Right kernel multiplexing and partial decomposition based rank metric zero-knowledge proof authentication method
By adopting a rank-based zero-knowledge proof authentication method based on right-core reuse and partial decomposition, the problem of excessive evidence length and signature size in existing technologies is solved, and effective rank-constrained verification and evidence compression are achieved in post-quantum authentication systems, thus promoting the development of post-quantum signature technology.
Patent Information
- Application Number
- CN202611345070.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-01
- Publication Date
- 2026-11-03
AI Technical Summary
Existing rank metric proofs adapted to the MPC-in-the-Head or VOLE-in-the-Head paradigms require explicit preservation of the complete secret, complete rank factorization, or an additional right kernel matrix, resulting in large evidence lengths and signature arithmetic parts. This fails to meet the engineering requirements of proving linear and rank constraints while reducing evidence length in post-quantum authentication systems.
A rank-based zero-knowledge proof authentication method based on right-kernel reuse and partial decomposition is adopted. The RSD and MinRank problems are partially decomposed, the complete secret matrix is reconstructed using the public linear relations in the system form, and the rank constraint is verified by directly generating the right-kernel matrix, thus constructing a post-quantum signature scheme.
It enables the verification of the rank constraint of the secret matrix without adding additional right-core evidence, reduces the evidence length and signature size, is suitable for the development of post-quantum signature technology, and optimizes the efficiency of identity authentication and digital signature.
Smart Images
Figure CN123034955A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a technology in the fields of information security and post-quantum cryptography, specifically to a rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition for the rank syndrome decoding (RSD) problem and the minimum rank (MinRank) problem. Background Technology
[0002] Existing rank metric proofs adapted to the MPC-in-the-Head or VOLE-in-the-Head (VOLEitH) paradigm typically require explicitly preserving the complete secret, the complete rank factorization factor, or an additional right kernel matrix. This results in a large evidence length and a large signature arithmetic part, failing to meet the engineering requirements of post-quantum authentication systems to prove linear and rank constraints while reducing evidence length and thus optimizing signature size. Summary of the Invention
[0003] To address the aforementioned shortcomings of existing technologies, this invention proposes a rank-metric zero-knowledge proof authentication method based on right-kernel reuse and partial decomposition. It partially decomposes the secret matrix in RSD and MinRank problems and reconstructs the complete secret matrix using publicly available linear relations in a systematic form. Simultaneously, it directly generates a right-kernel matrix based on the same matrix from the partial decomposition, thereby verifying the rank constraint of the secret matrix without introducing additional right-kernel evidence. Based on the zero-knowledge proof authentication protocol, a post-quantum signature scheme can be further constructed, which is of great significance for promoting the development of post-quantum signature technology.
[0004] This invention is achieved through the following technical solution:
[0005] This invention relates to a rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition, comprising:
[0006] Step 1: Initialize parameters and select a zero-knowledge proof protocol, specifically including:
[0007] 1.1 Select the parameters, finite field representation, security level, hash function, and VOLEitH parameters for the rank syndrome decoding RSD problem or the minimum rank MinRank problem, and select the VOLEitH protocol that supports polynomial constraint proofs of degree no more than three.
[0008] 1.2 Let For prime powers, For containing A finite field of elements for of Secondary expansion It is a positive integer. The target rank weight; express An identity matrix of order 1. This indicates that the matrix is concatenated column by column. This indicates that the matrix is concatenated row by row. Represents the transpose of a matrix or vector.
[0009] Step 2: Convert the public linear matrix into a systematic form and divide the secret to be proven into a first part matrix and a second part matrix, i.e., fixed... about After a set of bases, The vector on the coordinate-by-coordinate expansion according to the basis is The linear bijective of the matrix above, and then A matrix on the matrix is flattened by rows into a linear bijection of vectors, specifically including:
[0010] A) For RSD instances, convert the public matrix into system form. secret vector satisfy And order ,in: This is the first part of the matrix. This is the second part of the matrix.
[0011] B) For MinRank instances, convert the public matrix into system form. Secret Matrix satisfy Without loss of generality, we assume Divisible And record At that time, the secret matrix is divided into rows. ,in: This is the first part of the matrix. This is the second part of the matrix.
