Certification system, certification method and certification program

Abstract

To improve computation efficiency for range certification.SOLUTION: A certification system 1 comprises: a certification device 2 that holds a secret value; and a verification device 3 that is configured to be able to communicate data with the certification device 2. The certification device 2 and the verification device 3 include arithmetic circuit configuration information indicating a configuration of an arithmetic circuit to which the secret value is input. The certification device 2 executes certification creation to create a certification value for certifying that the secret value fits in a predetermined range using the arithmetic circuit configuration information, and transmits the certification value to the verification device 3. The verification device 3 determines whether or not the secret value fits in the predetermined range by executing certification verification to verify the certification value using the arithmetic circuit configuration information and the certification value.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present disclosure relates to a proof system, a proof method, and a proof program for performing a proof of range.

Background Art

[0002] Patent Document 1 describes a system for performing zero-knowledge proof including a proof device and a verification device. Zero-knowledge proof is a method of showing the correctness of knowledge that a prover wants to prove without revealing the knowledge. Zero-knowledge proof is a basic and important component in applications for protecting security and privacy (for example, concealing the amount of transfer in cryptocurrency and anonymous authentication in "Verifiable Credentials").

[0003] In recent years, application to lightweight devices has also been considered on the premise of IoT. Range proof, which is one of zero-knowledge proofs, is a technique for convincing a verifier that a value held by a prover is within a certain range without revealing the value. Conventionally, a construction method relying on the discrete logarithm assumption has been common, and exponential or pairing operations are required for proof generation and verification.

[0004] Since exponential operations and pairing operations are heavier in processing than multiplication and addition operations, if proof generation and verification can be performed by multiplication and addition operations, improvement in calculation efficiency can be expected. Also, although it is generally known that efficiency can be achieved by introducing preprocessing in a zero-knowledge proof protocol, a construction method assuming preprocessing in range proof has not been known.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0006] As a result of the inventors' detailed examination, the following problems were found. As zero-knowledge proof techniques, "Bulletproofs", "Flashproofs", "SwiftRange" and "QuickSilver" are known.

[0007] "Bulletproofs" can perform range proofs. "Bulletproofs" is based on the discrete logarithm assumption and generates and verifies proof values through exponentiation. Details of "Bulletproofs" are described in "B. bunz et al., 'Bulletproofs: Short Proofs for Confidential Transactions and More,' SP, 2018".

[0008] "Flashproofs" can perform range proofs. However, "Flashproofs" aims to improve computational efficiency from the perspective that it can parallelize by the number of bits in creating a proof of "being a bit". Details of "Flashproofs" are described in "N. Wang et al., 'Flashproofs: Efficient Zero-Knowledge Arguments of Range and Polynomial Evaluation with Transparent Setup,' ASIACRYPT, 2022".

[0009] "SwiftRange" can perform range proofs. However, "SwiftRange" can verify two matters to be proven in range proofs in a batch, and aims to improve computational efficiency from that perspective. Details of "SwiftRange" are described in "N. Wang et al., 'SwiftRange: A Short and Efficient Zero-Knowledge Range Argument For Confidential Transactions and More,' SP, 2024".

[0010] "QuickSilver" is capable of computationally confidential proofs. Computationally confidential proofs are a technique for convincing others of the correctness of a computation result without revealing information about the input. "QuickSilver" enables efficient "proof generation" and "proof verification" through a preprocessing phase and multiplication-and-addition. Details of "QuickSilver" are described in "K. Yang et al., "QuickSilver: Efficient and Affordable Zero-Knowledge Proofs for Circuits and Polynomials over Any Field," CAM CCS, 2021."

[0011] "Bulletproofs," "Flashproofs," and "SwiftRange" require special operations (i.e., operations with a heavier processing load than exponentiation) called exponentiation or pairing operations for the "proof generation" and "proof verification" required for range proofs. The calculation time required for these operations is "multiplication and addition < exponentiation < pairing operation." However, "Bulletproofs," "Flashproofs," and "SwiftRange" cannot perform "proof generation" and "proof verification" using only multiplication and addition without using exponentiation operations.

[0012] Furthermore, if some of the necessary computations could be performed in advance in a preprocessing phase that does not require interaction between the prover and verifier, the computations required in the interaction phase could be reduced, resulting in efficient range proofs in terms of computation time. However, "Bulletproofs," "Flashproofs," and "SwiftRange" are protocols that cannot proceed with computational processing until the interaction begins, making it difficult to introduce a preprocessing phase.

[0013] In addition, "QuickSilver" has features such as a preprocessing phase and multiplication and addition. However, "QuickSilver" does not assume range proofs. In addition, "QuickSilver" needs to generate a set of correlated random numbers as a key in the pre-phase, the same number as the number of secret values to be input into the arithmetic circuit.

[0014] Furthermore, "QuickSilver" is a method for achieving computational secrecy proofs for a single arithmetic circuit and is not intended for use with multiple arithmetic circuits. In order for the verifier to verify that the prover performed the computation honestly, the prover must send the evidence. However, sending the evidence as is would leak information about the secret. Therefore, the prover uses correlated random numbers generated in the pre-phase and sends the value obtained by adding the correlated random numbers to the secret value as evidence to the verifier. For this operation, a set of correlated random numbers is required for each secret value input to that arithmetic circuit. However, when using multiple arithmetic circuits, a set of correlated random numbers must be sent equal to the total number of secret values input to each arithmetic circuit.

[0015] The present disclosure aims to improve the computational efficiency for range proofs. [Means for solving the problem]

[0016] One aspect of the present disclosure is a proof system (1) comprising a proof device (2) that holds a secret value and a verification device (3) that is configured to be able to communicate data with the proof device, in which the proof device performs a range proof to prove to the verification device that the secret value falls within a predetermined range while keeping the secret value secret from the verification device.

[0017] The proving device and the verifying device are provided with one or more pieces of arithmetic circuit shape information that indicate the shapes of one or more preset arithmetic circuits into which a secret value is input. The proving device is configured to perform proof generation using one or more pieces of arithmetic circuit shape information to generate a proof value for proving that the secret value falls within a predetermined range, and to transmit the proof value to the verification device.

