Galois ring based rmfe implementation method

Abstract

A method for implementing RMFE based on the Galois ring involves initializing and selecting the Galois ring to obtain the interpolation set on the Galois ring, then performing polynomial interpolation calculations on the Galois ring based on the input RMFE; finally, the interpolated Galois ring GR(p k The polynomial on (r) is transformed into the Galois ring GR(p) k The elements on the integer ring (dr) are used to implement the RMFE mapping φ and the inverse mapping ψ, and finally the two mappings are concatenated to implement the RMFE. This invention addresses the gaps in the existing technology by implementing and optimizing the efficiency of the polynomial interpolation algorithm on the Galois ring, making it possible to extend many cryptographic protocols to integer rings, while improving the amortization efficiency of the protocols.

Description

Technical Field

[0001] This invention relates to a technology in the field of blockchain applications, specifically a reverse multiplication-friendly embedding (RMFE) implementation method based on the GALOIS ring. Background Technology

[0002] Most secure multi-party computation and zero-knowledge proof protocols are constructed using arithmetic circuits over finite fields. Extending existing cryptographic protocols to integer rings... It is of great significance because It is closer to hardware implementation and more compatible with binary circuits. However, Since there isn't a sufficiently large interpolation set, the general approach is to construct the protocol on its extended Galois ring. RMFE is a protocol derived from the Galois ring. A pair of mappings that maps the element-wise product of the Galois ring to The element-wise product of vectors in the ring of integers. The application of RMFE has extended many cryptographic protocols to the ring of integers. This makes it possible. However, there is still a lack of work on implementing RMFE on the Galois ring. Summary of the Invention

[0003] To address the aforementioned shortcomings of existing technologies, this invention proposes an RMFE implementation method based on Galois rings, enabling the generalization of many cryptographic protocols to integer rings. This makes it possible and improves the efficiency of the protocol's cost-sharing.

[0004] This invention is achieved through the following technical methods:

[0005] This invention relates to a method for implementing an RMFE based on a Galois ring, comprising:

[0006] Step 1: Initialize and select the Galois ring to obtain the interpolation set on the Galois ring, specifically including:

[0007] 1.1 Construct a cycle by selecting a prime number p and an exponent k. Heyu

[0008] 1.2 Construct a polynomial h(Y) = a0 + a1Y + ... + a r Y r , Where: a r =β r =1, other a i It is the set {0,1,…,p} k Elements within {-1}, β iIt is an element in the set {0,1,…,p-1}, that is, a polynomial whose first highest term has a degree of r; after all the coefficients of H(Y) modulo the prime number p, a new polynomial h`(Y) = β0 + β1Y + … + β r Y r , h`(Y) is a primitive polynomial with a first term, irreducible, and a highest term of degree r.

[0009] The polynomial h`(Y) satisfies the primitive polynomial property, i.e. And for any prime number p i |p r -1 has That is, the degree of h`(Y) is p r -1.

[0010] 1.3h`(Y) satisfies If we set h(Y) = h`(Y), then It is a primitive polynomial with the first term and the highest degree of r, and order p. r -1. For h(Y), there exists a class of roots. satisfy Right now It is a Galois ring of order p. r -1 is a non-zero element.

[0011] 1.4 Constructing a Galois ring and set All elements in set T lie on a Galois ring and satisfy the condition that the difference between any two elements is invertible.

[0012] Step 2: Based on the input RMFE, perform polynomial interpolation calculations on the Galois ring, specifically including:

[0013] 2.1 Given the input vector a∈GR(p) of the RMFE k ,r) n Randomly select n distinct elements from set T to form the interpolation point set. Where n≤p r -1.

[0014] 2.2 Perform the inversion of elements on the Galois ring using any of the following methods.

[0015] According to the nonzero element a∈GR(p) on the Galois ring k ,r), that is When the inverse of a is b∈GR(p) k ,r), and Then there is The above expression can be written in matrix multiplication form: First, multiply the last two matrices on the left side of the above equation to form the matrix with respect to the unknowns b0, b1, ... b r-1 A system of linear equations. Using Gaussian elimination on the system of linear equations, we obtain the inverse of a, b.

[0016] According to the nonzero element a∈GR(p) on the Galois ring k ,r), that is When the inverse of a is b∈GR(p) k ,r), and Then there is From the extended Euclidean algorithm over finite fields, we can obtain Solving for the results In model p 2 Under the conditions, Satisfy the equation Similarly, the solution is obtained Substituting the above equation, we get... Solving for the results Iterate k times, and solve in sequence to obtain We obtain the inverse of a, b.