[0012] Step 3: Perform partial decomposition on the second part of the matrix obtained in Step 2, that is, perform rank decomposition only on the second part of the matrix retained by the publicly disclosed matrix in the system form, without decomposing the matrix corresponding to the complete secret vector or the complete secret matrix; Second Evidence Matrix It is also used in the construction of the subsequent right kernel matrix, specifically including:
[0013] A) Calculate the first evidence matrix for the RSD instance. Second Evidence Matrix The second part of the matrix satisfies ;
[0014] B) Calculate the first evidence matrix for the MinRank instance. Second Evidence Matrix The second part of the matrix satisfies .
[0015] Step 4: Reconstruct the first part of the matrix based on the publicly disclosed linear relationship. This involves using the identity matrix portion of the publicly disclosed matrix in its systematic form, and calculating the first part of the matrix as a linear combination of the publicly disclosed syndrome and the second part of the matrix. Therefore, the first part of the matrix does not need to be submitted as independent evidence. Specifically, this includes:
[0016] A) For RSD instances, first, from the second part of the matrix... calculate Then according to Reconstruct the left-hand side of the secret vector and compute Thus Established;
[0017] B) For MinRank instances, according to Reconstruct the first part of the matrix Thus .
[0018] Step 5: Construct the right kernel matrix directly from the second evidence matrix and generate rank constraints, i.e., the right kernel has full column rank, thus ensuring that the rank of the complete secret does not exceed [a certain value]. The key is generated from a rank that is exactly... And before Sampling is performed from a linearly independent secret set to ensure that the target rank weight is... Specifically, it includes:
[0019] A) For RSD instances, the second evidence matrix Construct the right nucleus And verify the constraints Due to the partial decomposition relation, The identical right kernel relation is automatically satisfied, therefore the complete matrix X = σ(x) satisfies the right kernel constraint. The rank constraint means that the aforementioned right kernel has a full column rank, thus ensuring that the rank of the complete secret does not exceed [a certain value]. The key is generated from a rank that is exactly... And before Sampling is performed from a linearly independent secret set to ensure that the target rank weight is... .
[0020] B) For MinRank instances, the second evidence matrix Construct the right nucleus And verify the constraints Due to the partial decomposition relation, The same right kernel relation is automatically satisfied, hence the complete secret matrix. Satisfies the right kernel constraint.
[0021] Step 6: Convert the partial decomposition relation, linear reconstruction relation, and right kernel rank verification relation into low-order polynomial constraints, i.e., the total degree of the product of all evidence variables in each constraint does not exceed three; when the selected proof protocol only supports quadratic constraints, the cubic constraints can be expanded into polynomial constraints of degree no more than two by introducing intermediate product variables, specifically including:
[0022] A) For RSD instances, write the constraints as cubic polynomials. Where: the evidence is the first evidence matrix. Second Evidence Matrix ;
[0023] B) For MinRank instances, write the constraints as cubic polynomials. Where: the evidence is the first evidence matrix. Second Evidence Matrix .
[0024] Step 7: Execute the VOLEitH zero-knowledge proof protocol: The prover uses the first and second evidence matrices obtained in Step 3 as secret evidence, inputs the low-order polynomial constraints and their public coefficients obtained in Step 6 into the VOLEitH proof system selected in Step 1, and interacts with the verifier according to the selected VOLEitH protocol to generate proof information; the verifier finally completes the verification based on the public information and the received proof message.
[0025] The verification refers to the process by which the verifier confirms that the prover knows the secret that satisfies the public linear relation and the target rank constraint without obtaining the first evidence matrix, the second evidence matrix, and the complete secret.
[0026] Step 8: Generate authentication result or digital signature based on the proof: In interactive authentication scenarios, the verifier outputs an acceptance or rejection authentication result based on the verification result in Step 7; in digital signature scenarios, the interactive zero-knowledge proof protocol is converted into a non-interactive proof based on the Fiat-Shamir transformation, and the non-interactive proof is used as the digital signature. The signer generates a commitment and proof message based on the private key, hashes the message, public key, and commitment to obtain the challenge, and outputs the signature; the verifier uses the public key and message to reconstruct the challenge and performs VOLEitH verification to determine whether the signature is valid.
