly) accepted by the verifier. However, in one implementation, an additional algorithm is introduced. The additional algorithm input domain vector And output commitments For example, the prover algorithm can be used in the proof phase, while... The algorithm can be used in the commitment phase.

[0131] The following examples illustrate several further optional improvements, details, and implementation schemes.

[0132] For message space For prime modulus The implementation scheme generates concise proofs for the committed vector. In one implementation, a message space modulo composite numbers (e.g., composite numbers that are difficult to factorize) can be allowed. However, bilinear mappings are inefficient in this case. Therefore, this paper will assume that the message is modulo composite numbers. Take the mold.

[0133] The implementation scheme allows for vectors with small infinity norms. Or even binary Make a commitment and receive a commitment of constant size. Subsequently, it can be generated. A brief proof with binary entries. In one implementation, the proof consists of only two group elements. Specifically, the CRS can be... The size can be determined, and a commitment to the position of a single vector can be concisely disclosed. It can also be proven that for disclosed values... and public value The committed vector Satisfying linear equations Furthermore, it possesses aggregation properties that make it possible to publicly generate proofs of constant size for subvectors. These properties allow for concise proofs of various properties of the committed vectors. One implementation adds the important additional property of being able to prove the binary nature of vectors. For example, the aggregation scheme "Pointproofs: Aggregating Proofs for Multiple Vector Commitments" by Gorbunov et al. can be used.

[0134] For the purpose of describing some detailed implementation schemes, let for A cyclic group of order 1, equipped with a bilinear mapping (also known as a pairing). Bilinear mappings have the following properties: for all , And it is non-degenerate, for example, If and only if or Given and Security depends on calculating the discrete logarithm. The difficulty. Regarding safety parameters. a certain function By choosing a sufficiently large group order To improve security. For example, for Then you can choose a prime number. .

[0135] Preferably, group It is a prime number The order is an asymmetric bilinear group. Note that techniques for converting a symmetric bilinear group to an asymmetric bilinear group are known. For integers... , The problem is given as:

[0136]

[0137] in , , ,calculate .

[0138] In the actual implementation plan, and It can be instantiated from a suitable elliptic curve group, and It can be a subgroup of the group of invertible elements in a finite field. Examples of such groups are known in the art. For example, see the paper “Constructing Brezing-Weng pairing-friendly elliptic curves using elements in the cyclotomic field” by E. Kachisa, E. Schaefer, and M. Scott; the paper “A survey of elliptic curves for proof systems” by D. Aranha, Y. El Housni, and A. Guillevic; and the paper “Optimized and secure pairing friendly elliptic curves suitable for one layer proof composition” by Y. El Housni and A. Guillevic.

[0139] In this field, three types of pairings are sometimes distinguished. In type-1 pairings, we have In type-2 and type-3 pairings, we have The difference between them is that type-2 pairing allows for efficient and computable isomorphism. Although the reverse direction is not allowed, such isomorphism is unknown for type-3 pairings. Type-3 pairings offer the most efficient configuration. For improved security, type-2 or type-3 pairings are preferred, and type-1 pairings are preferred not to be used. See, for example, the paper "Pairings for cryptographers" by Steven D. Galbraith et al.

[0140] Vector commitment

[0141] In one implementation, vector commitment allows the use of vectors of constant size to scalars. Make a commitment, for example So that the promisor can make the commitment by only disclosing and short elements To target individual locations public Short elements Size and Dimensions Irrelevant. More information can be found in the paper "Concise Mercurial Vector Commitments and Independent Zero-Knowledge Sets with Short Proofs" by B. Libert and M. Yung. Note that it is unknown whether such schemes can achieve short proofs in binary. Note that in the context of bilinear mappings, vector commitments can be computed in either the first or second group. Furthermore, it is permissible to use vector commitment schemes that compute multiple group elements instead of a single element, or to use different suitable vector commitment schemes.

[0142] In the vector commitment scheme, the structured common reference string (SRS) contains the form: and The group elements. In this implementation, the elements Not publicly available. The sender selects uniformly. And calculate the following commitment function to... Make a commitment,

[0143] ,

[0144] This commitment function can be viewed as the evaluation of a polynomial (in exponential form), the coefficients of which are relative to the input. yes The commitment scheme has a second similar commitment function, which produces group elements in another group of bilinear mappings.

[0145] In order to Location Publicly available The promisor shall disclose the following evidence:

[0146]

[0147] This proof can be verified by checking the following information:

[0148] (1)

[0149] Let's verify.

[0150] Mathematically, it can be shown that if a malicious promisor can conceive of a promise... and valid proof ( For a certain position Two different places If (1) is satisfied, then it can calculate the missing elements in the SRS. Therefore, this scheme is binding under variations of the Diffie-Hellman assumption. The public reference scheme above uses a particularly suitable set of generators, but other suitable choices can also be made.

[0151] As illustrated by B. Libert, S. Ramanna, and M. Yung in their paper "Functional CommitmentSchemes: From Polynomial Commitments to Pairing-Based Accumulators from Simple Assumptions," this vector commitment allows for the proof of the committed vector using aggregation. Satisfy inner product relation , where public values For example, we can exponentiate (1). and for all indexes Take the product to obtain:

[0152] (2)

[0153] By assuming a random oracle The random aggregation coefficients can be derived. To target subvectors To aggregate proof ,in It is a subvector And limit the proof of aggregation to product. Verification can be performed by checking the following information:

[0154] .

