Cryptographic method for determining the binarity of a vector

Description

TECHNICAL FIELD

[0001] The presently disclosed subject matter relates to a cryptographic method for demonstrating by a prover to a verifier that a main vector is a binary vector, a cryptographic method for verifying by a verifier a proof, a system, a computer storage medium,BACKGROUND

[0002] A commitment scheme commits the sender, e.g., the prover or committer, to a secret message that remains secret until the commitment is opened. In a non-interactive commitment, the commitment and the opening phase may each comprise a single message from the committer to the verifier. A commitment scheme has two properties called hiding and binding. The former means that a commitment string C reveals no information about the committed message. The latter means that no adversary should be able to compute a commitment that can be opened for two distinct messages.

[0003] An example of a commitment scheme is the Pedersen commitment. In a cyclic group G or prime order p with generators g , h ∈ G, the sender commits to a message m ∈ ℤ p by choosing r ← R ℤ p and computing C = g m< · h r< , for a random r ← R ℤ p . In the opening phase, the sender reveals m and r. The commitment C perfectly hides m thanks to the uniform randomness r ∈ ℤ p . At the same time, no efficient committer can come up with a commitment C that can be opened in two different ways by revealing distinct pairs (m,r) ≠ (m',r') such that C = g m< · h r< = g m'< · h r'< unless it can compute the discrete logarithm log g (h). The Pedersen commitment naturally extends to commit to vectors of messages m 1 , … , m n ∈ ℤ p . To this end, the committer needs public parameters containing generators g 1 , … , g n , h ∈ G n + 1 and computes C = h r ⋅ ∏ i = 1 n g i m i .

[0004] Vector commitments allow a prover to commit to a vector of messages m = (m 1 , ..., m n ) ∈ D n< over some domain D by generating a short commitment string. Later, the committer is able to succinctly reveal individual coordinates of m. Here, succinctly means that the partial opening information, also referred to as a proof, should have constant size, e.g., independent of the dimension of the committed vector, yet still convince the verifier that the opened coordinate is correct. As in standard commitments, a vector commitment scheme preferably satisfies two security properties: (i) The binding property asserts that no efficient adversary can generate a commitment that can be opened to two different values at the same position i ∈ [n]; and (ii) The hiding property which guarantees that revealing a subset of components does not reveal any information about messages at non-revealed positions. Vector commitments enable significant savings in terms of storage, by storing only a constant-size commitment to a vector instead of commitments to individual coordinates, and bandwidth, thanks to the ability to provably and succinctly open individual positions.

[0005] Other succinct vector commitments may be based on the RSA assumption, or the Diffie-Hellman-like assumption in pairing-friendly groups.

[0006] Thibauld Feneuil et Al.: "Zero-Knowledge Protocols for the Subset Sum Problem from MPC-in-the-Head with Rejection", IACR, INTERNATIONAL ASSOCIATION FOR CRYPTOLOGIC RESEARCH,vol. 20221123:165319 23 November 2022 (2022-11-23), pages 1-51, discloses a methof for generating a proof that a vector is a binary vector. Izabachène Malika et Al.: "Block-Wise P-Signatures and Non-interactive Anonymous Credentials with Efficient Attributes", 12 December 2011 (2011-12-12), SAT 2015 18TH INTERNATIONAL CONFERENCE, AUSTIN, TX, USA, SEPTEMBER 24-27, 2015; [LECTURE NOTES IN COMPUTER SCIENCE; LECT.NOTES COMPUTER], SPRINGER, BERLIN, HEIDELBERG, PAGE(S) 431 - 450, ISBN: 978-3-540-74549-5, discloses a vector commitment committing to a vector of scalars that allows the committer to can open for an individual position.

[0007] One limitation of all known vector commitments with short proofs is that there is no efficient way to generate a short proof that the committed vector m is small, e.g., having elements in a given range, e.g., below and / or above a threshold, e.g., binary. One solution to this problem would be to generically use a general-purpose succinct non-interactive argument (SNARK) for all NP languages. While SNARKs could give constant-size proofs, they would require representing the statement as an arithmetic circuits. Then, the arithmetic circuit would have to compute the opening algorithm (and thus compute an exponentiation in a group ) of the commitment scheme, which would result in a complex arithmetic circuit. In turn, this would require a large common reference string (CRS) and make the proof generation very expensive since, in pairing-based SNARKs that give the smallest proof size, the CRS size and the computational cost of the prover both grow at least linearly with the number of multiplication gates in the arithmetic circuit.SUMMARY

[0008] There is a desire to have an improved method for demonstrating by a prover to a verifier that a main vector is a binary vector. A demonstrating method, verifying method, system and computer-readable medium is described in the accompanying claims. Specific embodiments of the invention are set forth in the dependent claims. In an embodiment, a commitment is computed for the main vector. The prover may then demonstrate the binarity by showing that an auxiliary vector is orthogonal with the main vector, e.g., by showing that their dot product is zero. The auxiliary vector comprises a Hadamard product of the main vector and a randomizing vector. The proof can be verified against the main commitment and a first auxiliary commitment. The first auxiliary commitment may be computed for the auxiliary vector, though in reverse order as the main vector.

[0009] A second proof may be computed to show that the first auxiliary commitment was indeed computed for a Hadamard product of the main vector and the randomizing vector, in reverse order. The second proof may be obtained by aggregating randomized openings for vector elements, in the main and first auxiliary commitments.

[0010] An advantage of the embodiments is that the main commitment, the auxiliary commitment, the first proof and the second proof each have a size which is independent on the dimension of the main vector. In an embodiment, a proof of binarity fits within 87 bytes for a suitable choice of elliptic curves, e.g., KSS18 curves, while a full proof of the validity of an FHE ciphertexts, fits within 225 bytes, e.g., using BLS12-446 curves.

[0011] In an embodiment, the main commitment is computed by evaluating a commitment function of the vector commitment scheme directly for the main vector. This is not strictly necessary, for example, using a vector commitment scheme with an additive homomorphic property the commitment function could be applied to any linear combination of the main vector and a vector known to the verifier. For example, a main commitment may be alternatively computed by evaluating the commitment function to the sum of the main vector and a vector known to the verifier. The verifier may obtain the former directly applied commitment from the alternative commitment and the known vector Applying the commitment function to the main vector itself is typical though.

[0012] Likewise, for the auxiliary commitment, a commitment function may be applied to any linear combination of the auxiliary vector and a public vector, in particular the randomization vector. Two typical choices are to apply the commitment function to the auxiliary vector directly, or to auxiliary vector minus the randomization vector; in an embodiment one of these two options is computed by the prover and shared with the verifier, while the verifier computes the other commitment itself.

[0013] For convenience most of the embodiments described in detail herein will assume the main commitment is obtained by applying a commitment function to the main vector, and the auxiliary commitment by applying a commitment function to the auxiliary vector, but other choices can be made in this respect.

[0014] Proofs and commitments may be represented as group elements. A bilinear map may be defined between a first and second group. The reverse order has the effect that a dot product of two vectors will be computed in the exponent when the bilinear map is applied to corresponding commitments, in the first and second group respectively. This may be applied to the main commitment and an auxiliary commitment. This may be the auxiliary commitment computed by the prover, or a second auxiliary commitment. The second auxiliary commitment can be computed from the first auxiliary commitment, e.g., using an additive homomorphic property of the vector commitment scheme.

[0015] In an embodiment, the scheme to prove binarity of a vector is zero-knowledge and / or non-interactive.

[0016] Proving the binarity of a vector can be applied in many situations. For example, it may be used in demonstrating that a committed number is smaller than a threshold, demonstrating the validity of a ring LWE ciphertext, demonstrating a vector x is ternary.

[0017] In an embodiment, a system, e.g., a device, is configured for the demonstrating and / or verifying method.

[0018] An embodiment of the method may be implemented on a computer as a computer implemented method, or in dedicated hardware, or in a combination of both. Executable code for an embodiment of the method may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computer readable medium for performing an embodiment of the method when said program product is executed on a computer.

[0019] In an embodiment, the computer program comprises computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.

[0020] Another aspect of the presently disclosed subject matter is a method of making the computer program available for downloading.BRIEF DESCRIPTION OF DRAWINGS

[0021] Further details, aspects, and embodiments will be described, by way of example only, with reference to the drawings. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the figures, elements which correspond to elements already described may have the same reference numerals. In the drawings, Figure 1 schematically shows an example of an embodiment of a demonstrating system, Figure 2 schematically shows an example of an embodiment of a proving system, Figure 3 schematically shows an example of an embodiment of a proving method, Figure 4a schematically shows a computer readable medium having a writable part comprising a computer program according to an embodiment, Figure 4b schematically shows a representation of a processor system according to an embodiment. Reference signs list

[0022] The following list of references and abbreviations corresponds to figures 1, 2, 3, 4a, and 4b, and is provided for facilitating the interpretation of the drawings and shall not be construed as limiting the claims. 100a proving system 110a proving device 113a processor system 114storage 115communication interface 120a verifying device 123a processor system 124a storage 125a communication interface 200a proving system 210a main vector source 211a main vector 212a randomizing vector 213a randomizing vector 219committed to vectors 220a commitment unit 221a main commitment 222a first auxiliary commitment 230a proving unit 231an orthogonality proof 232an equality proof 1000, 1001a computer readable medium 1010a writable part 1020a computer program 1110integrated circuit(s) 1120a processing unit 1122a memory 1124a dedicated integrated circuit 1126a communication element 1130an interconnect 1140a processor system DESCRIPTION OF EMBODIMENTS

[0023] While the presently disclosed subject matter is susceptible of embodiment in many different forms, there are shown in the drawings and will herein be described in detail one or more specific embodiments, with the understanding that the present disclosure is to be considered as exemplary of the principles of the presently disclosed subject matter and not intended to limit it to the specific embodiments shown and described.

[0024] In the following, for the sake of understanding, elements of embodiments are described in operation. However, it will be apparent that the respective elements are arranged to perform the functions being described as performed by them.

[0025] Further, the subject matter that is presently disclosed is not limited to the embodiments only, but also includes every other combination of features described herein or recited in mutually different dependent claims.

[0026] Figure 1 schematically shows an example of an embodiment of a proving device 110 and of an embodiment of a verifying device 120. Proving device 110 and verifying device 120 may be part of a proving system 100.

[0027] Proving device 110 is configured to demonstrate cryptographically to a verifying device that a vector is a binary vector using a vector commitment scheme. The vector commitment scheme comprises at least one commitment function taking as input a vector and producing a commitment as output. Vector commitment schemes may comprise more than one, e.g., two commitment functions each taking as input a vector and producing a commitment as output, however, the commitment values are produced in different groups. For example, a first commitment function may produce a group element in a first group, while a second commitment function may produce a group element in a second group. A bilinear map may be defined between the first and second group. A vector commitment scheme may have additional properties, e.g., the additive homomorphic property. According to this property, a new commitment may be computed for a sum of a first vector and second vector from the second vector and a commitment of the first vector, without knowing the first vector. The commitment scheme allows to prover to partially open for an element (x i ) at a position (i ∈ [n]) of a committed to vector by computing a proof, e.g., in the form of a group element. The verifier may verify that the proof proves that the committed to vector has the value at the position.

[0028] The verifying device 120 is configured to verify the cryptographic demonstration provided by the prover device. The prover device is also referred to as the prover. The verifying device is also referred to as the verifier.

[0029] An embodiment of a cryptographic method described herein is particularly advantageous as the size of the cryptographic proofs is independent of the dimension of the vector the binarity of which is being proven. This property is sometimes referred to as succinctness or conciseness, that is the proof is succinct. As the size of proofs is independent of the vector dimension, the size per dimension decreases as the vector dimension increases. Vector could have any length, as an example, an embodiment may be applied to vectors of at least, 10, 100, 1000, 10000 elements, e.g., bits, and so on.

[0030] System 100 may be used stand alone, but there are many applications in which proving whether a vector is binary may be used as a primitive. For example, many mathematical objects, e.g., may be expressed as a vector of bits, e.g., as a sequence of bits. The properties of the mathematical object may then be verified by demonstrating properties of the vector, e.g., by revealing one or more bits, by computing an inner product, e.g., dot product, over the vector, or part thereof and proving the result, performing other lines operations, and so on. For good security, the binarity of the vector should also be proven. Otherwise, a prover could attempt to cheat by committing to a non-binary vector.

[0031] Discussed in some detail are two specific applications, but many more are possible. For example, proving that a vector is binary may be used to prove that some number, known to the prover, lies in a particular range, e.g., is smaller than some upper bound. To do this, the number is converted to a binary vector, on which then appropriate linear operations can be done, e.g., a most significant bit may be opened; once the verifier is convinced that a committed vector contains the l-bit representation of an integer x, then the verifier knows that x is smaller than 2 l< .

