Bilinear pairing

Abstract

A computer-implemented method for computing a pairing in a script is provided. Computing the pairing includes at least one sub-computation performed in a target domain, where the target domain is represented as an extended domain. And generating a script, the script comprising at least one sub-function, and the at least one sub-function being configured to execute the sub-computation on the extension field in an extension form.

Description

Technical Field

[0001] This disclosure relates to a computer implementation method for calculating pairing in a script. Background Technology

[0002] Pairing on elliptic curves covers a wide range of cryptographic applications. For example, pairing can be used to build signatures, identity-based encryption, non-interactive zero-knowledge proofs, and multi-party key protocols with efficient communication.

[0003] pair It is defined in torsion groups. Two group source elements , A bilinear mapping on the target group. It maps a pair of elements to the target group. Elements in: . Summary of the Invention

[0004] Implementing pairing efficiently in a script is not easy. Methods known in the art require a script size of approximately 1.5 MB. This paper presents a method to improve the computational efficiency of pairing calculations, thereby optimizing the resulting pairing script.

[0005] Known methods for calculating pairwise operations use field arithmetic (e.g., Karatsuba multiplication) to minimize CPU cycles during execution. This increases the total number of mathematical operations—that is, reduces the number of multiplications but increases the number of additions, which execute faster.

[0006] According to one aspect disclosed herein, a computer-implemented method is provided for computing pairings in a script, the method comprising: generating a script wherein computing the pairings includes at least one sub-computation performed in a target domain, wherein the target domain is represented as an extended domain, wherein the script includes at least one subfunction configured to perform the sub-computation in an extended form on the extended domain.

[0007] Using an extended domain to perform the parts of the paired computation allows for multiplication instead of addition, thereby reducing the size of the script. Attached Figure Description

[0008] To aid in understanding embodiments of this disclosure and to illustrate how such embodiments can be implemented, descriptions will now be provided by way of example only, with reference to the accompanying drawings, in which: Figure 1 This is a schematic block diagram of a system for implementing blockchain. Figure 2 The illustration shows some examples of transactions that can be recorded in a blockchain; Figure 3 This demonstrates point addition and point doubling operations in elliptic curves; Figure 4 The conceptual partitioning of the script used to calculate pairings is illustrated schematically; Figure 5 The dependencies of the script that implements extended-field arithmetic are illustrated schematically; Figure 6 The diagram illustrates the relationships used in scripts to implement Miller loops for calculating single or multiple pairs. Detailed Implementation

[0009] 1. Elliptic curves and pairing 1.1 Elliptic Curve Let the cubic equation be... , where the coefficient , Take from containment Finite field of elements An elliptic curve is the set of affine points that satisfy the above equations. And an additional point at infinity (denoted as ): .

[0010] It is the domain of the curve, that is It can be said that, It is defined in superior of. point coordinates Not necessarily In, they can also be defined in (containing Extension field of each element superior.

[0011] Symbols. It refers to the definition in The equation of the elliptic curve on the x-axis is: If the domain can be determined from the context, but the specific form of the cubic equation needs to be emphasized, then it should be written as... If the domain and equation are known from the context, then it can be written as... This means that all points in the elliptic curve (i.e., any possible extended domain) have coordinates. point ). Indicates coordinates at The set of points in. Similarly, Indicates having an extension The set of points whose coordinates are .

[0012] 1.1.1 Point addition and point doubling operations in affine coordinate systems Elliptic curve A group is formed under the "tangent and chord" rule. This addition rule makes... Become an infinitely distant point A group of identity elements.

[0013] Figure 3 The group rule in elliptic curves is illustrated. The left figure shows point addition, while the right figure shows point doubling.

[0014] Two points To perform addition, you need to go through... straight line And after with The intersection point (this intersection point is not) or ,Right now Figure 3 Left side () vertical line Similarly, it needs to be on point. To perform a doubling operation, it is necessary to exist Tangent at the point and after with Another intersection ( Figure 3 Right side () vertical line The relevant formulas are given below, where the formula on the left corresponds to the formula for... The dot addition operation, the formula on the right corresponds to the addition operation for... The doubling operation is performed on the points.

[0015]

[0016] Note 1. As shown in Section 1.8, after... straight line ,exist Tangent at the point And in vertical line at the point This plays a crucial role in the definition of pairing. The table below provides the relevant formulas used to solve for the relationship between tangents and chords in affine coordinates. any point The value taken at the location (evaluation).

[0017]

[0018] 1.1.2 Scalar Multiplication Operations Let any integer and points scalar multiplication Defined as to Adding to itself Next (in) In the case of a negative number, then... (Perform addition operations).

[0019] .

[0020] Second-rate.

[0021] 1.2 Projective Coordinate System As described in the previous section, dot addition requires processing of field elements ( or Invert the elements to compute the scalar. Inversion is a computationally expensive operation and should therefore be avoided. This can be achieved by switching to projective coordinates. Coordinate transformation. This allows for the calculation of the domain elements without requiring inversion operations. Perform operations on points and rewrite Figure 3 Formulas for elliptic curve arithmetic.

[0022] 1.3 Torsion Group With embedding times set up If is the order (size) of the elliptic curve, then for any ,satisfy However, for smaller scalars, the point may vanish. For any divisor , The torsion group is of order 1 The set of points: .

[0023] Scratches also form groups. Therefore, it is Subgroups of. The structure of torsion groups is well known. If and If they are coprime, then This means And has an order of of A cyclic subgroup.

[0024] 1.3.1 Curve Number of embeddings As can be seen from Section 1.1, elliptic curves The point (coordinates) lies within the domain. extended domain This also means that the tortuosity might be in the extended domain. Embedding degree. Instruct the entire torsion group The location. The following two equivalent conditions define... : ● It makes Divisible The smallest positive integer.

[0025] ● It makes The smallest positive integer.

[0026] Clearly, by definition, the number of embeddings depends on and Therefore, for Any choice of , we can say that the corresponding number of embeddings is .

[0027] 1.3.2 two subgroups Pairings can be defined on On any two subgroups of . For efficiency reasons, the three types of pairings (see Section 1.5.1) are defined on . On the following two subgroups of scratch.

[0028] 1.3.3 Base domain group

[0029] This is Completely in The only subgroup in the base field. Defined as a Frobenius map In the eigenspace Torsion element. Therefore: .

[0030] because Fixed point ,Right now If and only if ,therefore This group is sometimes called the group of order . A group of rational points.

[0031] Note 2. It is important to remember that, The coordinates of the midpoint are always in In, therefore in We should perform elliptic curve arithmetic operations as efficiently as possible.

[0032] 1.3.4 Zero-trace group

[0033] This is A subgroup with important properties. Any point in the torsion group can be mapped to... The points in the equation. That is, there exists an explicit (computable) homomorphism. This makes it possible for all All have .

[0034] A trace map is defined as... ,in Trace mapping will actually... Mapping any point to In the middle. Zero-trace elements are mapped to... The point. Therefore, It is the feature space: .

[0035] The above-mentioned The mapping is defined as The inverse trace mapping. This satisfies ,therefore Mapping points to .

[0036] Note 3. In The computational cost of performing arithmetic operations in this context is relatively high because of the point... The coordinates are at In the middle. No need to directly address... To perform calculations, it is necessary to use the twist of the curve (see Section 1.4) for smaller domains. Perform the calculation.

[0037] 1.4 Twisted Line Let curve Twisted lines It is given by the following equation: , in It should be noted that, Defined in Above, among which It is the degree of the twist line. Both curves pass through... Given Isomorphism.

[0038] when When, the probability is defined as follows: ● Secondary twist line, Applicable to any curve. Therefore, in any case, .

[0039] ● Triple twist line, Applicable to curves .therefore, .

[0040] ● Four-fold twist line, Applicable to curves .therefore, .

[0041] ● Six-fold twist line, Applicable to curves .therefore, .

[0042] In the context of pairing, an important fact is: Middle Zero Trace Group exist The original image below is a twisted line. The base group in In other words, it is possible to first... In the middle rather than in its twisted line Perform arithmetic operations on it, and then map the results back to... .

[0043] Note 4. As can be seen from Section 1.3, in Performing arithmetic operations in this context is computationally expensive. It's important to remember that if you need to calculate... (in ), then we can calculate first Then, use it when needed in the Miller loop of the paired computation. (See Section 1.6). This can improve efficiency because... The coordinates belong to (instead of larger) When defining paired fields, you can do so by... Implicitly replaced with its twisted line To avoid mapping Point Perform dot addition (or dot doubling) operations, and then use the result when needed. Mapped to This allows for further improvements. Calculation Only two multiplication operations are required.

[0044] 1.5 pairs pair It is defined in torsion groups Two group source elements , A bilinear mapping on the target group. It maps a pair of elements to the target group. Elements in:

[0045] Make: 1. For each and each :

[0046] 2. If yes The generator, then yes The generator.

[0047] 3. This pairing can be calculated efficiently.

[0048] 1.5.1 Types of Pairing According to the source group , There are three types of pairings for the selection method.

[0049] Class 1. Symmetrical pairing: Therefore, it is a base group (see Section 1.3). The curve must be a supersingular curve, i.e., it must have a distorted mapping. , it will Points in the map are mapped to In the middle. It is known how to hash to... And how to sample random elements. All known pairings (see Section 1.3) require... and They belong to different groups, therefore the pairing is defined as The drawback of this pairing is that, as a hypersingular condition... It will hinder the efficiency of pairing.

[0050] Category 2. , is the base group, and Under this setting, it is necessary to have a source... arrive isomorphism, i.e., trace mapping (See Section 1.3). This means that, It cannot be a zero-trace group (because it is through...) Mapping to unit element The drawback of this pairing is that it is not yet clear how to pair them. The random elements are hashed or sampled, which limits functionality. One advantage of this pairing is that it is efficient due to isomorphism. This allows for security verification.

[0051] 3 categories. , is the base group, and That is, the zero trace group on the twist line The original image below. No images have yet been found from... arrive The (efficient) isomorphism affects security, but under this setting, how to use reverse-tracking is already well-defined. )right The random elements in the sample are hashed and sampled.