[0155] Prove the binary nature of the committed vector

[0156] In one implementation, the vector commitment public reference string contains a bilinear mapping. group And the following descriptions of generators:

[0157]

[0158] in It is the dimension of the committed vector. The proof calculates for random numbers. sum vector promise

[0159] By leveraging the aggregation property of commitments, it can be shown that for each We have To confirm for each This means because It is a prime number. This can be shown by using randomized vectors and aggregating individual equations, and demonstrating... Randomized vectors It is a vector of randomly aggregated coefficients, which can be obtained, for example, using random oracles. right Obtained through hashing, the random oracle can be implemented as a hash function. Examples include hashes from the hash function set SHA-2 (e.g., SHA-256) or from SHA-3. Vector exist Then select evenly, if there are Then it has The probability is only (in (These are safety parameters) to enable This is the conclusion of the Schwartz-Zippel lemma.

[0160] To prove this proposition using a constant number of group elements, we can first generate an auxiliary commitment by evaluating the following commitment function:

[0161] (3)

[0162] For random numbers It can be viewed as the same vector The commitment is However, in reverse order, and for each No. Each entry multiplied by Then, two proofs can be generated:

[0163] Calculate the equality proof, which confirms... For the form of The commitment is made using a vector (e.g., the inverse of an auxiliary vector). The commitment (3) satisfies:

[0164] (4).

[0165] Here, group elements This value can be considered publicly disclosed. Proof of the initial commitment. satisfy:

[0166] (5)

[0167] Randomized vectors It can be selected for random exponentiation and used to exponentiation of (5) respectively. And to exponentiate (4) If for each We divide by them and take all indexes. By multiplying the ratios, we will find that...

[0168]

[0169] The following equations must be satisfied:

[0170] (6).

[0171] yes Yes The reasons for the compelling proof of this commitment are as follows. Assume... For a certain vector promise Then, (4) becomes:

[0172] (7),

[0173] in It is the proof that can be calculated to make public The Proof of the position. Now, if we want to find the power of (7). And divide it by the power obtained from (5). We obtained:

[0174]

[0175] in Is it permissible to disclose (5) The One position. If exist and If then uniformly selected, then if there exists have The probability is So that .if The prover cannot efficiently compute a valid proof that satisfies (6). Because this would require having ,and It is not publicly available. In one implementation, it can be derived from a hash function (e.g., modeled as a random oracle). Ensure exist and The calculation then proceeds. If necessary, the randomized vector can be obtained through other methods. and For example, hash functions can include other dependencies, obtain randomized vectors from other cryptographic protocols, etc., as long as they are randomly chosen and compatible with... and Irrelevant.

[0176] prove It means product For vectors The promise, among which Is The vector committed in the middle. In the proof of orthogonality, it is confirmed that... and Orthogonal: that is From (2), we note that such a proof can be obtained as follows:

[0177]

[0178] And it satisfies the following equation:

[0179] (8)

[0180] To reduce the proof size, we can use the linearity of verification equations (6) and (8) to simplify the proof. and Aggregation using random aggregation coefficients single group element Random aggregation can be obtained from hash functions, for example, when applied to primary and secondary commitments.

[0181] Ultimately, the entire proof It can include only the... Auxiliary commitments and aggregate proofs .

[0182] In the above implementation scheme, the first auxiliary commitment is calculated as The second auxiliary commitment is calculated from this to verify the orthogonality proof. Conversely, the prover will calculate... Instead, it serves as the first auxiliary commitment. In this case, the first auxiliary commitment can be used directly by the verifier. However, the verifier will then compute the second auxiliary commitment to verify the equality proof. The second auxiliary commitment will then be computed as... .

[0183] As mentioned above, the implementation scheme can use a system equipped with bilinear mapping. group Any vector commitment on which: (i) the public reference string contains generators (ii) For vectors The commitment includes group elements (iii) in position The partial disclosure at the location includes group elements. and And it satisfies the following verification:

[0184]

[0185] in It can be calculated publicly from a public reference string; and It is a public index The function; and It is fixed.

[0186] The above implementation scheme is a special case of the above equation, wherein and .

[0187] Example 1 Detailed Implementation Plan

[0188] Enter security parameters and the maximum dimension of the committed vector At that time, execute the following:

[0189] - For a certain function ,as well as Choose prime order Asymmetric bilinear group .

[0190] - Select random number .calculate

[0191]

[0192] and For each , And for each , .

[0193] - Choose a hash function and .

[0194] The publicly available parameters are limited to:

[0195] ,

[0196] in It is a hash function. The public parameters are available to the verifier. Typically, sharing of the public parameters does not need to occur with each verification and can be assumed to have been done in previous iterations.

[0197] In order to obtain the principal vector Make a commitment and select a random number. The primary commitment is calculated by evaluating the following first commitment function.

[0198]

[0199] Main commitment and publicly available information Return it to the party providing the proof.

[0200] Given a commitment and including vectors and randomness Witness ,if Then return Otherwise, perform the following steps:

[0201] - Calculate the randomized vector Next, choose The auxiliary commitment is then calculated by computed the following second commitment function.

[0202]

[0203] Then, calculate the randomization vector. .

[0204] - Generate the following equality proof:

[0205]

[0206] The equality proof satisfies the following equation:

[0207] (9),

[0208] And indicate Hidden from Same vector However, the order is reversed.

[0209] - calculate orthogonality proof This proof The calculation is as follows:

[0210]

[0211] And satisfy the following equation:

[0212] (10).

[0213] element It can be viewed as a second auxiliary commitment, which in a sense makes a commitment to the vector, although the second auxiliary commitment is usually computed by the verifier.

[0214] - calculate And calculate the aggregate proof:

[0215] .

[0216] Output the final proof:

[0217] (11).

[0218] Public parameters, final proof, and master commitment can be shared with the verifier.

[0219] The verifier can continue as follows. Given a commitment... and the claimed proof The latter is analyzed in accordance with formula (11).

[0220] - calculate and .

[0221] - If the following equation is satisfied:

[0222] (12)

[0223] If the condition is met, return 1; otherwise, return 0.

