Zero-knowledge proof system based on a national cryptographic algorithm

Abstract

This invention discloses a zero-knowledge proof system (cryptography, zero-knowledge proof) based on national cryptographic algorithms. According to the national standards GB / T 32905-2016 "Information Security Technology SM3 Cryptographic Hash Algorithm" and GB / T 32918 "Information Security Technology SM2 Elliptic Curve Public Key Cryptographic Algorithm" series (including parts 1 to 5), the message padding, message expansion, compression functions, and chain structure of the SM3 hash algorithm are compiled into a first circuit constraint group, and the prime field operation, point operation, double scalar multiplication, and signature verification equation of SM2 signature verification are compiled into a second circuit constraint group. The native implementation is used as the gold standard for pre-computing witnesses and intercepting invalid signatures. After generating a witness trajectory consistent with the gold standard, a zero-knowledge proof is generated under the STARK framework and packaged into a self-describing proof package carrying a configuration version number. The verification end reconstructs the verification configuration according to the configuration within the package and enforces a security lower limit before verification. This invention is the first to achieve a complete circuit implementation of national cryptographic algorithms SM3 and SM2, with circuit constraints corresponding to each clause of the national standards and being auditable, eliminating the risks of under-constraints and degradation.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and zero-knowledge proof technology, specifically to a zero-knowledge proof system based on national cryptographic algorithms, and more particularly to a method and system for fully arithmeticating and circuitizing the SM3 cryptographic hash algorithm and the SM2 digital signature verification algorithm according to national standards and implementing zero-knowledge proof within the STARK framework. Background Technology

[0002] Zero-knowledge proofs allow the prover to prove the correctness of a statement without revealing the secret information behind the statement. They are a fundamental cryptographic technology in fields such as privacy computing, trusted data transfer, blockchain, and digital identity. STARK (Scalable Transparent Argument of Knowledge) proof systems do not require a trusted setup. Their proof size and verification overhead increase nearly logarithmically with the scale of computation, making them suitable for proving the correct execution of complex computations (see: Ben-Sasson et al., "Scalable, Transparent, and Post-Quantum Secure Computational Integrity", IACR ePrint 2018 / 046).

[0003] Existing zero-knowledge proof systems primarily utilize internationally recognized cryptographic algorithms, such as the SHA series of hash algorithms and the NIST standard elliptic curve cryptography. However, for the SM3 cryptographic hash algorithm (GB / T 32905-2016 "Information Security Technology SM3 Cryptographic Hash Algorithm") and the SM2 digital signature algorithm (GB / T 32918 "Information Security Technology SM2 Elliptic Curve Public Key Cryptography Algorithm" series of standards, including Parts 1 to 5) used in China's commercial cryptography system, existing technologies face the following long-standing unresolved challenges: (1) The compression function of the SM3 algorithm combines multiple operations such as circular shift, XOR, modular addition, and Boolean function. Among them, the direct arithmetic cost of circular shift and XOR on the prime field is extremely high. If the circuit is circuitized by looking up the table, the constraint semantics will be out of sync with the national standard clauses, and a lookup table proof component needs to be introduced, which will significantly expand the proof scale. (2) The SM2 algorithm involves 256-bit large integer prime field operations and elliptic curve point operations. The large integer modular multiplication cannot be directly expressed in the prime field (the intermediate product exceeds the field modulus). Existing technologies either use bit decomposition, which leads to an expansion of the number of circuit rows, or use approximate constraints that have not been fully verified, which poses a "under-constrained" security risk, that is, the constraints deviate from the real algorithm quietly and cannot be detected. (3) The existing technology lacks an auditable mapping mechanism that "corresponds to each clause of the national standard clauses" and it is difficult to meet the requirements of commercial cryptography compliance review for traceable and verifiable algorithm implementation; (4) In the prior art, the configuration parameters (such as security strength parameters) of the proof generation end often have default values. Once misused, they will silently generate proofs with low security strength. Furthermore, the verification end trusts the parameters passed by the client, which creates an attack surface of "client falsely reporting parameters".