[0052] Note 5. Currently, type 3 pairing is the most studied pairing type because it is more efficient than type 1 and offers more functionality than type 2. Therefore, this paper uses type 3 pairing for the script implementation in Section 3.

[0053] 1.6 Weil pairing, Tate pairing, and optimal Ate pairing In layman's terms, regarding the two points Pairing involves constructing a pair with Related functions Then the function at point The value is evaluated. The selected value... yes Miller The function is defined as: .

[0054] The formula above shows that the Miller function exist The place has a multiplicity of At zero point, It has a pole at that point, and The place has a multiplicity of The extreme point.

[0055] The original pairing is the Weil pairing. Several improved types have been proposed since then, among which the optimal Ate pairing is the most efficient. Different pairings can be concisely defined as follows: Weil pairing: .

[0056] Tate pairings: .

[0057] Optimal Ate pairing: ,in , making .

[0058] ● Weil pairing and Tate pairing require solving functions. The function has a degree of approximately (It is a group) (the order of). For cryptographic applications. Larger (e.g., (bits or higher), therefore the number of calculations is 1. Computing the function is a challenging task. Section 1.7 shows how to efficiently compute this function (i.e., in...). (In each step).

[0059] ● Weil pairing is generally not used because it requires calculating two Miller functions (in...). and The value is taken at P). Tate pairing and optimal Ate pairing require only one function value (taken at P).

[0060] ● Number of Miller functions required for optimal Ate pairing It is far less efficient than Tate pairing, and therefore more computationally efficient than Tate pairing. Therefore, all known implementations use optimal Ate pairing, and this is also the case here. However, it should be noted that... The exponentiation operation remains unchanged, and the Miller function depends on (instead of) Under the three settings, It is a point in the twisted line of the zero trace group, therefore its coordinates belong to .

[0061] 1.7 Pairing Friendly Curve Elliptic curves have parameters q , t , r , k : ●q Prime integers. Fundamental field. Size.

[0062] ● r Three groups Size.

[0063] ● k Number of embeddings.

[0064] ● t Frobenius trace. (Only needed for optimal Ate pairing) Because pairing involves Arithmetic operations are performed within this, therefore, if the number of embeddings... If the value is not too large, the elliptic curve is a "pairing-friendly" curve. Typically, .

[0065] For encrypted applications, it is difficult to solve for orders of... source group Elliptic Curve Discrete Logarithm (ECDLP) and the target group (i.e., optimal Ate pairing) Secondary unit root group The Discrete Logarithm Problem (DLP) in ) . This in Size and A trade-off is made between the size of the two.

[0066] The DLP in the algorithm is easier to solve than ECDLP, and the group size is chosen accordingly to ensure that all groups are resistant to attacks by the (EC)DLP solving algorithm. Size and The size ratio is .

[0067] The specific value of this ratio depends on the progress of solving these two problems. Parameters Used to measure the efficiency of elliptic curve arithmetic operations. Ideally, .

[0068] Note 6. A larger value means that a larger value is needed. The calculations are performed. The focus of this paper is on minimizing the computational costs in pairwise operations. instruction The number of times, not the number of CPU cycles. Therefore, A larger number of lines is not necessarily a disadvantage. In other words, pairings on non-optimal curves may result in smaller scripts. In this context, the number of embeddings and the number of twist lines appear to be more important parameters.

[0069] 1.7.1 Family of Parametric Curves The value is parameterized as a polynomial Given The specific value can be obtained. Depending on the shape of the polynomial, there exist different families of curves.

[0070] The most well-known families of curves are BN, BLS12, BLS24, and KSS, although other families are possible. Given the continuous development of DLP solving algorithms, BLS12 is more advantageous than BN for achieving 128-bit security strength. Therefore, the script implementation provided in this paper is based on the BLS12 curve. BLS12 is a family of curves between BLS12-381 and BLS12-440. The former is more efficient but may be affected by advancements in DLP solving algorithms; the latter is less efficient (relatively speaking, but still belongs to the 3-category pairing, see note 5 above), but is considered more secure: advancements in DLP solving algorithms in the short term are unlikely to reduce its security strength below 128 bits. The table below provides parameter information for the BLS12 curve family.

[0071]

[0072] Table 1: Parameterization of BLS12 curves.

[0073] 1.8 Miller Algorithm As discussed in Section 1.6, optimal Ate pairing requires two steps or functions. First, calculate... Then to To perform exponentiation, the following formula can be used for iterative calculation. f :

[0074]

[0075]

[0076] In the above formula, It's the Miller function. It is a point of passage a straight line, yes The vertical line at the point. Miller discovered that the above formula can be used to design a "doubling-addition" algorithm, requiring only approximately The calculation can be completed in one step. To avoid storage (It is the number of times) (function), intermediate function Also at (fixed) point Iterate through the values ​​at each point.

[0077]

[0078] Table 2: Optimal Ate pairings on BLS. 、 and It is distorted Wire EC arithmetic operations on twisted lines The calculation of the line values ​​and their sum is performed within the given context. exist In the process.

[0079] Therefore, Miller's algorithm uses the above formula in a "doubling-addition" manner to iteratively accumulate. Then to Perform exponentiation until This is the result of the pairing, as shown in the table above.

[0080] Note 7. An important optimization introduced is the so-called "denominator elimination." There's no need to calculate vertical lines. , The values ​​of are determined because these terms will be mapped to in the final exponentiation step. This optimization applies only to the Tate pair and its variants in the 3-class setting, but not to the Weil pair, because the pair uses a twisted line and a final exponentiation step.

[0081] 2. Implementation details of the BLS12 curve family BLS12 has embedding times And the equation of the curve is: , in As can be seen from Table 1, the parameters Derived from BLS12-381 polynomials and curve parameters: .

[0082] because Therefore, six twists are allowed. (See Section 1.4), its equation is as follows: .

[0083] here, ,in yes Non-square, non-cubic elements. Assume... , .

[0084] 2.1 Domain Representation The base domain of the target group ( It is represented by three different extended-domain towers.

[0085] This represents 1 (quadratic extension).

[0086]

[0087]

[0088] In this representation, The elements in are represented as (It contains) A pair of elements in a triplet of elements.

[0089] This represents 2 (sixth-order sextic extension).

[0090]

[0091] here, The elements in are represented as A vector of six elements.

[0092] This represents 3 (cubic extension).

[0093]

[0094]

[0095] In this last representation, The elements in are represented as The triplet of the element (which is) (element pairs).

[0096] here, It can be called the first domain. It can be called the second domain. It can be called the third domain. It can be called the fourth domain. This can be called the fifth domain. The fifth domain It is the target domain.

[0097] 2.1.1 Uses of the three representations exist In this case, only element-wise multiplication and inversion operations are required (the latter is only used for a simple part of the final exponentiation operation in the pairwise computation). Mature and efficient inversion algorithms exist for the second and third extensions. This means that the first representation can be used, where... yes Secondary extension on (and) yes The three extensions on, yes (A secondary extension on top of). In other words, it requires... and Arithmetic operations are performed within this representation, including addition, subtraction, multiplication, negation, and inversion. Furthermore, in this representation, simple conjugation can be used... To calculate units Yuan The inverse of (produced when calculating the second part of the final exponentiation operation).

[0098] Second representation ( The six extensions below ) is used to compute using the Frobenius operator. The power of (used for the final exponentiation operation). Frobenius is significantly better than the method used for... The standard square-multiplication algorithm for powers is more efficient, requiring only 5 multiplications (including pre-computation).

[0099] The third representation ( The three extensions above ) will be used in the Miller loop Multiplication is performed within this loop. The reason is that the result of a linear function can be represented very sparsely in a third representation. This fact can be used to split the Miller loop into two subroutines that can take advantage of the sparsity of the multiplication operations specified within the loop. The types of sparse multiplication operations can be distinguished using this method.

[0100] Based on the above description, the following sections specify arithmetic formulas. They will be used as the codebase for the scripts described in detail in Section 3.

[0101] 2.1.2 indicates the switching between them. The switching between the first representation (quadratic expansion) and the second representation (sixth expansion) is implicitly used during exponentiation via Frobenius (see Section 2.8). The output of the Miller loop ( The element is also converted from the first representation to the third representation (cubic expansion) before entering the final exponentiation operation.

[0102] Elements are Element pairs. Ultimately, There are always six elements. The coefficients are vectors, but the rules governing arithmetic operations differ depending on the representation. Switching representations revolves only around... The coefficients of a given element are shifted. The table below provides the exact arrangement of coefficients to switch between representations.

[0103]

[0104] Table 3: By surrounding coefficient Moving in Switch between different representations.

[0105] Example. The switch between quadratic and sixth-order extended representations can be derived as follows. Let... It is a secondary extension The elements. The coefficients are The elements in, and can be written as:

[0106]

[0107] in Use and It can be done by only surrounding Coefficient switching in the sixth expansion China indicates :

[0108]

[0109] .

[0110] 2.2 Arithmetic operations in Chinese — Twisted lines The elements in the modulus are 1. A first-order polynomial . Two of them can be used coefficient To identify.

[0111] .

[0112] In this context, addition, subtraction, and scalar multiplication are defined in a natural way. Therefore, addition and subtraction are component-based, and scalar multiplication multiplies each component by a scalar. All operations are performed modulo 1. conduct.

[0113]

[0114] Table 4: The addition, subtraction, and negation operations in the language. Here, Calculation Arithmetic operations are modulo operations. 。

[0115] Table 5 below defines Multiplication of elements in the middle is described. It also describes the operation as a separate routine. Find the squaring and multiplication operations.

[0116]

[0117] Table 5: Multiplication, squaring, and inversion of elements in a given set. Arithmetic operations are modulo operations. .in addition, yes Scalar multiplication operations in (see) (See the bottom right corner of Table 4).

[0118] 2.3 Arithmetic operations in The elements in the modulus are of polynomial of degree .

[0119]

[0120] Use both of them coefficient To identify it. Therefore. The table below gives... middle Arithmetic formulas for arithmetic operations. (Omitted) The subtraction, negation, and inversion operations are omitted because these operations are not needed when calculating pairs.