[0224] In terms of the length of the proof, Only The two elements are even shorter than the size-optimal SNARK for general NP languages. Using the KSS18 series pairing-friendly curves suggested by Kachisa et al., Each element (respectively) At a 128-bit security level, it can have a 348-bit representation (1044 bits in total). The overall proof length does not exceed 696 bits. It is worth noting that the overall proof length does not depend on the dimension of the principal vector. The computational cost of the prover is determined by... In The exponential operation is dominant. The workload of the verifier is equivalent to... In Sub-exponential operation, middle The exponential operation and the pairing were performed three times.

[0225] The plan can be modified in this way to ensure commitment. lie in And lie in In the middle, not the other way around. However, when... lie in In the middle, it is proven to be shorter because... Elements of type are typically represented more briefly. The following provides... exist The second example implementation scheme is shown in the figure.

[0226] Interestingly, one can mathematically prove that this construct is completely zero-knowledge for an algebraic adversary. Furthermore, one can prove the soundness of knowledge in algebraic group models (e.g., as formalized by G. Fuchsbauer, E. Kiltz, and J. Loss in their paper "The Algebraic Group Model and its Applications") and in stochastic oracle models. This means that we can extract witnesses or break evidence from any algebraic adversary that conceives a valid proof. Assumption. In Under the assumptions, this scheme provides knowledge integrity in both algebraic group models and stochastic oracle models.

[0227] Implementation 2 Detailed Implementation Plan

[0228] In the second example implementation, the vector commitment is now located In, and prove the calculation The auxiliary commitments in the text. Therefore, it is ultimately proven. This includes two elements from different groups.

[0229] Enter security parameters and the maximum dimension of the committed vector At that time, execute the following:

[0230] - For a certain function ,as well as Choose prime order Asymmetric bilinear group .

[0231] - Select random number .calculate

[0232]

[0233] and For each , And for each , .

[0234] - Choose a hash function and .

[0235] The publicly available parameters are:

[0236] ,

[0237] in It is a hash function.

[0238] In order to obtain the principal vector Make a commitment and select a random number. And calculate the following master commitments:

[0239]

[0240] Will and publicly available information return.

[0241] Given the main commitment and including vectors and randomness Witness ,if Then return Otherwise, perform the following operation:

[0242] - Calculate the randomized vector Next, choose And calculate the following auxiliary commitments:

[0243]

[0244] Then, calculate the randomization vector. .

[0245] - Generate the following equality proof:

[0246]

[0247] The equality proof satisfies the following equation:

[0248] ,

[0249] - calculate orthogonality proof This proof The calculation is as follows:

[0250]

[0251] And this proof satisfies the following equation:

[0252] .

[0253] element It can be viewed as a second auxiliary commitment, which in a sense makes a commitment to the vector, although the second auxiliary commitment is usually computed by the verifier.

[0254] - calculate And calculate the following aggregation proof:

[0255] .

[0256] Output the final proof:

[0257]

[0258] Given a commitment and the claimed proof Analyze it in the manner of equation (13).

[0259] calculate and .

[0260] if If the condition is met, return 1; otherwise, return 0.

[0261] In both the first and second example implementations, the second auxiliary commitment is computed to verify the orthogonality proof, while the equality proof directly uses the first auxiliary commitment. However, this can be modified for either implementation.

[0262] Example Application

[0263] Preferred implementation schemes can be used in many applications. Exemplary applications are discussed below.

[0264] A brief proof that the committed vector is very short.

[0265] The first application is constructing proofs that a committed scalar belongs to a certain range, which is useful, for example, in blockchain transactions. The paper "Bulletproofs: Short Proofs for Confidential Transactions and More" by [Authors' Name] (see, for example, Section 1.2.1, explaining Confidential Transactions) explains the need for such proofs. We briefly explain the idea of ​​committed scalars, such as dimensions. The vector. To prove For small For commitments, we can use commitment schemes that are also inner product function commitments. B. Libert and M. Yung describe this property and provide examples of such commitment schemes in their paper "Concise mercurial vector commitments and independent zero-knowledge sets with short proofs".

[0266] The proof is based on the second source group of bilinear mappings. China has Pedersen commitment To prove The proving party considers bit representation And for random numbers Calculate commitment .

[0267] By leveraging the aggregation property of commitments, it is possible to verify the commitment vector. Satisfy (i) (ii) For each , To prove (i), the proof can be adapted to (2) in order to generate a concise proof. , so that,

[0268] (14)

[0269] And it shows that (14) The index above equals The promise made in China .because The following equations must be satisfied:

[0270] ,

[0271] Therefore, the proof can actually calculate... So that

[0272] (15).

[0273] Proof (ii) can be solved using an implementation scheme. The entire proposition requires only 3 group elements (i.e., An element and The proof can be made with just two elements. This construction produces a range proof that is shorter than that known in the prior art (e.g., with only 3 group elements), and is as short as the size-optimal SNARK.

[0274] The construction outlined above can be easily extended to prove vector commitments. It is a vector with small entries (e.g., entries within a certain range (e.g., above and / or below a threshold)). The commitment. We can prove that all entries belong to potentially different ranges using only 3 group elements.

[0275] We can also handle the range ,in It's not a power of 2. The standard way to solve this problem is to consider integers. Make And generate a statement and The second part uses the additive homomorphic property of the commitment for proof. Instead of generating two separate range proofs, we can double the size of the CRS (by setting...). ,in (This is the maximum bit length of the range) and avoids increasing the proof size.

[0276] A brief proof for ring LWE ciphertext.

[0277] As a second application, it can prove the validity of a ring LWE ciphertext using only 3 group elements. This uses a concise proof implementation of the committed vector being binary. This embodiment also leverages the fact that the underlying vector commitment allows for the proof of inner product relations.