[0032] If the prover could commit to a non-binary vector, then the prover could cheat, making the verifier believe that the prover's number is smaller than the bound when it is not. Another application is in advanced cryptographic systems, such as multi-party computation and homomorphic encryption. In homomorphic encryption. Homomorphic encryption enables complex mathematical operations to be performed on encrypted data without compromising the encryption. Encryption schemes that allow computations to be performed on their encrypted data are known per-se, however, they are subject to some limits. For example, a homomorphic encrypting device may homomorphically encrypt the data. A homomorphic computing device may perform an algorithm, e.g., a software program, an arithmetic procedure, on the data without decrypting it. Existing methods to verify for the homomorphic computing device whether the received data is in fact correctly encrypted data suffer from drawbacks; for example, SNARKs' proofs are very expensive to compute. Using an embodiment, the data may be converted to a binary vector, which may then be used to prove the validity of the homomorphic encrypted data. By using a non-interactive proof that a committed vector is binary, we can obtain a short proof to convince the homomorphic computing device that a ciphertext is well-formed.

[0033] Cryptographically demonstrating that a vector is a binary vector may comprise various phases.

[0034] In an initializing phase, common parameters are shared between the prover device and the verifying device. Typically, a cryptographic method performs its computation not on the natural numbers but in various finite groups or rings. In the initializing phase, shared parameters are established between prover and verifier. In non-interactive zero-knowledge proofs, a set of trusted public parameters is often generated by a trusted party and made available to the prover and the verifier. Such shared parameters are sometimes referred to as a common reference string (CRS), or public parameters. The shared parameters may be obtained, e.g., generated, by a trusted party and sent to the prover and to the verifier. The shared parameters may be jointly generated, by the prover and the verifier together, possibly with involvement of the trusted party. Note that most embodiments use a trusted party. Preferably, the trusted party erases all its private randomness used to generate the CRS after delivery to the prover and verifier.

[0035] Typically, the initialization phase needs to be performed just once. This phase is often implicit. For example, the phase may be performed as part of another cryptographic method executed by the prover and verifier. The parameters of the other cryptographic method may then be used for a demonstrating method according to an embodiment. For example, the shared parameters may be implicitly known, e.g., they may be part of computer software provided at the prover and verifier.

[0036] For example, the shared parameters may comprise one or more groups, e.g., a first, second and third group. For example, the shared parameters may comprise a bilinear map, mapping from a first group and a second group to a third group. For example, the shared parameters may comprise a set of generators for said groups, in particular, for the first group and second group.

[0037] In a commitment phase, the prover commits to a vector x = (x 1 , ..., x n ). The prover computes a commitment according to a commitment scheme from the vector and the shared parameters. A commitment allows the prover to commit to a value, in this case to a vector, while keeping it hidden from others, in particular keeping it secret from the verifier. The commitment is sent to the verifier, this allows the prover to reveal the committed value or part thereof later; this is also referred to as opening the commitment. Commitments may be used for this ability, e.g., avoiding that the prover can change its value, e.g., vector x after the prover committed to it. However, commitments may also be used as part of other demonstrating. For example, in an embodiment the prover demonstrates to the verifier that the vector that is committed to is binary, without necessarily opening any part of the vector.

[0038] The commitment phase may comprise the computation of one or more commitments, but also the computation of one or more proofs; for example, proof that the committed to vector(s) have certain properties. The commitment(s) and proofs are shared with the verifier, e.g., sent to the verifier, e.g., over a computer network. Computing proofs and commitments may be separated to their own phases, e.g., a commitment phase and a proof phase.

[0039] In a verification phase, the verifier may verify for example, that the proofs supplied with the commitment are correct. Interestingly, this allows a prover to prove facts about a vector without revealing anything else about said vector. This so-called zero knowledge property is particularly desirable in cryptography.

[0040] For example, in the commitment phase, the proving device may compute a main commitment to commit to a particular vector at interest, e.g., the main vector. The commitment might allow the prover to later reveal one or more values of the main vector. The verifier could then verify that the commitment indeed corresponds to the revealed values. Interestingly, the proving device may also compute one or more proofs, demonstrating properties of the main vector. Such proofs can also be verified using the commitment. For example, the proving device may prove that the main vector and a vector defined by (y 1 (x 1 - 1), ..., y n (x n - 1)) are orthogonal; the vector y = (y 1 , ..., y n ) randomizes this sum.

[0041] To aid this proof, the proving device may compute one or more auxiliary commitments, that commit to other vectors related to the main vector. For example, an auxiliary commitment may be to the Hadamard product of the main vector and the randomizing vector. It was an insight of the inventor that reversing the order of this vector allows the subsequent verification to use a bilinear map. The proving device may generate further proofs. For example, the proving device may prove that the main commitment defined above, and the one or more auxiliary commitment(s) were actually obtained from the same main vector.

[0042] Main commitment and the auxiliary commitment are typically obtained by applying a commitment function of the vector commitment scheme to the main vector and auxiliary vector respectively. This typical case is assumed in most embodiments. However, a homomorphic property of the commitment scheme makes this not necessary, though; given a valid commitment a verifier can use the homomorphic property to derive additional commitments. This is especially useful for the auxiliary commitment. The auxiliary commitment may be obtained by applying a commitment function of the vector commitment scheme to the auxiliary vector, but also by applying the commitment function to the auxiliary vector minus the randomization vector. In the former case, the verifier may deriver the latter commitment; in the latter case, the verifier may derive the former commitment.

[0043] The ability to demonstrate that a vector is binary without necessarily revealing the full vector itself, is useful in many situations. Generally a mathematical object may be encoded as a binary vector, e.g., as a sequence of bits. Properties of the mathematical object may then be demonstrated by, e.g., by opening particular elements of the vector, computing dot-products over the vector or parts thereof, computing other operations, possibly linear operations on the vector. However, for this approach to have good security, the verifier should be convinced that the vector is binary. For example, to prove that a number known to the prover falls in a particular range, e.g., is smaller than an upper bound, the prover could encode the number as a binary vector and commit to it. By opening the last (n - l) elements of the binary vector to zero, e.g., the (n -l) most significant bits, using a constant-size, e.g., succinct, proof, the prover can prove that the integer is smaller than 2 l< . However, if the prover could cheat by committing to a non-binary vector, it would appear that the number is smaller than the bound, while it is not.

[0044] Another application is as a primitive in other cryptographic schemes in which data is shared in encrypted form, while still operations are performed on the data, e.g., homomorphic encryption. For example, data may be homomorphically encrypted by a homomorphic encryption device. The data may then be sent to a homomorphic computation device. The homomorphic computation device performs a computation on the encrypted data, without decrypting the data, e.g., without gaining knowledge of the plaintext of the data. The computation results, still encrypted, may be sent back to the encrypting device. There the encrypted computation results may be decrypted. Homomorphic encryption relies on the data being correctly provided according to the specific rules of the particular homomorphic encryption scheme. The computation device typically cannot verify whether the data has been correctly encrypted, e.g., because it cannot decrypt the data. Interestingly, using an embodiment this is possible. The encrypting device may convert the data and / or encryption randomness into a binary vector, then prove that the provided encrypted data correctly reflects the plain data according to the rules. Again this relies on being able to efficiently prove that the vector is binary.

[0045] Proving device 110 may comprise a processor system 113, a storage 114, and a communication interface 115. Verifying device 120 may comprise a processor system 123, a storage 124, and a communication interface 125. Storage 114 and 124 may be, e.g., electronic storage, magnetic storage, etc. The storage may comprise local storage, e.g., a local hard drive or electronic memory. Storage 114 and 124 may comprise non-local storage, e.g., cloud storage. In the latter case, storage 114 and 124 may comprise a storage interface to the non-local storage. Storage may comprise multiple discrete sub-storages together making up storage 114, 124. Storage may comprise a volatile writable part, say a RAM, a non-volatile writable part, e.g., Flash, a non-volatile non-writable part, e.g., ROM.

[0046] In the various embodiments of communication interfaces 115, and / or 125, the communication interfaces may be selected from various alternatives. For example, the interface may be a network interface to a local or wide area network, e.g., the Internet, a storage interface to an internal or external data storage, an application interface (API), etc.

[0047] Storage 114 and 124 may be non-transitory storage. For example, storage 114 and 124 may store data in the presence of power such as a volatile memory device, e.g., a Random Access Memory (RAM). For example, storage 114 and 124 may store data in the presence of power as well as outside the presence of power such as a non-volatile memory device, e.g., Flash memory.

[0048] The devices 110 and 120 may communicate internally, with each other, with other devices, external storage, input devices, output devices, and / or one or more sensors over a computer network. The computer network may be an internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. The devices 110 and 120 comprise a connection interface which is arranged to communicate within system 100 or outside of system 100 as needed. For example, the connection interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna.

[0049] The communication interface 115 may be used to send or receive digital data, e.g., commitments and proofs, vectors, e.g., binary vectors. The communication interface 125 may be used to send or receive digital data, e.g., commitments and proofs.

[0050] Proving device 110 and verifying device 120 may have a user interface, which may include well-known elements such as one or more buttons, a keyboard, display, touch screen, etc. The user interface may be arranged for accommodating user interaction for initiating a cryptographic protocol. The user interface may be arranged for a higher level protocol, e.g., initiating a homomorphic computation, e.g., a neural network evaluation, on encrypted data. As part of the higher level protocol, a vector may be generated along with a proof that the vector is binary. Other properties of the vector may be demonstrated with proofs as well, e.g., that the encrypted data is validly encrypted according to the homomorphic encryption scheme. A user interface is optional, as proving device and verifying device could operate automatically.

[0051] The execution of devices 110 and 120 may be implemented in a processor system. The devices 110 and 120 may comprise functional units to implement aspects of embodiments. The functional units may be part of the processor system. For example, functional units shown herein may be wholly or partially implemented in computer instructions that are stored in a storage of the device and executable by the processor system.

[0052] The processor system may comprise one or more processor circuits, e.g., microprocessors, CPUs, GPUs, etc. Devices 110 and 120 may comprise multiple processors. A processor circuit may be implemented in a distributed fashion, e.g., as multiple sub-processor circuits. For example, devices 110 and 120 may use cloud computing.

[0053] Typically, the proving device 110 and verifying device 120 each comprise a microprocessor which executes appropriate software stored at the device; for example, that software may have been downloaded and / or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash.

[0054] Instead of using software to implement a function, the devices 110 and / or 120 may, in whole or in part, be implemented in programmable logic, e.g., as field-programmable gate array (FPGA). The devices may be implemented, in whole or in part, as a so-called application-specific integrated circuit (ASIC), e.g., an integrated circuit (IC) customized for their particular use. For example, the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL, etc. In particular, proving device 110 and verifying device 120 may comprise circuits, e.g., for cryptographic processing, and / or arithmetic processing.

[0055] In hybrid embodiments, functional units are implemented partially in hardware, e.g., as coprocessors, e.g., cryptographic and / or mathematical coprocessors, and partially in software stored and executed on the device.

[0056] Figure 2 schematically shows an example of an embodiment of a proving system 200.

[0057] Proving system 200 is configured to implement a cryptographic method for demonstrating by a prover to a verifier that a main vector 211, x = (x 1 , ...,x n ) is a binary vector using a vector commitment scheme. For example, system 200 could be implemented in device 110.

[0058] Main vector 211 may be obtained from a main vector source 210. Typically, main vector source 210 may be part of a further cryptographic method. For example, a cryptographic object may be converted to a binary vector. By proving properties of the vector, the properties may be efficiently demonstrated to a verifier. An embodiment may be used to prove efficiently that the main vector is binary. The main vector may also be obtained, e.g., from storage or received from a third party.

[0059] In addition to the main vector, various further vectors may be used, e.g., to randomize or aggregate computations into a single value. Shown is randomizing vector 212 and randomizing vector 213. Typically, a randomizing vector is not secret, and is available or made available to the verifier by the prover. In principle, an agreement scheme between prover and verifier may be adapted to select the randomizing vectors. Preferably the randomizing vectors are selected by the prover system, as this allows a non-interactive scheme. To avoid that a dishonest prover has undue control over the randomization, a randomizing vector may be generated from a hash value, e.g., by applying a cryptographic hash function to data comprising one or more previous protocol parts, e.g., one or more of previously obtained vectors, commitments, proofs, and the like. This has the additional advantage that a verifier can generate the randomizing vectors themselves without having to receive them, thus reducing transmission costs.

[0060] In an embodiment, randomization vectors are chosen by the verifier or derived from the output of a hash function, e.g., applied to previously computed commitments. Security is improved if the prover cannot choose the randomization vector before committing to the vector. Generating the randomization vector from a hash function achieves that.

[0061] The randomization vectors, e.g., the hash functions, may be modeled as random oracle. This is not necessary, but convenient for proving mathematical properties.