[0017] Step 3: Calculate the interpolated Galois ring GR(p) k The polynomial on (r) is transformed into the Galois ring GR(p) k Elements on (,dr) implement RMFE mapping φ. Specifically: Where: g(x) = h(x) d ), that is, γ, Satisfying Relationships For Galois ring GR(p) k any element on (dr) Then add the Galois ring GR(p) k The polynomial on (r) is transformed into the Galois ring GR(p) k Elements on (dr).

[0018] Step 4: Implement the inverse mapping ψ in RMFE, that is, GR(p k An element on ,dr) is mapped to GR(p) k The vector on (r), specifically: according to GR(p) k elements on ,dr) And satisfy m∈Im(φ); transform element m into GR(p) according to step three. kA polynomial over the Galois ring GR(p,r) in step two k The set of interpolation points on the line r is assigned values ​​to obtain the input vector a of the RMFE.

[0019] Step 5: Cascade Steps 3 and 4 to implement RMFE, specifically by mapping the two RMFEs. and input vector Divide 'a' into groups of length n1, resulting in n2 groups. Apply the RMFE mapping φ1 to each sub-vector to obtain the vector. Applying the RMFE mapping φ2 to vector b, we obtain the Galois ring GR(p) k Elements on (,dr) implement cascaded RMFE mappings. Technical effect

[0020] This invention utilizes secure multi-party computation and zero-knowledge domains to implement two methods for finding inverses on Galois rings; it also implements GR(p k Polynomials over r) and GR(p) k Methods for converting elements between ,dr) are implemented; RMFE cascading is implemented, supporting the cascading of any number of RMFEs, extending many cryptographic protocols to integer rings. This also improves the efficiency of the agreement's cost-sharing mechanism. Attached Figure Description

[0021] Figure 1 This is a flowchart of the present invention;

[0022] Figure 2 This is a schematic diagram of the system of the present invention;

[0023] Figure 3 The graph shows the relationship between the runtime and k of (18,54;2)-RMFE and (6,54;4)-RMFE. Detailed Implementation

[0024] like Figure 1 As shown, this invention relates to a method for implementing cascaded RMFE mapping based on a Galois ring. The method includes the following steps:

[0025] Step 1) Determine the relevant parameters for generating the Galois ring, and obtain the exceptional set T, which specifically includes:

[0026] 1.1) Select the relevant parameters of the Galois ring: a prime number p, an exponent k that is a random integer of arbitrary bits, and n1, n2, D, r, d that are integers. These parameters need to satisfy the conditions: D(n1-1)≤r, D(n2-1)≤d, p+1≤n1, p r +1≤n2.

[0027] 1.2) The number of times the highest term is generated is p r -1 first polynomial exist Factor it to obtain For irreducible polynomials satisfying the highest term of degree r, a test is performed. This test must satisfy the condition that for any prime number p... i |p r -1 has That is, the selected polynomial factors are primitive polynomials with the first term, irreducible, and highest term of degree r, and their order is p. r -1, let the polynomial factor be h(Y) on the given surface. There exists a class of roots for h(Y). satisfy Right now The order of the Galois ring can be represented as p. r -1 is a non-zero element. Y, The following relation is satisfied in the Galois ring: Polynomial f(x) = h(x) d That is, satisfying deg(f) = rd, let the root of f be γ, γ, Satisfying Relationships Define the Galois ring GR(p) using f(x). k ,dr) facilitates the interaction of its elements with the Galois ring GR(p k Polynomials on (r) can be transformed into each other.

[0028] 1.3) Constructing a Galois ring structure gather Total p r One element;

[0029] Constructing Galois rings

[0030] Step 2) Implement the mapping of the first stage of RMFE. Specifically, it includes:

[0031] 2.1) Based on the RMFE input vector of length n1n2, divide it into groups of length n1, resulting in a total of n2 groups.

[0032] 2.2) Randomly select n1 elements from the set {0,1…p-1} as the interpolation point set T1.

[0033] 2.3) Run the Lagrange interpolation algorithm on each set of subvectors and interpolation points T1 to obtain the ring. n² polynomials.

[0034] 2.4) For the Galois ring GR(p k any element on r) Naturally, the ring The n² polynomials on the y-axis are transformed into the Galois ring GR(p) k n2 elements on r).

[0035] Step 3) Implement the mapping of the second stage of RMFE. Specifically, it includes:

[0036] 3.1) In the set n2 elements are randomly selected from the set of interpolation points T2.

[0037] 3.2) The Galois ring GR(p) generated in the previous step k The Lagrange interpolation algorithm is applied to the set of n2 elements and interpolation points T2 on the Galois ring GR(p,r), and the result is obtained by performing the Lagrange interpolation algorithm on the Galois ring GR(p,r). k A polynomial over (r).