[0278] For a certain The circumsegmented polynomial of degree 1, let the polynomial ring and make Our aim is to prove the existence of a witness. It consists of elements of a small norm ring, such that for public values... and ,

[0279] (16).

[0280] Therefore, we will rewrite (16) as The equation above:

[0281] (17)

[0282] in This time A vector of polynomials, and and The components are interpreted as coefficients in The polynomial in [the context]. If for each [the context]... ,but The magnitude of the inclusion factor is less than The polynomial.

[0283] Let's analyze Let the coefficients embed , it will Mapped to its coefficient vector .make For a structured matrix, such that If we rewrite (17) as By multiplying matrices and vectors on the matrix, we obtain the following relationship:

[0284] (18)

[0285] For each of , Equivalently, (18) can be written as:

[0286] (19).

[0287] To prove (19), the prover will use the Pedersen commitment to the vector Make a commitment. Then it will generate a short range proof, that is, for each ,as well as Finally, it will be proven that (19) in The above was established, among which yes The order. If This ensures that (19) also holds true for integers. Here, Limited to a value , making .

[0288] Specifically, this method allows proving that the committed vector is a solution to an instance of the subset summation problem, which is useful in many applications.

[0289] While this embodiment demonstrates the validity of the ring LWE ciphertext, the argumentation system can be easily extended to handle more general propositions of form (16) using proposition (16).

[0290] Let the proposition include the public key and LPR ciphertext ,in as well as It is plaintext. More information about LPR can be found in the paper "OnIdeal Lattices and Learning with Errors Over Rings" by Vadim Lyubashevsky et al.

[0291] We consider a provider who is willing to convince the verifier that a message exists. , secret and norm noise item , making

[0292] (20).

[0293] We will demonstrate the small polynomial and The existence of proves the above proposition, such that

[0294]

[0295] in ,and .exist Above, this can be written as:

[0296] (twenty one)

[0297] in Interpreted as A matrix whose coefficients are in middle.

[0298] To make the proof more concise, we can directly... To make a commitment.

[0299] For any integer ,make and We will also Limited to a decomposition function, the decomposition function is input to an integer vector. Output binary decomposition , making Then, we can prove:

[0300] (twenty two)

[0301] in , and

[0302] Therefore, the certifying party can testify against witnesses. The decomposition makes a commitment, in which To prove relation (22) with respect to the modulus Established (therefore in) This also holds true, because the infinite norms of both members are less than 1. The proof can use random vectors. (Derived from a hash function with random lookup output) and prove the commitment. exist satisfy According to standard arguments, if , prove Equivalent to proving the promise Satisfying the inner product relation can be achieved using methods as explained in this article. It is accomplished by using one element.

[0303] By applying the above approach, we can use only 3 group elements (i.e. An element and The validity of the ring LWE ciphertext is proved using only two group elements, and the proof is very concise. Under the (2n,n)-DLOG assumption, it can be proven that the scheme satisfies the concept of analog extractability in combinatorial algebraic group models and stochastic oracle models. Therefore, using only 3 group elements per proof, the resulting construct provides analog extractability in the combination of algebraic group models and stochastic oracle models, while the most computationally efficient analog extractability proof known in the art requires 4 group elements per proof: The two elements in The two elements in the model. Even if an adversary observes the proof generated by the honest prover, the reliability of the knowledge can still be guaranteed by the simulation extractability.

[0304] Furthermore, we obtained a structured random string length that is halved compared to using a general SNARK for arithmetic circuits. In the SNARK-based method, the number of multiplication gates in the arithmetic circuit is estimated to be approximately 142,000, which requires the prover to compute... China Super League Exponential operations or their equivalents. In our setup, we need to perform exponential operations on dimensions. The vector is committed, and the proof requires computation. The calculations are performed for exponents below 340,000. These estimates assume that for... An example of an LPR encryption system: common parameter choices are Binary uniform distribution ,and Sampling standard deviation The discrete Gaussian distribution. In this case, the Gaussian vector... It has an infinite norm with an overwhelming probability. . formula The standard deviation is expressed as And the center is 0 The discrete Gaussian distribution on the surface.

[0305] Prove that the committed vector is ternary.

[0306] Using the preferred implementation scheme, we can also prove the commitment. For ternary vectors Make a commitment. This is useful, for example, when we want to prove the validity of a ring LWE public key, whose underlying key is a polynomial with coefficients {-1, 0, 1}.

[0307] One method is to Write as two binary vectors The difference between The proving party may, before proving the following, separately test... and Generate two vector commitments : (i) Both are commitments to the positional string; (ii) and Make a commitment to the same vector. Even if we aggregate proofs, each proof... Still need The two elements and The three elements, because and All are needed The auxiliary commitment in.

[0308] At the cost of doubling the size of the CRS, we can reduce the size of the proof to An element and The two elements. Therefore, we can use binary vectors. Generate commitments, where Then we can prove: (i) It is binary; (ii) for each , To ensure the reliability of knowledge in security analysis, we also need a proof component. The proof component indicates At the end Commitments are made using vectors containing zeros at each position. For example, for the latter, the proof in "Pointproofs: Aggregating Proofs for Multiple Vector Commitments" by Sergey Gorbunov et al. can be used.

[0309] We can prove (i) as in the previous construction. For (ii), we can use the properties of the underlying commitment. That is, if Yes If the promise is valid, then the provider can calculate... This makes it possible for each ,

[0310] (twenty three),

[0311] and

[0312] (twenty four),

[0313] In the ternary system Initial commitment In the case of a certain property that can be calculated by the proving party, We also get:

[0314] (25),

[0315] By merging (23) to (25), we obtain:

[0316] (26)

[0317] in It can be calculated and demonstrated by the proving party. Then, we can obtain a random power from (26). (by hash) and (Get) and for all indexes The product is aggregated at once for all positions. The proof. This yielded the proof. The proof satisfies:

[0318] (27)

[0319] This provides Evidence. In fact, if it exists Such that (26) for certain things that can be computed by the proving party If it is not true, then as long as it is in and Then select coefficient (27) based on probability Established. The final proof Including commitments and pairing ,in yes Aggregation of proofs of commitment for binary vectors.

