Computer-implemented method and system for knowledge proof in blockchain transactions

Abstract

To provide a method of enabling knowledge proof in a blockchain transaction.SOLUTION: A method comprises sending, from a verifier to a prover, a blockchain transaction redeemable by means of data including: (i) first data (y) based on a combination of an ephemeral key (r), second data (c) and a private key of a public-private key pair of a cryptography system, where the public key (ν) is based on an integer generator raised to a first power, where the first power is based on the private key, and where knowledge of the private key is required in order to determine the ephemeral key from the first data; and (ii) third data (x) based on the integer generator raised to a second power, where the second power is based on the ephemeral key.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates generally to proof-of-knowledge systems for blockchain transactions, and in particular to on-chain non-interactive implementations of proof-of-knowledge systems. The present disclosure is particularly suited for use in, but not limited to, signature schemes for any data authentication. [Background technology]

[0002] Herein, we use the term "blockchain" to encompass all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variations thereof. Although other blockchain implementations have been proposed and developed, the most widely known application of blockchain technology is the Bitcoin ledger. Bitcoin may be referred to herein for convenience and illustrative purposes, but it should be noted that this disclosure is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are encompassed within the scope of this disclosure. The term "user" here may refer to a human or processor-based resource.

[0003] A blockchain is a peer-to-peer electronic ledger implemented as a computer-based decentralized distributed system, composed of blocks, which in turn are composed of transactions. Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system, and contains at least one input and at least one output. Each block contains a hash of the previous block, and these blocks are chained together to create a permanent, immutable record of all transactions written to the blockchain since origin. Transactions contain small programs, known as scripts, that embed their inputs and outputs and specify how and by whom the transaction's outputs are accessible. In the Bitcoin platform, these scripts are written using a scripting language based on the stack.

[0004] In order for a transaction to be written to the blockchain, it must be validated. Network nodes (miners) perform the work to ensure that invalid transactions are rejected from the network and that each transaction is valid. A software client installed on the node performs this validation work on unspent transactions (UTXOs) by executing the UTXO's lock and unlock scripts. If the execution of the lock and unlock scripts evaluates to TRUE, the transaction is valid and the transaction is written to the blockchain. Thus, for a transaction to be written to the blockchain, it must be (i) validated by the first node that receives the transaction, and if the transaction is valid, the node relays the transaction to other nodes in the network, (ii) added to a new block constructed by miners, and (iii) mined, i.e., added to the public ledger of past transactions.

[0005] Although blockchain technology is most widely known for its use in implementing cryptocurrencies, digital entrepreneurs are beginning to exploit the use of both the cryptographic security system on which Bitcoin is based and the data that can be stored on the blockchain to implement new systems. It would be highly advantageous if blockchain could be used to automate tasks and processes that are not limited to the cryptocurrency field. Such solutions could make their uses more diverse while taking advantage of the benefits of blockchain (e.g. permanence, tamper resistance of the record of events, decentralized processing, etc.).

[0006] One area of ​​current research is the use of blockchain-based computer programs for the implementation of "smart contracts". These are computer programs designed to automate the execution of the terms of a machine-readable contract or agreement. Unlike traditional contracts, which are written in a natural language, smart contracts are machine-executable programs that contain rules that can process inputs to generate outcomes, which in turn cause actions to be performed depending on the outcomes.

[0007] Another area of ​​blockchain-related interest is the use of "tokens" (or "coloured coins") to represent and transfer real-world entities via the blockchain. Potentially confidential or secret items can be represented by tokens that have no discernible meaning or value. Thus, the tokens act as identifiers that allow real-world items to be referenced from the blockchain.

[0008] A knowledge proof is a cryptographic system that allows one party to prove to another that he or she knows a secret without disclosing any information about the secret. There are many realizations of knowledge proof systems. However, most of them are computationally expensive.

[0009] It is therefore desirable to provide a proof-of-knowledge system for blockchain transactions that is more computationally efficient than existing proof-of-knowledge systems.

[0010] Such an improved solution has now been devised. Summary of the Invention

[0011] There is provided a method as defined in the accompanying claims.