[0004] Therefore, how to fully, faithfully, and auditably implement the national cryptographic algorithms SM3 and SM2 in a zero-knowledge proof system, and how to engineer the generation and verification of the proof to ensure strict consistency in security parameters and prevent downgraded exploitation, are urgent technical problems to be solved in this field. Summary of the Invention

[0005] To address the aforementioned deficiencies in existing technologies, this invention provides a zero-knowledge proof system based on national cryptographic algorithms. The technical problem it aims to solve is to arithmetically transform the national cryptographic algorithms SM3 and SM2 into circuit constraints according to national standards and implement them within the STARK framework, ensuring a faithful correspondence and auditability between the circuit constraints and national standards. Simultaneously, through gold standard dual-track verification, pre-compliance interception, and mandatory lower limits for security parameters at the verification end, it prevents under-constrained circuits and parameter degradation attacks.

[0006] To address the aforementioned technical problems, this invention provides a zero-knowledge proof method based on Chinese cryptographic algorithms, comprising the following steps: Receive business input data, wherein the business input data includes at least one of the following: a message to be proved, signature data, and public key data; Using the native implementation of the national cryptographic algorithm as the gold standard, the business input data is pre-calculated and witness data is generated. Simultaneously, the business input data undergoes compliance pre-verification. The national cryptographic algorithm includes the SM3 cryptographic hash algorithm implemented according to the national standard GB / T 32905-2016 "Information Security Technology SM3 Cryptographic Hash Algorithm" and the SM2 digital signature verification algorithm implemented according to the national standard GB / T 32918 "Information Security Technology SM2 Elliptic Curve Public Key Cryptography Algorithm" series of standards (including Parts 1 to 5). If the compliance pre-verification fails, the process is rejected from proceeding to the proof generation stage. According to the national standard provisions, the operation process of the national cryptographic algorithm is arithmetically converted into circuit constraints, including: compiling the message filling, message expansion, compression function and Merkle-Damgård chain structure of the SM3 hash algorithm into the first circuit constraint group, and compiling the prime field operation, elliptic curve point operation, double scalar multiplication operation and the verification equation of the SM2 signature verification process into the second circuit constraint group. Based on the witness data, a witness trajectory that satisfies the circuit constraints is generated, and the evaluation result of the witness trajectory is consistent with the calculation result of the gold standard bit by bit. Based on the witness trajectory and the circuit constraints, a zero-knowledge proof is generated under the STARK framework, and the zero-knowledge proof and the verification context are encapsulated into a self-describing proof package. The verification end parses the self-describing proof package, reconstructs the verification configuration based on the verification context carried in the proof package, forces the verification security parameters to be no lower than a preset lower limit, and then performs verification on the zero-knowledge proof.

[0007] Furthermore, in the first circuit constraint group, the state variables, message windows, and intermediate variables of the SM3 compression function adopt a column layout that combines Boolean bit representation and low-order decomposition representation. XOR and cyclic shift bit operations are directly constrained at the bit level, while modular addition operations are switched to low-order decomposition representation and set with explicit carry column constraints. Each message block corresponds to a preset number of trajectory rows consistent with the number of rounds. The sliding window of the message expansion is constrained across rows, and the filling rows introduced by the trajectory being filled to powers of 2 are constrained by the active column gating constraint to prevent them from participating in hash semantics. The compression result of the last active row is constrained to be equal to multiple public low-order decomposition values, which are the SM3 hash values ​​themselves.

[0008] Furthermore, the second circuit constraint group is compiled in a bottom-up chip-based manner, including: compiling the modular multiplication, modular addition, and modular subtraction operations on the SM2 prime field into single-row field operation circuits; using byte low-order decomposition convolution for modular multiplication and signed carry offset encoding to prevent prime field wrapping; and using quotient witness and remainder witness to constrain the completeness of modular reduction; compiling the point multiplication and point addition operations in Jacobian coordinates into single-row fully expanded point operation circuits; and compiling the double scalar multiplication [s]G+[t]P in the SM2 checksum. A Compile into a bitwise scan scalar multiplication chain circuit, where G is the base point and P is the multiplication point. A Let s be the public key point, and t be the signature verification scalars. The offset point technique is used to eliminate the infinite point branch, so that each line performs the doubling point and the bit-selected addition point. The output of the end of the scalar multiplication chain is restored to the x coordinate by the affine normalization circuit. The signature verification equation is compiled into a signature verification equation circuit that includes scalar interval checks, t value non-zero checks and signature verification equation validity checks.

[0009] Furthermore, the compliance pre-verification is as follows: before generating the proof, the signature data is fully verified using the gold standard. If the verification fails, the process is terminated directly and a failure is returned, so that invalid signatures do not enter any circuit evaluation process.