[0121]

[0122] Table 6: Arithmetic operations in [the context]. Here, belong .related middle For arithmetic operations, please refer to Section 2.2. Additionally, yes Multiplication operations (see the bottom left corner of Table 5).

[0123] 2.4 Arithmetic operations in The elements in the modulus are of polynomial of degree .

[0124]

[0125] Three of them can be used coefficient To identify. Tables 7 and 8 provide... middle Arithmetic formulas for arithmetic operations.

[0126]

[0127] Table 7: The addition, subtraction, and negation operations in the language. Here, .related For arithmetic operations, please refer to Section 2.2.

[0128]

[0129] Table 8: Multiplication, squaring, and inversion of elements in a given set. inside, .related For arithmetic operations, please refer to Section 2.2. Additionally, yes multiplication Calculations (see the bottom left corner of Table 5).

[0130] 2.5 Arithmetic operations in Calculations — Target Domain In the target domain, the vector has 12 components. Here, it is assumed that at least 6 elements in a sparse vector are set to zero, while at least 2 elements in a somewhat-what-sparse vector are set to zero.

[0131] 2.5.1 Multiplication under the second extension In the final exponentiation operation of the pairing, Represented as A second extension on top. That is, In this representation, the element is one that has The modulus of the median coefficient is a first-degree polynomial .therefore: .

[0132] Use both of them coefficient To identify. It can be seen that, There are three A vector of elements and .therefore, There are six A vector of coefficients, which are treated as pairs of triples: .

[0133] Table 9 provides... middle Formulas for multiplication, squaring, and inversion in arithmetic operations. The inversion of the unitary element is performed using conjugates, which is highly efficient. This is... This is represented by the advantage of the quadratic extension in the final exponentiation operation.

[0134]

[0135] Table 9: Multiplication, squaring, and inversion of elements in a given set. .related For arithmetic operations, please refer to Section 2.4. Additionally, yes scalar in Multiplication operations (see the bottom right corner of Table 7), and yes Multiplication operations (see the bottom left corner of Table 8).

[0136] 2.5.2 Exponentiation under the second-order extension The final exponentiation operation can be considered to consist of simple and complex parts. These terms are used in this field.

[0137] In the complex part of the final exponentiation operation, it is necessary to... and Perform exponentiation ( (These are curve parameters). These exponentiation operations are performed using the general algorithm "signed square-multiplication". Therefore, the exponent... ( or The bit is given in binary notation, meaning its bit belongs to This algorithm can only be used to exponentiate the identity element (i.e., in the load part of the final exponentiation operation). See Table 10.

[0138]

[0139] Table 10: Exponentiation operations for the identity element. Table 9 defines multiplication, squaring, and conjugate operations.

[0140] 2.5.3 Multiplication under triple extension During the Miller cycle, use Different multiplication formulas can be used to take advantage of the sparsity of the results of linear functions. Therefore, Represented as The three extensions above. That is, .therefore, The elements in are considered to have a modulus of 1. quadratic polynomial .

[0141] .

[0142] In this representation, Use three of them coefficient To identify. Because each There are two A vector of elements There are six A vector of coefficients, where the six coefficients are considered as coefficient-pair triples: .

[0143] The result of the straight line calculation It is a sparse element, and half of its coefficients are set to zero (see Section 2.7 below). That is, The elements are given in the following form: , Among them, the third The element is zero ,second element The second component is also zero. These elements are stored in a container containing only three... In the vector of coefficients: / / sparse representation of .

[0144] During the Miller loop, sparse elements are multiplied together. The result is a partially sparse element (i.e., the third element set to zero) in the following form. The second component of the coefficient, ): .

[0145] Furthermore, during the Miller cycle, sparsity will be reduced. or partially sparse With standard (dense) elements Multiplication. This allows for the use of [methods] in these types of multiplication operations. and The sparsity of multiplication is shown in Table 11. Table 11 presents the different types of multiplication operations. It should be noted that, in order to utilize sparsity, the formulas are low-level, meaning they are based on... It is given by arithmetic operations.

[0146]

[0147] Table 11

[0148] Table 11 (continued): For elements containing a certain degree of sparsity in Multiplication Operations. Here, .related For arithmetic operations, please refer to Section 2.2.

[0149] Multiplication and squaring operations in cubic representations are not necessary, but they can be used to avoid unnecessary switching between representations in the Miller loop, i.e., to avoid introducing opcode overhead. See Table 12.

[0150]

[0151] Table 12: Multiplication and squaring operations in Chinese. Here, .related For arithmetic operations, please refer to Section 2.3. Additionally, yes Multiplication operations (see) (Table 6, right center position).

[0152] 2.6 Twisted Line EC arithmetic operations Suppose a twisted line There are two points , .therefore, Belongs to the second source group It should be noted that, Belongs to the projective coordinate system. It belongs to an affine coordinate system. Regardless of their representation, twisted lines... The coordinates of the midpoint all belong to .point and The calculation can be performed using the formula shown in Table 13.

[0153]

[0154] Table 13: Top: Point addition operation in the twisted line. Bottom: Point doubling operation. Belongs to the projective coordinate system. belong Affine coordinate system. Here, ,related For arithmetic operations, please refer to Section 2.2.

[0155] 2.7 Target Domain The linear function in the middle Let the twisted lines in the projective coordinate system and the affine coordinate system be respectively Two points in , Furthermore, let the affine coordinate system be... Points in .point Belongs to the first source group And its coordinates belong to .point Belongs to the second source group And its coordinates belong to .

[0156] 2.7.1 Lines used for point addition operations

[0157] Calculate the points passing through the undistorted point and straight line exist The value at that location. The result of taking the value in can be represented as follows:

[0158] The result is that it has only three non-zero values. The sparse polynomial of the coordinates. Therefore, It can be represented in sparse form as three Vector of coordinates: .

[0159] Table 14 provides a list of coefficients that can be used to calculate the coefficients. The explicit formula.

[0160]

[0161] Figure 1 Used for calculation The formula for determining the value of a line in midpoint addition. Here. ， It is a scalar. Similarly, 、 Same as dot addition (top of Table 14). Related For arithmetic operations, please refer to Section 2.2.

[0162] 2.7.2 Straight lines used for doubling points

[0163] Similarly, it is used to calculate tangents. exist middle The formula for the value at point is given below:

[0164] same, It can be simply represented as three coordinate Vectors: related to the calculation of coefficients For the formula, please refer to Table 15.

[0165]

[0166] Table 15: Used for The formula for determining the value of a line in the midpoint doubling operation. Here. ， It's a scalar. (Regarding...) For arithmetic operations, please refer to Section 2.2.

[0167] 2.8 Power operation using Frobenius automorphism During the final exponentiation operation, the given... element form The power of. Only These calculations can be efficiently completed with just 5 multiplication operations, as described below.

[0168] It is represented as a quadratic extension (first representation), therefore In calculation When the expression is expanded, it is less than The powers disappear because their coefficients are Multiples of (domain features).

[0169] Then, for element It can be seen and ,in yes The conjugate of. Finally. And in the first representation, ,therefore This means for , ,in .

[0170] therefore:

[0171]

[0172] / / Switch to sixth-order expansion (see Table 3)

[0173] / / Switch back to secondary extension.

[0174] Calculate in a similar way and Please refer to Table 16 for the relevant formulas. It can be seen that pre-calculation... element (in , ), and hard-coded it in the algorithm.

[0175]

[0176] Table 16: q-power operations using Frobenius. Elements belong 。 related For arithmetic operations, please refer to Section 2.2. Pre-calculate elements. .also, express . conjugate.

[0177] 2.9 Final exponentiation operation Final exponentiation calculation In The index can be expressed as: , in It is the first Cyclic polynomial.

[0178] The pairing friendly domain can be defined as an extension ,in and .

[0179] In such pairing friendly domains In this context, the index can be represented as follows: .

[0180] In BLS12 (and BN), the number of embeddings is... Therefore, the above exponential formula becomes: .

[0181] Index Part This is referred to as the first or simplest part. (Part) This is referred to as the second or complex part. These parts are calculated in different ways, as described below.

[0182] 2.9.1 Final Exponentiation Operation—Part 1 (Simple) Will Represented as The elements in the exponentiation are then exponential. It is its conjugate Therefore, if ,but This means that the first part of the index is calculated as follows: .

[0183] Using the Frobenius operator For the algorithm used to calculate the simple part, please refer to Table 17. This part is the same as the BN curve.

[0184]

[0185] Table 17: The simplified part of the final exponentiation operation. Perform multiplication and inverse operations under the second extension. Calculate (see Table 9).

[0186] 2.9.1 Final Exponentiation Operation—Part Two (Complex) The second part is specific to each curve. Here, it explains how to perform this operation for BLS12. The output of the first part is... .

[0187] The second part includes calculations of exponentiation. ,in First, the exponent is represented as and . , where the coefficient It is an integer. This means that the final result of the exponentiation operation is: .

[0188] The above exponentiation operation is usually performed in the following way: The specific coefficient (which depends on the prime number) The parameterization (and therefore depends on the details of each curve) constructs an addition chain and applies the power... , and The Frobenius operator is applied. An addition chain optimized for BLS12 is used. See Table 18 for the algorithm. The addition chain is applied to it. The specific value is:

[0189] in These are curve parameters.

[0190]

[0191] Table 18: Exponentiation operation in the complex part. The algorithm uses five temporary variables. Table 9 shows the multiplication operations, and Table 10 shows... Out The exponentiation operation.

[0192] 3 scripts The following provides scripts that can be used to implement BLS12 pairing within a script. The script is divided into four main conceptual blocks: extended-domain arithmetic operation script 402, Miller loop script 404, final exponentiation operation script 406, and pairing script 408. The script used by external users is the script in pairing block 408. Other scripts 402, 404, and 406 are internal scripts. The conceptual division and dependencies of the scripts are as follows: Figure 4 As shown.

[0193] Some or all of the script blocks can be used to compute pairs. For example, Miller loop script block 404 can be used with a known final exponentiation script to compute the inverse. Other combinations of script blocks are possible.

[0194] Scripts 402, 404, 406, and 408 can be referred to as computation blocks in this paper.