[0012] 1. A method for enabling proof of knowledge in a blockchain transaction, the method comprising: A method may be provided that includes transmitting from a verifier to a prover a blockchain transaction redeemable with data including: (i) first data based on a combination of an ephemeral key, second data, and a private key of a public-private key pair of a cryptosystem, where the public key is based on an integer generator raised to a first multiplier, where the first multiplier is based on the private key, knowledge of the private key being required to determine the ephemeral key from the first data; and (ii) third data based on the integer generator raised to a second multiplier, where the second multiplier is based on the ephemeral key.

[0013] 1. A computer-implemented method for determining a value of two raised to an integer power, the method comprising: determining coefficients of terms of a power of 2 series, each term of the series including a respective power of 2 multiplied by a respective coefficient, each of the coefficients of each of the terms being either 0 or 1, and a sum of the terms being equal to the integer; determining that said coefficients have respective values ​​that are one; determining a product of a plurality of values, each said value being two raised to a respective power of two corresponding to each term of the series whose corresponding coefficient has a value of one; A method may be provided that includes:

[0014] 1. A computer-implemented method for adding two integers in a blockchain transaction, the method comprising: representing the integer as a pair of binary bit strings; - performing, with respect to said pairs of binary bit strings as input, a combining step comprising: (i) XORing each corresponding pair of bits of said input to generate a first output binary bit string, and (ii) ANDing each corresponding pair of bits of said input to generate a further bit string and concatenating a bit having value 0 as the least significant bit to said further bit string to generate a second output binary bit string; if said second output binary bit string contains bits of value 1, repeating said combining step using as input the output of the previous combining step until said second output binary bit string is generated which contains only bits of value 0; A method may be provided that includes:

[0015] 1. A method for determining the product of two integers in a blockchain transaction, the method comprising: representing first and second integer numbers as first and second binary bit sequences, respectively; providing, for each bit of the first integer having a value of 1, a respective stored bit sequence comprising a bit sequence representing the second integer and a number of bits of value 0 added thereto as least significant bits, said number being equal to the power of 2 represented by a corresponding bit of the first integer having a value of 1; adding together the stored bits according to at least one of the methods described above; A method may be provided that includes:

[0016] Determining an integer in modular arithmetic, the method comprising: determining coefficients of terms of a power series of 2(mod p), each term of the series being a respective power of 2(mod p) multiplied by a respective coefficient, each of the coefficients of each of the terms being either 0 or 1, and a sum of the terms being equal to the integer (mod p); storing a plurality of values, each said value being 2 raised to a respective power of 2(mod p) corresponding to each term of said series whose corresponding coefficient has a value of 1; adding said values ​​together according to at least one of the methods described above; A method may be provided that includes:

[0017] A system may be provided that includes a processor and a memory that includes executable instructions that, upon execution by the processor, cause the system to perform any embodiment of the computer-implemented methods described herein.

[0018] A non-transitory computer-readable storage medium may be provided that stores executable instructions that, when executed by a processor of a computer system, cause the computer system to at least perform a computer-implemented method described herein. [Brief description of the drawings]

[0019] Various embodiments according to the present disclosure are described with reference to the drawings. [Figure 1] Illustrates script execution of blockchain transactions to perform proof of knowledge. [Diagram 2] Demonstrates script execution of blockchain transactions to determine large powers of two. [Diagram 3] 3 illustrates script execution of a blockchain transaction for the particular example script shown in FIG. 2. [Figure 4]Shows script execution of a blockchain transaction to determine the sum of two large integers. [Diagram 5] Shows script execution of a blockchain transaction to determine the product of two large integers. [Figure 6] Shows scripted execution of blockchain transactions to determine large integers in modular arithmetic. [Figure 7] FIG. 1 illustrates a schematic diagram of a computing environment in which various embodiments can be implemented. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] The proof-of-knowledge system of this disclosure is an implementation of Schnorr's identification scheme [CP Schnorr (1990). 'Efficient Identification and Signatures for Cards' in G. Brassard ed. Adv. In Cryptology-Crypt 239-252. Springer Verlag (1990) Lecture Notes in Computer Science nr 435]. This scheme is not only conceptually simple, but also uses only the opcodes defined in the original Bitcoin protocol. As a result, it can be easily embedded in scripts within transactions. An on-chain non-interactive implementation of the proof-of-knowledge system is described along with two other implementations that include a translation into a proof scheme for arbitrary data authentication.