[0010] Furthermore, generating zero-knowledge proofs under the STARK framework includes: submitting the circuit constraints and the witness trajectory to the STARK proof system; the STARK proof system uses a small-feature prime field and a fourth-order algebraic extension of the prime field to carry an arithmetic challenge field; constructing commitments and challenges with arithmetic-friendly hashes; and generating proofs through low-degree extension, polynomial commitments, and Fiat-Shamir transformations; the configurations of the circuit constraints, the witness trajectory, and the STARK proof system are decoupled from each other, and configuration changes do not affect the circuit layer.

[0011] Furthermore, the self-describing proof package includes at least: proof data, public input, message length, version identifier, timestamp, and configuration version number; the verification end reconstructs the verification configuration only based on the configuration version number, and reverts to the production default configuration and issues an alarm for unknown configuration version numbers; the security parameters corresponding to the configuration version number meet the pre-configured mandatory lower limits, which include the lower limit of the number of queries, the lower limit of the proof workload, and the lower limit of the low-degree expansion multiple.

[0012] Furthermore, the zero-knowledge proof of the SM2 signature verification adopts a combinational proof and explicit binding: a first sub-proof is generated using a scalar multiplication chain circuit, a second sub-proof is generated using an affine normalization circuit, and a third sub-proof is generated using a signature verification equality circuit; the public values ​​of the first, second, and third sub-proofs are subjected to equivalence binding checks outside the circuit. The binding checks include scalar consistency binding, base point binding, point value transitivity consistency binding, and x-coordinate closed-loop binding. After all binding checks pass, the three sub-proofs and their binding results are encapsulated into a combinational proof package that is conjunctively equivalent to the full text of the national standard signature verification algorithm.

[0013] Furthermore, it also includes a gold standard dual-track verification: during the proof generation stage, a completeness verification is performed on each set of circuit constraints. The completeness verification is a verification that the witness trajectory is rejected after a negative tampering is applied to the constraint conditions of the circuit constraint, and the evaluation result of the witness trajectory is consistent with the calculation result of the gold standard bit by bit, so that each circuit constraint has positive consistency evidence and negative tampering rejection evidence.

[0014] Furthermore, the generation side of the verification configuration does not provide a default configuration, and the security parameters of the configuration must be explicitly specified by the caller; the verification end forces the verification of the lower limit of the security parameters of the reconstructed configuration in the proof package, so that configurations below the lower limit cannot pass the verification.

[0015] This invention also provides a zero-knowledge proof system based on the national cryptographic algorithm, comprising: an input verification module for receiving and verifying business input data; a gold standard calculation module for using the native implementation of the national cryptographic algorithm as the gold standard pre-calculated witness data and performing compliance pre-verification; a circuitization module for arithmetically converting the operation process of the national cryptographic algorithm into a first circuit constraint group and a second circuit constraint group according to the national standard provisions; a witness trajectory generation module for generating a witness trajectory that is consistent with the gold standard calculation result bit by bit; a proof generation module for generating zero-knowledge proofs under the STARK framework and encapsulating them into a self-describing proof package; and a verification module for reconstructing the verification configuration based on the verification context carried in the proof package, forcibly verifying the lower limit of security parameters, and performing verification.

[0016] Compared with the prior art, the present invention has the following beneficial effects: (1) For the first time, the complete circuitization of the national cryptographic SM3 and SM2 algorithms in the zero-knowledge proof system was realized: the message filling, message expansion, compression function and Merkle-Damgård chain structure of SM3, and the prime field operation, dot operation, double scalar multiplication and signature verification equation of SM2 were all compiled into circuit constraints. The circuit constraints corresponded to the national standard clauses one by one, forming an auditable "constraint-clause" mapping, which met the requirements of commercial cryptography compliance review for traceable and verifiable algorithm implementation; (2) Eliminate the risk of under-constraint through the gold standard dual-track system: The native implementation serves as the gold standard for comparison, witnessing that the trajectory evaluation result is consistent with the gold standard bit by bit, and each circuit constraint is equipped with a negative tampering test, transforming the most dangerous risk in zero-knowledge proof engineering, "circuit constraints quietly deviate from the real algorithm", into a mechanically verifiable equation. The security audit attack surface is cut into two independent verifiable propositions: "circuit itself is correct" and "binding relationship is complete". (3) Achieve “Never produce proof for false propositions” through compliance pre-verification: Invalid signatures are intercepted and rejected by native signature verification before entering any circuit for evaluation, eliminating computational waste and semantic pollution in generating proofs for invalid data; (4) A single contract is achieved between the generation and verification ends through self-describing proof packages and versioned configurations: the verification end only authenticates the configuration version number carried in the proof package to rebuild the configuration, eliminating the "client false parameter" attack surface; the generation side configuration has no default value, and the verification end enforces the lower limit of security parameters, eliminating the silent output of low security strength proofs from both the compilation and runtime levels. (5) Achieve circuit equivalence of the entire verification chain through combined proof and explicit binding: Replace the difficult-to-audit giant circuit with multiple dedicated circuits and public value binding checks. Each sub-circuit can be tested, audited, and reused independently. The proof proposition after combination is exactly equivalent to the full text of the national standard verification algorithm. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall architecture of the zero-knowledge proof system based on the national cryptographic algorithm of this invention.