[0027] Technical effect
[0028] This invention decomposes only a portion of the matrix of the secret object, avoiding the overall decomposition of the complete solution or the complete low-rank matrix. The corresponding right-kernel matrix can be directly constructed using the partially decomposed matrix, enabling right-kernel verification of rank constraints without the need to introduce the right-kernel matrix as additional evidence. This invention simultaneously combines the evidence compression effect of the system form with the advantages of right-kernel-based rank constraint verification. It is applicable to both RSD and MinRank problems, which are difficult to rank measurement, and can serve as a fundamental component in identity authentication, post-quantum digital signatures, zero-knowledge proof services, and privacy-preserving credential systems. Attached Figure Description
[0029] Figure 1 This is a flowchart of the present invention;
[0030] Figure 2 This is a schematic diagram of the system structure for an example. Detailed Implementation
[0031] like Figure 2As shown, this embodiment relates to a rank metric zero-knowledge proof authentication system based on right-kernel reuse and partial decomposition that implements the above method. It includes: a parameter initialization unit, a system form conversion unit, a partial decomposition unit, a linear reconstruction unit, a right-kernel reuse and rank verification unit, a constraint conversion unit, a VOLEitH zero-knowledge proof unit, an identity authentication unit, and a digital signature unit. Specifically: the parameter initialization unit determines the stratigraphical difficulty problem parameters, the finite field representation, the hash function, and the VOLEitH parameters based on the type and security level of the rank syndrome decoding RSD problem or the minimum rank MinRank problem; it selects the VOLEitH protocol that supports polynomial constraint proofs with a degree not exceeding three and outputs the system common parameters; the system form conversion unit receives the system common parameters, the public linear matrix, and the public instance, converts the public linear matrix into a system form containing identity matrix blocks, and divides the secret object to be proved into a first part matrix and a second part matrix. The system outputs the publicly disclosed matrix in system form and the block relationship between the first part matrix and the second part matrix. The partial decomposition unit receives the second part matrix and calculates the first evidence matrix and the second evidence matrix. The linear reconstruction unit is connected to the system form conversion unit and the partial decomposition unit respectively and receives the publicly disclosed instance and the second part matrix determined by the first evidence matrix and the second evidence matrix. It reconstructs the first part matrix according to the publicly disclosed linear relationship under the system form, so that the complete secret matrix composed of the first part matrix and the second part matrix satisfies the corresponding publicly disclosed linear constraints and outputs the reconstruction relationship of the first part matrix. The right kernel reuse and rank verification unit is connected to the partial decomposition unit and the linear reconstruction unit respectively and reuses the second evidence matrix to directly construct the right kernel matrix and generate the product constraint of the first part matrix with respect to the right kernel matrix. The constraint conversion unit is connected to the partial decomposition unit, the linear reconstruction unit and the right kernel reuse and rank verification unit respectively and converts the partial decomposition relationship, the linear reconstruction relationship and the right kernel rank verification relationship into a finite field. The system consists of a low-order polynomial constraint system; the VOLEitH zero-knowledge proof unit uses the first and second evidence matrices as secret evidence, the low-order polynomial constraints and their public coefficients as the constraint system, executes the VOLE-in-the-Head zero-knowledge proof protocol and generates the proof message π; the identity authentication unit outputs the acceptance or rejection identity authentication result based on the verification result of the zero-knowledge proof; the digital signature unit generates a non-interactive digital signature based on the Fiat-Shamir transformation and completes the signature verification based on the message to be verified, the public key and the digital signature reconstruction challenge.
[0032] The first part of the matrix can be reconstructed from the publicly known linear relations in the system form, and the second part of the matrix is used to perform partial decomposition. For the RSD instance, the first part of the matrix is... The second part of the matrix is For the MinRank instance, the first part of the matrix is: The second part of the matrix is .
[0033] The partial decomposition unit performs rank decomposition only on the second part of the matrix, and does not perform global rank decomposition on the complete secret object.
[0034] The product relationship of the second part matrix with respect to the right kernel matrix is automatically guaranteed by the partial decomposition relationship.