[0195] In the examples provided in this article, the script is presented as a blockchain script. However, it should be understood that the script can be any form of computer-readable script. Specifically, the script can be any form of bytecode or binary code. In such code, any loops are expanded. For example, instead of defining a branching script that includes if statements, each loop is defined sequentially to generate a script without branches.

[0196] The scripts provided in this article minimize the size of such branchless scripts.

[0197] 3.1 Extended-field arithmetic operation script The extended-field arithmetic operation script performs arithmetic operations on paired extended fields. That is, it performs arithmetic operations on the fields. Perform arithmetic operations.

[0198] Available implementations for multiplication and squaring of quadratic or cubic extensions of a given base field use the Karatsuba multiplication and squaring complex number method or the Chung-Hasan squaring method, respectively. While these algorithms reduce the number of multiplication operations, they typically require more base field arithmetic operations. Therefore, they are faster to execute (requiring fewer CPU cycles) but more expensive to describe in a script.

[0199] The scripts presented in this article use algorithms that produce scripts with fewer opcodes. Therefore, these scripts are considered space-efficient.

[0200] The extended-field arithmetic operation block is divided into eight groups, see [link to relevant documentation]. Figure 5 The script for the upper-level FQ12 group is used for the paired Miller loops and the final exponentiation part. The inner-level group contains the implementation of FQ12 (… The script required for the operation in ).

[0201] The script provided in this article can be used to compute pairings. These pairings can be computed by performing a set of sub-computations within a target domain. The target domain can be represented as an extended domain, and the sub-computations can be performed using subfunctions on that extended domain.

[0202] Subcomputations of paired computations can be performed by subfunctions executed on different extension fields. The elements output by the subfunctions can be converted to representations in the different extension fields.

[0203] By using sub-functions in the extended domain, the size of paired calculations in the script is reduced, thereby improving computational efficiency.

[0204] 3.1.1 FQ Arithmetic operations on FQ. FQ elements are integers. Modulus .therefore, .

[0205] It can easily perform modulo integer addition, subtraction, negation, multiplication, and squaring operations. Bitcoin scripts support modulo operations using native opcodes such as OP_ADD, OP_SUB, OP_MUL, and OP_MOD.

[0206] 3.1.2 FQ2 Arithmetic operations on, where FQ2 elements are a pair of integers. ,in Table 19 lists the scripts.

[0207]

[0208] Table 19: Arithmetic operation script 3.1.3 FQ4 Arithmetic operations on FQ4 elements. An FQ4 element is a pair of FQ2 elements. ,in Table 20 lists the scripts.

[0209]

[0210] Table 10: Arithmetic operation script 3.1.4 FQ6 Arithmetic operations on FQ6. The element FQ6 is a triplet of the element FQ2. ,in Table 21 lists the scripts.

[0211]

[0212] Table 21: Arithmetic operation script 3.1.5 FQ12Quadratic Multiplication operations on top. That is, A secondary extension of FQ12Quadratic elements. An FQ12Quadratic element is a pair of FQ6 elements. ,in Table 22 lists the scripts.

[0213]

[0214] Table 22: Under the second-order extension A script for multiplication operations.

[0215] 3.1.6 FQ12CubicSparse Sparse multiplication and squaring operations on [a surface]. That is, The three expansions above. Distinguish the following element types: ● FQ12CubicSparse. A triplet of FQ2 elements. ,in .

[0216] ● FQ12CubicSomewhatSparse. Five FQ2 elements. ,in .

[0217] ● FQ12CubicDense. Six FQ2 elements. ,in (Standard elements under the third expansion in FQ12).

[0218] Table 23 lists the scripts.

[0219]

[0220] Table 23: Three-stage expansion A script for sparse multiplication operations.

[0221] 3.1.7 FQ12Invert An algorithm for inverting elements in a given set. The inversion operation involves elements of the following types (defined in previous chapters): ● FQ elements ● FQ2 Element ● FQ6 elements ● FQ12 Quadratic element.

[0222] Table 24 lists the scripts used to perform inversion operations on elements.

[0223]

[0224] Table 24: Scripts for performing inversion operations on elements.

[0225] 3.1.8 FQ12Frobenius Using Frobenius Element Exponentiation operation.

[0226]

[0227] Table 25: Power calculation using Frobenius.

[0228] 3.2 Miller Loop Script Figure 6 The relationship of the script required to implement the Miller loop for a single pair or a combination of three pairs is shown.

[0229] Miller's loop script includes a line function and a square-and-update function. The line function outputs an array of elements, which are then fed as input to the square-and-update function. The line function receives curve points. and As input.

[0230] Each of these functions includes multiple loops, the number of which is determined by the curve parameters. Defined, where the number of loops equals the curve parameters. The bit length. Curve parameters are hard-coded into a script, i.e., predefined. Each loop includes a set of sub-functions that execute a portion of the function.

[0231] In both single-pair and multi-pair variations, each cycle of the linear function can include one of two distinct sets of subfunctions, referred to in this paper as the first subfunction set and the second subfunction set. Which of these two subfunction sets is used for a particular cycle depends on the curve parameter conditions.

[0232] When curve parameters are represented in binary form, curve parameter conditions are based on the values ​​of the corresponding bits of the curve parameters. In the example below, if the corresponding bit is set to 0, the first curve parameter condition is satisfied; if the corresponding bit is set to 1, the second curve parameter condition is satisfied.

[0233] If the corresponding bit of the curve parameter is set to 0, indicating that the first curve parameter is satisfied, then the first set of sub-functions is used. If the corresponding bit of the curve parameter is set to 1, indicating that the second curve parameter is satisfied, then the second set of sub-functions is used. Since the curve parameters are predefined and hard-coded in the script, the corresponding set of sub-functions for each loop of the line function is also predefined. Therefore, branching is not required in the script.

[0234] In the case of a single pairing, the first set of sub-functions is a subset of the second set of sub-functions. That is, all sub-functions in the first set of sub-functions are also sub-functions in the second set of sub-functions.

[0235] In the case of multiple pairings, the first set of subfunctions and the second set of subfunctions include some identical subfunctions and some different subfunctions.

[0236] The array of elements output by the line function includes the elements computed for each loop of the line function (i.e., the output of each loop).

[0237] The line function also includes an initial curve point subfunction, which uses curve points... As input, and calculate the initial curve points. The first loop of the linear function takes the initial curve points as input and updates the curve points. Each subsequent iteration of the linear function calculates the current curve point from the previous iteration. As input, and configured to update To calculate the next current curve point.

[0238] The elements in the array of elements calculated in a specific loop are based on the current curve point. That is, the curve point received as the input of the loop. To calculate.

[0239] In the single-pair variant, the squared-update function also includes two sets of subfunctions, where the specific set used for each loop depends on the curve parameter conditions described above. These two possible sets of subfunctions for the squared-update function may be referred to in this paper as the third and fourth subfunction sets.

[0240] Each of the third and fourth sub-function sets includes a squaring sub-function and a multiplication sub-function. In the third sub-function set, the multiplication sub-function is a sparse-by-dense vector multiplication operation, while in the fourth sub-function set, the multiplication sub-function is a partially sparse-by-dense vector multiplication operation.

[0241] In the multiple-pair variant, the loop of the squared-update function includes the curve parameters. An unrelated set of identical sub-functions. All loops include the same sub-functions for squaring and multiplication.

[0242] The output of the squared-update function is the intermediate value. Median It can be used to calculate pairings.

[0243] Tables 26 and 27 show scripts that can be used to execute Miller loops for single or multiple pairs, respectively.

[0244] By executing the Miller loop in this way, intermediate values ​​can be computed using sparse multiplication operations within the extended field. The operands of sparse multiplication operations can be described very simply, thus reducing the number of opcodes used for stack management and consequently improving computational efficiency. Table 11 fully illustrates the new formulas for different variations of sparse multiplication operations.

[0245] Since the curve parameters are predefined, each loop of each function is also predefined. Therefore, the term "loop" refers to a set of sub-functions implemented sequentially within the function. A loop can be viewed as unrolled. That is, a specific set of sub-functions is not executed again with different inputs, but rather the exact same set of sub-functions is executed using inputs from the directly preceding set of sub-functions, or a similar set of sub-functions is executed under different curve parameter conditions.

[0246] In this way, the Miller loop itself can be considered as an expanded loop. That is, each sub-function is executed only once.

[0247] 3.2.1 Split the Miller loop into two loops To iterate over the Miller loop, the Miller loop (Table 2, steps 1 to 10) is split into two loops. The first loop calculates and stores the results of the linear function in the FQ12-element array. In the middle. The main (second) loop uses the stored results. As input, and update the element And then square it.

[0248] [Miller loop] [Line functions loop] [Main loop] By calculating the Miller loop in this way, many multiplication operations are sparse, and the description (and execution) of these multiplication operations is faster than standard FQ12 multiplication in a script. See Table 26 for pseudocode.

[0249] 3.2.2 Multiple pairings It also allows for combined Miller loops, thus supporting multi-pairings. This article presents the case of three pairs. In this case, the three linear functions (one for each pair) are computed together, resulting in an array containing the computations of the combined linear functions. Then, update the combination. The value is then squared.

[0250] [3-miller loop] [3-line functions loop] [3-main loop] Combining linear functions allows for more sparse multiplication operations than calculating them individually, thus improving overall computation speed. See Table 27 for pseudocode.

[0251] 3.2.3 Pre-calculation Perform addition operations on points and point addition functions In the formula (Table 14) used to calculate the point addition function, the value... and Addition with dots (Table 13 top) Same. In the Miller loop, these values ​​only need to be calculated once for both operations. Therefore, they can be calculated first. Then, equivalent routines for point addition and line value taking are defined respectively. These routines are based on... and As input.

[0252]

[0253] Table 26: The Miller loop (see Table 2, steps 1 to 10) is represented as two loops and has sparse characteristics. Multiplication operation.

[0254]

[0255] Table 27: Sparse multiplication operation for three-pair combination Miller loops.

[0256] 3.2.4 Script Miller loops have three types of operations: 1) Twisted line Dot addition / dot doubling operations in Chinese.