[0019] To make the objectives, technical solutions, and effects of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the invention. Without departing from the concept of this invention, those skilled in the art can make various modifications to the following embodiments, all of which fall within the protection scope of this invention.

[0020] like Figure 1 As shown, the zero-knowledge proof system based on the national cryptographic algorithm of the present invention adopts a layered architecture, which consists of the following layers from bottom to top: STARK basic framework layer (L1), national cryptographic circuit layer (L2), proof orchestration layer (L3) and application interface layer (L4). Figure 1 In the Chinese code: 1 is input validation, 2 is compliance pre-interception, 3 is witness pre-computation, 4 is witness trajectory generation, 5 is zero-knowledge proof generation, 6 is self-describing proof package encapsulation, and 7 is verification end configuration reconstruction and security parameter lower limit enforcement.

[0021] The STARK foundational framework layer (L1) provides primitive capabilities for prime field arithmetic, polynomial commitments, low-degree extensions, Fiat-Shamir challenges, and proof generation / verification. In this embodiment, the arithmetic field is a small-character prime field (modulus approximately 2^n). 31 The challenge field is a quartic algebraic extension of the prime field; the commitment and challenge construction uses arithmetic-friendly hashing (sponge structure permutation); the polynomial commitment uses the FRI polynomial commitment scheme based on Merkle trees. All of the above components are replaceable slots, and replacement does not affect the upper-level circuitry.

[0022] The national cryptographic circuit layer (L2) is the core of this invention, comprising two independent circuit modules: an SM3 circuitization module (corresponding to the first circuit constraint group) and an SM2 circuitization module (corresponding to the second circuit constraint group). These two circuit modules are independent of each other and are unaware of any proof configuration or business concepts; their external contract is merely a public input layout. Simultaneously, the national cryptographic circuit layer includes the following gold standard modules: a native SM3 implementation (based on GB / T 32905-2016 "Information Security Technology SM3 Cryptographic Hash Algorithm"), a native SM2 prime field and curve implementation, and a native SM2 signature verification implementation (based on the GB / T 32918 "Information Security Technology SM2 Elliptic Curve Public Key Cryptography Algorithm" series of standards, including parts 1 to 5).

[0023] The proof orchestration layer (L3) receives business input, calls the gold standard module to perform pre-computation and compliance pre-verification, calls the national cryptographic circuit layer to generate witness traces, generates zero-knowledge proofs on the STARK basic framework layer, and encapsulates the proof and verification context into a self-describing proof package. The verification side parses the proof package, reconstructs the configuration, enforces lower limits on security parameters, and performs verification. The proof orchestration layer is the sole convergence point for cryptographic decisions, exposing only coarse-grained business functions to the upper layers.

[0024] The application interface layer (L4) provides an entry point for interaction with upper-layer applications. It receives the message to be proven, signature data, and public key data, performs format verification (such as hexadecimal encoding, length, and format prefix verification), and then forwards it to the proof orchestration layer, returning the proof package and verification result. This layer does not contain any cryptographic logic; it is only for boundary defense and protocol adaptation, and its replacement does not affect the proof semantics.