[0035] The total degree of the low-degree polynomial constraint with respect to the secret evidence variable does not exceed three; when the selected VOLEitH protocol only supports quadratic constraints, the constraint transformation unit converts the cubic constraint into a polynomial constraint of degree no more than two by introducing a product intermediate variable.
[0036] like Figure 1 As shown, this embodiment relates to a rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition of the above system, specifically including:
[0037] Step 1: Initialize parameters and select a zero-knowledge proof protocol, specifically including:
[0038] 1.1 Let For prime powers, For containing A finite field of elements for of Secondary expansion It is a positive integer. For the target rank weight, without loss of generality, let Divisible ,count ; express An identity matrix of order 1. This indicates that the matrix is concatenated column by column. This indicates that the matrix is concatenated row by row. Represents the transpose of a matrix or vector. Choose the security parameter λ, hash function, and VOLEitH parameter, and select the VOLEitH protocol that supports polynomial constraint proofs of degree no more than three.
[0039] 1.2 Fixed about A basis is given, and a linear bijection is defined as follows: Used to The length of the top is The vector is expanded coordinate-by-coordinate according to the basis as follows On matrix, Used to Restore the matrix row by row The length of the top is The vector.
[0040] Step 2: Convert the public linear matrix into a systematic form and divide the secret to be proven into a first part matrix and a second part matrix, specifically including:
[0041] A) For an RSD instance, set a public verification matrix. and open syndrome Wherein: the public verification matrix is in system form: , ; secret vector satisfy The secret vector is divided into... ,in: , And order:
[0042] B) For MinRank instances, set the secret matrix. Satisfy the public linear equation Among them: public matrix For system format: Divide the secret matrix into rows. ,in: This is the first part of the matrix. The second part of the matrix is ordered according to the same coordinate order. .
[0043] Step 3: Perform partial decomposition on the second part of the matrix, specifically including:
[0044] A) Calculate the first evidence matrix for the RSD instance. Second Evidence Matrix The second part of the matrix satisfies First Evidence Matrix Second Evidence Matrix The second part of the matrix serves as secret evidence of the VOLEitH protocol. As by and Determined intermediate quantities; second evidence matrix It is also used in the construction of the right kernel matrix in step 5.
[0045] B) Calculate the first evidence matrix for the MinRank instance. Second Evidence Matrix The second part of the matrix satisfies First Evidence Matrix Second Evidence Matrix The second part of the matrix serves as secret evidence of the VOLEitH protocol. As by and Determined intermediate quantities; second evidence matrix It is also used in the construction of the right kernel matrix in step 5.
[0046] Step 4: Reconstruct the first part of the matrix based on the publicly known linear relationship, specifically including:
[0047] A) For RSD instances, first according to calculate Then, reconstruct the left-hand side of the secret vector according to the system formal syndrome equation: Complete secret vector satisfy Because y and For public information, From the first evidence matrix Second Evidence Matrix It is confirmed, therefore there is no need to... or As an independent, secret piece of evidence, it can be represented by an evidence matrix.
[0048] B) For MinRank instances, first according to calculate Then, reconstruct the left-hand side of the secret matrix according to the systemic formal syndrome equation: ; From the first evidence matrix Second Evidence Matrix Sure.
[0049] Step 5: Construct the right kernel matrix directly from the second evidence matrix and generate rank constraints, specifically including:
[0050] A) For the RSD instance, the right kernel matrix is: Rank constraint is .
[0051] B) For the MinRank instance, the right kernel matrix is: Rank constraint is .
[0052] Step 6: Convert the partial decomposition relation, linear reconstruction relation, and right kernel rank verification relation into low-order polynomial constraints, specifically including:
[0053] A) For RSD instances, it is known that... , Write the following relationship as follows: Regarding the first evidence matrix Second Evidence Matrix Polynomial constraints: .
[0054] B) For a MinRank instance, it is known that... , Write the following relationship as Regarding the first evidence matrix Second Evidence Matrix Polynomial constraints:
[0055] Step 7: Execute the VOLEitH zero-knowledge proof protocol. The proving party uses the first and second evidence matrices obtained in Step 3 as secret evidence, inputs the low-order polynomial constraints and their public coefficients obtained in Step 6 into the VOLEitH proof system selected in Step 1, and generates a proof message π according to the selected VOLEitH protocol. The verifying party completes the verification using the system's public parameters, public instances, and the received proof message π, specifically including:
[0056] A) In the RSD case, successful verification indicates that the prover knows the secret vector x that satisfies the following relation: ;
[0057] B) In the MinRank case, successful verification indicates that the prover knows the secret matrix E that satisfies the following relation: .