[0257] 2) Target domain The values ​​of the linear function in the equation.

[0258] 3) Sparse multiplication and squaring operations in CSS.

[0259] Section 3.1 covers the scripts used for (3). Tables 28 and 29 list the remaining scripts used to implement the Miller loop.

[0260]

[0261] Table 28: Elliptic curve algorithm and linear function value retrieval script.

[0262]

[0263] Table 29: Miller Loop Script.

[0264] 3.3 Final exponentiation script 3.3.1 Avoid inverse operations The most computationally expensive operation in pairwise computation (domain arithmetic) is computation. The inverse of the Miller loop. During the second part of the final exponentiation, the inverse can be avoided through conjugation, but this cannot be achieved in the first part. Therefore, the output of the Miller loop must be... Perform the inverse operation to calculate the pairings.

[0265] In the method described in this paper, the off-chain pair Perform the inverse operation, and then use the inverse result. This is passed as input to the final exponentiation script. Therefore, the inversion routine is replaced with a check. This change results in significant savings when describing the script, as all the routines used for inversion operations in the intermediate extended field are no longer needed. See Table 30.

[0266]

[0267] Table 30: The first part of the final exponentiation operation performed through inverse testing. Multiplication under the second expansion The operation method is shown in Table 9.

[0268] As mentioned above, value This can be referred to as the intermediate value in this article. The inverse of this value... (Provided as input to the final exponentiation script) can be referred to in this paper as a candidate inverse intermediate value. Due to the steps... The inverse provided by the verification is The inverse is therefore considered as a candidate value. The result of this verification is to check whether the target inverse median is equal to the target inverse median, which is the value. The reverse.

[0269] In one embodiment, the median value This is the output of the Miller loop script that returned a 404 error. As described below, the intermediate value... It can be considered as derived from the initial value.

[0270] 3.3.2 Combining the first and second exponentiation operations The final exponentiation script only needs to run the simple and complex parts sequentially. Since there are two forms of the simple part, there are two final exponentiation scripts.

[0271] [Final exponentiation]:= [Easy part] [Hard part] [Final exponentiation with inverse check]:= [Easy part with inverse check] [Hard part] .

[0272] 3.3.3 Script Table 31 lists the scripts required for the final exponentiation operation.

[0273]

[0274] Table 31: Final exponentiation script.

[0275] 3.4 Pairing Script These scripts combine the Miller loop script with the final exponentiation script.

[0276] 3.4.1 Switching Representation The output of the Miller loop is Elements under triple expansion The final exponentiation operation has the same expectation. However, it is represented as a second-order extended element.

[0277]

[0278] Table 32: Switching from cubic to quadratic representation. See also Table 3.

[0279] 3.4.2 Single Pairing Script Two variations of the pairing script can be used. These variations are functionally equivalent, but the second variation (with inverse verification) is described more briefly.

[0280] Standard pairing script: [Pairing]:= [Miller loop] [From cubic to quadratic] [Final exponentiation] Space-efficient pairing script: [Pairing with inverse check]:= [Miller loop] [From cubic to quadratic] [Final exponentiation withinverse check] .

[0281] 3.4.3 Multiple Pairing Scripts Similarly, for multiple pairings, two variations of the pairing script can be used, depending on whether the inverse is computed off-chain and verified on-chain: Standard 3 pairing script: [3-pairing]:= [3-Miller loop] [From cubic to quadratic] [Final exponentiation] Space-efficient 3-pairing script: [3-pairing with inverse check]:= [3-Miller loop] [From cubic to quadratic] [Final exponentiation withinverse check] .

[0282] 4. Blockchain Implementation Methods The script described above can be used for blockchain transactions. The examples provided in this article use use cases that provide knowledge of the secret value, such as zero-knowledge proofs. It should be understood that by modifying the locking script to perform the required computations, the pairings generated by executing the script can be used for other purposes known in the art.

[0283] The challenger, Alice, generates a locking or challenging blockchain transaction. The locking blockchain transaction includes a locking script that enables the execution of the computations and verifications discussed above, as well as the calculated pairings.

[0284] The challenged party, Bob, generates an unlocking blockchain transaction. This unlocking transaction can be called a solution or proof blockchain transaction. Here, Bob can also be referred to as a provider or proof generator. The unlocking transaction includes an unlocking script that provides the inputs needed to satisfy the locking script and generate a pair.

[0285] For example, Alice generates a locking script that locks the number of UTXOs. This locking script is unlocked by a locking script that uses zero-knowledge proofs to prove that the secret value is known. To verify the zero-knowledge proof, bilinear pairing is computed.

[0286] The locking script in this example uses Figure 4 Each of the scripts 402, 404, 406, and 408 is used to compute the pairings. However, it should be understood that any combination of these scripts can be used with other suitable script blocks to compute the pairings. For example, Miller's loop script 404 can be used with a known script for computing inverses, and the output of both scripts can be used to compute the pairings.

[0287] The unlock script generated by Bob and included in the proof transaction includes all the elements required for the lock script to calculate the pair, as well as any other components required to satisfy the lock script's requirements.

[0288] In this example, the unlocking script includes candidate proof values ​​(also known as initial values) and candidate inverse intermediate values. The initial values ​​include points in the source population used to compute the pairings. The candidate inverse intermediate value is a point in the target field (an element of field FQ12). The unlocking script also includes a signature generated using Bob's private key.

[0289] The locking script includes Miller loop script 404, which is configured to execute the linear function and square-update function as described above. Miller loop script 404 derives the intermediate values ​​as described above based on the proof provided in the unlocking script. .

[0290] The locking script also includes a final exponentiation script 406, which is configured to verify the candidate inverse intermediate values ​​provided in the unlocking script. Is it equal to the intermediate value calculated by Miller's loop script 404? The inverse of . This verification can be performed as described above.

[0291] The locking script also includes a bilinear pairing script 408, which is configured to compute pairings. This is based on intermediate values ​​computed by the Miller loop script 404. And the candidate inverse intermediate values ​​provided in the unlocking script As input.

[0292] The locking script may include another computational block or script configured to verify the proof provided in the unlocking script based on the computed bilinear pairing.

[0293] The locking script can be thought of as providing a request for the value (e.g., a candidate inverse intermediate value) required to unlock the UTXO. In some embodiments, the challenger can send the request off-chain to include the required value in the unlocking script.

[0294] It should be understood that the term "proof" is not limited to zero-knowledge proofs. For example, a proof could be proof that a certain value is eligible to participate in an exchange.

[0295] The initial values ​​or proofs provided in the unlock script include a pair of elliptic curve points from which a bilinear pair can be computed. Alternatively, the pair of elliptic curve points can be derived from the initial values.

[0296] The locking script for a blockchain transaction can be used for other computations involving the pair. For example, the result of the pair can be used to compute a BLS signature. The initial values ​​provided in the unlocking script can include the public key and the message (to which the pair is computed). ), or signature, and curve generator (also considered for the second pairing of values). ).

[0297] Those skilled in the art will recognize the use of bilinear pairings, and other computations that can be implemented using the methods disclosed herein. In each implementation, the initial value is the point on which the pairings are computed. The specific meaning of these points depends on the use case: proof in zk proof, signature / public key in signature, etc., as discussed in this article.

[0298] 5 Examples 5.1 Script Size Estimation The input is In Elements, representing two points and That is, approximately byte.

[0299]

[0300] Table 33

[0301] Table 34

[0302] Table 35

[0303] Table 36.

[0304] As an estimate, the script size is approximately 121KB, used to evaluate a pair in the script.

[0305] If three-way pairing and equality checks are required, the script size would be approximately 180KB (one Miller loop is 30KB, so three Miller loops would be 90KB, and a final exponentiation operation would be 90KB). The smallest script for this type of comparison currently available is 1.5MB, as claimed by sCrypt. Even with some stack space management, the script size for three-way pairing and equality checks presented in this article is well less than 1.5MB.

[0306] It should be noted that the above [3-Miller Loop] script can be further reduced in size.

[0307] 5.2 BLS12 Parameters expressed in hexadecimal.

[0308] q: 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9fefffffffffaaab r: 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001 x: 0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb y: 0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1 h: 0x396c8c005555e1568c00aaab0000aaab b: 4 x'_0: 0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8 x'_1: 0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e y'_0: 0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801 y'_1: 0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be h': 0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5 b': 4 * (u + 1) 。

[0309] 6. Exemplary System Overview A blockchain is a distributed data structure in which a copy of the blockchain is maintained at each of multiple nodes in a distributed peer-to-peer (P2P) network (hereinafter referred to as a "blockchain network") and is widely publicized. A blockchain consists of a series of data blocks, where each block contains one or more transactions. Apart from the so-called "coinbase transaction," each transaction points to a previous transaction in a sequence that can span one or more blocks and return to one or more coinbase transactions. Coinbase transactions will be discussed further below. Transactions submitted to the blockchain network are included in new blocks. The process of creating new blocks is often called "mining," which involves each of the multiple nodes competing to perform "proof-of-work," i.e., solving a cryptographic puzzle based on a defined, ordered, and verified set of pending transactions waiting to be included in a new block of the blockchain. It should be noted that the blockchain can be pruned at some nodes, and the publication of a block can be achieved by publishing only the block header.

[0310] Transactions in a blockchain can be used for one or more of the following purposes: transferring digital assets (i.e., a certain number of digital tokens); sorting a set of entries in a virtualized ledger or registry; receiving and processing timestamped entries; and / or sorting index pointers by time. Additional layered functionalities on the blockchain can also be implemented. For example, blockchain protocols can allow the storage of additional user data or data indexes within transactions. There is no pre-specified limit to the maximum data capacity that can be stored in a single transaction, thus allowing increasingly complex data to be incorporated. For example, this can be used to store electronic documents, audio, or video data in the blockchain.