[0062] For example, in an embodiment the randomizing vector (y = (y 1 ,...,y n )) may be obtained from a scalar (u) chosen by the verifier or derived from the output of a hash function, e.g., by the prover. The randomizing vector may then be obtained by a series of polynomial functions applied to the scalar. For example, the randomizing vector may be reconstructed by the prover as (f 0 (u), f 2 (u),..., f n-1 (u)). The polynomials may be chosen by a protocol designer, or by the verifier. The polynomials may be used repeatedly, in multiple iterations of the protocol. This has the advantage of reducing the data sent by the verifier. For example, the verifier may select a random scalar u, and send it to the prover, who can then reconstruct the randomizing vector. In an embodiment, the polynomials are chosen as follows: y = (1,u,u 2< , ...,u n-1< ).

[0063] One or more of the randomizing vectors may be used in computing auxiliary commitments, although some may not be. This is indicated in figure 2, as randomizing vector y = (y 1 , ..., y n ), 212 is an input to a commitment unit 220, whereas randomizing vector t = (t 1 ,..., t n ), 213 is not. Both randomizing vector 212 and randomizing vector 213 may be obtained by hashing a previous commitment, e.g., commitments 221, 222, discussed below.

[0064] Proving system 200 comprises a commitment unit 220 configured to compute vector commitments. Shown in figure 2 is a main commitment 221. The main commitment commits to the main vector x, 211. Later the prover could choose to open all or part of vector 211, and a verifier could verify that the opened part is indeed the same as the main vector 211 when the commitment 221 was computed.

[0065] Commitment unit 220 may be used to compute further commitments that help in constructing later proofs. For example, commitment unit 220 is used to compute a first auxiliary commitment 222. The auxiliary commitment is not to randomizing vector 212 directly, as the verifier has access to vector 212, e.g., can generate it by itself. However, first auxiliary commitment 222 may be to the Hadamard product of the main vector (x) and the randomizing vector (y), with elements x i y i . It was an insight that having an opposite order in which the main commitment 221 and the auxiliary commitment 222 commitments are computed allows efficient verification using a bilinear map. The first auxiliary commitment 222 is in a reverse order as the order of the main vector. For example, the main commitment may commit to the vector x = (x 1 , ...,x n ), whereas the first auxiliary commitment 222 may commit to the auxiliary vector in the reverse order, e.g., to the (y n x n , ...,y 1 x 1 ). Note that the order in which the main vector is used in main commitment and the auxiliary commitment is reversed. In this example, the main commitment uses the natural order of the main vector, e.g., the order in which the main vector was received or generated, while the auxiliary vector reverses the order in which the main vector elements are used. However, this could be reversed, the main commitment could reverse the natural order, while the auxiliary reverses this, that is, uses the natural order again.

[0066] In an embodiment, the vector commitment scheme is homomorphic, e.g., additive homomorphic. This has the consequence that a verifier can construct additional commitments given the received commitments, e.g., the main and first auxiliary commitment. For example, the verifier may compute a second auxiliary commitment from the first auxiliary commitment for a further vector, (y n x n - y n , ... ,y 1 x 1 - y 1 ) given that the verifier has the randomizing vector 212.

[0067] Furthermore, the vector commitment scheme is preferably arranged to allow a partial opening for an element (x i ) at a position (i ∈ [n]) of a vector. This allows the constructions of proofs by computing a product and / or division of proofs ranging over the indices in corresponding vectors, e.g., the main vector and / or the auxiliary vector.

[0068] For example, the vector commitment scheme may be a Pedersen commitment scheme.

[0069] Proving system 200 further comprises a proving unit 230. Proving unit 230 is configured to generate proofs for statement about vectors that can be verified using commitment for said vectors, without requiring knowledge of the vectors themselves.

[0070] Proving unit 230 may be used to construct orthogonality proof 231, e.g., a first proof π y . The orthogonality proof demonstrates to the verifier that the further vector, (y 1 x 1 - y 1 , ..., y n x n - y n ) is orthogonal to the main vector. This shows that the sum y 1 (x 1 - 1)x 1 + ... y n (x n - 1)x n = 0, which means that, with overwhelming probability, each of x i is either 0 or 1, as the y i randomize this sum, e.g., the y i are random, e.g., are chosen independent of the x i . More precisely, if one of the x i is not in {0,1}, then the probability that the sum equals zero is only 1 / p.

[0071] This proof is supplemented by a second proof π eq , an equality proof 232, that links the main commitment 221 and the first auxiliary commitment 222. For example, the equality proof 232 demonstrates that the main vector in the Hadamard product committed to in the first auxiliary commitment is the main vector committed to in the main commitment. More precisely, the equality proof 232 may demonstrate that the main vector in the Hadamard product committed to in the first auxiliary commitment is the main vector committed to in the main commitment. More precisely, that the first auxiliary commitment is commits to the auxiliary vector in reverse order, that is to the reverse order of the Hadamard product of the main vector (x) and the randomizing vector (y).

[0072] Interestingly, the main commitment, the auxiliary commitment, the first proof and the second proof may each have a size which is independent on the dimension of the main vector, that is they are succinct.

[0073] The proving system may be further configured to make the commitment and the auxiliary commitment available to the verifier, and making the first proof and / or the second proof or an aggregation thereof available to the verifier. The verifier may verify that the orthogonality proof and / or the equality proof agree with the main and first auxiliary commitment.

[0074] Possibly, in a later state additional proofs may be generated by the proving system. For example, the proving system may generate proofs for further properties of the main vector. For example, the main vector may be opened in whole or in part. For example, linear operators may be applied to the main vector and the result may be opened; for example, a dot product with the main vector and another vector may be computed, the another vector may be a known vector. The result of the dot product may be revealed to the verifier and its correctness demonstrated using the main commitment and possibly further auxiliary commitments.

[0075] In an embodiment, the commitments and proofs are group elements. For example, a bilinear map e(,) is defined from a first group and a second group G ^ to a third group G T . A vector commitment and a proof may be an element in one of the first and second groups. Verification of a proof comprising one or more application of the bilinear map to the proof and an expression in the generators of the other group, thus obtaining an element in the third group. Verification of a proof may also comprise one or more application of the bilinear map to commitment(s) and an expression in the generators of a group, or vice versa, thus obtaining an element in the third group. The verification comprises comparing the results of the first and second application in the third group. The vector elements of a vector may also be group elements, e.g., the natural numbers modulo a prime p.

[0076] For example, verification of the orthogonality proof 221 may comprise a first application of the bilinear map to the first proof and a generator of the second group e(π y , ĝ), and a second application of the bilinear map ( e C y ⋅ ∏ j = 1 n g n + 1 − j − y j , C ^ ) to the main commitment and the second auxiliary commitment.

[0077] Likewise, the equality proof π eq may be verified by comparing applications of the bilinear map to the second proof e(π eq ,ĝ), the main commitment e ∏ i = 1 n g n + 1 − i t i ⋅ y i C ^ , and the auxiliary commitment e C y ∏ i = 1 n g ^ i t i .

[0078] The bilinear map may be applied to products of selected group generators, that are chosen so that the comparison in the third group balances, e.g., equals, if the proof is correct. For example, in case of the equality proof if the main commitment and the first auxiliary commitment both correspond to the same main vector.

[0079] The inventor had the insight that embodiment may use any vector commitment over groups (, G ^ , G T ) equipped with a bilinear map e : G × G ^ → G T , where: (i) The common reference string contains generators g 1 , … , g n 1 ∈ G n 1 , g ^ 1 , … , g ^ n 2 ∈ G ^ n 2 ; (ii) A commitment to a vector (x 1 , ... , x n ) comprises group elements C 1 , … , C m 1 ∈ G m 1 , C ^ 1 , … , C ^ m 2 ∈ G ^ m 2 ; (iii) A partial opening at position i ∈ [n] comprises group elements π 1 , … , π l 1 ∈ G l 1 and π ^ 1 , … , π ^ l 2 ∈ G ^ l 2 and satisfies a verification of the form ∏ τ = 1 m 1 e C τ g ^ μ τ i ⋅ ∏ τ = 1 m 2 e g ν τ i C ^ τ ⋅ ∏ τ = 1 l 1 e π τ g ^ j τ ⋅ ∏ τ = 1 l 2 e g k τ π ^ τ ⋅ g T x i = 1 G T , where g T ∈ G T is publicly computable from the common reference string; ν 1 (i), ... , ν m2 (i) E [n 1 ] and µ 1 (i), ..., µ m1 (i) ∈ [n 2 ] are functions of the opened index i ∈ [n]; and j 1 , ...j ℓ1 E [n 2 ], k 1 , ... , k ℓ2 ∈ [n 1 ] are fixed.

[0080] Embodiments are provided that are a special case of the above equation, e.g., where m 1 = 1, m 2 = 0, ℓ 1 = 1, ℓ 2 = 0 and g T = e(g 1 ,ĝ n )).

[0081] These embodiments have various advantages. The common reference string has linear size in the dimension of committed vectors. It supports constant-size proofs that a committed vector m ∈ ℤ p n satisfies inner product relations (m, t) = x for public t ∈ ℤ p n and x ∈ ℤ p . Furthermore, proofs are short and contain just a few group elements.

[0082] For example, an embodiment may be a cryptographic method for demonstrating by a prover to a verifier that a main vector (x = (x 1 ,...,x n )) is a binary vector using a vector commitment scheme, a bilinear map (e(,)) being defined from a first group and a second group (, G ^ ) to a third group ( G T ), a vector commitment being an element in one of the first and second groups ( G ^ ; ), computing by a prover a main commitment (Ĉ; C), the main commitment committing to the main vector (x), obtaining by the prover a randomizing vector (y = (y 1 ,...,y n )), the randomizing vector being made available to the verifier, computing by the prover a first auxiliary commitment (C y ; Ĉ y ), the first auxiliary commitment committing to, in reverse order, to an auxiliary vector comprising, a Hadamard product of the main vector (x) and the randomizing vector (y), generating a first proof (π y ) demonstrating that a further vector comprising the product of the randomizing vector and the main vector minus 1 in each component (y i (x i - 1) is orthogonal to the main vector (x i ), the first proof being arranged for verification by a verifier.

[0083] The first proof may be obtained as a proof that a dot product of two vectors is zero. The reason for reversing the order of the Hadamard product of the main vector (x) and the randomizing vector (y) makes it possible to verify the proof with the bilinear map. The bilinear map of the main commitment and the auxiliary commitment will compute a product of polynomials in the exponent. In the product, one of the coefficient will be the dot product of the two vectors.

[0084] For example, if C ^ = g ^ γ + ∑ j x j α j and C y = g γ + ∑ j z j α j , then the pairing e(C y ,Ĉ) computes a product of polynomials in the exponent. In the product, the coefficient of a n+1< becomes ∑ i = 1 n x i z n + 1 − i . If the order of the z i is reversed in the commitment the inner product < x,z > is obtained as the coefficient of a n+1< .

[0085] For example, an embodiment may be a cryptographic method for verifying by a verifier that a main vector (x = (x 1 , ..., x n )) is a binary vector, comprising verification of the first proof comprising a first application of the bilinear map to the first proof and a generator of the second group (e(π y ,ĝ)), verification further comprising obtaining a second auxiliary commitment ( c y ⋅ ∏ j = 1 n g n + 1 − j − y j ) from the first auxiliary commitment for the further vector, verification of the first proof comprises a second application of the bilinear map ( e C y ⋅ ∏ j = 1 n g n + 1 − j − y j , C ^ ) to the main commitment and the second auxiliary commitment, the verification comprises comparing the results of the first and second application in the third group.

[0086] Embodiments may be implemented as non-interactive zero-knowledge (NIZK) proof system. Such a proof system typically comprises the algorithms (CRS - Gen, Prove, Verify).

[0087] The CRS - Gen algorithm may be used in an initialization phase for example. On input of a security parameter λ ∈ ℕ and (optionally) other parameters, CRS - Gen generates a common reference string pp and optionally a simulation trapdoor τ; Algorithm Prove takes as input the common reference string pp, a statement x and a witness w and outputs a proof π; Verify takes as input pp, a statement x and a proof π and returns 0 or 1. Correctness requires that honestly generated proofs are always (or at least with overwhelming probability) accepted by the verifier. However, in an embodiment, an additional algorithm Com is introduced that inputs a vector x ∈ D n< over a domain D and outputs a commitment C. For example, the prover algorithm may be used in a proof phase, while the Com algorithm may be used in a commitment phase.

[0088] Below several further optional refinements, details, and embodiments are illustrated.

[0089] For a message space ℤ p n , for a prime modulus p, embodiments generate succinct proofs for committed vectors. In an embodiment, it may be allowed to use a message space modulo a composite number, e.g., a hard to factor composite number. However, bilinear maps are less efficient in such case. Accordingly, it will be assumed herein that messages are modulo a prime p.