[0021] The following notes and use cases of this disclosure should be noted: Proof-of-Knowledge systems can be embedded in as little as one transaction, provided the public verification key is available elsewhere. Also, payments can only be used if the recipient knows the secret value. In particular, the public key (the verification key) does not need to be publicly visible or included in the transaction. This provides perfect privacy protection for the recipient. Also, security can be tuned by choosing different prime numbers. This provides flexibility in the tradeoff between efficiency and security.

[0022] When proof of knowledge means proof of ownership, the solution becomes a smart contract expressing that funds are only released if the recipient can prove ownership of some asset. As an example, a land registry can implement the same proof of knowledge system to record ownership of properties. The land registry can have an authenticated verification key list where each owner is given their corresponding secret value. To prove ownership of a property, an owner can simply construct a proof of knowledge when given a challenge. Importantly, we note that the verification key does not need to be included in the transaction; it can be hidden during the computation.

[0023] Another example could be any token system implementing a proof of knowledge system. Similarly, as mentioned above, ownership of some tokens can be proven by constructing a proof of knowledge of a secret value. The solution can also be used in rental services, where the key to unlock the rented property is a proof of knowledge that can be obtained by initiating a transaction including the same challenge. For example, to access a rented car or house, the renter receives a challenge to provide a proof of knowledge from a locked door. The renter then composes a transaction including the challenge. The owner of the property discloses the proof of knowledge when accepting payment, thus disclosing the proof of knowledge needed to unlock the door to the car or house.

[0024] The present disclosure may also be a solution for asset transfer involving a third party, for example a lawyer (third party) who is instructed by his client's will to release funds only to those who know the secret value.

[0025] Before outlining specific embodiments of the present disclosure, the Schnorr identification scheme [CP Schnorr (1990). 'Efficient Identification and Signatures for Cards' in G. Brassard ed. Adv. In Cryptology-Crypt 239-252. Springer Verlag (1990) Lecture Notes in Computer Science nr 435] is disclosed herein.

number

[0026] For public parameters, they present the following subgroups of order q of the multiplicative group:

number

[0027] The condition is that the following formula must have 2 as a subgroup generator:

number

[0028] This greatly improves the efficiency of the exponentiation.

[0029] The security of the scheme is based on the discrete logarithm problem. For a group of size N, the security is approximately √N. For example, if q is 256 bits, the security of the scheme is approximately 128 bits. This means that an attacker needs approximately 2 128 This requires operations.

[0030] For reference, the signature scheme obtained by the Fiat-Shamir Transform is represented as follows:

number

[0031] Notably, the main difference between the proof-of-knowledge and signature schemes is the replacement of the challenge c by:

number

[0032] Proof of knowledge in transactions Non-conversational Transactions A transaction is described from Bob to Alice, where Alice can only spend the payment if she provides a proof of knowledge.

[0033] Assume that Bob has a copy of the public parameters (p, q) and Alice's proof key v, either from Alice herself or from a verifiable source.

[0034] Bob can simply compose a transaction to include the following outputs:

number

[0035] ν c Let mod p be computed off-block by Bob, and the value entry is arbitrary. To achieve perfect privacy, Bob can send a challenge c to Alice off-chain, or they can have some shared randomness as the challenge.

[0036] For Alice to spend the payment, she simply calculates x and y as instructed in the protocol and constructs a transaction with the unlock script as follows:

number

[0037] To verify a transaction, the script is executed as shown in Figure 1.

number

[0038] It should be noted that ν c Mod p can be pre-computed and put into the script, which not only saves computation to enable in-script verification, but also hides the public verification key.

[0039] To protect the integrity of the output of the transaction Alice generates, ECDSA signatures require an id attached to the lock script in Bob's transaction, i.e.

number

[0040] In response, when Alice spends the transaction, she signs the new transaction with her ECDSA signature, i.e.

number

[0041] 2 if y is a large number y To compute mod p, a more complex script involving bitwise calculations needs to be implemented. The implementation would be possible if the current limit on the maximum number of opcodes were significantly increased. The script is detailed in Figure 2.

[0042] It was assumed that the arithmetic opcodes used were equipped with a big integer library, which was the case in Bitcoin's original protocol. However, in Figures 4-6 an alternative embodiment is shown that uses string arithmetic to simulate big integer arithmetic operations.

[0043] 2 y Calculate mod p:

[0044] The script shown in Figure 2 is executed by performing the following steps:

number

[0045] Here, the top of the stack is 2 y With mod p.