[0320] Prove the exact Hamming weights of binary vectors.

[0321] For binary promise We can also prove It has a fixed Hamming weight. This is particularly useful in the context of fully homomorphic encryption (FHE), because for efficiency reasons, the secret key is sometimes chosen to have a specific structure. To prove the commitment... Has Hamming weight We can prove that: (i) It is binary; (ii) it is the same as a one-dimensional vector. The inner product is exactly The preferred implementation scheme already allows for proof (i). To prove (ii), the prover can generate a short... , making

[0322] (28)

[0323] This equation is possible as in (2), because Again, we can Aggregate with other proof components to obtain only those containing One element and Proof of the two elements.

[0324] Prove the bounded Hamming weights of any vector.

[0325] We are now considering being committed to any Prove the problem of small Hamming weights. Utilizing the additive homomorphism property of commitment schemes, this also allows us to prove that two committed vectors are close in terms of Hamming distance.

[0326] To prove this proposition, we first generate a weighted set to Hamming with the following values: random vectors promise For all , making Then we can prove: (i) It is binary and has Hamming weights. (ii) For each Whenever This means .

[0327] We can prove (i) as explained in the previous paragraphs. To prove (ii), we can prove that for random vectors... , The latter condition has an overwhelming probability. make sure In fact, if it exists So that and We use negligible probability get ,if only exist and They were then randomly selected.

[0328] More specifically, for a given random number The proof side calculates the pair auxiliary commitment and prove This is a commitment to the binary vector. Then, the prover generates another commitment. And it is demonstrated for the inverse Hadamard product through the exact same process as in the preferred embodiment. Make a commitment, among which Next, the prover can generate a brief... , making

[0329] (29)

[0330] This equation is possible because So that when we consider the left-hand side terms of (29) as a product of univariate polynomials over exponents, the sum is... yes The coefficient.

[0331] Figure 3 An embodiment of the proof method 300 is illustrated schematically. Method 300 can be implemented by a computer. Method 300 involves the prover using a vector commitment scheme to prove the principal vector to the verifier. It is a binary vector. Method 300 includes:

[0332] - The provider calculates the (310) principal commitment. The principal commitment is for the principal vector Make a commitment;

[0333] - Obtain the (320) randomized vector from the prover. This randomized vector can be used by the verifier.

[0334] - The first ancillary commitment (330) is calculated by the proving party. The first auxiliary commitment makes commitments to the auxiliary vector in reverse order, and the auxiliary vector includes the main vector. and randomized vectors Hadamaji,

[0335] - Generate (340) first proof The first proof confirms that the other vector is orthogonal to the principal vector. The other vector consists of the product of the randomized vector and the principal vector minus 1 in each component. The first proof is configured to be verified by the verifier.

[0336] Optionally, method 300 further includes:

[0337] - Generate (350) second proof ( The second proof confirms that the principal vector in the Hadamard product of the commitments in the first auxiliary commitment is the principal vector of the commitments in the main commitment.

[0338] On the one hand, it also relates to a cryptographic method for a verifier to verify a proof generated according to any of the preceding claims.

[0339] For example, verification and confirmation methods can be computer-implemented. Vectors, proofs, and commitments can be represented using multiple bits. For example, vectors can have at least 10, 100, or 1000 vectors. For example, proofs and commitments can be represented bitwise, and each can include at least 100 bits or at least 500 bits.

[0340] It is possible to perform this method in many different ways, as will be apparent to those skilled in the art. For example, the steps may be performed in the order shown, but the order of the steps may be changed, or some steps may be performed in parallel. Furthermore, other method steps may be inserted between the steps. The inserted steps may be improvements to the method described herein, or they may be unrelated to this method. For example, some steps may be performed at least partially in parallel. Moreover, a given step may not have completely finished before the next step begins.

[0341] Implementations of this method may be executed using software, which includes instructions for causing a processor system to execute method 300. The software may only include those steps taken by a specific sub-entity of the system. The software may be stored on a suitable storage medium (e.g., hard disk, floppy disk, memory, optical disk, etc.). The software may be transmitted as a signal via wired, wireless, or data network (e.g., the Internet). The software may be available on a server for download and / or remote use. Implementations of this method may be executed using a bitstream configured to configure programmable logic (e.g., a field-programmable gate array (FPGA)) to execute the method.

[0342] It will be understood that the subject matter of this disclosure is also extended to computer programs suitable for implementing the subject matter of this disclosure, particularly computer programs on or in a carrier. Programs may be in the form of source code, object code, intermediate source code, and object code such as partially compiled forms, or any other form suitable for implementing the methods. Embodiments relating to computer program products include computer-executable instructions corresponding to each processing step of at least one of the stated methods. These instructions may be subdivided into subroutines and / or stored in one or more files that can be statically or dynamically linked. Another embodiment relating to computer program products includes computer-executable instructions corresponding to each device, unit, and / or portion of at least one of the stated systems and / or products.

[0343] The following terms represent a favorable implementation plan.

[0344] Clause 1. A scheme for the prover to confirm the principal vector to the verifier using a vector commitment scheme. It is a binary vector cryptographic method (300).

[0345] - The provider calculates the (310) principal commitment. For the principal vector The first commitment to make a promise;

[0346] - Obtain the (320) randomized vector from the proof. This randomized vector can be used by the verifier.