[0090] Embodiments allow committing to a vector x of small infinity norm or even a binary x ∈ {0,1}" and obtain a constant-size commitment C. Subsequently, it is possible to generate a short proof that x has binary entries. In an embodiment, the proof comprises just two group elements. In particular, CRS may be of O(n)-size, and it is possible to succinctly open the commitment for individual vector positions. It is also possible to prove that a committed vector x ∈ ℤ p satisfies a linear equation 〈x, t〉 = s for a public t ∈ ℤ p n and a public s ∈ ℤ p . Furthermore, it has aggregation properties that make it possible to generate a constant-size proof for a sub-vector opening. These properties allow a succinct proving of various properties of committed vectors. An embodiment adds the important additional property of being able to prove binarity of vectors. For example, the aggregation scheme of Gorbunov, et al. "Pointproofs: Aggregating Proofs for Multiple Vector Commitments" may be used.

[0091] For the purpose of describing a number of detailed embodiments, let (, G ^ , G T ) be cyclic groups of order p that are equipped with a bilinear map, also referred to as a pairing, e : G × G ^ → G T . A bilinear map has the property that e(g a< ,ĝ b< ) = e(g, ĝ) ab< for all a , b ∈ ℤ, and is non-degenerate, e.g., e g h ^ = 1 G T iff h ^ = 1 G ^ or g = 1 G . Security relies on the hardness of computing a discrete logarithm α ∈ ℤ p given {g αi< } i∈[2n] and {ĝ αi< } i∈[n] . Security is improved by choosing a sufficiently large group order p = G = G ^ = G ^ T > 2 l λ , for some function l : ℕ → ℕ of the security parameter λ. For example, for λ = 128, one might select a prime p > 2 256< .

[0092] Preferably, the groups (, G ^ , G T ) are asymmetric bilinear groups of prime order p. Note that techniques are known to convert symmetric bilinear groups to asymmetric bilinear groups. For integers m, n, the (m, n)-Discrete Logarithm ((m,n)-DLOG) problem is, given g , g α , g α 2 , … , g α m , g ^ , g ^ α , … , g ^ α n where α ← R ℤ p , g ← R G , g ^ ← R G ^ , to compute α ∈ ℤ p .

[0093] In a practical embodiment, and G ^ may be instantiated from suitable elliptic curves groups while G T may be a subgroup of the group of invertible elements in a finite field. Examples of such groups are known in the art. See for example the papers by E. Kachisa, E. Schaefer, and M. Scott, "Constructing Brezing-Weng pairing-friendly elliptic curves using elements in the cyclotomic field."; D. Aranha, Y. El Housni, and A. Guillevic, "A survey of elliptic curves for proof systems."; Y. El Housni and A. Guillevic, "Optimized and secure pairing friendly elliptic curves suitable for one layer proof composition."

[0094] In the art, three types of pairings are sometimes distinguished. In Type-1 pairings, we have G ^ = G. In Type-2 and Type-3 pairings, we have G ^ ≠ G and they differ in that Type-2 pairings admit an efficiently computable isomorphism ψ : G ^ → G, though not in the converse direction, whereas no such isomorphism is known for Type-3 pairings. Type-3 pairings offer the most efficient configuration. For increased security, preferably one uses either a Type-2 or Type-3 pairings, and preferably not a Type-1 pairing. See, for example, the paper by Steven D. Galbraith, et al., "Pairings for cryptographers".Vector commitments

[0095] In an embodiment, a vector commitment allows committing to a vector of scalars m 1 , … , m n ∈ ℤ p n using a constant-size, e.g., C = g γ ⋅ ∏ j = 1 n g j m j ∈ G in such a way that the committer can open C for an individual position i ∈ [n] by revealing just m i and a short element π i whose size is independent of the dimension n. More information may be obtained from the paper by B. Libert and M. Yung, "Concise Mercurial Vector Commitments and Independent Zero-Knowledge Sets with Short Proofs". Note that it was not known that such schemes could enable short proofs of binarity. Note, that in the context of a bilinear map, a vector commitment could be computed in either of first or second group. Furthermore, it is permitted to use vector commitment schemes that compute multiple group elements instead of a single element, or to use a different suitable vector commitment schemes.

[0096] In a vector commitment scheme, the structured common reference string (SRS) contains group elements of the form (g, {g i = g (αi)< } i∈[2n]\{n+1} ) and g ^ g ^ i = g ^ α i i = 1 n . In this embodiment, the element g n+1 = g (αn+1)< is not publicly available. The sender commits to m = m 1 , … , m n ∈ ℤ p n by choosing γ ← R ℤ p uniformly and computing the commitment function C = g γ ⋅ ∏ j = 1 n g j m j = g γ + ∑ j = 1 n m j ⋅ α j , which can be seen as the evaluation (in the exponent) of a polynomial whose coefficients are (γ, m 1 , ..., m n ) for the input α ∈ ℤ p . The commitment scheme has a second, similar, commitment function that produces a group element in the other group of the bilinear map.

[0097] To open a position i ∈ [n] of m to m i , the committer reveals a proof π i = g n + 1 − i γ ⋅ ∏ j = 1 , j ≠ i n g n + 1 − i + j m j = C / g m i ⋅ α i α n + 1 − i which is verified by checking that e C g ^ n + 1 − i = e π i g ^ ⋅ e g 1 g ^ n m i .

[0098] It can be shown mathematically that if a malicious committer can come up with a commitment C and valid proofs π i , π i , satisfying (1) for two distinct m i ≠ m i , at some position i ∈ [n], then it can compute the missing element g n+1 = g (αn+1)< of the SRS. Accordingly, this scheme is binding under a variant of the Diffie-Hellman assumption. The common reference scheme above uses a particularly suitable set of generators, but other suitable choices may be made.

[0099] As shown in the paper by B. Libert, S. Ramanna and M. Yung, "Functional Commitment Schemes: From Polynomial Commitments to Pairing-Based Accumulators from Simple Assumptions", this vector commitment allows proving that a committed vector m ∈ ℤ p n satisfies an inner product relation 〈m, t〉 = x for public t = t 1 , … , t n ∈ ℤ p n , x ∈ ℤ p , by using aggregation. For example, one can raise (1) to the power t i ∈ ℤ p and take the product over all indices i ∈ [n] to obtain e C ∏ i = 1 n g ^ n + 1 − i t i = e ∏ i = 1 n π i t i , g ^ ⋅ e g 1 g ^ n ∑ i = 1 m m i ⋅ t i .

[0100] By assuming a random oracle H, proofs {π i } i∈S may be aggregated for a sub-vector S ⊆ [n] by deriving random aggregation coefficients t i = H i , C , S , m S ∈ ℤ p , where m[S] is the sub-vector (m i ) i∈S , and defining the aggregated proof as the product π S = ∏ i ∈ S π i t i . Verification is achieved by checking that e C ∏ i ∈ S g ^ n + 1 − i t i = e π S g ^ ⋅ e g 1 g ^ n ∑ i ∈ S m i ⋅ t i .Proving binarity of a committed vector

[0101] In an embodiment, the vector commitment common reference string contains the description of groups (, G ^ , G T ) with a bilinear map e : G × G ^ → G T and generators g g i = g α i i ∈ 2 n \ n + 1 and g ^ g ^ i = g ^ α i i = 1 n , where n is the dimension of committed vectors. The prover computes a commitment C ^ = g ^ γ ⋅ ∏ j = 1 n g ^ j x j for a random γ ∈ ℤ p and a vector x = (x 1 , ..., x n ) ∈ {0,1} n< .

[0102] Using the aggregation properties of the commitment, it can be demonstrated that x i ∈ {0,1} for each i ∈ [n] by showing that, for each i ∈ [n], we have x i • (x i - 1) = 0 modp. This implies x i ∈ {0,1} since p is prime. This can be shown by using a randomization vector and aggregating the individual equalities, and show that ∑ i = 1 n y i ⋅ x i ⋅ x i − 1 = 0 mod p. The randomization vector y = y 1 , … , y n ∈ ℤ p n is a vector of random aggregation coefficients, which may be obtained by hashing y = H(Ĉ), e.g., using a random oracle H : 0 1 * → ℤ p n , which may be implemented as a hash function. Examples include a hash from the set of hash functions SHA-2, e.g., SHA-256, or from SHA-3. The vector y ∈ ℤ p n is chosen uniformly after x i i = 1 n , the probability to have ∑ i = 1 n y i ⋅ x i ⋅ x i − 1 = 0 mod p is only 1 / p < 2 -λ< (where λ is the security parameter) if there exists i ∈ [n] such that x i ∉ {0,1}. This follows from the Schwartz-Zippel lemma.

[0103] In order to prove the statement using a constant number of group elements, first an auxiliary commitment may be generated by evaluating a commitment function: C y = g γ y ⋅ ∏ j = 1 n g n + 1 − j y j ⋅ x j , for a random γ y ← R ℤ p , which can be seen as a commitment to the same vector (x 1 , ...,x n ) as Ĉ, but in the reversed order and where the i-th entry is multiplied by y i for each i ∈ [n]. Then, two proofs can be generated: An equality proof is computed that demonstrates that C y commits to a vector of the form (y n • x n ,..., y 1 • x 1 ), e.g., the reverse of an auxiliary vector. The commitment (3) satisfies: e C y g ^ i = e g i γ y ⋅ ∏ j = 1 , j ≠ i n g n + 1 − j + 1 y j ⋅ x j , g ^ ⋅ e g 1 g ^ n y i ⋅ x i ∀ i ∈ n

[0104] Here, the group element g i γ y ⋅ ∏ j = 1 , j ≠ i n g n + 1 − j + i y j ⋅ x j may be regarded as a proof opening the value y i · x i . The initial commitment C ^ = g ^ γ ⋅ ∏ j = 1 n g ^ j x j satisfies e g n + 1 − i C ^ = e g n + 1 − i γ ⋅ ∏ j = 1 , j ≠ i n g n + 1 − i + j x j ︸ ≜ π x , i , g ^ ⋅ e g 1 g ^ n x i ∀ i ∈ n ,

[0105] A randomization vector t 1 , … , t n ← R ℤ p n may be chosen for random exponents, and used to raise (5) to the power t i · y i and (4) to the power t i , respectively. If we divide them for each i ∈ [n] and take the product of the ratios over all indices i ∈ [n], we find that π eq = ∏ i = 1 n g n + 1 − i γ ⋅ ∏ j ∈ n \ i g n + 1 − i + j x j t j ⋅ y i ∏ i = 1 n g i γ y ⋅ ∏ j ∈ n \ i g n + 1 − j + i y j ⋅ x j t i . satisfies e ∏ i = 1 n g n + 1 − i t i ⋅ y i , C ^ e C y ∏ i = 1 n g ^ i t i = e π eq q ^ ,

[0106] The reason why π eq is a convincing proof that C y is a commitment to (y n • x n ,..., y 1 • x 1 ) is the following. Suppose that C y is a commitment C y = g γ y ⋅ ∏ j = 1 n g n + 1 − j z n + 1 − j to some vector (z 1 , ...,z n ). Then, (4) becomes e C y g ^ i = e π z , i g ^ ⋅ e g 1 g ^ n z n + 1 − i ∀ i ∈ n , where π z , i = ∏ j = 1 , j ≠ i n g n + 1 − j + i z n + 1 − j is the proof that a prover can compute to open the (n + 1 - i)-th position of C y . Now, if we raise (7) to the power t i and divide it from (5) raised to the power t i · y i , we obtain e ∏ i = 1 n g n + 1 − i t i ⋅ y i , C ^ e C y ∏ i = 1 n g ^ i t i = e ∏ i = 1 n π x , i y i / π z , i t i , g ^ ⋅ e g 1 g ^ n ∑ i = 1 n t i ⋅ y i ⋅ x i − z n + 1 − i , where π x , i = ∏ j = 1 , j ≠ i n g n + 1 − i + j x j is the computable proof that allows opening the i-th position of Ĉ in (5). If (t 1 , ..., t n ) is chosen uniformly after (z 1 , ...,z n ), (y 1 , ..., y n ) and (x 1 , ...,x n ), then the probability to have ∑ i = 1 n t i ⋅ y i ⋅ x i − z n + 1 − i = 0 mod p is 1 / p < 1 / 2 λ< if there exists i ∈ [n] such that z n+1- i # y i • x i . If ∑ i = 1 n t i ⋅ y i ⋅ x i − z n + 1 − i ≠ 0, the prover cannot efficiently compute a valid proof π eq satisfying (6) as this would require to have g n + 1 ∑ i = 1 n t i ⋅ y i ⋅ x i − z n + 1 − i and g n+1 = g (αn+1)< is not publicly available. In an embodiment, one may derive t = t 1 , … , t n = H y C ^ C y ∈ ℤ p n from a hash function, e.g., modeled as a random oracle, to make sure (t 1 ,..., t n ) is computed after y, (x 1 , ...,x n ) and (z 1 ,...,z n ). The randomizing vectors y and t may be obtained in other ways if desired; For example, the hash functions may comprise further dependencies, the randomizing vectors may be obtained from other cryptographic protocols, and so on, as long as they are chosen randomly and independently of x and z.