[0046] Note that the current maximum stack depth is 1000. If 128 bits of security were to be achieved, then y would be 256 bits. Thus, the current upper limit on stack depth is not an issue.

[0047] An example of the execution of the script shown in FIG. 2 is shown in detail in FIG.

[0048] Example:2 12 Calculate the mod 31.

number

[0049] The script of FIG. 2 is then executed as shown in FIG.

[0050] 1 Round Transaction If there is a request for on-chain communication, it is straightforward for Alice to initiate the communication by sending a transaction to Bob and handing over her public verification key.

number

[0051] Note that Output 1 is simply there to cover the transaction fees for the miner. Output 2 can also be included in Output 1 using "<ν> OP_DROP".

[0052] The second leg of the round is the transaction described in the non-interactive case, and a challenge c embedded in the lock script. This can be done with a new output by OP_RETURN, or by adding " <c>This is possible by adding "PO_DROP".

[0053] Implementation as a signature scheme The Schnorr scheme can also be used as a method for source verification of any data type, in other words as a digital signature scheme. Currently, any digital signature scheme involving large integer powers is avoided in Bitcoin due to its significant computational cost. The above Schnorr signature scheme can be implemented within Bitcoin scripts, since the costly exponentiations can be pre-computed off-chain. An important technical difference between proofs of knowledge and digital signatures is that in digital signatures, the challenge issued by the verifier is a hash of the message or data and an ephemeral public key used in the signature (see above).

[0054] The difficulty here is that Bob does not know the ephemeral public key before signing. One way to overcome this is for the signer to send the ephemeral public key before Bob generates the transaction. A better way might be to have a set of ephemeral public keys shared between the signer and Bob.

[0055] For example, Bob wants to send Alice some Bitcoins that she can spend only if she provides a valid signature (x,y) on message m by a signer with public key v that is trusted by Bob. He can construct the following transaction:

number

[0056] To spend the payment from Bob, Alice first obtains a signature (x, y) from the signer on message m.

[0057] Note that both x and m are fixed in the lock script by:

number

[0058] The value of y is the key that provides authentication.

[0059] Alice can then compose a transaction with the following unlock script:

number

[0060] Note that this script does not require Alice to generate a signature for m, it only provides a signature generated by a signer with public key v. The last four opcodes in the locking script above (OP_DUP through OP_CHECKSIG) ensure that Alice's private key is also required to spend the transaction.

[0061] The implementation of the signature scheme is such that the challenge c is c Since mod p must be included in the lock script, it does not provide the same level of privacy protection as a proof-of-knowledge system implementation. c Deriving ν mod p is computationally not difficult.

[0062] The message being signed must also be known to the verifier, who provides both of the following in the lock script:

number

[0063] On the one hand, this limits the ability of an implementation to provide a method for the verification of uncertain data; when the message space is small, the verifier can use flow control opcodes for the Schnorr scheme to first determine and then authenticate the message.

[0064] For example, Bob creates a transaction that requires authorization from a third party (Carol) if Alice wants to use it. In this case, the message being signed is a Boolean value, i.e.

number

[0065] Bob does not know what message is included as part of the unlock script, but he wants to verify that it is signed by Carol with public key v. If the message from Carol is 'Yes', Alice can use it, if it is 'No', it is returned to Bob.

[0066] m 1 and m 2 The corresponding challenges are:

number

[0067] Bob generates the following lock script:

number

[0068] The lock script first checks whether the message is 1 Or m 2 Then it checks that the token has been signed by Carol, and finally it checks that an authorized user unlocks the transaction.

[0069] For example, if the message Carol wants to sign is m1="Yes", she can generate a signature (x,y) corresponding to her selected message and send the message / signature to Alice. Alice can then generate the following unlock script to use in the transaction:

number

[0070] Calculating x+y A script for adding two large integers together is detailed in Figure 4. Let the integers (x,y) be pushed onto the stack as two binary strings. This script is denoted FUNC_STRINGADD in a further embodiment.

[0071] The Theory Behind Addition a 0 and b 0 Let be two binary strings of length t. Define:

number

[0072] Processing is a string of 0, b k =00...0, when repeated enough times, k is a 0 +b 0 is a binary string representing

[0073] Proof: Note that XOR simulates a bitwise addition in the sense that any carries are not taken into account.

number

[0074] The problem is just that 1 + 1 is not 0. However, the ∧ operation can be used to identify this scenario, because it indicates where this problem occurred by flagging it with a 1. Note that these 1s in the result indicate carries that are part of the addition. By concatenating the result with a 0, we effectively generate a number that captures all the carries. This process can be repeated until there are no more carries in the addition.