[0038] 3.3) For the Galois ring GR(p k any element on (dr) According to the above formula, the Galois ring GR(p k The polynomial on (r) is transformed into the Galois ring GR(p) k Elements on (dr).

[0039] In the specific experiment, the (18,54;2)-RMFE mapping was set. Mapping φ2:GR(2) 16 ,3) 9 →GR(2 16 ,54).

[0040] Set the polynomial f(x) = x 3 +x+1,g(x)=f(x 18 )=x 54 +x 18 +1, that is

[0041] Set the input vector to (1,9,2,8,3,7,4,6,5,5,6,4,7,3,8,2,9,1).

[0042] Set T1 = ([0], [1]).

[0043] Set T2 = ([52798 25053 34096][33316 54572 4873][53427 6919 26938][4088 5144726567][28405 22399 22173).

[0044] Mapping φ1 yields the Galois ring GR(2) 16 ,3) The above 9 elements are: ([9 65528][8 65530][7 65532][6 65534][5][4 2][3 4][2 6][1 8]).

[0045] Mapping φ2 yields the Galois ring GR(2) 16 The elements on (,20) are:

[0046] [2 22211 30556 11899 53636 34979 43323 4 1 0 0 0 0 0 0 0 0 0 6 2900123035 2710 62828 42503 36529 65528 8 0 0 0 0 0 0 0 0 0 0 34271 4368 3863926897 61168 31265 0 0 0 0 0 0 0 0 0 0 0].

[0047] RMFE inverse mapping acts on GR(2) 16 The elements on (,20) are output as vector (1,9,2,8,3,7,4,6,5,5,6,4,7,3,8,2,9,1).

[0048] like Figure 2 As shown, this embodiment illustrates a system for implementing the above method, comprising: in an integer ring The two mappings of RMFE, which run secure multi-party computation or zero-knowledge proof instances on the Galois ring, correspond to the protocols running on the Galois ring. RMFE will connect the integer ring. The input is mapped onto the Galois ring. Sufficient interpolation points are found on the Galois ring for interpolation, and the corresponding protocol is run. The output from the Galois ring is then mapped back using the RMFE inverse mapping. Above, this leads to the conclusion that it is possible to achieve this within the integer ring. Secure multi-party computation or zero-knowledge proof protocols running on it.

[0049] The engineering application value of this invention lies in providing guidance for the implementation of RMFE tools commonly used in the fields of secure multi-party computation and zero-knowledge proofs. Specifically, it accelerates the algorithm for finding interpolation points on Galois rings; implements two algorithms for finding inverses on Galois rings and accelerates the polynomial interpolation algorithm on Galois rings; and implements GR(p k Polynomials over r) and GR(p) k An algorithm for converting elements between ,dr) is implemented; cascading of RMFEs is implemented, which can support the cascading of any number of RMFEs.

[0050] This invention can be applied to the field of outsourced computing. In outsourced computing, the server needs to prove that it performed the computation honestly. The computation between the two parties is typically... This is because computers are naturally suited to Model 2. k The operation. By using RMFE, it can be... Data on the finite field is mapped to the Galois ring, thus enabling the use of proven proof protocols over finite fields to ensure the reliability and verifiability of the computation.

[0051] Specifically, when a server needs to prove that it has honestly computed a certain arithmetic circuit, existing compilers can transform this problem into an R1CS (rank-1 constraint system) problem. That is, the server needs to convince the user that it possesses a vector w such that the relation Aw·Bw=Cw holds, where A, B, and C are public matrices, and each element is in... In the middle. Due to The lack of interpolation points prevents the use of proof protocols over finite fields. In the system implemented in this invention, data from A, B, C, w is grouped, and RMFE is used to transfer the data from... The above mapping onto the Galois ring allows the proof to be performed on the Galois ring.

[0052] The parameters are set as k=2, d=3. The parameters of RMFE are

[0053] Group the data in matrices A, B, and C, that is, treat every two data points as a group.

[0054] Run RMFE for each set of data, and the results are as follows: w = (x), where x is GR(2) 2 Generators of ,3). Using the zero-knowledge proof protocol for R1CS on the Galois ring, it is possible to achieve this in GR(2 2,3) Complete the proof above.

[0055] Table 1 shows the different parameters obtained from tests when D=2 and D=4 (d is the maximum number of multiplications supported) (for example, (4,25) represents RMFE). RMFE runtime (unit: ms).