[0107] The proof π eq implies that the product C y ⋅ ∏ j = 1 n g n + 1 − j − y j is a commitment to the vector (y n · (x n - 1), ...,y 1 · (x 1 - 1)), where (x 1 , ...,x n ) is the vector committed in Ĉ. In an orthogonality proof, it is demonstrated that (y n · (x n - 1),...,y 1 · (x 1 - 1)) is orthogonal to (x n ,...,x 1 ): i.e., ∑ i = 1 n y i ⋅ x i ⋅ x i − 1 = 0. From (2), we notice that such a proof can be obtained as π y = C y ⋅ ∏ j = 1 n g n + 1 − j − y j γ ⋅ ∏ i = 1 n g i γ y ⋅ ∏ j ∈ n \ i g n + 1 − j + i y j ⋅ x j − 1 x i and satisfies e C y ⋅ ∏ j = 1 n g n + 1 − j − y j , C ^ = e π y g ^ ⋅ e g 1 g ^ n ∑ i = 1 n y i ⋅ x i ⋅ x i − 1 = e π y g ^

[0108] In order to reduce the proof size, the linearity of verification equations (6) and (8) may be used to aggregate π eq and π y into a single group element π = π eq δ eq ⋅ π y δ y using random aggregation coefficients δ eq , δ y ∈ ℤ p 2 . The random aggregation could be obtained from a hash function, e.g., applied to the main and auxiliary commitment.

[0109] Eventually, the entire proof π = C y π ∈ G 2 may comprise just the auxiliary commitment C y to (y n · x n , ..., y 1 · x 1 ) and the aggregated proof π ∈ G.

[0110] In the above embodiment, a first auxiliary commitment is computed as C y = g γy< • ∏ j = 1 n g n + 1 − j y j ⋅ x j , from which a second auxiliary commitment is computed to verify the orthogonality proof, C y ⋅ ∏ j = 1 n g n + 1 − j − y j . Instead, the prover could have computed C y = g γ y ⋅ ∏ j = 1 n g n + 1 − j y j ⋅ x j − y j , as the first auxiliary commitment instead. In this case, the first auxiliary commitment could be used directly by the verifier. However, then the verifier would compute a second auxiliary commitment to verify the equality proof. The second auxiliary commitment would then be computed as C y ⋅ ∏ j = 1 n g n + 1 − j + y j .

[0111] As mentioned above, embodiments may use any vector commitment over groups (, G ^ , G T ) equipped with a bilinear map e : G × G ^ → G T , where: (i) The common reference string contains generators g 1 , … , g n 1 ∈ G n 1 , g ^ 1 , … , g ^ n 2 ∈ G ^ n 2 ; (ii) A commitment to a vector (x 1 , ..., x n ) comprises group elements C 1 , … , C m 1 ∈ G m 1 , C ^ 1 … , C ^ m 2 ∈ G ^ m 2 ; (iii) A partial opening at position i ∈ [n] comprises group elements π 1 , … , π l 1 ∈ G l 1 and π ^ 1 , … , π ^ l 2 ∈ G ^ l 2 and satisfies a verification of the form ∏ τ = 1 m 1 e C τ g ^ μ τ i ⋅ ∏ τ = 1 m 2 e g ν τ i C ^ τ ⋅ ∏ τ = 1 l 1 e π τ g ^ j τ ⋅ ∏ τ = 1 l 2 e g k τ π ^ τ ⋅ g T x i = 1 G T , where g T ∈ G T is publicly computable from the common reference string; v 1 (i), ... , v m2 (i) ∈ [n 1 ] and µ 1 (i), ... , µ m1 (i) ∈ [n 2 ] are functions of the opened index i ∈ [n]; and j 1 , ...j ℓ1 ∈ [n 2 ], k 1 , ... , k ℓ2 ∈ [n 1 ] are fixed.

[0112] The above embodiments is a special case of the above equation, where m 1 = 1, m 2 = 0, ℓ 1 = 1, ℓ 2 = 0 and g T = e(g 1 ,ĝ n ).Example 1, detailed embodiment

[0113] On input of a security parameter λ and the maximal dimension n ∈ poly(λ) of committed vectors, do the following: Choose asymmetric bilinear groups (, G ^ , G T ) of prime orderp > 2 l(λ)< , for some function l : ℕ → ℕ, and g ← R G , g ^ ← R G ^ . Pick a random α ← R ℤ p . Compute g 1 , … , g n , g n + 2 , … , g 2 n ∈ G and g ^ 1 , … , g ^ n ∈ G ^ , where g i = g (αi)< for each i ∈ [2n]\{n + 1} and ĝ i = ĝ (αi)< for each i ∈ [n]. Choose hash functions H , H t : 0 1 * → ℤ p n and H agg : 0 1 * → ℤ p 2 .

[0114] The public parameters are defined to be where H = {H, H t , H agg } are hash functions.The public parameters are made available to the verifier. Typically, sharing public parameters need not be done for each demonstration, and may be assumed to have been done at a previous iteration.

[0115] To commit to a main vector x = x 1 , … , x n ∈ ℤ p n , choose a random γ ← R ℤ p and compute the main commitment by evaluating the following first commitment function, C ^ = g ^ γ ⋅ ∏ j = 1 n g ^ j x j

[0116] Return the main commitment C ^ ∈ G ^ and the opening information aux = γ ∈ ℤ p to the prover.

[0117] Given a commitment Ĉ and witnesses (x; aux) comprising a vector x = x 1 , … , x n ∈ ℤ p n and randomness aux = γ ∈ ℤ p , return ⊥ if (x 1 ,...,x n ) ∉{0,1} n< . Otherwise, do the following: Compute the randomizing vector y = y 1 , … , y n = H C ^ ∈ ℤ p n . Next, choose γ y ← R ℤ p and compute the auxiliary commitment by computing a second commitment function C y = g γ y ⋅ ∏ j = 1 n g n + 1 − j y j ⋅ x j

[0118] Then, compute randomizing vector t = t 1 , … , t n = H t y C ^ C y ∈ ℤ p n . Generate an equality proof which satisfies e ∏ i = 1 n g n + 1 − i t i ⋅ y i C ^ e C y ∏ i = 1 n g ^ i t i = e π eq g ^ , and shows that C y hides the same vector x 1 , … , x n ∈ ℤ p n as Ĉ but in reversed order. Compute an orthogonality proof π y ∈ G that ∑ i = 1 n y i ⋅ x i ⋅ x i − 1 = 0. This proof π y is computed as and satisfies e C y ⋅ ∏ j = 1 n g n + 1 − j − y j , C ^ = e π y g ^

[0119] The element C y ⋅ ∏ j = 1 n g n + 1 − j − y j can be regarded as a second auxiliary commitment, in the sense that it commits to a vector, although the second auxiliary commitment is typically computed by a verifier. Compute δ eq δ y = H agg C ^ C y ∈ ℤ p 2 and compute an aggregated proof π = π eq δ eq ⋅ π y δ y .

[0120] Output the final proof π : = C y π ∈ G 2 .

[0121] The public parameters, final proof, main commitment may be shared with a verifier.

[0122] A verifier may proceed as follows. Given a commitment C ^ ∈ G ^ and a purported proof π, parse the latter as in (11). Compute y = H C ^ ∈ ℤ p n , δ eq δ y = H agg C ^ C y ∈ ℤ p 2 and t = H t y C ^ C y ∈ ℤ p n . Return 1 if e C y δ y ⋅ ∏ i = 1 n g n + 1 − i δ eq ⋅ t i − δ y ⋅ y i , C ^ e C y ∏ i = 1 n g ^ i δ eq ⋅ t i = e π g ^ . and 0 otherwise.

[0123] In terms of proof length, π requires just 2 element of G, which is even shorter than size-optimal SNARKs for general NP languages. Using the KSS18 family of pairing-friendly curves suggested by Kachisa et al. , each element of (resp. G ^ ) can have a 348-bit (resp. 1044-bit) representation at the 128-bit security level. The overall proof length does not exceed 696 bits. Remarkably, the overall proof length does not depend on the dimension of the main vector. The computational cost of the prover is dominated by 3n exponentiations in G. The verifier's workload amounts to n exponentiations in G, n exponentiations in G ^ and 3 pairings.

[0124] It is possible to modify the scheme in such a way that the commitment Ĉ lives in and C y lives in G ^ , rather than the opposite. However, the proof is shorter when C y lives in G since elements of usually have a shorter representation. A second example embodiment where C y is in G ^ is provided below.

[0125] Interestingly, one can prove mathematically that the construction is perfectly zero-knowledge against algebraic adversaries. Furthermore, one can prove knowledge-soundness in the algebraic group model, e.g., as formalized in the paper by G. Fuchsbauer, E. Kiltz, and J. Loss, "The Algebraic Group Model and its Applications", and in the random oracle model. This means that, from any algebraic adversary that comes up with a valid proof, we can either extract a witness or break the (2n,n)-DLOG assumption. Under the (2n,n)-DLOG assumption, the scheme provides knowledge-soundness in the algebraic group model and in the random oracle model.Example 2, detailed embodiment

[0126] In the second example embodiment the vector commitment now lives in and the proof computes an auxiliary commitment in G ^ . The final proof π thus comprises two elements in different groups.

[0127] On input of a security parameter λ and the maximal dimension n ∈ poly(λ) of committed vectors, do the following: Choose asymmetric bilinear groups (, G ^ , G T ) of prime order p > 2 l(λ)< , for some function l : ℕ → ℕ, and g ← R G , g ^ ← R G ^ . Pick a random α ← R ℤ p . Compute g 1 , … , g n , g n + 2 , … , g 2 n ∈ G and g ^ 1 , … , g ^ n ∈ G ^ , where g i = g (αi)< for each i ∈ [2n]\{n + 1} and ĝ i = ĝ (αi)< for each i ∈ [n]. Choose hash functions H , H t : 0 1 * → ℤ p n and H agg : 0 1 * → ℤ p 2 .

[0128] The public parameters are where H = {H, H t , H agg } are hash functions.

[0129] To commit to a main vector x = x 1 , … , x n ∈ ℤ p n , choose a random γ ← R ℤ p and compute the main commitment C = g γ ⋅ ∏ j = 1 n g j x j

[0130] Return C E G and the opening information aux = γ ∈ ℤ p .

[0131] Given the main commitment C and witnesses (x; aux) comprising the main vector x = x 1 , … , x n ∈ ℤ p n and randomness aux = γ ∈ ℤ p , return ⊥ if (x 1 , ..., x n ) ∉ {0,1} n< . Otherwise, do the following: Compute a randomizing vector y = y 1 , … , y n = H C ∈ ℤ p n . Next, choose γ y ← R ℤ p and compute an auxiliary commitment C ^ y = g ^ γ y ⋅ ∏ j = 1 n g ^ n + 1 − j y j ⋅ x j

[0132] Then, compute a randomizing vector t = t 1 , … , t n = H t y C C ^ y ∈ ℤ p n . Generate an equality proof π eq = ∏ i = 1 n g n + 1 − i γ ⋅ ∏ j ∈ n \ i g n + 1 − i + j x j t i ⋅ y i ∏ i = 1 n g i γ y ⋅ ∏ j ∈ n \ i g n + 1 − j + i y j ⋅ x j t i which satisfies e C ∏ i = 1 n g ^ n + 1 − i t i ⋅ y i e ∏ i = 1 n g i t i , C ^ y = e π eq g ^ Compute an orthogonality proof π y ∈ G that ∑ i = 1 n y i ⋅ x i ⋅ x i − 1 = 0. This proof π y is computed as and satisfies e C , C ^ y ⋅ ∏ j = 1 n g ^ n + 1 − j − y j = e π y g ^

[0133] The element C ^ y ⋅ ∏ j = 1 n g ^ n + 1 − j − y j can be regarded as a second auxiliary commitment, in the sense that it commits to a vector, although the second auxiliary commitment is typically computed by a verifier. Compute δ eq δ y = H agg C C ^ y ∈ ℤ p 2 and compute an aggregated proof π = π eq δ eq ⋅ π y δ y .

[0134] Output the final proof π : = C ^ y π ∈ G ^ × G .

[0135] Given a commitment C ∈ G and a purported proof π, parse it as in (13). Compute y = H C ∈ ℤ p n , δ eq δ y = H agg C C ^ y ∈ ℤ p 2 and t = H t y C C ^ y ∈ ℤ p n . Return 1 if e C , C ^ y δ y ⋅ ∏ i = 1 n g ^ n + 1 − i δ eq ⋅ t i − δ y ⋅ y i e ∏ i = 1 n g i δ eq ⋅ t i , C ^ y = e π g ^ . and 0 otherwise.

[0136] In both the first and second example embodiments, the second auxiliary commitment is computed for the verification of the orthogonality proof, while the equality proof uses the first auxiliary commitment directly. This could be changed around though for either embodiment.Example applications

[0137] The preferred embodiment can be used in many applications. Exemplifying applications are discussed below.Short proofs that committed vectors are short.