[0075] Proof by induction: We want to prove the following:

number

number

[0076] As shown in Table 1 below, a 00 and b 00 By going through all possible values ​​of , we can conclude that for t=1, the statement is true. Table 1 [Table 1]

[0077] Suppose the statement is true for t=k for some k>=1. We want to prove that the statement is true for t=k+1.

number

[0078] Note that we use the fact that the statement is true for t=k, i.e.:

number

[0079] Additionally, the following facts are used:

number

[0080] Multiplying by 2 is equivalent to shifting the bit string one place to the left and appending a 0 to the end.

[0081] The final formula for deduction is again taken from Table 1 above.

[0082] Since we have proven that if the statement is true for t=k then it is true for t=k+1, by induction we conclude:

number

[0083] It should be noted that a 1 and b 1 is two numbers, 0 and b 0 Without loss of generality, by repeating the above proof, we conclude that:

number

[0084] Therefore, when the process is repeated until one of the outputs consists entirely of bits having the value 0, it is concluded that the other output represents the sum of the two initial inputs.

[0085] Calculate x y: Figure 5 details the script for multiplying two large integers together.

[0086] One of the integers, y, is written as:

number

[0087] Let y be pushed onto the stack as follows:

number

[0088] where y 0 is at the top of the stack.

[0089] The script then takes the value of another integer, x, and appends it as the least significant bit to y i , along with the number of bits of value 0 corresponding to the power of 2 represented by each non-zero value of . These values ​​are then added together by the FUNC_STRINGADD process described above with reference to FIG.

[0090] Calculate y mod p: The script for computing large integers in modular arithmetic is detailed in Figure 6. The following values ​​are first precomputed for i=k-1,...,t, where k is the bit length of p:

number

[0091] Let y be pushed onto the stack as follows:

number

[0092] where y t is at the top of the stack.

[0093] Finally, FUNC_SPLITSTRINGTOBIT is defined to take a binary string input and push each bit vertically onto the stack. This can be achieved using OP_SUBSTR.

[0094] <Conclusion> A protocol implementation has been described that allows payments from Bob to Alice to be made only if Alice knows a secret value. The advantages of this disclosure come from its simplicity, security, usability, and compatibility with the original Bitcoin protocol, which is the most secure and reliable.

[0095] The choice to use an integer representation instead of an elliptic curve representation makes it much easier to implement and understand. The fact that only the public key of the power of the random number needs to be published provides security in terms of protecting the privacy of the recipient. Furthermore, values ​​can be precomputed to enable on-chain verification and save computations.

[0096] A novel and efficient implementation of modulo prime exponentiation is also described. This allows the proof-of-knowledge system to be embedded in scripts within standard transactions that can be accepted by miners in the Bitcoin network. As a by-product, a signature scheme implementation is also provided, allowing arbitrary data authentication and verification within the script. Furthermore, all standard properties and extensions of Schnorr are applied to the signature scheme. For example, batch verification allows verification against multiple signatures in one step by aggregating them first. Another example is the extension to threshold signatures, an alternative to MULTISIG in Bitcoin.

[0097] Referring to FIG. 7, an illustrative simplified block diagram of a computing device 2600 that may be used to implement at least one embodiment of the present disclosure is provided. In various embodiments, the computing device 2600 may be used to implement any of the illustrated systems described above. For example, the computing device 2600 may be configured for use as a data server, a web server, a portable computing device, a personal computer, or any electronic computing device. As shown in FIG. 7, the computing device 2600 may include one or more processors with one or more levels of cache memory and memory controller (collectively labeled 2602) that may be configured to communicate with a storage subsystem 2606 that includes a main memory 2608 and a permanent storage device 2610. The main memory 2608 may include a dynamic random access memory (DRAM) 2618 and a read only memory (ROM) 2620 as shown. The storage subsystem 2606 and the cache memory 2602 may be used for storage of information such as details associated with transactions and blocks as described in this disclosure. The processor 2602 may be utilized to provide the steps or functions of any embodiment as described in this disclosure.

[0098] The processor 2602 may also communicate with one or more user interface input devices 2612 , one or more user interface output devices 2614 , and a network interface subsystem 2616 .