[0018] The verification device is configured to determine whether a secret value falls within a predetermined range by performing proof verification for verifying a proof value using one or more arithmetic circuit shape information and the proof value.

[0019] The proof system of the present disclosure configured as described above can use the "preprocessing phase" and "proof generation by multiplication and addition", which are techniques used in "QuickSilver" of operation-concealing proof, by expressing what is to be shown in the range proof as an arithmetic circuit. As a result, the proof system of the present disclosure can reduce the operations required in proof generation and proof verification, and thus can improve the operation efficiency for range proof.

[0020] Another aspect of the present disclosure is a proof method executed in a proof system (1) including a proof device (2) holding a secret value and a verification device (3) configured to be capable of data communication with the proof device, and the proof device executes a range proof for proving to the verification device that the secret value remains within a predetermined range while keeping the secret value secret from the verification device.

[0021] In the proof method of the present disclosure, the proof device and the verification device include one or more arithmetic circuit shape information indicating the shape of one or more preset arithmetic circuits into which the secret value is input. In the proof method of the present disclosure, the proof device performs proof generation for generating a proof value for proving that the secret value falls within a predetermined range using one or more arithmetic circuit shape information, and transmits the proof value to the verification device.

[0022] In the proof method of the present disclosure, the verification device determines whether the secret value falls within a predetermined range by performing proof verification for verifying the proof value using one or more arithmetic circuit shape information and the proof value.

[0023] The proof method of the present disclosure is a method executed in the proof system of the present disclosure, and by executing this method, the same effects as those of the proof system of the present disclosure can be obtained. Yet another aspect of the present disclosure is a proof program configured to cause a computer of a proof device in a proof system (1) that includes a proof device (2) that holds a secret value and a verification device (3) that is configured to be able to communicate data with the proof device, and that performs a range proof to prove to the verification device that the secret value falls within a predetermined range while keeping the secret value secret from the verification device, to execute a generation and transmission process (L8, L9).

[0024] The generation and transmission process executes proof generation to generate a proof value for proving that the secret value falls within a predetermined range using one or more pieces of arithmetic circuit configuration information, and transmits the proof value to the verification device.

[0025] A computer of a certification device controlled by the certification program of the present disclosure can constitute a part of the certification system of the present disclosure, and can obtain the same effects as the certification system of the present disclosure.

[0026] Yet another aspect of the present disclosure is a proof program configured to cause a computer of a verification device of a proof system (1) including a proof device (2) that holds a secret value and a verification device (3) configured to be capable of data communication with the proof device, the proof device performing a range proof that proves to the verification device that the secret value falls within a predetermined range while keeping the secret value secret from the verification device, to execute a verification process (L10).

[0027] The verification-side acquisition process uses one or more pieces of arithmetic circuit configuration information and the proof value to perform proof verification that verifies the proof value, thereby determining whether the secret value falls within a predetermined range. The computer of the verification device controlled by the proof program of the present disclosure can constitute a part of the proof system of the present disclosure, and can obtain the same effects as the proof system of the present disclosure. [Brief description of the drawings]

[0028] [Figure 1] 1 is a block diagram showing a configuration of a certification system according to a first embodiment. [Figure 2]FIG. 2 is a block diagram showing the configurations of a proving device, a verifying device, and a random number providing device. [Figure 3] 2 is a functional block diagram showing the functional configuration of a proving device, a verification device, and a random number providing device according to the first embodiment. FIG. [Figure 4] FIG. 10 is a sequence diagram showing a procedure for range proof according to the first embodiment. [Figure 5] FIG. 2 is a circuit diagram showing the configuration of an arithmetic circuit according to the first embodiment. [Figure 6] FIG. 10 is a functional block diagram showing the functional configurations of a proving device, a verification device, and a random number providing device according to a second embodiment. [Figure 7] FIG. 10 is a sequence diagram showing a procedure for range proof according to the second embodiment. [Figure 8] FIG. 2 is a diagram showing a first display mode of the display unit. [Figure 9] FIG. 10 is a diagram showing a second display mode of the display unit. [Figure 10] FIG. 10 is a circuit diagram showing the configuration of an arithmetic circuit according to another embodiment. [Figure 11] FIG. 10 is a functional block diagram showing the functional configuration of a proving device and a verifying device according to another embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0029] [First embodiment] A first embodiment of the present disclosure will be described below with reference to the drawings. As shown in FIG. 1, the proof system 1 of this embodiment includes a proof device 2, a verification device 3, and a random number provider 4.

[0030] The proving device 2 has a function of performing data communication with the verification device 3 and the random number provider 4 via a wide area wireless communication network NW. The verification device 3 has a function of performing data communication with the proving device 2 and the random number provider 4 via the wide area wireless communication network NW.

[0031] The random number provider 4 has a function of performing data communication with the proving device 2 and the verifying device 3 via the wide area wireless communication network NW. As shown in FIG. 2, the certification device 2 includes a control device 21, a communication device 22, and a storage device 23.

[0032] The control device 21 is an electronic control device mainly composed of a microcomputer including a CPU 26, a ROM 27, a RAM 28, etc. Various functions of the microcomputer are realized by the CPU 26 executing a program stored in a non-transitory tangible recording medium. In this example, the ROM 27 corresponds to the non-transitory tangible recording medium storing the program. Furthermore, the execution of this program results in the execution of a method corresponding to the program. Note that some or all of the functions executed by the CPU 26 may be configured as hardware using one or more ICs, etc. Furthermore, the number of microcomputers constituting the control device 21 may be one or more.

[0033] The communication device 22 performs data communication with the verification device 3 and the random number provider 4 via the wide area wireless communication network NW. The storage device 23 stores various data. As shown in FIG. 3, the verification device 3 includes a control device 31, a communication device 32, and a storage device 33.