[0138] The first application is to construct proofs that a committed scalar belongs to an interval, which can be useful, e.g., in blockchain transactions. The need for such proofs is explained, e.g., in the paper by Benedikt Bünz, et al., "Bulletproofs: Short Proofs for Confidential Transactions and More", see, e.g., section 1.2.1, explaining Confidential Transactions. We briefly explain the idea for committed scalars, e.g., vectors of dimension n = 1. To prove that V ^ = g ^ r ⋅ g ^ 1 x is a commitment to a small x ∈ [0, 2 ℓ< - 1], we may use a commitment scheme that is also an inner product functional commitment. A description of this property and an example of such a commitment scheme is given in the paper by B. Libert and M. Yung, "Concise mercurial vector commitments and independent zero-knowledge sets with short proofs."

[0139] The prover has a Pedersen commitment V ^ = g ^ r ⋅ g ^ 1 x in the second source group G ^ of the bilinear map. In order to prove x ∈ [0, 2 ℓ< - 1], the prover considers the bit representation (x 1 , ...,x ℓ ) ∈ {0,1} ℓ< of x and computes a commitment C ^ = g ^ γ ⋅ ∏ j = 1 n g j x j for a random γ ∈ ℤ p .

[0140] Using the aggregation properties of the commitment, it can be demonstrated that the committed vector x 1 , … , x n ∈ ℤ p n satisfies: (i) ∑ i = 1 l x i ⋅ 2 i − 1 = x ; (ii) x i ∈ {0,1} for each i ∈ [ℓ]. In order to prove (i), the prover can adapt (2) so as to generate a short proof ∏ i = 1 l π i 2 i − 1 ∈ G such that e ∏ i = 1 l g n + 1 − i 2 i − 1 , C ^ = e ∏ i = 1 l π i 2 i − 1 , g ^ ⋅ e g 1 g ^ n ∑ i = 1 l x i ⋅ 2 i − 1 and show that the exponent above e(g 1 , ĝ n ) in (14) is equal to the committed x in V ^ = g ^ r ⋅ g ^ 1 x . Since V satisfies e g n V ^ = e g 1 g ^ n x ⋅ e g n r g ^ , the prover can actually compute π x = ∏ i = 1 l π i 2 i − 1 / g n r such that e ∏ i = 1 l g n + 1 − i 2 i − 1 , C ^ e g n V ^ = e π x g ^ .

[0141] Proving (ii) can be addressed using an embodiment. The entire statement can be proven using just 3 group elements (namely, one element of G ^ and two elements of ). This construction yields the a range proof shorter than any known in the art, e.g., only 3 group elements which is as short as size-optimal SNARKs.

[0142] The construction outlined above easily extends to prove that a vector commitment V ^ = g ^ r ⋅ ∏ j = 1 n g ^ j x j is a commitment to a vector x = (x 1 , ...,x n ) with small entries, e.g., having entries in a range, e.g., above and / or below a threshold. We can prove that all entries belong to possibly distinct ranges using just 3 group elements.

[0143] We can also handle ranges [0,B] where B + 1 is not a power of 2. The standard approach to this problem is to consider the integer l ∈ ℕ such that 2 ℓ-1< ≤ B < 2 ℓ< and generate two range proofs showing that x ∈ [0, 2 ℓ< - 1] and x + (2 ℓ< - 1 - B) ∈ [0, 2 ℓ< - 1], where the second part is proven using the additive homomorphic property of the commitment. Instead of generating two independent range proofs, we can instead double the size of the CRS (by setting n = 2ℓ̅, where ℓ̅ ≥ ℓ is the maximal bitlength of the range) and avoid increasing the proof size.Short proofs for ring LWE ciphertexts.

[0144] As a second application, it can be used to prove the validity of ring LWE ciphertexts using just 3 group elements. This uses embodiments of the short proofs that a committed vector is binary. This example also exploits the fact that the underlying vector commitment allows proving inner-product relations.

[0145] Let the polynomial rings R = ℤ X / Φ , for some cyclotomic polynomial of degree d, and R q = R / (qR). We aim at proving the existence of a witness s = (s 1 , ..., s M ) ∈ R M< comprised of small-norm ring elements such that ∑ i = 1 M a i ⋅ s i = t mod q Φ for public t ∈ R q N and a 1 , … , a M ∈ R q N . To this end, we re-write (16) as the following equality over ℤ X / Φ ∑ i = 1 M a i ⋅ s i = t + r ⋅ q mod Φ , where r ∈ R N< is a vector of polynomials of degree ≤ d - 1 and the components of a i i = 1 M and t are interpreted as polynomials with coefficients in {-[q / 2],...,[ql2]}. If || s i || ∞ ≤ B i for each i ∈ [M], r contains polynomials with coefficients of magnitude smaller than || r || ∞ ≤ dM • max i∈[M] (B i ) / 2.

[0146] Let us parse a i = a i , 1 , … , a i , N ⊤ ∈ R q N . Let the coefficient embedding ϕ : R → ℤ d that maps s i = ∑ j = 1 d s i , j ⋅ X j − 1 to its coefficient vector ϕ s i = s i , 1 , … , s i , d ∈ ℤ d . Let rot a i , j ∈ ℤ d × d the structured matrix such that ϕ a i , j ⋅ s i mod Φ = rot a i , j ⋅ ϕ s i ∈ ℤ d . If we re-write (17) as a matrix-vector product over , we obtain the relation A 1 … A M ⋅ ϕ s 1 ⋮ ϕ s M = ∑ i = 1 M A i ⋅ ϕ s i = ϕ t + ϕ r ⋅ q where for each i ∈ [M]. Equivalently, (18) can be written A 1 … A M − q ⋅ I Nd ⋅ ϕ s 1 ⋮ ϕ s M ϕ r = ϕ t

[0147] In order to prove (19), the prover will commit to the vector x ∈ ℤ Md + Nd using a Pedersen commitment. Then, it will generate short range proof that || ϕ(s i ) || ∞ ≤ B i for each i ∈ [M] and || ϕ(r) || ∞ ≤ dM · max i∈[M] (B i ) / 2. Finally, it will prove that (19) holds over ℤ p , where p is the order of G ^ . If p > 2Mqdmax i (B i ), this ensures that (19) also holds over the integers. Here, x mod p is defined as the value y ∈ (-p / 2,p / 2) such that y ≡ x(modp).

[0148] In particular, this approach allows proving that a committed vector is a solution to an instance of the subset sum problem, which is useful in many applications.

[0149] Although this example proves the validity of a ring LWE ciphertext, using statement (16) the argument system easily extends to handle more general statements of the form (16). Let a statement comprise a public key a b ∈ R q 2 and an LPR ciphertext t 1 t 2 = a ⋅ r + e 1 , b ⋅ r + e 2 + Δ ⋅ m ∈ R q 2 , where Δ = q / 2 and m ∈ R / (2R) is the plaintext. More information on LPR can be found, e.g., in the paper by Vadim Lyubashevsky, et al. ,"On Ideal Lattices and Learning with Errors Over Rings".

[0150] We consider a prover willing to convince a verifier that there exists a message m E R / (2R), a secret r ∈ R / (2R), and noise terms e 1 ,e 2 E R of norm ||e 1 || ∞ , ∥ e 2 ∥ ∞ ≤ B such that a 1 b Δ 1 ⋅ r m e 1 e 2 = t 1 t 2 mod q

[0151] We will prove the above statement by showing the existence of small polynomials r,m ∈ R / (2R), e 1 ,e 2 ∈ R, and r 1 ,r 2 ∈ R such that a X 1 − q b X Δ 1 − q ⋅ r X m X e 1 X e 2 X r 1 X r 2 X = t 1 X t 2 X mod Φ with || e 1 || ∞ , || e 2 || ∞ ≤ B, and || r 1 || ∞ , || r 2 ||∞≤ (d + 1) / 2. Over , this can be written rot a I d − q ⋅ I d rot b Δ ⋅ I d I d − q ⋅ I d ︸ ≜ A ¯ ⋅ ϕ r ϕ m ϕ e 1 ϕ e 2 ϕ r 1 ϕ r 2 ︸ ≜ w = ϕ t 1 ϕ t 2 ︸ ≜ ϕ t where A is interpreted as a 2d × 6d matrix with coefficients in − q / 2 , … , q / 2 .

[0152] To make the proof shorter, we can directly commit to the bits of w.

[0153] For any integer z ∈ ℤ, let g z = 1 , 2 , 4 , … , 2 z − 2 , − 2 z − 1 ⊤ ∈ ℤ 1 × z and G z = I d ⊗ g z ⊤ ∈ ℤ d × dz . We also define G z − 1 v as the decomposition function that inputs an integer vector v ∈ [-2 z-1< ,2 z-1< - 1] d< and outputs a binary decomposition G z − 1 v ∈ 0 1 d ⋅ z such that G z ⋅ G z − 1 v = v . Then, we can prove that rot a G 1 + log B − q ⋅ G log d rot b Δ ⋅ I d G 1 + log B − q ⋅ G log d ︸ ≜ A ˜ ⋅ ϕ r ϕ m e 1 e 2 r 1 r 2 ︸ ≜ w = ϕ t 1 ϕ t 2 ︸ ≜ ϕ t where e 1 = G 1 + log B − 1 ϕ e 1 , e 2 = G 1 + log B − 1 ϕ e 2 , r 1 = G log d − 1 ϕ r 1 and r 2 = G log d − 1 ϕ r 2 .

[0154] The prover can thus commit to the decomposition of the witness w ∈ {0,1} D< , where D = 2d(2 + logB + logd). In order to prove that relation (22) holds modulo p (and thus also over since both members have infinity norm smaller than p / 2), the prover can use a random vector θ ∈ ℤ p 2 d (derived from a hash function with random-looking outputs) and prove that the committed w ∈ {0,1} D< satisfies θ T< · à · w = θ T< · ϕ(t ) over ℤ p . By a standard argument, if à · w ≠ ϕ(t ) mod p, we have θ T< . (à · w - ϕ(t )) = 0 mod p with probability 1 / p. Proving that θ T< · à · w = θ T< · ϕ(t ) mod p amounts to proving that a committed w satisfies an inner product relation, which can be done using one element of as explained herein

[0155] By applying the above ideas, we can prove the validity of a ring LWE ciphertext using just 3 group elements (namely, one element of G ^ and two elements of ), which is very short. Under the (2n,n)-DLOG assumption, the scheme can be proven to satisfy the notion of simulation-extractability in the combined algebraic group model and random oracle model. The resulting construction thus provides simulation-extractability in the algebraic group model combined with the random oracle model using only 3 group elements per proof while the most computationally efficient simulation-extractable proofs known in the art requires 4 group elements per proof: 2 elements in and 2 elements in G ^ . Simulation-extractable guarantees knowledge-soundness even if the adversary observes proofs generated by honest provers.

[0156] In addition, we obtain a shorter structured random string, by a factor 2, than if one were to use a generic SNARK for arithmetic circuits. In a SNARK-based approach it is estimated that the number of multiplication gates in the arithmetic circuit would be roughly 142000, so that the prover would have to compute more than 10 6< exponentiations in or their equivalent. In our setting, we need to commit to vectors of dimension n ≈ 112000 and the prover has to compute less than 340000 exponentiations in . These estimations assume an instantiation of the LPR cryptosystem for λ = 128, where a common choice of parameters is d = 1024, q ≈ 2 64< , with binary uniform r ∈ R / (2R) while e 1 ,e 2 are sampled from a discrete Gaussian distribution with standard deviation αq ≈ 2 39< . In this case, a Gaussian vector e i ∼ D ℤ d , αq has infinity norm || e i ||∞≤ B = αq λ < 2 43 with overwhelming probability. The formula e i ∼ D ℤ d , αq denotes the discrete Gaussian over ℤ d with standard deviation αq and center 0.Proving that a committed vector is ternary.

[0157] Using the preferred embodiment, we can also prove that a commitment C ^ = g ^ γ ⋅ ∏ j = 1 l g ^ j x j commits to a ternary vector x = (x 1 ,...,x ℓ ) ∈ {-1,0,1} ℓ< . This is useful, e.g., when we want to prove the validity or a ring LWE public key for which the underlying secret key is a polynomial with coefficients in {-1,0,1}.

[0158] An approach is to write x as the difference x = x 0 - x 1 between two binary vectors x 0 ,x 1 ∈ {0,1} ℓ< . The prover can generate two vector commitments Ĉ 0 ,Ĉ 1 to x 0 and x 1 , respectively, before proving that: (i) Ĉ 0 ,Ĉ 1 are both commitments to bitstrings; (ii) C ^ 0 ⋅ C ^ 1 − 1 and Ĉ commit to the same vector. Even if we aggregate proofs, each proof π still requires 2 elements of G ^ and 3 elements of since Ĉ 0 and Ĉ 1 both require an auxiliary commitment in .