[0099] Bus subsystem 2604 may provide a mechanism that allows the various components and subsystems of computing device 2600 to communicate with each other as intended. Although bus subsystem 2604 is illustrated generally as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses.

[0100] The network interface subsystem 2616 may provide an interface to other computing devices and networks. The network interface subsystem 2616, in some embodiments, may act as an interface to receive data from and transmit data to other systems in the computing device 2600. For example, the network interface subsystem 2616 may allow a data technician to connect the device to a network so that the data technician can send data to and receive data from the device without being in a remote location, such as a data center.

[0101] User interface input devices 2612 may include one or more user input devices, such as a keyboard, a pointing device such as an integrated mouse, trackball, touchpad, or graphics tablet, a scanner, a barcode scanner, a touch screen integrated into a display, a voice recognition system, an audio input device such as a microphone, and other types of input devices. In general, use of the term "input device" is intended to include all possible types of devices and mechanisms for inputting information into computing device 2600.

[0102] The one or more user interface output devices 2614 may include a display subsystem, a printer, or a non-visual display such as an audio output device, etc. The display subsystem may include a cathode ray tube (CRT), a liquid crystal display (LCD), a light emitting diode (LED) display, or a flat-panel device such as a projection or other display device. In general, use of the term "output device" is intended to include all possible types of devices and mechanisms for outputting information from the computing device 2600. The one or more user interface output devices 2614 may be used, for example, to present a user interface and facilitate user interaction with applications that perform the processes and transformations described herein, when such interaction is appropriate.

[0103] The storage subsystem 2606 may provide a computer-readable storage medium that stores basic programming and data structures that provide the functionality of at least one embodiment of the present disclosure. Applications (e.g., programs, code modules, instructions) that, when executed by one or more processors, provide the functionality of one or more embodiments of the present disclosure may be stored in the storage subsystem 2606. These application modules or instructions may be executed by one or more processors 2602. The storage subsystem 2606 also provides a repository for storing data used in accordance with the present disclosure. For example, the main memory 2608 and the cache memory 2602 may provide volatile storage for programs and data. The permanent storage device 2610 may provide permanent (non-volatile) storage of programs and data and may include a magnetic hard disk drive, one or more floppy disk drives associated with removable media, one or more optical drives (e.g., CD-ROM, or DVD, or Blue-Ray) drives associated with removable media, and other similar storage media. Such programs and data may include programs for performing the steps of one or more embodiments described in this disclosure, and data associated with the transactions and blocks described in this disclosure.

[0104] The computing device 2600 may be of various types, including a portable computing device, a tablet computer, a workstation, or any other device described below. Additionally, the computing device 2600 may include another device that can be connected to the computing device 2600 through one or more ports (e.g., USB, headphone jack, optical connector, etc.). A device that can be connected to the computing device 2600 may include multiple ports configured to receive optical fiber connectors. The device may thus be configured to convert optical signals into electrical signals that are sent to the computing device 2600 through the ports connecting the devices for processing. Due to the ever-changing nature of computers and networks, the description of the computing device 2600 shown in FIG. 7 is intended only as a specific example for purposes of describing a preferred embodiment of the device. Many other configurations are possible having more or fewer components than the system shown in FIG. 7.

[0105] <Enumerated exemplary embodiments> Example embodiments of the present disclosure can be described in terms of the following paragraphs.

[0106] [Item 1] A method for enabling proof of knowledge in a blockchain transaction, the method comprising: 1. A method comprising: transmitting, from a verifier to a prover, a blockchain transaction redeemable with data including: (i) first data based on a combination of an ephemeral key, second data, and a private key of a public-private key pair of a cryptosystem, where the public key is based on an integer generator raised to a first multiplier, where the first multiplier is based on the private key, knowledge of the private key being required to determine the ephemeral key from the first data; and (ii) third data based on the integer generator raised to a second multiplier, where the second multiplier is based on the ephemeral key.

[0107] By providing a blockchain transaction redeemable by data based on a cryptosystem where the public key is based on an integer generator raised to a first multiplier, the first multiplier being based on a private key, this provides the advantage of being computationally simple and efficient, and therefore not as computationally expensive as other cryptosystems such as elliptic curve cryptography. By including in the data required to redeem the transaction an ephemeral key, a second data and a private key of a public-private key pair, knowledge of which is required to determine the ephemeral key from the first data, and a third data based on an integer generator raised to a second multiplier, the second multiplier being based on the ephemeral key, this provides the advantage of allowing verification that the first data contains the private key to be made without disclosing the private key. By determining the second data, this indicates that the party composing the first and third data must be in possession of the private key.