[0347] - The first ancillary commitment (330) is calculated by the proving party. The first auxiliary commitment is made to the auxiliary vector in the reverse order of the main vector, and the auxiliary vector includes the main vector. and the randomized vector Hadamaji,

[0348] - Generate (340) first proof The first proof confirms that the other vector is orthogonal to the principal vector. The first proof includes the product of the randomized vector and the principal vector minus 1 in each component. The first proof is configured to be verified by the verifier.

[0349] Clause 2. The method described in Clause 1, wherein:

[0350] - By evaluating the principal vector The main commitment is calculated using the commitment function of the vector commitment scheme. , and / or

[0351] - The auxiliary commitment is calculated by evaluating the commitment function of the vector commitment scheme used for the auxiliary vector, or the commitment function of the linear combination of the auxiliary vector and the randomized vector, or the commitment function of the auxiliary vector minus the randomized vector. .

[0352] Clause 3. The method according to any one of the preceding clauses includes:

[0353] Generate (350) second proof The second proof confirms that the principal vector in the Hadamard product of the commitment in the first auxiliary commitment is the principal vector of the commitment in the main commitment.

[0354] Clause 4. The method according to Clause 3, wherein the commitment scheme is configured to allow for the position of the vector. element at The second proof, which is partially disclosed, comprises the product of proofs covering the index of the main vector divided by the product of proofs covering the index of the auxiliary vector.

[0355] Clause 5. The method according to any one of the preceding clauses, wherein the primary commitment, the secondary commitment, the first proof, and the second proof each have a size independent of the dimension of the primary vector.

[0356] Clause 6. The method according to any one of the preceding clauses, wherein the vector commitment scheme is additive homomorphic.

[0357] Clause 7. The verification, according to any one of the preceding clauses, further includes obtaining a second auxiliary commitment from the first auxiliary commitment. .

[0358] Clause 8. The method according to Clause 7, wherein the second auxiliary commitment is obtained from the first auxiliary commitment and the randomization vector using the additive homomorphic property of the commitment scheme.

[0359] Clause 9. The method according to any one of the preceding clauses, wherein the bilinear mapping Limited to Group 1 and Group 2 To the third group Vector commitments are in the first and second groups. One of the elements,

[0360] - The verification of this first proof includes applying the bilinear mapping The first application to the generators of the first proof and the second group.

[0361] Clause 10. The method according to Clause 9, wherein the verification of the first proof includes the bilinear mapping. The verification is applied to a second application of the primary commitment and the secondary commitment, and includes comparing the results of the first and second applications in the third group.

[0362] Clause 11. The method according to Clauses 10 and 7, wherein the verification of the first proof includes applying a bilinear mapping. The verification is applied to a second application of the primary commitment and the second secondary commitment, and includes comparing the results of the first and second applications in the third group.

[0363] Clause 12. The second proof shall be made in accordance with the method of Clause 9, Clause 3, or any of the preceding clauses. This is the first group The second proof is configured for verification by a verifier, which includes comparing bilinear mappings. Applying this to the second proof, the bilinear mapping... Applying this main commitment to the application, a bilinear mapping will be used. Apply the auxiliary commitment to the application of the auxiliary commitment, or apply the bilinear mapping to the application of the second auxiliary commitment derived from the auxiliary commitment and the randomization vector.

[0364] Clause 13. The application of the bilinear mapping according to the method of Clause 12 is performed together with the product of the selected group generator, wherein the group generator is selected to balance the comparison if the primary commitment and the first secondary commitment both correspond to the same primary vector.

[0365] Clause 14. The method pursuant to Clause 4, Clause 9, or any of the preceding clauses, wherein:

[0366] - A bilinear mapping applied to the selected group elements in the first group and the master commitment. In this third group, it is equivalent to the public proof applied to an element at an index and the bilinear mapping of the selected group elements in the second group. A bilinear mapping applied to selected group elements in the first group and selected elements in the second group, where the value of the element at the specified index is used as the exponent for power generation. The product of, and / or

[0367] - A bilinear mapping applied to the auxiliary commitment and the selected group elements in the second group. This is equivalent to the public proof applied to an element at an index in the third group and the bilinear mapping of selected group elements in the second group. A bilinear mapping applied to selected group elements in the first group and selected elements in the second group, where the value of the element at the specified index is used as the exponent for power generation. The product of.

[0368] Clause 15. The method according to any one of the preceding clauses includes:

[0369] - Make the commitment and the auxiliary commitment available to the verifier, and make the first proof and / or the second proof or a combination thereof available to the verifier.

[0370] Clause 16. The method according to any one of the preceding clauses, wherein the vector commitment scheme includes the Pedersen commitment scheme.

[0371] Clause 17. A method for verifying figures Methods for values ​​less than a threshold include:

[0372] - Get the number bit representation The bit vector is calculated and the commitment of that vector is computed, and at least a first proof is generated according to any one of the preceding claims.

[0373] - Generate proof that the bit vector is equal to the number.

[0374] Clause 18. A method for verifying rings A method for validating a ring-shaped LWE ciphertext, the ciphertext comprising a first vector. Second vector ,for and Satisfying the equation For integers Satisfying the equation The method includes converting vectors Represented as a binary vector, it generates at least the first proof according to any one of clauses 1 to 16, generating the vector. Proof that the equation is satisfied.

[0375] Clause 19. A method for verifying vectors The method for ternary numbers includes... Write as two binary vectors The difference between And generate a first proof for the concatenation vector of two binary vectors as described in any of clauses 1 to 16.

[0376] Clause 20. A cryptographic method for a verifier to verify a proof generated pursuant to any of the preceding clauses, said cryptographic method comprising:

[0377] Verification of the first proof, which includes applying the bilinear mapping to the first proof and the second group. The first application of the generator, verification also includes obtaining a second auxiliary commitment for another vector from the first auxiliary commitment. The verification of the first proof includes applying the bilinear mapping. The second application is applied to the primary commitment and the second auxiliary commitment, and the verification includes comparing the results of the first and second applications in the third group.