[0159] At the expense of doubling the CRS size, we can reduce the size of proofs to one element of G ^ and 2 elements of . To do this, we can generate a commitment to a binary vector x = (x 0 |x 1 ) ∈ {0,1}", where n = 2ℓ. We can then prove that: (i) x = (x̅ 1 , ...,x̅ n ) is binary; (ii) For each i ∈ [ℓ], x̅ i - x̅ i+ℓ = x i . In order to ensure knowledge-soundness in the security analysis, we also need a proof component π 0 showing that Ĉ commits to a vector containing zeroes in its last ℓ positions. For example, for the latter the proof from Sergey Gorbunov et al., "Pointproofs: Aggregating Proofs for Multiple Vector Commitments", may be used.

[0160] We can prove (i) as in previous constructions. As for (ii), we can use the properties of the underlying commitment. Namely, if C ^ x = g ^ γ x ⋅ ∏ j = 1 n g ^ j x ¯ j is a commitment to x = (x 1 |x 2 ), the prover can compute π ¯ θ , i , 0 , π ¯ θ , i , 1 ∈ G such that e g n + 1 − i C ^ x = e g 1 g ^ n x ¯ i ⋅ e π ¯ θ , i , 0 g ^ and e g n + 1 − i − l C ^ x = e g 1 g ^ n x ¯ i + l ⋅ e π ¯ θ , i , 1 g ^ for each i ∈ [ℓ]. In the initial commitment C ^ = g ^ γ ⋅ ∏ j = 1 l g ^ j x j to the ternary x = (x 1 , ... , x ℓ ), we also have e g n + 1 − i C ^ = e g 1 g ^ n x i ⋅ e π ˜ θ , i g ^ ∀ i ∈ l for some π ˜ θ , i ∈ G computable by the prover. By combining (23)-(25), we have e g n + 1 − i ⋅ g n + 1 − i − l − 1 , C ^ x e g n + 1 − i C ^ = e π ¯ θ , i , 0 / π ¯ θ , i , 1 ⋅ π ˜ θ , i ︸ ≜ π θ , i g ^ , where π θ,i is computable by the prover and argues that x̅ i = x̅ i - x̅ i+ℓ . We can then aggregate proofs for all positions i ∈ [ℓ] at once by raising (26) to a random power θ i ∈ ℤ p (obtained by hashing Ĉ and Ĉ x ) and taking the product over all indices i ∈ [ℓ]. This yields a proof π θ = ∏ i ∈ l π θ , i θ i ∈ G satisfying e ∏ i = 1 l g n + 1 − i θ i ⋅ g n + 1 − i − l − θ i , C ^ x e ∏ i = 1 l g n + 1 − i θ i , C ^ = e π θ g ^ which provides evidence that x = x 0 - x 1 . Indeed, if there exists i ∈ [ℓ] such that (26) does not hold for some π θ,i computable by the prover, then (27) holds with probability 1 / p as long as the coefficients (θ 1 ,...,θ ℓ ) are chosen after Ĉ and Ĉ x . The final proof π = (Ĉ x ,C y ,π) that x ∈ {-1,0,1} ℓ< comprises the commitment Ĉ x and a pair C y π ∈ G 2 , where π is an aggregation of π θ with the proof that Ĉ x commits to a binary vector.Proving exact Hamming weights for binary vectors.

[0161] For a commitment C ^ = g ^ γ ⋅ ∏ j = 1 n g ^ j x j to a binary x ∈ {0,1} n< , we can also prove that x has a fixed Hamming weight. This is useful in the context of FHE, where secret keys are sometimes chosen with a special structure for efficiency reasons. To prove that a committed x has Hamming weight k, we can prove that: (i) x is binary; (ii) Its inner product with the all-one vector (1,1, ...,1) is exactly k. The preferred embodiment allows proving (i). In order to prove (ii), the prover can generate a short π k ∈ G such that e ∏ i = 1 n g n + 1 − i , C ^ = e g 1 g ^ n k ⋅ e π k g ^ , which is possible as in (2) since k = ∑ i = 1 n x i . Again, we can aggregate π k with other proof components to obtain a proof comprised of just one element of G ^ and two elements of .Proving bounded Hamming weights for arbitrary vectors.

[0162] We now consider the problem of proving small Hamming weights for an arbitrary x = x 1 , … , x n ∈ ℤ q n committed as C ^ = g ^ γ ⋅ ∏ j = 1 n g ^ j x j . Using the additive homomorphic property of the commitment scheme, this also allows proving that two committed vectors are close in terms of Hamming distance.

[0163] To prove the statement, we first generate a commitment C w to a random vector w = (w 1 , ...,w n ) ∈ {0,1} n< of Hamming weight HW(w ) = B for which w i = 1 for all i ∈ [n] such that x i ≠ 0. We can then prove that: (i) w is binary and has Hamming weight B; (ii) For each i ∈ [n], w i = 1 whenever x i ≠ 0, which implies HW(x ) ≤ HW(w ).

[0164] We can prove (i) as explained in the previous paragraph. In order to prove (ii), we can prove that ∑ i = 1 n y i ⋅ 1 − w i ⋅ x i = 0 for a random vector y = y 1 , … , y n ∈ ℤ p n . The latter condition ensures that ∀i ∈ [n]: (x i ≠ 0) ⇒ (w i = 1) with overwhelming probability 1 - 1 / p. Indeed, if there exists i ∈ [n] such that x i ≠ 0 and w i = 0, we have ∑ i = 1 n y i ⋅ 1 − w i ⋅ x i = 0 with negligible probability 1 / p as long as (y 1 , ..., y n ) is chosen randomly after w and x.

[0165] In more details, the prover computes an auxiliary commitment C w = g γ w ⋅ ∏ j = 1 n g j w i to w ∈ {0,1}", for some random γ w ← R ℤ p , and proves that C w is a commitment to a binary vector. Then, the prover generates another commitment C y = g γ y ⋅ ∏ i = 1 n g n + 1 − i y i ⋅ w i and proves that it commits to the reversed Hadamard product (y n · w n , ... , y 1 · w 1 ), where (y 1 ,...,y n ) = H(Ĉ,C w ), by proceeding exactly as in the preferred embodiment. Next, the prover can generate a short π y ∈ G such that e ∏ i = 1 n g n + 1 − i y i ⋅ C y − 1 , C ^ = e π y g ^ ⋅ e g 1 g ^ n ∑ i = 1 n y i ⋅ 1 − w i ⋅ x i = e π y g ^ , which is possible since ∏ i = 1 n g n + 1 − i y i ⋅ C y − 1 = g γ y ⋅ ∏ i = 1 n g n + 1 − i y i ⋅ 1 − w i , so that the sum ∑ i = 1 n y i ⋅ 1 − w i ⋅ x i is the coefficient of α n+1< when we see the left-hand-side member of (29) as a product of univariate polynomials in the exponent.

[0166] Figure 3 schematically shows an example of an embodiment of a proving method 300. Method 300 may be computer-implemented. Method 300 demonstrates by a prover to a verifier that a main vector (x = (x 1 , ..., x n )) is a binary vector using a vector commitment scheme. Method 300 comprises computing (310) by a prover a main commitment (Ĉ; C), the main commitment committing to the main vector (x ), obtaining (320) by the prover a randomizing vector (y = (y 1 , ... , y n )), the randomizing vector being made available to the verifier, computing (330) by the prover a first auxiliary commitment (C y ; Ĉ y ), the first auxiliary commitment committing, in reverse order, to an auxiliary vector comprising a Hadamard product of the main vector (x ) and the randomizing vector (y ), generating (340) a first proof (π y ) demonstrating that a further vector comprising the product of the randomizing vector and the main vector minus 1 in each component (y i (x i - 1) is orthogonal to the main vector (x i ), the first proof being arranged for verification by a verifier. Optionally, method 300 further comprises generating (350) a second proof (π eq ) demonstrating that the main vector in the Hadamard product committed to in the first auxiliary commitment is the main vector committed to in the main commitment.

[0167] An aspect further concerns a cryptographic method for verifying by a verifier a proof generated according to any of the preceding claims.

[0168] For example, the verifying and demonstrating methods may be computer implemented methods. The vectors, proofs, and commitments may be represented by multiple bits. For example, the vectors may have at least 10, 100, 1000 vectors. For example, proofs, and commitments may be represented digitally in bits and may each comprise at least 100, at least 500, bits.

[0169] Many different ways of executing the method are possible, as will be apparent to a person skilled in the art. For example, the order of the steps can be performed in the shown order, but the order of the steps can be varied or some steps may be executed in parallel. Moreover, in between steps other method steps may be inserted. The inserted steps may represent refinements of the method such as described herein, or may be unrelated to the method. For example, some steps may be executed, at least partially, in parallel. Moreover, a given step may not have finished completely before a next step is started.

[0170] Embodiments of the method may be executed using software, which comprises instructions for causing a processor system to perform method 300. Software may only include those steps taken by a particular sub-entity of the system. The software may be stored in a suitable storage medium, such as a hard disk, a floppy, a memory, an optical disc, etc. The software may be sent as a signal along a wire, or wireless, or using a data network, e.g., the Internet. The software may be made available for download and / or for remote usage on a server. Embodiments of the method may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to perform the method.

[0171] It will be appreciated that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the presently disclosed subject matter into practice. The program may be in the form of source code, object code, a code intermediate source, and object code such as partially compiled form, or in any other form suitable for use in the implementation of an embodiment of the method. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods set forth. These instructions may be subdivided into subroutines and / or be stored in one or more files that may be linked statically or dynamically. Another embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the devices, units and / or parts of at least one of the systems and / or products set forth.

[0172] The following clauses represent favorable embodiments. Clause 1. A cryptographic method (300) for demonstrating by a prover to a verifier that a main vector (x = (x 1 , ... , x n )) is a binary vector using a vector commitment scheme, computing (310) by a prover a main commitment (Ĉ; C), the first commitment committing to the main vector (x ), obtaining (320) by the prover a randomizing vector (y = (y 1 , ... , y n )), the randomizing vector being made available to the verifier, computing (330) by the prover a first auxiliary commitment (C y ; Ĉ y ), the first auxiliary commitment committing to, in reverse order as the main vector, an auxiliary vector comprising a Hadamard product of the main vector (x ) and the randomizing vector (y ), generating (340) a first proof (π y ) demonstrating that a further vector comprising the product of the randomizing vector and the main vector minus 1 in each component (y i (x i - 1)) is orthogonal to the main vector (x i ), the first proof being arranged for verification by a verifier. Clause 2. A method as in Clause 1, wherein the main commitment (Ĉ; C) is computed by evaluating a commitment function of the vector commitment scheme for the main vector (x ), and / or the auxiliary commitment (Ĉ; C) is computed by evaluating a commitment function of the vector commitment scheme for the auxiliary vector, or a linear combination of the auxiliary vector and the randomizing vector, or for the auxiliary vector minus the randomizing vector. Clause 3. A method as in any of the preceding clauses, comprising generating (350) a second proof (π eq ) demonstrating that the main vector in the Hadamard product committed to in the first auxiliary commitment is the main vector committed to in the main commitment. Clause 4. A method as in Clause 3, wherein the commitment scheme is arranged to allow a partial opening for an element (x i ) at a position (i ∈ [n]) of a vector, the second proof comprising a product of proofs ranging over the indices in the main vector divided by a product of proofs ranging over the indices in the auxiliary vector. Clause 5. A method as in any of the preceding clauses, wherein the main commitment, the auxiliary commitment, the first proof and the second proof each have a size which is independent on the dimension of the main vector. Clause 6. A method as in any of the preceding clauses, wherein the vector commitment scheme is additively homomorphic. Clause 7. A method as in any of the preceding clauses, the verification further comprising obtaining a second auxiliary commitment C y ⋅ ∏ j = 1 n g n + 1 − j − y j from the first auxiliary commitment. Clause 8. A method as in Clause 7, wherein the second auxiliary commitment is obtained from the first auxiliary commitment and the randomizing vector using an additive homomorphic property of the commitment scheme. Clause 9. A method as in any of the preceding clauses, wherein a bilinear map (e(,)) is defined from a first group and a second group (, G ^ ) to a third group ( G T ), a vector commitment being an element in one of the first and second groups ( G ^ ; ), verification of the first proof comprising a first application of the bilinear map to the first proof and a generator of the second group (e(π y ,ĝ)). Clause 10. A method as in Clause 9, wherein verification of the first proof comprises a second application of the bilinear map (e(C y , Ĉ)) to the main commitment and the auxiliary commitment, the verification comprises comparing the results of the first and second application in the third group. Clause 11. A method as in Clause 10 and 7, wherein verification of the first proof comprises a second application of the bilinear map ( e C y ⋅ ∏ j = 1 n g n + 1 − j − y j , C ^ ) to the main commitment and the second auxiliary commitment, the verification comprises comparing the results of the first and second application in the third group. Clause 12. A method as in Clause 9, Clause 3 and any of the preceding clauses, wherein the second proof (π eq ) is an element of the first group (), the second proof being arranged for verification by a verifier, said verification comprising comparing applications of the bilinear map to the second proof (e(π eq ,ĝ)), the main commitment ( e ∏ j = 1 n g n + 1 − i t i ⋅ y i , C ^ ), and the auxiliary commitment ( e C y ∏ i = 1 n g ^ i t i ) or a second auxiliary commitment derived from the auxiliary commitment and the randomization vector. Clause 13. A method as in Clause 12, wherein the applications of the bilinear map are with products of selected group generators, wherein the group generators are selected for the comparison to balance if the main commitment and the first auxiliary commitment both correspond to the same main vector. Clause 14. A method as in Clause 4, Clause 9 and any of the preceding clauses, wherein the bilinear map applied to a selected group element of the first group and the main commitment (e(g n+1-i , Ĉ)) equals in the third group the product of the bilinear map applied to an opening proof for an element at an index and a selected group element of the second group (e(π x,i ,ĝ)) and the bilinear map applied to a selected group element of the first group and a selected element of the second group, raised to the value of the element at the index (e(g 1 ,ĝ n ) xi< ), and / or the bilinear map applied to the auxiliary commitment and a selected group element of the second group (e(C y ,ĝ i )) equals in the third group the product of the bilinear map applied to an opening proof for an element at an index and a selected group element of the second group (e(ε yx,i ,ĝ)) and the bilinear map applied to a selected group element of the first group and a selected element of the second group, raised to the value of the element at the index (e(g 1 ,ĝ n ) yi·xi< ). Clause 15. A method as in any of the preceding clauses, comprising making the commitment and the auxiliary commitment available to the verifier, and making the first proof and / or the second proof or an aggregation thereof available to the verifier. Clause 16. A method as in any of the preceding clauses, wherein the vector commitment scheme comprises a Pedersen commitment scheme. Clause 17. A method for demonstrating that a number (x) is smaller than a threshold, comprising obtaining a bit vector comprising a bit representation ((x 1 , ... , x ℓ ) ∈ {0,1} ℓ< ) of the number (x) and computing a commitment for the vector, and generating at least the first proof according to any of the preceding clauses, generating a proof demonstrating the equality of the bit vector to the number. Clause 18. A method for demonstrating validity of a ring LWE ciphertext over a ring R = ℤ X / Φ , the ciphertext comprising a first vector s = (s 1 ,...,s M ) ∈ R M< , and a second vector a, satisfying the equation ∑ i = 1 M a i ⋅ s i = t mod q Φ , for t ∈ R q N and a 1 , … , a M ∈ R q N , and R q = R / (qR) for an integer q, comprising representing vector s as a binary vector, generating at least a first proof as in any of clause 1-16, generating a proof that the vector s satisfies the equation. Clause 19. A method for demonstrating a vector x is ternary, comprising write x as the difference x = x 0 - x 1 between two binary vectors x 0 , x 1 ∈ {0,1} ℓ< and generating at least a first proof as in any of clause 1-16, for the concatenated vector of the two binary vectors. Clause 20. A cryptographic method for verifying by a verifier a proof generated according to any of the preceding clauses. Clause 21. A system comprising: one or more processors; and one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for a method according to any of the preceding clauses. Clause 22. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations according to any of clauses 1-20.