[0311] In the "output-based" model (sometimes called the UTXO-based model), a given transaction's data structure includes one or more inputs and one or more outputs. Any spendable output includes an element specifying the amount of digital assets, which can be derived from the ongoing sequence of transactions. Spendable outputs are sometimes called UTXOs ("unspent transaction outputs"). Outputs may also include a locking script that specifies the future redemption conditions of the output. A locking script is a predicate that defines the conditions necessary to verify and transfer digital tokens or assets. Each input to a transaction (other than coinbase transactions) includes a pointer (i.e., a reference) to such outputs in a previous transaction and may also include an unlocking script used to unlock the locking script pointing to the output. Thus, consider a pair of transactions, referred to as the first transaction and the second transaction (or the "target" transaction). The first transaction includes at least one output specifying the amount of digital assets and includes a locking script defining one or more conditions for unlocking that output. The second (target) transaction includes at least one input and an unlocking script, the at least one input including a pointer to the output of the first transaction; the unlocking script is used to unlock the output of the first transaction.

[0312] In this model, when a second (target) transaction is sent to the blockchain network for propagation and recording, one of the validity conditions applied at each node will be that the unlocking script satisfies all of the conditions defined in one or more of the locking script of the first transaction. Another condition will be that the output of the first transaction has not yet been redeemed by another earlier valid transaction. Any node that finds the target transaction invalid based on any of these conditions will not propagate the transaction (as a valid transaction, but possibly registering it as invalid) nor include it in a new block to be recorded in the blockchain.

[0313] Another transaction model is the account-based model. In this case, the amount of each transaction is not defined by referring to the UTXO of previous transactions in the past transaction sequence, but by referring to the absolute account balance. The current state of all accounts is stored individually in the blockchain by the nodes and is continuously updated.

[0314] Figure 1 An exemplary system 100 for implementing blockchain 150 is shown. System 100 may include a packet-switched network 101, typically a wide area network such as the Internet. The packet-switched network 101 includes a plurality of blockchain nodes 104 (typically referred to as “miners”), which may be configured to form a peer-to-peer (P2P) network 106 within the packet-switched network 101. Although not shown, the blockchain nodes 104 may be configured as a near-complete graph. Thus, each blockchain node 104 is highly connected to other blockchain nodes 104.

[0315] Each blockchain node 104 includes peer computer devices, with different nodes 104 belonging to different peers. Each blockchain node 104 includes a processing device, which includes one or more processors, such as one or more central processing units (CPUs), accelerator processors, dedicated processors, and / or field-programmable gate arrays (FPGAs), as well as other devices, such as application-specific integrated circuits (ASICs). Each node also includes memory, i.e., computer-readable memory in the form of non-transitory computer-readable media. The memory may include one or more memory cells that employ one or more memory media, such as magnetic media like hard disks, electronic media such as solid-state drives (SSDs), flash memory, or electrically erasable programmable read-only memory (EEPROMs), and / or optical media such as optical disc drives.

[0316] Blockchain 150 comprises a series of data blocks 151, with a corresponding copy of blockchain 150 maintained at each of the multiple blockchain nodes 104 in the distributed or blockchain network 106. As mentioned above, maintaining a copy of blockchain 150 does not necessarily mean storing blockchain 150 completely. Rather, blockchain 150 can be pruned as long as each blockchain node 150 stores the block header of each block 151 (discussed below). Each block 151 in the blockchain includes one or more transactions 152, where a transaction in this context refers to a data structure. The nature of the data structure will depend on the type of transaction protocol used as part of the transaction model or plan. A given blockchain uses a specific transaction protocol throughout.

[0317] Blockchain node 104 can be configured to forward transaction 152 to other blockchain nodes 104, thereby propagating transaction 152 throughout the network 106. Blockchain node 104 can be configured to create block 151 and store a corresponding copy of the same blockchain 150 in its corresponding memory. Blockchain node 104 can also maintain an ordered set (or “pool”) 154 of transactions 152 waiting to be incorporated into block 151. The ordered pool 154 is often referred to as a “mempool.” In this document, the term is not intended to be limited to any particular blockchain, protocol, or model. The term refers to a set of transactions that node 104 has accepted as valid, and for that set of transactions, node 104 is forced not to accept any other transactions attempting to spend the same output.

[0318] In a given current transaction 152j, the inputs (or each input) include a pointer that references the output of a previous transaction 152i in the transaction sequence, specifying that the output will be redeemed or "spent" in the current transaction 152j. Spending or redeeming does not necessarily mean transferring financial assets, although this is certainly a common application. More generally, spending can be described as consuming an output or allocating it to one or more outputs in another subsequent transaction. Typically, the previous transaction can be any transaction in the ordered set 154 or any block 151. Although the existence and verification of the validity of the previous transaction 152i are required to ensure the validity of the current transaction, the existence of the previous transaction 152i is not necessary when the current transaction 152j is created or even sent to network 106. Therefore, in this document, "previous" refers to the predecessor in the logical sequence linked by pointers, and not necessarily the creation or sending time in the time series; thus, the possibility of creating or sending transactions 152i or 152j out of order is not necessarily excluded (see the discussion of isolated transactions below). The previous transaction 152i can also be referred to as the preceding transaction or predecessor transaction.

[0319] Due to the resources involved in transaction verification and publication, each blockchain node 104 typically takes the form of a server comprising one or more physical server units, or even an entire data center. However, in principle, any given blockchain node 104 can take the form of a single user terminal or a networked set of user terminals.

[0320] Each blockchain node 104's memory stores software configured to run on the processing device of the blockchain node 104 to perform its corresponding role and process transactions 152 according to the blockchain node protocol. It should be understood that any action attributed herein to the blockchain node 104 can be performed by software running on the processing device of the corresponding computer device. The node software can be implemented in one or more applications at the application layer or lower layers such as the operating system layer or protocol layer, or any combination of these layers.

[0321] Any given blockchain node can be configured to perform one or more of the following operations: verifying transactions, storing transactions, propagating transactions to other peers, and performing consensus (e.g., proof-of-work) / mining operations. In some examples, each type of operation is performed by a different node 104. That is, a node can be specialized for a particular operation. For example, node 104 can focus on transaction verification and propagation, or it can focus on block mining. In some examples, blockchain node 104 can perform more than one of these operations in parallel. Any reference to blockchain node 104 can refer to the entity configured to perform at least one of these operations.

[0322] The computer devices 102 of each of the multiple parties 103, acting as consumer users, are also connected to the network 101. These users can interact with the blockchain network 106 but do not participate in verifying transactions or constructing blocks. Some of these users or agents 103 can act as senders and receivers in transactions. Other users can interact with the blockchain 150 without having to act as senders or receivers. For example, some parties can act as storage entities storing copies of the blockchain 150 (e.g., having already obtained a copy of the blockchain from blockchain node 104).

[0323] Some or all of the parties 103 may be connected as part of a different network, such as a network overlaid on blockchain network 106. Users of the blockchain network (often referred to as “clients”) may be considered part of the system containing blockchain network 106; however, these users are not blockchain nodes 104 because they do not perform the roles required for blockchain nodes. Instead, each party 103 may interact with blockchain network 106 to utilize blockchain 150 by connecting to blockchain node 106 (i.e., communicating with blockchain node 106). For illustrative purposes, parties 103 and their corresponding devices 102 are shown: a first party 103a and its corresponding computer device 102a, and a second party 103b and its corresponding computer device 102b. It should be understood that more such parties 103 and their corresponding computer devices 102 may exist and participate in system 100, but are not shown for convenience. Each party 103 may be an individual or organization. For illustrative purposes only, the first party 103a is referred to as Alice and the second party 103b as Bob in this document, but it should be understood that this is not limited to Alice or Bob, and any reference to Alice or Bob in this document may be replaced by "first party" and "second party" respectively.

[0324] Each party 103's computer device 102 includes a corresponding processing means, which includes one or more processors, such as one or more CPUs, graphics processing units (GPUs), other accelerator processors, application-specific processors, and / or FPGAs. Each party 103's computer device 102 also includes memory, i.e., computer-readable storage in the form of a non-transitory computer-readable medium. The memory may include one or more memory cells in the form of one or more memory media, such as magnetic media like hard disks, electronic media such as SSDs, flash memory, or EEPROMs, and / or optical media such as optical disc drives. The memory on each party 103's computer device 102 stores software including corresponding instances of at least one client application 105 configured to run on the processing means. It should be understood that any action attributed herein to a given party 103 can be performed by software running on the processing means of the respective computer device 102. Each party 103's computer device 102 includes at least one user terminal, such as a desktop or laptop computer, tablet computer, smartphone, or wearable device such as a smartwatch. The computer device 102 of the given party 103 may also include one or more other network resources, such as cloud computing resources accessed through a user terminal.

[0325] The client application 105 may initially be provided to any given party 103's computer device 102 via, for example, a suitable computer-readable storage medium downloaded from a server, or via a removable storage device such as a removable SSD, flash key, removable EEPROM, removable disk drive, floppy disk or tape, optical disc such as a CD or DVD ROM, or a removable optical drive.

[0326] The client application 105 includes at least a "wallet" function. This has two main functions. One function is to enable the respondent 103 to create, authorize (e.g., sign) transactions 152 and send them to one or more Bitcoin nodes 104, which then propagate through the network of blockchain nodes 104, thus being included in blockchain 150. The other function is to report to the respondent the amount of digital assets they currently possess. In an output-based system, this second function involves organizing the amounts defined in the outputs of the various transactions 152 belonging to the relevant parties scattered across blockchain 150.

[0327] Note: While various client functionalities can be described as being integrated into a given client application 105, this is not necessarily limiting. Rather, any client functionality described herein can be implemented in a suite of two or more different applications, such as through an API interface or as a plugin for one application. More colloquially, client functionalities can be implemented at the application layer or at a lower layer such as the operating system, or any combination of these layers. The following description is based on client application 105, but it should be understood that this is not limiting.

[0328] An instance of client application or software 105 on each computer device 102 is operatively coupled to at least one of the blockchain nodes 104 of network 106. This enables the wallet functionality of client 105 to send transaction 152 to network 106. Client 105 can also liaise with blockchain node 104 to query blockchain 150 for any transaction in which the corresponding party 103 is the recipient (or actually to check other parties' transactions in blockchain 150, since, in this embodiment, blockchain 150 is a public facility that provides transaction trust to some extent through its public visibility). The wallet functionality on each computer device 102 is configured to formulate and send transaction 152 according to a transaction protocol. As described above, each blockchain node 104 runs software configured to verify transaction 152 according to a blockchain node protocol and forward transaction 152 for propagation in blockchain network 106. Transaction protocols and node protocols correspond to each other, and a given transaction protocol and a given node protocol together implement a given transaction model. The same transaction protocol is used for all transactions 152 in blockchain 150. All nodes 104 in network 106 use the same node protocol.