[0058] Step 8: Generate an authentication result or digital signature based on the proof. In the interactive authentication scenario, the proving party and the verifying party execute the VOLEitH zero-knowledge proof protocol according to Step 7; the verifying party outputs "accept" if the verification passes and "reject" if the verification fails. In the digital signature scenario, the interactive zero-knowledge proof protocol is converted into a non-interactive proof based on the Fiat-Shamir transformation. If the verification passes, the digital signature is deemed valid; otherwise, the digital signature is deemed invalid.
[0059] Through practical application scenario experiments, performance tests of key generation, signature generation, and signature verification were conducted on an 11th generation Intel® Core™ i7-11850H processor with a base frequency of 2.50GHz, with Turbo Boost disabled during the tests. Table 1 shows several optional parameters and examples of evidence length. These examples illustrate the improvement effect of this invention compared to dual support decomposition modeling at typical security levels. Specific parameters can be adjusted according to the target security level, implementation platform, hash function, and VOLEitH parameter.
[0060] Table 1
[0061] As shown in Tables 2 and 3, the results of the present invention are shown under the RSD problem and the MinRank problem, respectively. The signature time and verification time are both on the order of several hundred milliseconds.
[0062] Table 2
[0063] Table 3
[0064] The performance examples above demonstrate that the present invention reduces the arithmetic portion of the VOLEitH signature by decreasing the evidence length. For the RSD case, the evidence length is improved to... For the MinRank case, the evidence length formula is improved to:
[0065] In practical deployments, the provider can be a device, server, or user terminal that needs to prove its identity to the verifier, while the verifier can be an authentication server, an off-chain verification module for blockchain smart contracts, or a digital signature verification module. The provider does not disclose its secret vector. or secret matrix It outputs only zero-knowledge proofs or signatures, thereby achieving privacy-preserving authentication with post-quantum security.
[0066] Under typical 128-bit security parameters, this invention, compared to dual support decomposition, can reduce the evidence length in the RSD case from 45 bytes to 24 bytes, a reduction of approximately 47%, and the evidence length in the MinRank case from 41 bytes to 18 bytes, a reduction of approximately 56%, as shown in Table 4, which represents the evidence length / signature size under typical 128-bit security parameters. Under the same VOLEitH parameters, this invention can further shorten the arithmetic part and the overall signature length, reducing the signature size by approximately 55 bytes in the RSD case and approximately 91 bytes in the MinRank case.
[0067] Table 4
[0068] In summary, this invention can reduce the evidence length while maintaining linear and rank constraints, thereby optimizing the signature size, which is of great significance for promoting the development of post-quantum signature technology.
[0069] The above-described specific implementations can be partially adjusted by those skilled in the art in different ways without departing from the principles and purpose of the present invention. The scope of protection of the present invention is defined by the claims and is not limited to the above-described specific implementations. All implementation schemes within the scope of the claims are bound by the present invention.