[0034] The control device 31 is an electronic control device mainly composed of a microcomputer including a CPU 36, a ROM 37, a RAM 38, etc. Various functions of the microcomputer are realized by the CPU 36 executing a program stored in a non-transitory tangible recording medium. In this example, the ROM 37 corresponds to the non-transitory tangible recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 36 may be configured as hardware using one or more ICs, etc. Furthermore, the number of microcomputers constituting the control device 31 may be one or more.

[0035] The communication device 32 performs data communication with the proving device 2 and the random number providing device 4 via the wide area wireless communication network NW. The storage device 33 stores various data. The random number provider 4 includes a control device 41, a communication device 42, and a storage device 43.

[0036] The control device 41 is an electronic control device mainly composed of a microcomputer including a CPU 46, a ROM 47, a RAM 48, etc. Various functions of the microcomputer are realized by the CPU 46 executing a program stored in a non-transitory tangible recording medium. In this example, the ROM 47 corresponds to the non-transitory tangible recording medium storing the program. Furthermore, the execution of this program executes a method corresponding to the program. Note that some or all of the functions executed by the CPU 46 may be configured as hardware using one or more ICs, etc. Furthermore, the number of microcomputers constituting the control device 41 may be one or more.

[0037] The communication device 42 performs data communication with the proving device 2 and the verification device 3 via the wide area wireless communication network NW. The storage device 43 stores various data. As shown in FIG. 3, the proving device 2 includes a proof calculation processing unit 51 and a communication unit 52 as functional blocks that are realized by the CPU 26 executing a program stored in the ROM 27.

[0038] The proof calculation processing unit 51 executes the proof calculation process described later. The communication unit 52 performs data communication between the verification device 3 and the random number provider 4. The verification device 3 includes a proof calculation processing unit 61, a communication unit 62, and a proof verification processing unit 63 as functional blocks realized by the CPU 36 executing a program stored in the ROM 37.

[0039] The proof calculation processing unit 61 executes the proof calculation processing described later. The communication unit 62 performs data communication between the proving device 2 and the random number providing device 4. The proof verification processing unit 63 executes the proof verification processing described later.

[0040] The random number providing device 4 includes an ideal function processing unit 71 and a communication unit 72 as functional blocks realized by the CPU 46 executing a program stored in the ROM 47. The ideal function processing unit 71 generates a set of correlation random numbers, which will be described later. The communication unit 72 performs data communication with the proving device 2 and the verifying device 3.

[0041] Next, the procedure of range proof executed by the proof system 1 will be described. Range proof is a technique for showing that a specific value of a certain secret value w (hereinafter, secret value w) is being held without revealing the specific value of the secret value w.

[0042] As a framework for implementing range concealment, consider that the secret value w satisfies "0 ≤ w ≤ 2 n - 1". On the premise that the prover P can generate the bit representation value w of the secret value w if it has the secret value w, the prover P shows the following first verification item and second verification item to the verifier V. i is an integer that is 0 or more and (n - 1) or less. n is an integer of 1 or more. In the present embodiment, the proving device 2 corresponds to the prover P, and the verifying device 3 corresponds to the verifier V. i The first verification item is "the bit representation value w

[0043] is the bit representation of the secret value w". However, it does not matter whether the bit representation value w i is 0 or 1. The first verification item is represented by Equation (1). i The second verification item is "the bit representation value w

[0044]

Equation

[0045] is indeed a bit representation". The second verification item is represented by Equation (2). i The second verification item is represented by Equation (2).

[0046]

Equation

[0047] As shown in Fig. 4, the proof device 2 holds a secret value w and a bit representation of the secret value w. The secret value w is, for example, a value indicating the prediction accuracy of an object detected by an object detection DNN based on detection data from one or more sensors mounted on a vehicle. DNN is an abbreviation for Deep Neural Network.

[0048] As shown by the arrow L1, the proving device 2 and the verifying device 3 are connected to one first arithmetic circuit C val and n second arithmetic circuits C bit-i An arithmetic circuit is a directed acyclic graph represented by a combination of addition gates and multiplication gates for a variable vector x as input.

[0049] 1st arithmetic circuit C val By utilizing the relationship shown in equation (3), the function f val is generated by converting it into an arithmetic circuit.

[0050]

number

[0051]

number

[0052] 2nd arithmetic circuit C bit-i By utilizing the relationship shown in equation (5), the function f bit-i is generated by converting it into an arithmetic circuit.

[0053]

number

[0054] 1st arithmetic circuit C val is the bit representation value w as shown in Figure 5. i and 2 in multiplication gates that multiply the secret value w by -1, and one multiplication gate that multiplies the bit representation value w i and 2 i and (n-1) addition gates that add n multiplied values of and , and a bit representation value w i and 2 i and one addition gate that adds the sum of the n multiplication values of w and w times the secret value w multiplied by -1.

[0055] 2nd arithmetic circuit C bit-i is the bit representation value w i and -1, and a bit representation value w i The sum of and -1 and the bit representation value w i and one multiplication gate for multiplying

[0056] 1 first arithmetic circuit C val and n second arithmetic circuits C bit-i If the prover P can prove to the verifier V that all of the outputs of n It can be shown that the range is "-1".

[0057] As indicated by arrows L2 and L3 in FIG. 4, the proving device 2 and the verification device 3 request the required number of sets of correlated random numbers (in this embodiment, (2n+2) sets) from the random number providing device 4.

[0058] As indicated by arrow L4, the random number provider 4 sends a set of correlated random numbers that satisfy the IT-MACs relationship shown in equation (7) (i.e., (2n+2) sets of (μ, M[μ])) to the proving device 2. IT-MACs is an abbreviation for Information Theoretic Message Authentication Codes.

[0059] As indicated by arrow L5, the random number provider 4 sends to the verification device 3 a set of correlated random numbers (i.e., (2n+2) sets of (Δ, K[μ])) that satisfy the IT-MACs relationship shown in equation (7).

[0060] The Δ in Equation (7) is a random number that is commonly used for a plurality of correlated random numbers. The μ in Equation (7) is different for each set of correlated random numbers. That is, for each set of correlated random numbers, the random number providing device 4 randomly generates μ and M[μ] in Equation (7), and by applying the randomly generated μ and M[μ] to Equation (7) to calculate K[μ], a pair of (Δ, K[μ]) and a pair of (μ, M[μ]) are generated. Note that the random number providing device 4 may calculate M[μ] after randomly generating μ and K[μ].