[0025] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A zero-knowledge proof method based on Chinese cryptographic algorithms, characterized in that, Includes the following steps: Receive business input data, wherein the business input data includes at least one of the following: a message to be proved, signature data, and public key data; Using the native implementation of the national cryptographic algorithm as the gold standard, the business input data is pre-calculated and witness data is generated. Simultaneously, the business input data undergoes compliance pre-verification. The national cryptographic algorithm includes the SM3 cryptographic hash algorithm implemented according to the national standard GB / T32905-2016 "Information Security Technology SM3 Cryptographic Hash Algorithm" and the SM2 digital signature verification algorithm implemented according to the national standard GB / T 32918 "Information Security Technology SM2 Elliptic Curve Public Key Cryptography Algorithm" series of standards (including Parts 1 to 5). If the compliance pre-verification fails, the process is rejected from proceeding to the proof generation stage. According to the national standard provisions, the operation process of the national cryptographic algorithm is arithmetically converted into circuit constraints, including: compiling the message filling, message expansion, compression function and Merkle-Damgård chain structure of the SM3 hash algorithm into the first circuit constraint group, and compiling the prime field operation, elliptic curve point operation, double scalar multiplication operation and the verification equation of the SM2 signature verification process into the second circuit constraint group. Based on the witness data, a witness trajectory that satisfies the circuit constraints is generated, and the evaluation result of the witness trajectory is consistent with the calculation result of the gold standard bit by bit. Based on the witness trajectory and the circuit constraints, a zero-knowledge proof is generated under the STARK framework, and the zero-knowledge proof and the verification context are encapsulated into a self-describing proof package. The verification end parses the self-describing proof package, reconstructs the verification configuration based on the verification context carried in the proof package, forces the verification security parameters to be no lower than a preset lower limit, and then performs verification on the zero-knowledge proof.

2. The method according to claim 1, characterized in that, In the first circuit constraint group, the state variables, message windows, and intermediate variables of the SM3 compression function adopt a column layout that combines Boolean bit representation and low-order decomposition representation. XOR and cyclic shift bit operations are directly constrained at the bit level, while modular addition operations are switched to low-order decomposition representation and set with explicit carry column constraints. Each message block corresponds to a preset number of trajectory rows consistent with the round number. The sliding window of the message expansion is constrained across rows, and the filling rows introduced by the trajectory being padded to powers of 2 are constrained by the active column gating constraint to prevent them from participating in the hash semantics. The compression result of the last active row is constrained to be equal to multiple public low-order decomposition values, which are the SM3 hash values ​​themselves. The second circuit constraint group is compiled in a bottom-up chip-based manner, including: compiling modular multiplication, modular addition, and modular subtraction operations on the prime field of SM2 into single-row field operation circuits; modular multiplication using byte low-order decomposition convolution and signed carry offset encoding to prevent prime field wrapping; and using quotient witness and remainder witness to constrain the completeness of modular reduction; compiling point multiplication and point addition operations in Jacobian coordinates into single-row fully expanded point operation circuits; and compiling the double scalar multiplication [s]G+[t]P in SM2 verification. A Compile into a bitwise scan scalar multiplication chain circuit, where G is the base point and P is the multiplication point. A Let s be the public key point, and t be the signature verification scalars. The offset point technique is used to eliminate the infinite point branch, so that each line performs the doubling point and the bit-selected addition point. The output of the end of the scalar multiplication chain is restored to the x coordinate by the affine normalization circuit. The signature verification equation is compiled into a signature verification equation circuit that includes scalar interval checks, t value non-zero checks and signature verification equation validity checks.

3. The method according to claim 1, characterized in that, The compliance pre-verification is as follows: before generating the proof, the signature data is fully verified using the gold standard. If the verification fails, the process terminates directly and returns a failure, preventing invalid signatures from entering any circuit evaluation process. It also includes a gold standard dual-track verification: during the proof generation stage, a completeness verification is performed on each set of circuit constraints. The completeness verification is a verification that the witness trajectory is rejected after a negative tampering is applied to the constraint conditions of the circuit constraints, and the evaluation result of the witness trajectory is consistent with the calculation result of the gold standard bit by bit, so that each circuit constraint has positive consistency evidence and negative tampering rejection evidence.

4. The method according to claim 1, characterized in that, Generating zero-knowledge proofs under the STARK framework includes: submitting the circuit constraints and the witness trajectory to the STARK proof system; the STARK proof system uses a small-feature prime field and a fourth-order algebraic extension of the prime field to carry an arithmetic challenge field; constructing commitments and challenges with arithmetic-friendly hashes; and generating proofs through low-degree extension, polynomial commitments, and Fiat-Shamir transformations; the configurations of the circuit constraints, the witness trajectory, and the STARK proof system are decoupled from each other, and configuration changes do not affect the circuit layer.