[0329] As part of the account-based transaction model, another type of transaction protocol operated by some blockchain networks can be called an "account-based" protocol. In the account-based case, each transaction does not define the amount transferred by referencing the UTXO of previous transactions in a sequence of past transactions, but rather by referencing the absolute account balance. The current state of all accounts is stored individually in the blockchain by the network's nodes and is continuously updated. In such systems, transactions are ordered using the account's running transaction record (also known as a "position" or "nonce"). This value is signed by the sender as part of its cryptographic signature and hashed as part of the transaction reference calculation. Furthermore, optional data fields can also be used to sign transactions. For example, if a data field contains the ID of a previous transaction, that data field can point to that previous transaction.

[0330] Some account-based transaction models share similarities with the output-based transaction model described in this paper. For example, as mentioned above, the data fields of an account-based transaction can point to the previous transaction, which is equivalent to the input of an output-based transaction referencing the output point of the previous transaction. Therefore, both models support chaining between transactions. As another example, an account-based transaction includes a "recipient" field (specifying the account's receiving address) and a "value" field (specifying a certain amount of digital assets). The recipient and value fields together are equivalent to the output of an output-based transaction, which can be used to allocate a certain amount of digital assets to a blockchain address. Similarly, account-based transactions have a "signature" field, which includes the transaction's signature. This signature is generated using the sender's private key and confirms that the sender has authorized the transaction. This is equivalent to the input / unlock script of an output-based transaction, which typically includes the transaction's signature. When both types of transactions are submitted to their respective blockchain networks, the signature is checked to determine if the transaction is valid and can be recorded on the blockchain. On an account-based blockchain, a "smart contract" refers to a transaction containing a script configured to perform one or more actions (e.g., sending or "releasing" digital assets to a recipient address) in response to one or more inputs (provided by the transaction) that satisfy one or more conditions defined in the smart contract's script. Smart contracts exist as transactions on the blockchain and can be invoked (or triggered) by subsequent transactions. Therefore, in some examples, a smart contract can be viewed as equivalent to a locking script for an output-based transaction (which can be triggered by a subsequent transaction) that checks whether the inputs of the subsequent transaction satisfy one or more conditions defined in the locking script.

[0331] 7. UTXO-based model Figure 2 An exemplary transaction protocol is illustrated. This is an example of a UTXO-based protocol. Transaction 152 (referred to as "Tx") is the basic data structure of blockchain 150 (each block 151 includes one or more transactions 152). The following description will refer to either an output-based or UTXO-based protocol. However, this is not limited to all possible embodiments. It should be noted that while an exemplary UTXO-based protocol is described with reference to Bitcoin, it can also be implemented on other example blockchain networks.

[0332] In the UTXO-based model, each transaction (“Tx”) 152 includes a data structure comprising one or more inputs 202 and one or more outputs 203. Each output 203 may include an unspent transaction output (UTXO), which can be used as a source of input 202 for another new transaction (if the UTXO has not yet been redeemed). The UTXO includes a value specifying the amount of digital assets. This represents a set of tokens on the distributed ledger. The UTXO may also contain the transaction ID of its source transaction, as well as other information. The transaction data structure may also include a header 201, which may include size indicators for the input fields 202 and the output fields 203. The header 201 may also include the transaction ID. In this embodiment, the transaction ID is a hash of the transaction data (excluding the transaction ID itself) and is stored in the header 201 of the original transaction 152 committed to node 104.

[0333] For example, Alice 103a wants to create transaction 152j to transfer a certain amount of related digital assets to Bob 103b. Figure 2 In the middle, Alice's New Affairs 152j is marked as " Tx 1 The new transaction acquires the amount of digital assets locked to Alice in the output 203 of the previous transaction 152i in the sequence, and transfers at least a portion of such an amount to Bob. Figure 2 In the middle, the previous transaction 152i is marked as " Tx 0 ". Tx 0 and Tx 1 It is just an arbitrary marker, and it does not necessarily mean Tx 0 The first transaction in Blockchain 151 and Tx 1 Subsequent transactions in pool 154. Tx 1 It can point to any previous (i.e. preceding) transaction that still has an unspent output 203 locked to Alice.

[0334] As used in the context of transaction sequences in this article, the terms "previous" and "subsequent" refer to the order of transactions in the sequence defined by the transaction pointers specified within the transaction (which transaction points to which other transaction, etc.). They can also be replaced with "predecessor" and "successor," "ancestor" and "descendant," or "parent" and "child," etc. This does not necessarily refer to the order in which they are created, sent to network 106, or arrive at any given blockchain node 104. However, subsequent transactions (descendant transactions or "children") that point to a previous transaction (ancestor transaction or "parent") will not be valid unless the parent transaction is valid. Children that arrive at blockchain node 104 before their parent are considered orphaned. Depending on the node protocol and / or node behavior, they may be discarded or buffered for a period of time to wait for their parent.

[0335] Previous matters Tx 0 One or more outputs 203 include a specific UTXO, tagged as UTXO 0 Each UTXO includes a value representing the amount of digital assets and a locking script that defines the conditions that the unlocking script in input 202 of a subsequent transaction must meet to make the subsequent transaction valid and thus successfully redeem the UTXO.

[0336] A locking script (also known as scriptPubKey) is a piece of code written in a domain-specific language recognized by the node protocol. A specific example of such a language is called a "script" (with an uppercase S), which can be used by the blockchain network. The locking script specifies the information required for the transaction output 203, such as Alice's signature requirement. The locking script appears in the transaction output. An unlocking script (also known as scriptSig) is a piece of code written in a domain-specific language that provides the information required to satisfy the locking script standard. For example, it might contain Bob's signature. The unlocking script appears in the transaction input 202.

[0337] Therefore, in the example shown, Tx 0 Output 203 UTXO 0 Including the locking script [Checksig] P A This locking script requires Alice's signature (Sig). P A to redeem UTXO 0 (Strictly speaking, it is for those who attempt to redeem) UTXO 0 Subsequent transactions are valid). [Checksig] P A Contains the public key from Alice's public-private key pair. PA The representation of (i.e., hash). Tx 1 Input 202 includes pointers to Tx 1 pointers (e.g., via their transaction IDs) TxID 0 In the implementation example, this refers to the entire transaction. Tx 0 (hash value). Tx 1 Input 202 includes Tx 0 Chinese logo UTXO 0 The index, in order to Tx 0 It is identified in any other possible output. Tx 1 Input 202 further includes an unlock script. <Sig P A The unlocking script includes Alice's cryptographic signature, which she creates by applying the private key from her key pair to a predetermined portion of data (sometimes referred to in cryptography as a "message"). The data (or "message") that Alice needs to sign to provide a valid signature can be defined via a locking script, a node protocol, or a combination thereof.

[0338] When new transactions Tx 1 Upon reaching blockchain node 104, the node applies the node protocol. This includes running the locking and unlocking scripts together to check if the unlocking script meets the conditions defined in the locking script (wherein the conditions may include one or more criteria).

[0339] It should be noted that script code is typically represented graphically (i.e., using a non-precise language). For example, opcodes can be used to represent specific functions. "OP_..." refers to a specific opcode in the scripting language. For instance, OP_RETURN is a scripting language opcode. When OP_FALSE is added before the opcode at the beginning of the locking script, the opcode creates a non-spendable output for the transaction. This output can store data within the transaction, thus immutably recording the data in the blockchain. For example, the data may include files that need to be stored in the blockchain.

[0340] Typically, the input to a transaction contains a digital signature corresponding to the public key PA. In this embodiment, this is based on ECDSA using the elliptic curve secp256k1. The digital signature signs a specific segment of data. In this embodiment, for a given transaction, the signature will sign part of the transaction input and part or all of the transaction output. Signing a specific portion of the output depends on the SIGHASH flag. The SIGHASH flag is typically a 4-byte code included at the end of the signature, used to select the output to be signed (and thus fixed at the time of signing).

[0341] Locking scripts are sometimes called "scriptPubKey," referring to the fact that they typically include the public keys of the parties to whom the corresponding transaction is locked. Unlocking scripts are sometimes called "scriptSig," referring to the fact that they typically provide the corresponding signature. However, more generally speaking, in all applications of Blockchain150, the conditions for UTXO redemption do not necessarily include signature verification. Furthermore, scripting languages ​​can be used to define any one or more conditions. Therefore, the more general terms "locking script" and "unlocking script" are preferable.

[0342] 8. Further comments Once the disclosure herein is given, other variations or use cases of the disclosed technology may become apparent to those skilled in the art. The scope of this disclosure is not limited to the described embodiments, but only to the appended claims.

[0343] For example, some of the embodiments described above have been based on Bitcoin network 106, Bitcoin blockchain 150, and Bitcoin node 104. However, it should be understood that the Bitcoin blockchain is a specific example of blockchain 150, and the above description can generally be applied to any blockchain. That is, the present invention is by no means limited to the Bitcoin blockchain. More generally, any references to Bitcoin network 106, Bitcoin blockchain 150, and Bitcoin node 104 above can be replaced with references to blockchain network 106, blockchain 150, and blockchain node 104, respectively. Blockchains, blockchain networks, and / or blockchain nodes may share some or all of the characteristics described above for Bitcoin blockchain 150, Bitcoin network 106, and Bitcoin node 104.

[0344] In a preferred embodiment of the invention, the blockchain network 106 is a Bitcoin network, and the Bitcoin node 104 performs at least all of the described functions of creating, publishing, propagating, and storing blocks 151 of the blockchain 150. It is not excluded that other network entities (or network elements) may perform only one or some of these functions, but not all of them. That is, network entities may perform the function of propagating and / or storing blocks without creating and publishing blocks (remember that these entities are not considered nodes of the preferred Bitcoin network 106).