[0061]

Equation

[0062] In order to create a proof that the outputs of (n + 1) arithmetic circuits are all 0, a key (i.e., a correlated random number) is required in advance by the sum of the "number of secret inputs", the "number of multiplication gates", and the "number of arithmetic circuits".

[0063] One second arithmetic circuit C bit-i Since the "number of secret inputs" in is "2", the "number of secret inputs" in n second arithmetic circuits C bit-i is "2n". The "number of secret inputs" in one first arithmetic circuit C val is "n + 1". Therefore, the "number of secret inputs" is "3n + 1".

[0064] The "number of multiplication gates" targets multiplication gates where neither of the two inputs is a "public value". That is, the "number of multiplication gates" targets the multiplication gates of n second arithmetic circuits C bit-i . Therefore, the "number of multiplication gates" is "n".

[0065] The "number of arithmetic circuits" targets arithmetic circuits that include the multiplication gates targeted in the above "number of multiplication gates". That is, the "number of arithmetic circuits" targets n second arithmetic circuits C bit-i . Therefore, the "number of arithmetic circuits" is "n".

[0066] From the above, the sum of the "number of secret inputs", "number of multiplication gates", and "number of arithmetic circuits" is "5n + 1". In contrast, the random number providing device 4 reduces the required number of sets of correlated random numbers from (5n + 1) to (2n + 2) by the following first reduction method and second reduction method.

[0067] The first reduction method is to use a common correlated random number for the input of the same value to the arithmetic circuit. Specifically, for the two inputs of the same bit representation value w bit-i in the second arithmetic circuit C i and the one input of the same bit representation value w val in the first arithmetic circuit C i a total of three inputs are inputs of the same value, so the correlated random numbers corresponding to these are made common. As a result, the required number of sets of correlated random numbers for the inputs of n second arithmetic circuits C bit-i and the inputs of one first arithmetic circuit C val can be reduced from (3n + 1) to (n + 1).

[0068] The second reduction method is to compress the proof for the multiplication gate. Originally, correlated random numbers are required to prevent the leakage of knowledge of the secret value w and the bit representation value w i from the proof that the prover P has calculated correctly, and n sets of correlated random numbers are required for the proof of the arithmetic circuit including the multiplication gate. In contrast, by aggregating the proof generation of n second arithmetic circuits C bit-i it is made possible to prove n arithmetic circuits with one proof. As a result, the required number of sets of correlated random numbers can be reduced from n to 1.

[0069] As shown by the arrow L6, the proving device 2 creates a value for proving that the secret value w is within the range of "0 ≦ w ≦ 2 n -1" using the relationship of IT-MACs. Specifically, the proving device 2 (i.e., the prover P) and the verifying device 3 (i.e., the verifier V) communicate with each other, whereby the proving device 2, for each arithmetic circuit (i.e., one first arithmetic circuit C val and n second arithmetic circuits Cbit-i Output x of each out M[x out ], and the verification device 3 generates the output x of each arithmetic circuit. out K[x out ] to create a

[0070] Since IT-MACs allow homomorphic addition, constant addition, and constant multiplication, which will be described later, the proof device 2 can calculate M[x out ] can be created, and the verification device 3 uses (2n+2) pairs of (Δ, K[μ]) to create K[x out ] can be created.

[0071] If the authenticated x is represented as [x], the set of authenticated values that prover P has is [x] P =(x,M[x]), and the pair of authentication values held by the verifier V is [x] V =(Δ,K[x]). Homomorphic addition means that the prover P and the verifier V can calculate [x'']=[x]+[x'] from [x] and [x']. That is, the prover P can calculate [x''] P =(x+x',M[x]+M[x']), and the verifier V calculates [x''] V =(Δ,K[x]+K[x']).

[0072] Constant addition means that the prover P and the verifier V can calculate [y] = c + [x] from [x] and a public constant c. That is, the prover P can calculate [y] P =(c+x,M[x]), and the verifier V calculates [y] V =(Δ,K[x]+cΔ).

[0073] Constant multiplication means that the prover P and the verifier V can calculate [z] = c[x] from [x] and a public constant c. That is, the prover P can calculate [z] P =(cx, cM[x]), and the verifier V calculates [z] V =(Δ,cK[x]).

[0074] Here, a calculation for authenticating the output value of an arithmetic circuit while keeping the input value and the values on the arithmetic circuit secret will be described. Assume that the arithmetic circuit has an n-dimensional input, a 1-dimensional output, and t multiplication gates where both of the two inputs to the gates are not publicly known constants.

[0075] In the preprocessing phase, the prover P and the verifier V obtain authenticated randomness {[μ i} i∈{1,…,n} ,{[ν i} i∈{n+1,…,t} using VOLE. VOLE is the abbreviation of Vector Oblivious Linear Evaluation.

[0076] For the prover P, "{[μ i} i∈{1,…,n} ={([μ i ,M[μ i )} i∈{1,…,n} " and "{[ν i} i∈{n+1,…,t} ={([ν i ,M[ν i )} i∈{n+1,…,t} ".

[0077] For the verifier V, "{[μ i} i∈{1,…,n} ={(Δ,K[μ i )} i∈{1,…,n} " and "{[ν i} i∈{n+1,…,t} ={(Δ,K[ν i )} i∈{n+1,…,t} ".

[0078] In the interaction phase, the prover P sends δ i (=w i -μ i ) for i∈{1,…,n} to the verifier V. w i is the input to the input gate. "M[μ i =K[μ i -Δμ i +Δδ i -Δδ i」, so 「M[μ i =(K[μ i +Δδ i )-Δ(δ i +μ i )」 holds.

[0079] Define M[w i as M[μ i , and define K[w i as (K[μ i +Δδ i ). Then, the prover P and the verifier V can each calculate M[w i and K[w i independently.