[0108] [Item 2] The method of item 1, wherein the integer generator is 2.

[0109] This offers the advantage of being more computationally efficient.

[0110] [Item 3] The method according to item 1 or 2, wherein the second data is selected by the verifier.

[0111] This provides the advantage of ensuring that the party configuring the first data is in possession of the private key.

[0112] [Item 4] The method according to any one of items 1 to 3, further comprising a step of transmitting the second data from the verifier to the prover separately from the blockchain transaction.

[0113] This offers the advantage of increased privacy protection.

[0114] [Item 5] The first data is in the form of the following formula:

number

[0115] [Item 6] The method according to any one of items 1 to 5, wherein the second data is based on a message.

[0116] [Item 7] The method of item 6, wherein the message includes data for implementing a smart contract.

[0117] [Item 8] The second data is in the form of the following formula:

number

[0118] [Item 9] The method according to any one of items 6 to 8, further comprising the step of receiving the message at the verifier.

[0119] [Item 10] The method according to any one of items 1 to 9, further comprising a step of sharing at least one temporary key between the verifier and the prover.

[0120] [Item 11] The method according to any one of items 1 to 10, further comprising a step of receiving the public key at the verifier.

[0121] [Item 12] The method according to any one of items 1 to 11, further comprising the step of receiving the first data and the second data at the verifier.

[0122] [Item 13] A computer-implemented method for determining a value obtained by raising 2 to an integer power, the method comprising: determining coefficients of terms of a power of 2 series, each term of the series including a respective power of 2 multiplied by a respective coefficient, each of the coefficients of each of the terms being either 0 or 1, and a sum of the terms being equal to the integer; determining that said coefficients have respective values ​​that are one; determining a product of a plurality of values, each said value being two raised to a respective power of two corresponding to each term of the series whose corresponding coefficient has a value of one; The method includes:

[0123] This offers the advantage of being computationally efficient by allowing the coefficients to be represented by binary bit strings.

[0124] [Item 14] The method of item 13, wherein the value is pre-calculated and stored.

[0125] [Item 15] The method according to item 13 or 14, wherein the method is implemented by a blockchain transaction.

[0126] [Item 16] The method comprises: y 16. The method according to any one of items 13 to 15, further comprising determining a value mod p, where y is the integer.

[0127] [Item 17] The method according to any one of items 13 to 16, wherein the method is used to provide a blockchain transaction in the method according to any one of items 1 to 12.

[0128] [Item 18] A computer-implemented method for adding two integers in a blockchain transaction, the method comprising: representing the integer as a pair of binary bit strings; - performing, with respect to said pairs of binary bit strings as input, a combining step comprising: (i) XORing each corresponding pair of bits of said input to generate a first output binary bit string, and (ii) ANDing each corresponding pair of bits of said input to generate a further bit string and concatenating a bit having value 0 as the least significant bit to said further bit string to generate a second output binary bit string; if said second output binary bit string contains bits of value 1, repeating said combining step using as input the output of the previous combining step until said second output binary bit string contains only bits of value 0; The method includes:

[0129] This provides the advantage of allowing computationally efficient large integer additions to be performed in blockchain transactions.

[0130] [Item 19] A method for determining the product of two integers in a blockchain transaction, the method comprising: representing first and second integer numbers as first and second binary bit sequences, respectively; providing, for each bit of the first integer having a value of 1, a respective stored bit sequence comprising a bit sequence representing the second integer and a number of bits of value 0 added thereto as least significant bits, said number being equal to the power of 2 represented by a corresponding bit of the first integer having a value of 1; adding together the stored bits by at least one method according to claim 18; The method includes:

[0131] [Item 20] A step of determining an integer in modular arithmetic, the method comprising the steps of: determining coefficients of terms of a power series of 2(mod p), each term of the series being a respective power of 2(mod p) multiplied by a respective coefficient, each of the coefficients of each of the terms being either 0 or 1, and a sum of the terms being equal to the integer (mod p); storing a plurality of values, each said value being 2 raised to a respective power of 2(mod p) corresponding to each term of said series whose corresponding coefficient has a value of 1; adding said values ​​together according to at least one method according to claim 18; The method includes:

[0132] [Item 21] A computer-implemented system comprising: A processor; A memory including executable instructions that, when executed by the processor, cause the system to perform any embodiment of the computer-implemented method according to any one of claims 1 to 20; A system including:

[0133] [Item 22] A non-transitory computer-readable storage medium storing executable instructions, the executable instructions, when executed by a processor of a computer system, causing the computer system to at least perform an embodiment of the method described in any one of items 1 to 20.