[0345] In other embodiments of the invention, blockchain network 106 may not be the Bitcoin network. In these embodiments, it is not excluded that nodes may perform at least one or more, but not all, of the functions of creating, publishing, propagating, and storing blocks 151 of blockchain 150. For example, on these other blockchain networks, "node" can be used to refer to a network entity configured to create and publish blocks 151 but not to store and / or propagate these blocks 151 to other nodes.

[0346] To put it even more colloquially, any reference above to the term "Bitcoin node" 104 can be replaced by the terms "network entity" or "network element," where such an entity / element is configured to perform some or all of the roles in creating, publishing, propagating, and storing blocks. The functionality of such a network entity / element can be implemented in hardware in the same manner as described above with reference to blockchain node 104.

[0347] Some embodiments have been described based on a blockchain network used to implement a proof-of-work consensus mechanism to secure the underlying blockchain. However, proof-of-work is merely one type of consensus mechanism, and in general embodiments, any suitable consensus mechanism can be used, such as proof-of-stake, delegated proof-of-stake, proof-of-capacity, or proof-of-past-time. As a specific example, proof-of-stake uses a randomization process to determine which blockchain node 104 has the opportunity to produce the next block 151. The selected node is typically called a validator. Blockchain nodes can lock their tokens for a period of time to have the opportunity to become a validator. Generally, the node that locks the largest amount of tokens for the longest time is most likely to become the next validator.

[0348] It should be understood that the above embodiments are described by way of example only. More generally, a method, apparatus, or program may be provided based on any one or more of the following statements.

[0349] Statement 1. A computer-implemented method for computing a pair in a script, the method comprising: generating a script, wherein computing the pair includes at least one sub-computation performed in a target domain, wherein the target domain is represented as an extended domain, wherein the script includes at least one sub-function configured to perform the sub-computation in an extended form on the extended domain.

[0350] Statement 2. The sub-computation described in accordance with Statement 1 is one of the following: multiplication; inverse operation.

[0351] Statement 3. The method according to statement 1 or statement 2, wherein the target domain is the domain of a Barreto-Lynn-Scott (BLS) family of curves with an embedding number of 12.

[0352] Statement 4. The method according to any of the preceding statements, wherein the second field It is the first domain The second extension on, where the third field It is the second domain The second extension on, where the fourth field It is the second domain The third extension, and the fifth field Yes: the second domain The sixth extension on; the third domain The third extension on; or, the fourth domain A secondary extension of the above.

[0353] Statement 5. The method described in statement 4, wherein the fifth field It is the target domain.

[0354] Statement 6. The method described according to statement 4 or statement 5, wherein the second field It is a distorted domain.

[0355] Statement 7. The method described according to Statement 4 or any of its dependent statements, wherein the script comprises a plurality of subfunctions, and at least one of the plurality of subfunctions is configured to perform a subcomputation in each of the following: the second domain The six extensions mentioned above; the third domain The aforementioned three extensions; the fourth domain The aforementioned secondary extension.

[0356] Statement 8. The method according to statement 4 or any of its dependent statements, wherein the script includes a Miller loop subscript configured to execute a Miller function for a predefined number of inputs, wherein the Miller loop subscript is configured to compute intermediate values, wherein the pairings are computed based on the intermediate values.

[0357] Statement 9. The method according to Statement 8, wherein the Miller loop subscript includes at least one sparse vector multiplication subfunction, wherein the at least one vector multiplication subfunction is in the third domain The above three extensions are executed.

[0358] Statement 10. The method described according to statement 9, wherein the at least one vector multiplication subfunction is a sparse vector multiplication subfunction.

[0359] Statement 11. The method according to any one of statements 8 to 10, wherein the Miller loop subscript includes at least one point addition or point doubling subfunction, wherein the point addition or point doubling subfunction is in the second domain. Executed in China.

[0360] Statement 12. The method according to any one of statements 8 to 11, wherein the Miller loop subscript includes at least one straight line subfunction, wherein the at least one straight line function is in the third domain The above three extensions are executed.

[0361] Statement 13. The method according to Statement 4 or any of its dependent statements, wherein the script includes an exponentiation subscript configured to verify whether a received candidate inverse intermediate value is equal to a target inverse intermediate value, wherein the exponentiation subscript includes a set of subfunctions in the fourth domain. The above secondary extension is executed.

[0362] Statement 14. The method described according to statement 13, which is subordinate to statement 8, wherein the exponentiation subscript receives the intermediate value calculated by the Miller loop subscript as input, wherein the intermediate value is the third field. The elements in the third expansion, wherein the exponentiation subscript is configured to: extract the intermediate value from the third field The elements in the third expansion are converted into the fourth field. The elements in the second expansion.

[0363] Statement 15. The method described according to statement 13 or statement 14, wherein the exponentiation subscript includes a conjugate subfunction configured to compute the inverse of the unitary element in the target domain.

[0364] Statement 16. The method according to any one of statements 13 to 15, wherein the exponentiation subscript includes at least one constant value subfunction, the at least one constant value subfunction being configured to perform the constant number of exponentiations on the identity element via Frobenius endomorphism, wherein the constant value subfunction is configured to operate in the second domain. Perform multiple multiplication operations.

[0365] Statement 17. A computer-implemented method for calculating pairings, wherein the method includes: generating a script configured to perform the method according to any of the preceding statements.

[0366] Statement 18. The method according to Statement 17, wherein the script is a blockchain script, wherein the method further comprises: generating a challenge blockchain transaction, wherein the challenge blockchain transaction includes a first locking script, the first locking script including the script; and providing the challenge blockchain transaction back to one or more nodes of the blockchain network.

[0367] Statement 19. A computer device comprising: a memory including one or more memory cells; and a processing means including one or more processing units, wherein the memory stores code configured to run on the processing means, the code being configured to perform a method according to any one of statements 1 to 18 when executed on the processing means.

[0368] Statement 20. A computer program contained on a computer-readable storage medium and configured to perform the method according to any one of statements 1 to 18 when run on one or more processors.

Claims

1. A computer-implemented method for calculating pairings in a script, the method comprising: A script is generated, wherein computing the pairing includes at least one sub-computation performed in a target domain, wherein the target domain is referred to as an extended domain, and wherein the script includes at least one sub-function configured to perform the sub-computation in an extended form on the extended domain.

2. The method of claim 1, wherein the sub-computation is one of the following: Multiplication operation; Inverse operation.

3. The method according to claim 1 or claim 2, wherein the target domain is a domain of a Barreto-Lynn-Scott (BLS) family of curves with an embedding order of 12.

4. The method according to any one of the preceding claims, wherein the second domain It is the first domain The second extension on, where the third field It is the second domain The second extension on, where the fourth field It is the second domain The third extension, and the fifth field yes: The second domain The six extensions above; The third domain The third extension on; or The fourth domain A secondary extension of the above.

5. The method according to claim 4, wherein the fifth domain It is the target domain.

6. The method according to claim 4 or claim 5, wherein the second domain It is a distorted domain.

7. The method of claim 4 or any dependent claim thereof, wherein the script comprises a plurality of subfunctions, wherein at least one of the plurality of subfunctions is configured to perform a subcomputation in each of the following: The second domain The above six extensions; The third domain The above three extensions; The fourth domain The aforementioned secondary extension.

8. The method of claim 4 or any of its dependent claims, wherein the script includes a Miller loop subscript configured to execute a Miller function for a predefined number of inputs, wherein the Miller loop subscript is configured to compute intermediate values, wherein the pairings are computed based on the intermediate values.

9. The method of claim 8, wherein the Miller loop subscript includes at least one sparse vector multiplication subfunction, wherein the at least one vector multiplication subfunction is in the third domain The above three extensions are executed.

10. The method according to claim 9, wherein the at least one vector multiplication subfunction is a sparse vector multiplication subfunction.

11. The method according to any one of claims 8 to 10, wherein the Miller loop subscript includes at least one point addition or point doubling subfunction, wherein the point addition or point doubling subfunction is in the second domain. Executed in China.

12. The method according to any one of claims 8 to 11, wherein the Miller loop subscript includes at least one straight line subfunction, wherein the at least one straight line function is in the third domain The above three extensions are executed.

13. The method of claim 4 or any dependent claim thereof, wherein the script includes an exponentiation subscript configured to verify whether a received candidate inverse intermediate value is equal to a target inverse intermediate value, wherein the exponentiation subscript includes a set of subfunctions in the fourth domain. The above secondary extension is executed.

14. The method of claim 13, which is dependent on claim 8, wherein the exponentiation subscript receives the intermediate value calculated by the Miller loop subscript as input, wherein the intermediate value is the third domain. The elements in the third expansion, wherein the exponentiation subscript is configured as follows: The intermediate value is from the third domain. The elements in the third expansion are converted into the fourth field. The elements in the second expansion.

15. The method of claim 13 or claim 14, wherein the exponentiation subscript includes a conjugate subfunction configured to compute the inverse of the identity element in the target domain.

16. The method according to any one of claims 13 to 15, wherein the exponentiation subscript comprises at least one constant exponentiation subfunction, the at least one constant exponentiation subfunction being configured to perform the constant number of exponentiations on the identity element via Frobenius automorphism, wherein the constant exponentiation subfunction is configured in the second domain Perform multiple multiplication operations.

17. A computer-implemented method for calculating pairings, wherein the method comprises: Generate a script configured to perform the method according to any one of the preceding claims.

18. The method of claim 17, wherein the script is a blockchain script, and the method further comprises: Generate a challenge blockchain transaction, wherein the challenge blockchain transaction includes a first locking script, and the first locking script includes the script; as well as The challenged blockchain transaction is provided back to one or more nodes in the blockchain network.

19. A computer device, the computer device comprising: The memory includes one or more memory units; as well as A processing apparatus comprising one or more processing units, wherein the memory stores code configured to run on the processing apparatus, the code being configured to execute the method according to any one of claims 1 to 18 when run on the processing apparatus.

20. A computer program, the computer program being contained on a computer-readable storage medium and configured to perform the method according to any one of claims 1 to 18 when executed on one or more processors.

Images