[0080] In the interactive phase, the prover P sends d i (=w α w β -ν i ), i ∈ {n + 1, …, t} to the verifier V. w α , w β are inputs that are not publicly disclosed constants to the multiplication gate.

[0081] Since 「M[ν i =K[ν i -Δν i +Δd i -Δd i 」, 「M[ν i =(K[ν i +Δd i )-Δ(d i +ν i )」 holds. Define M[w γ as M[ν i , and define K[w γ as (K[ν i +Δd i ). Then, the prover P and the verifier V can each calculate M[w γ and K[w γ independently. Note that 「w γ =w α w β 」. That is, w γ is w α , wβ is the output of a multiplication gate with input

[0082] Also, w α ,w β Let be a non-public constant input and w γ For an addition gate with output, "(M[w α ]+M[w β ])=(K[w α ]+K[w β ])-Δ(w α +w β )" is established.

[0083] M[w γ ] to (M[w α ]+M[w β ]), and K[w γ ] to (K[w α ]+K[w β ]), then the prover P and the verifier V each have M[w γ ] and K[w γ ] can be calculated independently. γ =w α +w β "

[0084] w α ,w β When one of the two is a public constant, the output of the sum w γ For the prover P, [w γ ] P =(w β +w α ,M[w α ]), and the verifier V calculates [w γ ] V =(Δ,K[w α ]+w β Δ) can be calculated.

[0085] w α ,w β The output of the multiplication value when one of the two is a public constant is w γ For the prover P, [w γ ] P =(w β wα , w β M[w α ) is calculated, and the verifier V uses [w γ V = (Δ, w β K[w α ) can be calculated.

[0086] Then, up to the output of the arithmetic circuit, the authentication of {[w i} i∈{1,…,n+t} is advanced to obtain [w out . For the prover P, "[w out = (w out , M[w out )". For the verifier V, "[w out = (Δ, K[w out )".

[0087] As shown by the arrow L7, the verification device 3 sends a random number χ as a challenge to the proof device 2 in order to batch the verification of the following gate-by-gate paradigm for (n + 1) arithmetic circuits.

[0088] Here, the random number χ as a challenge (hereinafter referred to as the challenge value χ) will be described. "QuickSilver" is a VOLE-based zero-knowledge proof for the correctness of the output value of an arithmetic circuit.

[0089] In the preprocessing phase where interaction between the prover P and the verifier V is not required, a pair of correlated random numbers is held mutually using VOLE, and in the interactive phase where interaction is required, proofs are generated based on multiplication and addition operations using IT-MACs, thereby improving the efficiency of proof generation and verification during interaction. To satisfy soundness, for all multiplication gates where both of the two input values input to the gate are not publicly disclosed constants, it is necessary to verify that the prover P has multiplied correctly. As a proof generation method, "QuickSilver" proposes a gate-by-gate paradigm.

[0090] ​The gate-by-gate paradigm is a technique for collectively proving the soundness for all multiplication gates in an arithmetic circuit where both of the two input values fed into the gates are not publicly disclosed constants. For each multiplication gate (α, β, γ, Mult) in the arithmetic circuit C, if w γ =w α ·w β is satisfied, then m i =k i -Δ·w i , i ∈ {α, β, γ}, and the relationship in Equation (8) is utilized.

[0091]

Number

[0092] Also, when the arithmetic circuit C has t multiplication gates, the above can be collectively expressed as Equation (9) using the challenge value χ by the verifier V.

[0093]

Number

[0094] Furthermore, to satisfy zero-knowledge property, using the output [ζ] of VOLE, the prover P sends the proof (U := A0 + M[ζ], V := A1 + ζ) to the verifier V, and the verifier V can collectively verify t multiplication gates by verifying B + K[ζ] = U + V·Δ.

[0095] As shown by arrow L8, the proof device 2 creates a proof value π by collectively performing appropriate calculations for (n + 1) arithmetic circuits. As shown by arrow L9, the proof device 2 sends the proof value π created collectively for (n + 1) arithmetic circuits to the verification device 3.

[0096] As shown by arrow L10, the verification device 3 collectively verifies the correctness of the proof value π for (n + 1) arithmetic circuits. As indicated by arrow L11, the proof device 2 sends the created M[x for (n + 1) pieces to the verification device 3. out

[0097] As indicated by arrow L12, for each of the (n + 1) arithmetic circuits, the verification device 3 verifies that the relation M[x out =K[x out is satisfied. By verifying that the relation M[x out =K[x out is satisfied for each of the (n + 1) arithmetic circuits, it can be convinced that x out is the correct output. This is because if x out is the correct output, then x out =0.

[0098] The process indicated by arrow L6 corresponds to the process executed by the proof operation processing unit 51 of the proof device 2 and the process executed by the proof operation processing unit 61 of the verification device 3. The processes indicated by arrows L7, L10, and L12 correspond to the processes executed by the proof verification processing unit 63 of the verification device 3.

[0099] The processes indicated by arrows L8, L9, and L11 correspond to the processes executed by the proof operation processing unit 51 of the proof device 2. The proof system 1 configured as described above includes a proof device 2 that holds a secret value w and a verification device 3 that is configured to be able to communicate data with the proof device 2. The proof system 1 executes a range proof in which the proof device 2 proves to the verification device 3 that the secret value w remains within a predetermined range while keeping the secret value w secret from the verification device 3.

[0100] The proof device 2 and the verification device 3 include (n + 1) arithmetic circuit shape information indicating the shapes of one preset first arithmetic circuit C i into which the secret value w and the bit representation value w val of the secret value w are input, and n second arithmetic circuits C bit-i .

[0101] As a preprocessing phase, the proving device 2 and the verification device 3 are each configured to acquire a proving-side correlated random number and a verification-side correlated random number having a preset correlation with each other by a preset number of random number acquisitions according to the number of one or more arithmetic circuits. The proving-side correlated random number of the number of random number acquisitions is a set of (2n + 2) (μ, M[μ]). The verification-side correlated random number of the number of random number acquisitions is a set of (2n + 2) (Δ, K[μ]).