[0134] It should be noted that the above-described embodiments illustrate, rather than limit, the disclosure, and that those skilled in the art can devise many alternative embodiments without departing from the scope of the disclosure, which is defined by the appended claims. In the claims, any reference signs in parentheses shall not be construed as limiting the claims. The terms "comprising" and "including" and the like do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprising" means "having or consisting of" and "comprising" means "comprising or consisting of". A singular reference of an element does not exclude a plural reference of such an element. Vice versa. The disclosure can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

[0135] References [1] CP Schnorr (1990). 'Efficient Identification and Signatures for Cards' in G. Brassard ed. Adv. In Cryptology-Crypt 239-252. Springer verlag (1990) lecture notes in Computer Science nr 435.< / c>

Claims

1. 1. A method for enabling proof of knowledge in blockchain transactions, comprising: sending, from a verifier computer system to a prover computer system, a blockchain transaction redeemable by data including a value in an integer power of two; The power of two values ​​are as follows: determining coefficients of terms of a power of 2 series, each term of the series including a respective power of 2 multiplied by a respective said coefficient, each said coefficient of each said term being 0 or 1, and the sum of said terms being equal to said integer; determining that the coefficients have respective values ​​that are 1; determining a product of a plurality of values, each said value being two raised to a respective power of two, corresponding to each term of the series whose corresponding coefficient has a value of one; The method is determined by:

2. The method of claim 1 , wherein the value is pre-calculated and stored.

3. The method of claim 1 , wherein the method is implemented by a blockchain transaction.

4. The method comprises determining a value of: 2 y towards The method of claim 1 , wherein y is the integer.

5. The data is (i) first data based on a combination of a temporary key, second data, and a private key of a public-private key pair of a cryptosystem, wherein the public key is based on two raised to a first power, the first multiplier is based on the private key, and knowledge of the private key is required to determine the temporary key from the first data; (ii) third data based on 2 raised to a second multiplier, the second multiplier being based on the temporary key; and The method of claim 1 , comprising:

6. 1. A computer-implemented method for adding two integers in a blockchain transaction, the method comprising: representing the integer as a pair of binary bit strings; performing, with the pairs of binary bit strings as input, a combining step comprising: (i) XORing each pair of corresponding bits of the input to generate a first output binary bit string; and (ii) ANDing each pair of corresponding bits of the input to generate a further bit string and concatenating a bit with value 0 as the least significant bit to the further bit string to generate a second output binary bit string; if said second output binary bit string contains bits of value 1, repeating said combining step using the output of the previous combining step as input until said second output binary bit string contains only bits of value 0; A method comprising:

7. 1. A method for determining the product of two integers in a blockchain transaction, the method comprising: representing first and second integers as first and second binary bit sequences, respectively; providing, for each bit of the first integer having a value of 1, a respective stored bit sequence comprising a bit sequence representing the second integer and a number of bits of value 0 added thereto as least significant bits, the number being equal to the power of 2 represented by the corresponding bit of the first integer having a value of 1; adding the stored bits together according to the method of claim 6; A method comprising:

8. 1. A method for determining integers in modular arithmetic, said method comprising: determining coefficients of terms of a power series of 2(mod p), each term of the series being a respective power of 2(mod p) multiplied by a respective said coefficient, each said coefficient of each said term being 0 or 1, and the sum of said terms being equal to said integer (mod p); storing a plurality of values, each said value being 2 raised to a respective power of 2(mod p) corresponding to each term of said series whose corresponding coefficient has a value of 1; 7. The method of claim 6, further comprising the steps of: adding the values ​​together; A method comprising:

9. 1. A computer-implemented system comprising: a processor; a memory containing executable instructions which, upon execution by said processor, cause said system to perform a method according to any one of claims 1 to 8; A system including:

10. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by a processor of a computer system, cause the computer system to perform at least the method of any one of claims 1 to 8.

Images