5. The method according to claim 1, characterized in that, The self-describing proof package includes at least: proof data, public input, message length, version identifier, timestamp, and configuration version number; the verification end reconstructs the verification configuration only based on the configuration version number, and reverts to the production default configuration and issues an alarm for unknown configuration version numbers; the security parameters corresponding to the configuration version number meet the pre-configured mandatory lower limits, which include the lower limit of the number of queries, the lower limit of the proof workload, and the lower limit of the low-degree expansion multiple; the generation side of the verification configuration does not provide a default configuration, and the security parameters of the configuration must be explicitly specified by the caller; the verification end forcibly verifies the lower limit of the security parameters of the reconstructed configuration in the proof package, so that configurations below the lower limit cannot pass verification.

6. The method according to claim 1, characterized in that, The zero-knowledge proof of the SM2 signature verification adopts a combination of proof and explicit binding: a scalar multiplication chain circuit generates the first sub-proof, an affine normalization circuit generates the second sub-proof, and a signature verification equality circuit generates the third sub-proof; the public values ​​of the first, second, and third sub-proofs are subjected to equivalence binding checks outside the circuit. The binding checks include scalar consistency binding, base point binding, point value transitivity consistency binding, and x-coordinate closed-loop binding. After all binding checks pass, the three sub-proofs and their binding results are encapsulated into a combination proof package that is conjunctively equivalent to the full text of the national standard signature verification algorithm.

7. A zero-knowledge proof system based on Chinese cryptographic algorithms, characterized in that, include: An input verification module is used to receive and verify business input data, wherein the business input data includes at least one of the following: a message to be verified, signature data, and public key data. The gold standard calculation module is used to pre-calculate and generate witness data for the business input data using the native implementation of the national cryptographic algorithm as the gold standard, and to perform compliance pre-verification on the business input data; the national cryptographic algorithm includes the SM3 cryptographic hash algorithm implemented according to the national standard GB / T 32905-2016 "Information Security Technology SM3 Cryptographic Hash Algorithm" and the SM2 digital signature verification algorithm implemented according to the national standard GB / T 32918 "Information Security Technology SM2 Elliptic Curve Public Key Cryptographic Algorithm" series of standards (including parts 1 to 5); The circuitization module is used to arithmetically convert the operation process of the national cryptographic algorithm into circuit constraints according to the national standard provisions. This includes compiling the message filling, message expansion, compression function and Merkle-Damgård chain structure of the SM3 hash algorithm into the first circuit constraint group, and compiling the prime field operation, elliptic curve point operation, double scalar multiplication operation and verification equation of the SM2 signature verification process into the second circuit constraint group. The witness trajectory generation module is used to generate a witness trajectory that satisfies the circuit constraints based on the witness data, and the evaluation result of the witness trajectory is consistent with the calculation result of the gold standard bit by bit. The proof generation module is used to generate zero-knowledge proofs based on the witness trajectory and the circuit constraints under the STARK framework, and to encapsulate the zero-knowledge proofs and the verification context into a self-describing proof package. The verification module is used to parse the self-describing proof package, reconstruct the verification configuration based on the verification context carried in the proof package, force the verification security parameters to be no lower than a preset lower limit, and then perform verification on the zero-knowledge proof.

8. The system according to claim 7, characterized in that, In the circuitization module, the first circuit constraint group adopts a column layout that combines Boolean bit representation and low-order decomposition representation, and sets an active column to perform gating constraints on the padding rows introduced by padding to powers of 2; the second circuit constraint group is compiled sequentially in a chip-based manner, including a single-row domain operation circuit, a single-row fully expanded point operation circuit, a bit-scan scalar multiplication chain circuit, an affine normalization circuit, and a signature verification equation circuit; the proof generation module generates SM2 verification certificates in a combined proof manner, the SM2 verification certificate consists of a scalar multiplication chain sub-proof, an affine normalization sub-proof, and a signature verification equation sub-proof, and performs equivalence binding checks on the public values ​​of the three sub-proofs outside the circuit, including scalar consistency binding, base point binding, point value transitive consistency binding, and x-coordinate closed-loop binding.

9. The system according to claim 7, characterized in that, The verification module enforces the lower limits of three security parameters—query count, proof workload, and low-degree expansion multiple—on the reconstructed verification configuration within the proof package. For unknown configuration version numbers, it reverts to the production default configuration and issues an alarm.

10. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the zero-knowledge proof method based on the national cryptographic algorithm as described in any one of claims 1 to 6.

Images