[0102] As an interaction phase, the proving device 2 performs data communication with the verification device 3 using the proving-side correlated random number of the number of random number acquisitions, the secret value w, the bit representation value w of the secret value w, and the shape information of (n + 1) arithmetic circuits, and executes proof generation for generating a proof value π for proving that the secret value w is within a predetermined range, and is configured to transmit the proof value π to the verification device 3. Specifically, the proving device 2 receives a challenge value χ for (n + 1) arithmetic circuits (that is, one first arithmetic circuit C i and n second arithmetic circuits C val ) from the verification device 3, and is configured to generate a proof value π for (n + 1) arithmetic circuits using the received challenge value χ. bit-i )

[0103] As an interaction phase, the verification device 3 executes proof verification for verifying the proof value π using the verification-side correlated random number of the number of random number acquisitions, the shape information of (n + 1) arithmetic circuits, and the proof value π, and is configured to determine whether the secret value w is within a predetermined range.

[0104] Such a proof system 1 can use the "preprocessing phase" and "proof generation by multiplication and addition", which are techniques used in "QuickSilver" for operation hiding proof, by expressing the matter to be shown by range proof as an arithmetic circuit. Thereby, the proof system 1 can reduce the operations required in proof generation and proof verification, and thus can improve the operation efficiency for range proof.

[0105] Furthermore, the proof system 1 executes arithmetic processing by dividing it into a preprocessing phase that does not require interaction and an interactive phase that requires interaction, and uses correlation random numbers so that the proof device 2 and the verification device 3 can perform calculations independently without interacting with each other in the preprocessing phase. As a result, the proof system 1 can reduce the calculations required for proof generation and proof verification, and thus can further improve the calculation efficiency for range proof.

[0106] Also, the proof device 2 is configured to execute proof generation using only multiplication and addition, and the verification device 3 is configured to execute proof verification using only multiplication and addition. Thereby, the proof system 1 can execute proof generation and proof verification without using exponentiation, and can further improve the calculation efficiency for range proof.

[0107] Based on IT-MACs, the proof device 2 is configured to calculate a pair of (w val , M[w bit-i ) for each of the (n + 1) arithmetic circuits (i.e., one first arithmetic circuit C out and n second arithmetic circuits C out ) using proof-side correlation random numbers. Based on IT-MACs, the verification device 3 is configured to calculate a pair of (Δ, K[w out ) for each of the (n + 1) arithmetic circuits using verification-side correlation random numbers. Thereby, the proof system 1 can prevent the verification device 3 from knowing what w out the proof device 2 holds until the proof device 2 transmits M[w out corresponding to the outputs of the (n + 1) arithmetic circuits to the verification device 3 and the verification device 3 obtains the verification result.

[0108] When the same bit representation value w i is input to the (n + 1) arithmetic circuits, a plurality of the same bit representation values w iA common prover-side correlated random number and a common verifyer-side correlated random number are used for the range proof. This allows the proof system 1 to reduce the number of random numbers to be acquired and improve the efficiency of calculations for range proof.

[0109] The proving device 2 is configured to generate a proof value π that combines proofs for a challenge value χ for multiple arithmetic circuits into one. This enables the proving system 1 to reduce the number of random numbers to be acquired and improve the efficiency of calculations for range proving.

[0110] [Second embodiment] A second embodiment of the present disclosure will be described below with reference to the drawings. In the second embodiment, only the parts that are different from the first embodiment will be described. The same reference numerals will be used to designate common components.

[0111] As shown in FIG. 6, the proof system 1 of the second embodiment includes a proof device 2, a verification device 3, and a random number provider 4. The proving device 2 includes a proof calculation processing unit 51 , a communication unit 52 , and a display unit 53 .

[0112] The verification device 3 includes a proof calculation processing unit 61 , a communication unit 62 , a proof verification processing unit 63 , and a display unit 64 . The random number provider 4 includes an ideal function processing unit 71 and a communication unit 72.

[0113] 7, in the certification system 1 of the second embodiment, the certification device 2 possessed by the certifier P who has the certificate CT shows the verification device 3 possessed by the verifier V that the numerical value described in the certificate CT issued by the issuer IS is within a certain range without disclosing the specific numerical value. Specifically, in this embodiment, the certification device 2 shows the verification device 3 that the accident score described in the certificate CT is 6 points or less without disclosing the accident score itself.

[0114] The verifier V is convinced that the value written in the certificate CT held by the prover P is within a certain range and provides some kind of service. As shown by arrow L21, the issuer IS issues a certificate CT to the prover P. The certificate CT contains a value w (i.e., the secret value w) that the prover P wants to keep secret. Also, the prover P and the verifier V share a commitment Com to the secret value w by some means.

[0115] The commitment Com is generated by a cryptographic technique that has two characteristics: information about the secret value w cannot be obtained from the commitment Com created by the sender based on the secret value w (i.e., it has confidentiality), and it is also impossible to forge that the commitment Com was generated from a value w' other than the secret value w (i.e., it has bindingness).

[0116] As an example of the above-mentioned "some means", as shown by arrow L22, the issuer IS registers the commitment Com with a public third party TP that manages the commitment Com. As shown by arrow L23, the verifier V makes an inquiry to the third party TP to obtain the commitment Com corresponding to the secret value w.

[0117] Also, as an example of the above-mentioned "some means", for example, the verifier V makes an inquiry to the issuer IS to obtain the commitment Com corresponding to the secret value w described in the certificate CT held by the prover P.

[0118] As shown by arrows L24 and L25, the proof device 2 and the verification device 3 share, by some means, the shape of one first arithmetic circuit C val and the shape of n second arithmetic circuits C bit-i Since the first arithmetic circuit C val and the second arithmetic circuit C bit-i are publicly available information, for example, the verifier V may make an inquiry to the issuer IS or to a third party TP.