[0173] Figure 4a shows a computer readable medium 1000 having a writable part 1010, and a computer readable medium 1001 also having a writable part. Computer readable medium 1000 is shown in the form of an optically readable medium. Computer readable medium 1001 is shown in the form of an electronic memory, in this case a memory card. Computer readable medium 1000 and 1001 may store data 1020 wherein the data may indicate instructions, which when executed by a processor system, cause a processor system to perform an embodiment of a demonstrating and / or verifying method, according to an embodiment. The computer program 1020 may be embodied on the computer readable medium 1000 as physical marks or by magnetization of the computer readable medium 1000. However, any other suitable embodiment is conceivable as well. Furthermore, it will be appreciated that, although the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable. The computer program 1020 comprises instructions for causing a processor system to perform said demonstrating and / or verifying method.

[0174] Figure 4b shows in a schematic representation of a processor system 1140 according to an embodiment of a demonstrating and / or verifying system. The processor system comprises one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is schematically shown in Figure 4b. Circuit 1110 comprises a processing unit 1120, e.g., a CPU, for running computer program components to execute a method according to an embodiment and / or implement its modules or units. Circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of memory 1122 may be read-only. Circuit 1110 may comprise a communication element 1126, e.g., an antenna, connectors or both, and the like. Circuit 1110 may comprise a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method. Processor 1120, memory 1122, dedicated IC 1124 and communication element 1126 may be connected to each other via an interconnect 1130, say a bus. The processor system 1110 may be arranged for contact and / or contact-less communication, using an antenna and / or connectors, respectively.

[0175] For example, in an embodiment, processor system 1140, e.g., the demonstrating and / or verifying system may comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, ARM Cortex-R8, etc. The memory circuit may be an ROM circuit, or a non-volatile memory, e.g., a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the device may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., arranged for providing the software.

[0176] While system 1140 is shown as including one of each described component, the various components may be duplicated in various embodiments. For example, the processing unit 1120 may include multiple microprocessors that are configured to independently execute the methods described herein or are configured to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functionality described herein. Further, where the system 1140 is implemented in a cloud computing system, the various hardware components may belong to separate physical systems. For example, the processor 1120 may include a first processor in a first server and a second processor in a second server.

[0177] It should be noted that the above-mentioned embodiments illustrate rather than limit the presently disclosed subject matter, and that those skilled in the art will be able to design many alternative embodiments.

[0178] In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb 'comprise' and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article 'a' or 'an' preceding an element does not exclude the presence of a plurality of such elements. Expressions such as "at least one of" when preceding a list of elements represent a selection of all or of any subset of elements from the list. For example, the expression, "at least one of A, B, and C" should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The presently disclosed subject matter may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer. In the device claim enumerating several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0179] In the claims references in parentheses refer to reference signs in drawings of exemplifying embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.

Claims

1. A computer implemented, cryptographic method (300) for demonstrating by a prover to a verifier that a main vector (x = (x1, ... , xn)) is a binary vector using a vector commitment scheme, wherein the vector commitment scheme is arranged to compute a proof allowing a partial opening for an element (xi) at a position (i ∈ [n]) of a committed vector, - computing (310) by a prover a main commitment (Ĉ; C), the main commitment committing to the main vector (x), - obtaining (320) by the prover a randomizing vector (y = (y1,... , yn)), the randomizing vector being made available to the verifier, wherein the randomizing vector is chosen by the verifier or derived from the output of a cryptographic hash function, - computing (330) by the prover a first auxiliary commitment (Cy; Ĉy), the first auxiliary commitment committing to, in reverse order as the main vector, an auxiliary vector comprising a Hadamard product of the main vector (x) and the randomizing vector (y), - generating (340) a first proof (πy) demonstrating that a further vector comprising the product of the randomizing vector and the main vector minus 1 in each component (yi(xi - 1)) is orthogonal to the main vector (xi), the first proof being arranged for verification by the verifier - generating (350) a second proof (πeq) demonstrating that the main vector in the Hadamard product committed to in the first auxiliary commitment is the main vector committed to in the main commitment.

2. A method as in Claim 1, wherein - the main commitment (Ĉ; C) is computed by evaluating a commitment function of the vector commitment scheme for the main vector (x), and / or - the auxiliary commitment (Ĉ; C) is computed by evaluating a commitment function of the vector commitment scheme for the auxiliary vector, or a linear combination of the auxiliary vector and the randomizing vector, or for the auxiliary vector minus the randomizing vector.

3. A method as in Claim 1 or 2, the second proof comprising a product of proofs ranging over the elements of the main vector divided by a product of proofs ranging over the elements of the auxiliary vector.

4. A method as in any of the preceding claims, wherein the main commitment, the auxiliary commitment, the first proof and the second proof each have a size which is independent on the dimension of the main vector.

5. A method as in any of the preceding claims, wherein the vector commitment scheme is additively homomorphic.

6. A method as in any of the preceding claims, the verification further comprising obtaining a second auxiliary commitment C y ⋅ ∏ j = 1 n g n + 1 − j − y j from the first auxiliary commitment.

7. A method as in Claim 6, wherein the second auxiliary commitment is obtained from the first auxiliary commitment and the randomizing vector using an additive homomorphic property of the commitment scheme.

8. A method as in any of the preceding claims, wherein a bilinear map (e(,)) is defined from a first group and a second group (, G ^ ) to a third group ( G T ), a vector commitment being an element in one of the first and second groups ( G ^ ; ), - verification of the first proof comprising a first application of the bilinear map to the first proof and a generator of the second group (e(πy,ĝ)).

9. A method as in Claim 8, wherein verification of the first proof comprises a second application of the bilinear map (e(Cy,Ĉ)) to the main commitment and the auxiliary commitment, the verification comprises comparing the results of the first and second application in the third group.

10. A method as in Claim 9, and Claim 6 or 7, wherein verification of the first proof comprises a third application of the bilinear map ( e C y ⋅ ∏ j = 1 n g n + 1 − j − y j , C ^ ) to the main commitment and the second auxiliary commitment, the verification comprises comparing the results of the first and second application in the third group.

11. A method as in Claim 8, and any of the preceding claims, wherein the second proof (πeq) is an element of the first group (), the second proof being arranged for verification by a verifier, said verification comprising comparing applications of the bilinear map to the second proof (e(πeq,ĝ)), the main commitment ( e ∏ i = 1 n g n + 1 − i t i ⋅ y i , C ^ ), and the auxiliary commitment ( e C y ∏ i = 1 n g ^ i t i ) or a second auxiliary commitment derived from the auxiliary commitment and the randomization vector.

12. A method as in Claim 11, wherein the applications of the bilinear map are with products of selected group generators, wherein the group generators are selected for the comparison to balance if the main commitment and the first auxiliary commitment both correspond to the same main vector.

13. A method as in Claim 3, Claim 8 and any of the preceding claims, wherein - the bilinear map applied to a selected group element of the first group and the main commitment (e(gn+1-i,Ĉ)) equals in the third group the product of the bilinear map applied to an opening proof for an element at a position and a selected group element of the second group (e(πx,i,ĝ)) and the bilinear map applied to a selected group element of the first group and a selected element of the second group, raised to the value of the element at the position (e(g1,ĝn)xi) and / or - the bilinear map applied to the auxiliary commitment and a selected group element of the second group (e(Cy,ĝi)) equals in the third group the product of the bilinear map applied to an opening proof for an element at an position and a selected group element of the second group (e(εyx,i,ĝ)) and the bilinear map applied to a selected group element of the first group and a selected element of the second group, raised to the value of the element at the position (e(g1,ĝn)yi·xi).

14. A method as in any one of the preceding claims, wherein the second proof (πeq) is obtained aggregating randomized openings for vector elements.

15. A method as in any of the preceding claims, comprising - making the commitment and the auxiliary commitment available to the verifier, and making the first proof and / or the second proof or an aggregation thereof available to the verifier.

16. A method as in any of the preceding claims, wherein the vector commitment scheme comprises a Pedersen commitment scheme.

17. A method for demonstrating that a number (x) is smaller than a threshold, comprising - obtaining a bit vector comprising a bit representation ((x1, ... , xℓ) ∈ {0,1}ℓ) of the number (x) and computing a commitment for the vector, and generating at least the first proof according to any of the preceding claims, - generating a proof demonstrating the equality of the bit representation to the number (x), - demonstrating that the number (x) is smaller than the threshold by opening one or more most significant bits of the bit vector.

18. A method for demonstrating validity of a ring LWE ciphertext over a ring R = ℤ X / Φ , the ciphertext comprising a first vector s = (s1, ... , sM) ∈ RM, and a second vector a, satisfying the equation ∑ i = 1 M a i ⋅ s i = t mod q Φ , for t ∈ R q N and a 1 , … , a M ∈ R q N , and Rq = R / (qR) for an integer q, comprising representing vector s as a binary vector, generating at least a first proof as in any of claim 1-16, generating a proof that the vector s satisfies the equation.

19. A method for demonstrating a vector x is ternary, comprising write x as the difference x = x0 - x1 between two binary vectors x0, x1 ∈ {0,1}ℓ and generating at least a first proof as in any of claim 1-16, for the concatenated vector of the two binary vectors.

20. A method as in any of the preceding claims, wherein the randomizing vector (y = (y1, ... , yn)) is obtained from a scalar (u) chosen by the verifier or derived from the output of a hash function, the randomizing vector being obtained by a series of polynomial functions applied to the scalar, e.g., y = (1, u, u2, ... , un-1).

21. A cryptographic method for verifying by a verifier a proof generated according to any of the preceding claims.

22. A system comprising: one or more processors; and one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for a method according to any of the preceding claims.

23. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform operations according to any of claims 1-21.