[0056] Table 1

[0057] Compared to existing technologies, this method transfers zero-knowledge proof protocols over finite fields to integer rings. This approach, closer to computer hardware implementation, yields superior performance. Furthermore, packaging data and mapping it to elements on the Galois ring using RMFE distributes the overall system runtime, further improving performance.

[0058] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation methods within the scope of the claims are subject to the constraints of the present invention.

Claims

1. A method for implementing RMFE based on a Galois ring, characterized in that, After initializing and selecting the Galois ring to obtain the interpolation set on the Galois ring, polynomial interpolation calculations are performed on the Galois ring based on the input RMFE; then the interpolated Galois ring GR(p k The polynomial on (r) is transformed into the Galois ring GR(p) k The elements on (,dr) are used to implement the RMFE mapping φ and the inverse mapping ψ, and finally the two mappings are cascaded to implement the RMFE.

2. The implementation method of RMFE based on Galois ring according to claim 1, characterized in that, The interpolation set on the Galois ring is obtained in the following way: 1.1 Construct a cycle by selecting a prime number p and an exponent k. Heyu 1.2 Construct a polynomial h(Y) = a0 + a1Y + ... + a r Y r , Where: a r =β r =1, other a i It is the set {0,1,…,p} k Elements within {-1}, β i It is an element in the set {0,1,…,p-1}, that is, a polynomial whose first highest term has a degree of r; after all the coefficients of h(Y) modulo the prime number p, a new polynomial h`(Y) = β0 + β1Y + ... + β r Y r , h`(Y) is a primitive polynomial with the first term, irreducible, and degree r of the highest term; 1.3h`(Y) satisfies Set h(Y) = h`(Y), that is... It is a primitive polynomial with the first term and the highest degree of r, and order p. r -1, for h(Y), there exists a class of roots satisfy Right now It is a Galois ring of order p. r -1 is a non-zero element; 1.4 Constructing a Galois ring and set All elements in set T lie on a Galois ring and satisfy the condition that the difference between any two elements is invertible.

3. The implementation method of RMFE based on Galois ring according to claim 2, characterized in that, The polynomial h`(Y) described above satisfies the primitive polynomial property, i.e. And for any prime number p i |p r -1 has That is, the degree of h`(Y) is p r -1.

4. The implementation method of RMFE based on Galois ring according to claim 1, characterized in that, The polynomial interpolation calculation mentioned above is specifically... include: 2.1 Based on the input vector a∈GR(p) of RMFE k ,r) n Randomly select n distinct elements from set T to form the interpolation point set. Where: n≤p r -1; 2.2 Perform element inversion calculations on the Galois ring using any of the following methods: a) Based on the nonzero element a∈GR(p) on the Galois ring k ,r), that is When the inverse of a is b∈GR(p) k ,r), and Then there is The above expression can be written in matrix multiplication form: First, multiply the last two matrices on the left side of the above equation to form the matrix with respect to the unknowns b0, b1, ... b r-1 Given a system of linear equations, we can use Gaussian elimination to obtain the inverse of a, b. b) Based on the nonzero element a∈GR(p) on the Galois ring k ,r), that is When the inverse of a is b∈GR(p) k ,r), and Then there is From the extended Euclidean algorithm over finite fields, we can obtain Solving for the results In model p 2 Under the conditions, Satisfy the equation Similarly, the solution is obtained Substituting the above equation, we get... Solving for the results Iterate k times, and solve in sequence to obtain We obtain the inverse of a, b.

5. The method for implementing RMFE based on a Galois ring according to claim 1, characterized in that, The mapping φ is specifically as follows: Where: g(x) = h(x) d ), that is, γ, Satisfying Relationships For Galois ring GR(p) k any element on (dr) Then add the Galois ring GR(p) k The polynomial on (r) is transformed into the Galois ring GR(p) k Elements on (dr).

6. The method for implementing RMFE based on a Galois ring according to claim 1, characterized in that, The inverse mapping ψ is specifically: GR(p) k An element on ,dr) is mapped to GR(p) k The vector on (r), specifically: according to GR(p) k elements on ,dr) And satisfy n∈Im(φ); transform element m into GR(p) according to step three. k A polynomial over the Galois ring GR(p,r) in step two k The set of interpolation points on the line r is assigned values ​​to obtain the input vector a of the RMFE.

7. The implementation method of RMFE based on Galois ring according to claim 1, characterized in that, The aforementioned mapping cascading specifically refers to: based on two RMFE mappings and input vector Divide 'a' into groups of length n1, resulting in n2 groups. Apply the RMFE mapping φ1 to each sub-vector to obtain the vector. Applying the RMFE mapping φ2 to vector b, we obtain the Galois ring GR(p) k Elements on (,dr) implement cascaded RMFE mappings.

Images