[0119] As shown by arrow L26, the proof device 2 and the verification device 3 obtain, as a preprocessing phase, for example, a set of correlated random numbers (i.e., a pre-shared key) from a random number providing device 4. As shown in FIG. 8, the display unit 53 included in the prover P's proving device 2 and the display unit 64 included in the verifier V's verification device 3 display, as the state regarding their own correlation random numbers, any one of "requesting", "receiving", "received", and "no response". Further, the display unit 53 and the display unit 64 display, as the state regarding the other party's correlation random number, any one of "requesting", "receiving", "received", and "no response". The display units 53 and 64 shown in FIG. 8 display "receiving" as the state regarding their own correlation random number and display "receiving" as the state regarding the other party's correlation random number.

[0120] As shown by the arrow L27 in FIG. 7, as an interaction phase, the proving device 2 and the verification device 3 communicate with each other, and the proving device 2 generates a proof. The proving device 2 presents the generated proof to the verification device 3.

[0121] As shown by the arrow L28, the verification device 3 verifies the correctness of the proof received from the proving device 2 and outputs acceptance if it is correct and rejection if it is incorrect. In response to the output, the verification device 3, as shown in FIG. 9, displays acceptance or rejection on the display unit 64. Further, the verification device 3 transmits the output result to the proving device 2. The proving device 2 receives the output result from the verification device 3 and, as shown in FIG. 9, displays acceptance or rejection, which is the output result, on the display unit 53.

[0122] [Third Embodiment] The third embodiment of the present disclosure will be described below with reference to the drawings. In the third embodiment, the parts different from the second embodiment will be described. The same reference numerals are given to the common configurations.

[0123] The proof system 1 of the third embodiment includes, similarly to the second embodiment, a proving device 2, a verification device 3, and a random number providing device 4. In the proof system 1 of the third embodiment, the prover P shows the verifier V that the carbon dioxide emission amount is within a certain range without revealing the calculation result of the carbon dioxide emission amount.

[0124] First, the proving device 2 calculates the carbon dioxide emission amount for the corresponding facility, product, or other target for which the carbon dioxide emission amount is to be calculated, and obtains a calculated value w (i.e., the secret value w). The proving device 2 registers the value Com obtained by committing the calculated value w in a public repository. The committed value Com is, for example, a Pedersen commitment, and may be given a digital signature by the prover.

[0125] As an input phase, the proving device 2 and the verifying device 3 share, by some means, the shape of one first arithmetic circuit C val and the shapes of n second arithmetic circuits C bit-i . Note that since the first arithmetic circuit C val and the second arithmetic circuit C bit-i are publicly available information, they may be registered in a public repository, for example.

[0126] As a preprocessing phase, the proving device 2 and the verifying device 3 obtain, for example, a set of correlated random numbers from a random number providing device 4. The display unit 53 provided in the proving device 2 of the prover P and the display unit 64 provided in the verifying device 3 of the verifier V display, as the state regarding their own correlated random numbers, any one of "requesting", "receiving", "received", and "no response". Also, the display unit 53 and the display unit 64 display, as the state regarding the correlated random numbers of the other party, any one of "requesting", "receiving", "received", and "no response".

[0127] As an interaction phase, the proving device 2 and the verifying device 3 communicate with each other, and the proving device 2 generates a proof. The proving device 2 presents the generated proof to the verifying device 3. The verifying device 3 verifies the correctness of the proof received from the proving device 2, and outputs acceptance if it is correct and rejection if it is incorrect. In response to the output, the verifying device 3 displays acceptance or rejection on the display unit 64. Also, the verifying device 3 transmits the output result to the proving device 2. The proving device 2 receives the output result from the verifying device 3 and displays acceptance or rejection, which is the output result, on the display unit 53.

[0128] If a malicious prover attempts to generate a proof with a value w' different from the calculation result, or if the value w to be committed is not the calculated value based on a legitimate calculation result, the verification will be accepted for the value w'. In this case, a trusted third party can perform the calculation of the carbon dioxide emissions, create a commitment to the calculation result w, or register it in a public repository to avoid the above attack.

[0129] The proof system 1 can be used not only for the range proof of carbon dioxide emissions but also as a system for proving that some quantity or value remains within a certain range while hiding it. As described above, one embodiment of the present disclosure has been explained, but the present disclosure is not limited to the above embodiment and can be implemented in various modifications.

[0130] [Modification Example 1] In the above embodiment, a form using one first arithmetic circuit C val and n second arithmetic circuits C bit-i was shown. However, as shown in FIG. 10, instead of one first arithmetic circuit C val and n second arithmetic circuits C bit-i , one first arithmetic circuit C val and n second arithmetic circuits C bit-i can be combined into one arithmetic circuit C T and used. The arithmetic circuit C T is a circuit having (n + 1) inputs and (n + 1) outputs. Even when one arithmetic circuit C T is used, the number of sets of correlated random numbers to be shared in advance is (2n + 2).

[0131] [Modification Example 2] In the above embodiment, a form in which the random number providing device 4 includes the ideal function processing unit 71 was shown. However, as shown in FIG. 11, the proving device 2 may include the ideal function processing unit 71, and the verifying device 3 may include the ideal function processing unit 71. Thereby, the random number providing device 4 can be made unnecessary in the proof system 1.

[0132] [Modification Example 3] In the above embodiment, the interactive phase requires interaction because the proving device 2 receives the challenge value χ from the verification device 3 and generates a proof value π that the calculation was correct using the challenge value χ. However, by using the "Fiat-Shamir transformation," the proving device 2 may obtain the challenge value χ from an ideal function called an oracle and transmit the proof value π to the verification device 3, allowing the proving device 2 and the verification device 3 to perform proof generation and proof verification without interaction.

[0133] The oracle may also be implemented using a random function or a hash function. The oracle may be provided by using the random number provider 4 or by using a separate random number provider.

[0134] Furthermore, the oracle may be provided in the ideal function processing unit 71 of the proving device 2, and in the ideal function processing unit 71 of the verification device 3. This makes it possible to eliminate the need for the random number provider 4 in the proving system 1.

[0135] Details of the Fiat-Shamir transform are described in A. Fiat at el. "How to prove yourself: Practical solutions to identification and signature problems," CRYPTO, 1987.