[0378] Clause 21. A system comprising: one or more processors; and one or more storage devices storing instructions, which, when executed by said one or more processors, cause said one or more processors to perform operations according to any one of the preceding clauses.

[0379] Clause 22. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform the operations described in any one of Clauses 1 to 20.

[0380] Figure 4a A computer-readable medium 1000 having a writable portion 1010 and a computer-readable medium 1001 also having a writable portion are shown. The computer-readable medium 1000 is shown in the form of an optically readable medium. The computer-readable medium 1001 is shown in the form of electronic memory, in this case, a memory card. Both computer-readable media 1000 and 1001 can store data 1020, which can instruct instructions, when executed by a processor system, to cause the processor system to perform an implementation of a verification and / or validation method according to an embodiment. The computer program 1020 can be embodied on the computer-readable medium 1000 as a physical marker or by magnetization of the computer-readable medium 1000. However, any other suitable embodiment is contemplated. Furthermore, it should be understood that although the computer-readable medium 1000 is shown herein as an optical disc, the computer-readable medium 1000 can be any suitable computer-readable medium, such as a hard disk, solid-state memory, flash memory, etc., and can be non-recordable or recordable. Computer program 1020 includes instructions for causing the processor system to execute the verification and / or validation method.

[0381] Figure 4b A schematic representation of a processor system 1140 according to an implementation of a verification and / or validation system is shown. The processor system includes one or more integrated circuits 1110. Figure 4b The diagram schematically illustrates the architecture of one or more integrated circuits 1110. Circuit 1110 includes a processing unit 1120 (e.g., a CPU) for running computer program components to perform methods according to one embodiment and / or implement its modules or units. Circuit 1110 includes memory 1122 for storing programming code, data, etc. A portion of memory 1122 may be read-only. Circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both. Circuit 1110 may include an application-specific integrated circuit 1124 for performing some or all of the processing defined in the method. Processor 1120, memory 1122, application-specific integrated circuit 1124, and communication element 1126 may be interconnected to each other via interconnect 1130 (e.g., a bus). Processor system 1110 may be configured for contact and / or contactless communication, using an antenna and / or a connector, respectively.

[0382] For example, in one embodiment, the processor system 1140 (e.g., a verification and / or validation system) may include processor circuitry and memory circuitry, the processor being configured to execute software stored in the memory circuitry. For example, the processor circuitry may be an Intel Core i7 processor, an ARM Cortex-R8, etc. The memory circuitry may be ROM circuitry or non-volatile memory (e.g., flash memory). Alternatively, the memory circuitry may be volatile memory (e.g., SRAM memory). In the latter case, the device may include a non-volatile software interface (e.g., a hard disk, a network interface, etc.) configured to provide the software.

[0383] Although system 1140 is shown as including one of each described component, multiple components may be repeated in multiple embodiments. For example, processing unit 1120 may include multiple microprocessors configured to independently execute the methods described herein, or configured to execute steps or subroutines of the methods described herein, such that multiple processors cooperate to achieve the functionality described herein. Furthermore, in the case where system 1140 is implemented in a cloud computing system, multiple hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0384] It should be noted that the embodiments mentioned above are illustrative and not limiting of the subject matter of this disclosure, and those skilled in the art will be able to devise many alternative embodiments.

[0385] In the claims, any reference numerals enclosed in parentheses shall not be construed as limiting the claims. The use of the verb 'comprise' and variations thereof does not exclude the presence of elements or steps other than those recited in the claims. The article 'a' or 'an' preceding an element does not exclude the presence of a plurality of such elements. When an expression such as 'at least one' precedes a list of elements, it indicates the selection of all elements or any subset thereof from the list. For example, the expression 'at least one of A, B, and C' should be understood to include only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter of this disclosure can be implemented by hardware comprising several different elements, as well as by a suitably programmed computer. In device claims enumerating several parts, several of these parts can be implemented by the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to exert an advantage.

[0386] In the claims, the reference numerals enclosed in parentheses refer to reference numerals in the drawings illustrating the embodiments or formulas of the embodiments, thereby improving the comprehensibility of the claims. These reference numerals should not be construed as limiting the claims.

Claims

1. A computer-implemented method for a prover to verify a principal vector using a vector commitment scheme. It is a cryptographic method for binary vectors (300), wherein the vector commitment scheme is configured to compute the allowed positions of the committed vector. element at To provide partially public proof, The provider calculates the principal commitment (310). The principal commitment is for the principal vector Make a commitment; The proof yields a (320) randomized vector. This randomization vector is used by the verifier, and is either chosen by the verifier or derived from the output of a cryptographic hash function. The proving party calculates (330) the first ancillary commitment. The first auxiliary commitment is made to the auxiliary vector in the reverse order of the main vector, and the auxiliary vector includes the main vector. and the randomized vector Hadamaji, Generate (340) first proof The first proof confirms that the other vector is orthogonal to the principal vector. The other vector comprises the product of the randomized vector and the principal vector minus 1 in each component. The first proof is configured to be verified by the verifier. Generate (350) second proof The second proof confirms that the principal vector in the Hadamard product of the commitment in the first auxiliary commitment is the principal vector of the commitment in the main commitment.

2. The method according to claim 1, wherein: By evaluating the principal vector The main commitment is calculated using the commitment function of the vector commitment scheme. ,and The auxiliary commitment is calculated by evaluating the commitment function of the vector commitment scheme used for the auxiliary vector, or the commitment function of the linear combination of the auxiliary vector and the randomized vector, or the commitment function of the auxiliary vector minus the randomized vector. .