Claims
1. A rank-metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition, characterized in that, include: Step 1: Initialize parameters and select a zero-knowledge proof protocol; Step 2: Convert the public linear matrix into a systematic form and divide the secret to be proven into a first part matrix and a second part matrix, i.e., fixed... about After a set of bases, The vector on the coordinate-by-coordinate expansion according to the basis is The linear bijective of the matrix above, and then The matrix on the matrix is flattened by rows into a linear bijection of vectors; Step 3: Perform partial decomposition on the second part of the matrix obtained in Step 2, that is, perform rank decomposition only on the second part of the matrix retained by the publicly disclosed matrix in the system form, without decomposing the matrix corresponding to the complete secret vector or the complete secret matrix; Second Evidence Matrix It is also used for the construction of the subsequent right kernel matrix; Step 4: Reconstruct the first part matrix based on the publicly disclosed linear relationship. That is, use the identity matrix part in the publicly disclosed matrix in the system form to calculate the first part matrix by linear combination of the publicly disclosed syndrome and the second part matrix. Therefore, there is no need to submit the first part matrix as independent evidence. Step 5: Construct the right kernel matrix directly from the second evidence matrix and generate rank constraints, i.e., the right kernel has full column rank, thus ensuring that the rank of the complete secret does not exceed [a certain value]. The key is generated from a rank that is exactly... And before Sampling is performed from a linearly independent secret set to ensure that the target rank weight is... ; Step 6: Convert the partial decomposition relation, linear reconstruction relation, and right kernel rank verification relation into low-order polynomial constraints, i.e., the total degree of the product of all evidence variables in each constraint does not exceed three; when the selected proof protocol only supports quadratic constraints, the cubic constraint can be expanded into a polynomial constraint of degree no more than two by introducing intermediate product variables. Step 7: Execute the VOLEitH zero-knowledge proof protocol: The prover uses the first and second evidence matrices obtained in Step 3 as secret evidence, inputs the low-order polynomial constraints and their public coefficients obtained in Step 6 into the VOLEitH proof system selected in Step 1, and interacts with the verifier according to the selected VOLEitH protocol to generate proof information; the verifier finally completes the verification based on the public information and the received proof message. Step 8: Generate authentication result or digital signature based on proof: In interactive authentication scenarios, the verifier outputs an acceptance or rejection authentication result based on the verification result in Step 7. In digital signature scenarios, interactive zero-knowledge proof protocols are converted into non-interactive proofs based on the Fiat-Shamir transformation, and the non-interactive proofs are used as digital signatures. The signer generates a commitment and proof message based on the private key, hashes the message, public key, and commitment to obtain a challenge, and outputs the signature. The verifier uses the public key and message to reconstruct the challenge and performs VOLEitH verification to determine whether the signature is valid.
2. The rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition according to claim 1, characterized in that, Step 1 specifically includes: 1.1 Select the parameters, finite field representation, security level, hash function, and VOLEitH parameters for the rank syndrome decoding RSD problem or the minimum rank MinRank problem, and select the VOLEitH protocol that supports polynomial constraint proofs with a degree not exceeding three. 1.2 Let For prime powers, For containing A finite field of elements for of Secondary expansion It is a positive integer. The target rank weight; express An identity matrix of order 1. This indicates that the matrix is concatenated column by column. This indicates that the matrix is concatenated row by row. Represents the transpose of a matrix or vector.
3. The rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition according to claim 1, characterized in that, Step 2 specifically includes: A) For RSD instances, convert the public matrix into system form. secret vector satisfy And order ,in: This is the first part of the matrix. This is the second part of the matrix; B) For MinRank instances, convert the public matrix into system form. Secret Matrix satisfy Without loss of generality, we assume Divisible And record At that time, the secret matrix is divided into rows. ,in: This is the first part of the matrix. This is the second part of the matrix.
4. The rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition according to claim 1, characterized in that, Step 3 specifically includes: A) Calculate the first evidence matrix for the RSD instance. Second Evidence Matrix The second part of the matrix satisfies ; B) Calculate the first evidence matrix for the MinRank instance. Second Evidence Matrix The second part of the matrix satisfies .
5. The rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition according to claim 1, characterized in that, Step 4 specifically includes: A) For RSD instances, first, from the second part of the matrix... calculate Then according to Reconstruct the left-hand side of the secret vector and compute Thus Established; B) For MinRank instances, according to Reconstruct the first part of the matrix Thus .
6. The rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition according to claim 1, characterized in that, Step 5 specifically includes: A) For RSD instances, the second evidence matrix Construct the right nucleus And verify the constraints Due to the partial decomposition relationship Since the same right kernel relation is automatically satisfied, the complete matrix X = σ(x) satisfies the right kernel constraint. The rank constraint means that the above right kernel has a full column rank, thus ensuring that the rank of the complete secret does not exceed [a certain value]. The key is generated from a rank that is exactly... And before Sampling is performed from a linearly independent secret set to ensure that the target rank weight is... ; B) For MinRank instances, the second evidence matrix Construct the right nucleus And verify the constraints Due to the partial decomposition relationship The same right kernel relation is automatically satisfied, hence the complete secret matrix. Satisfies the right kernel constraint.