3. The method according to claim 1 or 2, wherein the second proof comprises the product of proofs covering the elements of the main vector divided by the product of proofs covering the elements of the auxiliary vector.

4. The method according to claim 1 or 2, wherein the primary commitment, the secondary commitment, the first proof, and the second proof each have a size independent of the dimension of the primary vector.

5. The method of claim 1 or 2, wherein the vector commitment scheme is additively homomorphic.

6. The method of claim 1 or 2, wherein the verification further comprises obtaining a second auxiliary commitment from the first auxiliary commitment. .

7. The method of claim 6, wherein the second auxiliary commitment is obtained from the first auxiliary commitment and the randomization vector using the additive homomorphic property of the commitment scheme.

8. The method according to claim 1 or 2, wherein the bilinear mapping Limited to Group 1 and Group 2 To the third group Vector commitments are in the first and second groups. , One of the elements, The verification of the first proof includes applying the bilinear mapping. The first application to the generators of the first proof and the second group.

9. The method of claim 8, wherein verifying the first proof includes applying the bilinear mapping. The verification is applied to a second application of the primary commitment and the secondary commitment, and includes comparing the results of the first and second applications in the third group.

10. The method of claim 9, wherein the verification further comprises obtaining a second auxiliary commitment from the first auxiliary commitment. And the verification of the first proof includes applying the bilinear mapping The verification is applied to a third application of the primary commitment and the second secondary commitment, and includes comparing the results of the first and second applications in the third group.

11. The method of claim 8, wherein the second proof This is the first group The second proof is configured for verification by a verifier, which includes comparing bilinear mappings. Applying this to the second proof, the bilinear mapping... Applying this main commitment to the application, a bilinear mapping will be used. Apply the auxiliary commitment to the application of the auxiliary commitment, or apply the bilinear mapping to the application of the second auxiliary commitment derived from the auxiliary commitment and the randomization vector.

12. The method of claim 11, wherein the application of the bilinear mapping is performed together with the product of the selected group generator, wherein the group generator is selected to balance the comparison if the primary commitment and the first secondary commitment both correspond to the same primary vector.

13. The method of claim 3, wherein the bilinear mapping Limited to Group 1 and Group 2 To the third group Vector commitments are in the first and second groups. One of the elements, the verification of the first proof includes the bilinear mapping The first application to the generators of the first proof and the second group, wherein: The bilinear mapping applied to the selected group elements in the first group and the master commitment In this third group, it is equivalent to the public proof applied to an element at a position and the bilinear mapping of the selected group elements in the second group. A bilinear mapping applied to selected group elements in the first group and selected elements in the second group, with the value of the element at that position used as the exponent for power generation. The product of, and / or Bilinear mapping applied to the auxiliary commitment and the selected group elements in the second group This is equivalent to the public proof of the third group applied to an element at a given position and the bilinear mapping of the selected group elements in the second group. A bilinear mapping applied to selected group elements in the first group and selected elements in the second group, with the value of the element at that position used as the exponent for power generation. The product of.

14. The method according to claim 1 or 2, wherein the second proof It is obtained by randomly publishing the aggregated vector elements.

15. The method according to claim 1 or 2, comprising: Make the commitment and the auxiliary commitment available to the verifier, and make the first proof and / or the second proof or a combination thereof available to the verifier.

16. The method of claim 1 or 2, wherein the vector commitment scheme comprises the Pedersen commitment scheme.

17. The method of claim 1 or 2, wherein the randomization vector scalar selected by the verifier The randomized vector is obtained or derived from the output of the hash function by multiple polynomial functions applied to the scalar.

18. A confirmed figure Methods for values ​​less than a threshold include: Get the number The bit representation The bit vector is calculated and the commitment of that vector is computed, and at least a first proof is generated according to any one of the preceding claims. Generate confirmation that the bit represents the number Proof of equality The number is proven by publicly disclosing one or more of the most significant bits of the bit vector. Less than the threshold.

19. The verification figure according to claim 18 Methods less than a threshold, where the randomization vector scalar selected by the verifier The randomized vector is obtained or derived from the output of the hash function by multiple polynomial functions applied to the scalar.

20. A method for verifying rings A method for validating a ring-shaped LWE ciphertext, the ciphertext comprising a first vector. Second vector ,for and Satisfying the equation For integers Satisfying the equation The method includes converting vectors Represented as a binary vector, it generates at least the first proof according to any one of claims 1 to 17, generating a vector. Proof that the equation is satisfied.

21. The method for verifying rings according to claim 20 A method for validating the LWE ciphertext on a ring, where the randomized vector scalar selected by the verifier The randomized vector is obtained or derived from the output of the hash function by multiple polynomial functions applied to the scalar.

22. A method for verifying vectors The method for ternary numbers includes... Write as two binary vectors The difference between And generate at least one first proof as described in any one of claims 1 to 17 for the connection vector of the two binary vectors.

23. The verification vector according to claim 22 The method is ternary, where the randomized vector scalar selected by the verifier The randomized vector is obtained or derived from the output of the hash function by multiple polynomial functions applied to the scalar.

24. The method of claim 23, wherein the plurality of polynomial functions are .

25. A cryptographic method for a verifier to verify a first proof generated according to any one of claims 1-17, the cryptographic method comprising: Verification of the first proof, which includes applying the bilinear mapping to the first proof and the second group. The first application of the generator, verification also includes obtaining a second auxiliary commitment for another vector from the first auxiliary commitment. The verification of the first proof includes applying the bilinear mapping. The second application is applied to the primary commitment and the second auxiliary commitment, and the verification includes comparing the results of the first and second applications in the third group.

26. A system comprising: One or more processors; And one or more storage devices storing instructions, which, when executed by the one or more processors, cause the one or more processors to perform the operation of the method according to any one of the preceding claims.

27. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform the operation of the method according to any one of claims 1 to 25.

Images