7. The rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition according to claim 1, characterized in that, Step 6 specifically includes: A) For RSD instances, write the constraints as cubic polynomials. Where: the evidence is the first evidence matrix. Second Evidence Matrix ; B) For MinRank instances, write the constraints as cubic polynomials. Where: the evidence is the first evidence matrix. Second Evidence Matrix .
8. The rank metric zero-knowledge proof authentication method based on right kernel reuse and partial decomposition according to claim 1, characterized in that, The verification refers to the process by which the verifier confirms that the prover knows the secret that satisfies the public linear relation and the target rank constraint without obtaining the first evidence matrix, the second evidence matrix, and the complete secret.
9. A rank-metric zero-knowledge proof authentication system based on right kernel reuse and partial decomposition, implementing the method of any one of claims 1-8, characterized in that, include: The system comprises a parameter initialization unit, a system form conversion unit, a partial decomposition unit, a linear reconstruction unit, a right kernel reuse and rank verification unit, a constraint conversion unit, a VOLEitH zero-knowledge proof unit, an identity authentication unit, and a digital signature unit. Specifically: the parameter initialization unit determines the parameters for the stratification difficulty problem, the finite field representation, the hash function, and the VOLEitH parameters based on the type and security level of the rank syndrome decoding RSD problem or the minimum rank MinRank problem; it selects the VOLEitH protocol that supports polynomial constraint proofs of no more than three degrees and outputs the system common parameters; the system form conversion unit receives the system common parameters, the public linear matrix, and the public instance, converts the public linear matrix into a system form containing identity matrix blocks, divides the secret object to be proven into a first part matrix and a second part matrix, and outputs the system form public matrix, the first part matrix, and the second part matrix. The block relationship of moments is defined; the partial decomposition unit receives the second part matrix and calculates the first evidence matrix and the second evidence matrix; the linear reconstruction unit is connected to the system form transformation unit and the partial decomposition unit respectively and receives the public instance and the second part matrix determined by the first evidence matrix and the second evidence matrix. It reconstructs the first part matrix according to the public linear relationship under the system form, so that the complete secret matrix composed of the first part matrix and the second part matrix satisfies the corresponding public linear constraints and outputs the reconstruction relationship of the first part matrix; the right kernel reuse and rank verification unit is connected to the partial decomposition unit and the linear reconstruction unit respectively and reuses the second evidence matrix to directly construct the right kernel matrix and generate the product constraint of the first part matrix with respect to the right kernel matrix; the constraint transformation unit is connected to the partial decomposition unit, the linear reconstruction unit and the right kernel reuse and rank verification unit respectively and converts the partial decomposition relationship, the linear reconstruction relationship and the right kernel rank verification relationship into a finite field. The system consists of a low-order polynomial constraint system; the VOLEitH zero-knowledge proof unit uses the first and second evidence matrices as secret evidence, the low-order polynomial constraints and their public coefficients as the constraint system, executes the VOLE-in-the-Head zero-knowledge proof protocol and generates the proof message π; the identity authentication unit outputs the acceptance or rejection identity authentication result based on the verification result of the zero-knowledge proof; the digital signature unit generates a non-interactive digital signature based on the Fiat-Shamir transformation and completes the signature verification based on the message to be verified, the public key and the digital signature reconstruction challenge.
10. The system according to claim 9, characterized in that, The first part of the matrix can be reconstructed from the publicly known linear relations in the system form. The second part of the matrix is used to perform partial decomposition. For the RSD instance, the first part of the matrix is... The second part of the matrix is For the MinRank instance, the first part of the matrix is: The second part of the matrix is ; The partial decomposition unit only performs rank decomposition on the second part of the matrix, and does not perform global rank decomposition on the complete secret object; The product relationship of the second part matrix with respect to the right kernel matrix is automatically guaranteed by the partial decomposition relationship; The total degree of the low-degree polynomial constraint with respect to the secret evidence variable does not exceed three; when the selected VOLEitH protocol only supports quadratic constraints, the constraint transformation unit converts the cubic constraint into a polynomial constraint of degree no more than two by introducing a product intermediate variable.