[0136] The control device 21, 31 and the method described herein may be implemented by a special-purpose computer configured by configuring a processor and memory programmed to execute one or more functions embodied in a computer program. Alternatively, the control device 21, 31 and the method described herein may be implemented by a special-purpose computer configured by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the control device 21, 31 and the method described herein may be implemented by one or more special-purpose computers configured by combining a processor and memory programmed to execute one or more functions with a processor configured with one or more hardware logic circuits. Furthermore, the computer program may be stored as instructions executed by a computer on a computer-readable non-transitory tangible storage medium. The method for implementing the functions of each unit included in the control device 21, 31 does not necessarily need to include software; all of the functions may be implemented using one or more hardware components.

[0137] In the above embodiments, multiple functions of one component may be realized by multiple components, or one function of one component may be realized by multiple components. Furthermore, multiple functions of multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Furthermore, part of the configuration of the above embodiments may be omitted. Furthermore, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments.

[0138] In addition to the above-mentioned proof device 2 and verification device 3, the present disclosure can also be realized in various forms, such as a system having the proof device 2 and verification device 3 as components, a program for causing a computer to function as the proof device 2 and verification device 3, a non-transient physical recording medium such as a semiconductor memory on which this program is recorded, and a proof method. [Technical idea disclosed in this specification] [Item 1] A proof system (1) comprising a proving device (2) that holds a secret value and a verification device (3) that is configured to be able to communicate data with the proving device, wherein the proving device performs range proof to prove to the verification device that the secret value falls within a predetermined range while keeping the secret value secret from the verification device, the proving device and the verifying device each include one or more pieces of arithmetic circuit shape information indicating the shapes of one or more preset arithmetic circuits to which the secret value is input; the proving device is configured to perform proof generation to generate a proof value for proving that the secret value is within the predetermined range using one or more pieces of arithmetic circuit configuration information, and to transmit the proof value to the verification device; The verification device is configured to determine whether the secret value falls within the predetermined range by performing proof verification using one or more of the arithmetic circuit shape information and the proof value.

[0139] [Item 2] The certification system according to item 1, In a pre-processing phase, the proving device and the verifying device are configured to respectively acquire proof-side correlated random numbers and verification-side correlated random numbers, which have a predetermined correlation with each other, by a predetermined number of random number acquisitions according to the number of one or more arithmetic circuits; the proving device is configured to perform the proof generation using the proving-side correlated random number of the random number acquisition number, the secret value, and one or more pieces of arithmetic circuit configuration information, and to transmit the proof value to the verification device; The verification device is a proof system configured to determine whether the secret value falls within the specified range by performing the proof verification using the verification side correlated random number of the random number acquisition number, one or more of the arithmetic circuit shape information, and the proof value.

[0140] [Item 3] The certification system according to item 1 or 2, The attestation system, wherein the attestation device is configured to obtain a challenge value from an oracle, and is configured to generate and transmit the attestation value to the verification device.

[0141] [Item 4] Item 3. The certification system according to item 3, The proving device is configured to obtain the challenge value by using a Fiat-Shamir transformation.

[0142] [Item 5] The certification system according to item 1 or 2, A proof system configured, in an interactive phase, for the proof device to receive a challenge value for one or more of the arithmetic circuits from the verification device and generate the proof value for one or more of the arithmetic circuits using the received challenge value.

[0143] [Item 6] The certification system according to any one of items 1 to 5, the proving device is configured to perform the proof generation using only multiplications and additions; A proof system in which the verification device is configured to perform the proof verification using only multiplication and addition.

[0144] [Item 7] Item 2: The certification system according to item 2, the proof-side correlated random number and the verification-side correlated random number have a relationship of "M[μ]=K[μ]-Δμ", The proof-side correlation random number is a pair (μ, M[μ]), A proof system in which the verification-side correlated random number is a set (Δ, K[μ]).

[0145] [Item 8] Item 7. The certification system according to item 7, The output value of the arithmetic circuit is w out As, The proof device is configured to calculate a pair of (w out , M[w out ) for each of one or more of the arithmetic circuits based on IT-MACs and using the proof-side correlation random numbers. The verification device is configured to calculate a pair of (Δ, K[w out ) for each of one or more of the arithmetic circuits based on IT-MACs and using the verification-side correlation random numbers, in a proof system.

[0146] [Item 9] The proof system according to any one of Items 1 to 8, wherein one or more of the arithmetic circuits are circuits representing the following expressions (1) and (2).

[0147] [Equation]

[0148] [Equation]

[0149] [Item 10] The proof system according to Item 9, wherein a plurality of the arithmetic circuits represent the above expression (1) as the following expression (3) and the above expression (2) as "w i (w i -1) = 0".

[0150] [Equation]

[0151] [Item 11] The proof system according to Item 9, wherein one of the arithmetic circuits represents the above expressions (1) and (2) combined into one as a circuit having (n + 1) inputs and (n + 1) outputs.

[0152] [Item 12] Item 5. The certification system according to item 5, The proving device is a proving system configured to generate the proof value by combining proofs for the challenge value for a plurality of the arithmetic circuits into one proof value.

[0153] [Item 13] Item 2: The certification system according to item 2, A proof system in which, when the same secret value is input to one or more of the arithmetic circuits, a common proof-side correlated random number and a common verification-side correlated random number are used for the same multiple secret values.

[0154] [Item 14] A proof method executed in a proof system (1) comprising a proving device (2) that holds a secret value and a verification device (3) that is configured to be able to communicate data with the proving device, wherein the proving device performs a range proof that proves to the verification device that the secret value falls within a predetermined range while keeping the secret value secret from the verification device, the proving device and the verifying device each include one or more pieces of arithmetic circuit shape information indicating the shapes of one or more preset arithmetic circuits to which the secret value is input; the proving device performs proof generation to generate a proof value for proving that the secret value is within the predetermined range using one or more pieces of arithmetic circuit configuration information, and transmits the proof value to the verification device; The verification device performs proof verification to verify the proof value using one or more pieces of arithmetic circuit configuration information and the proof value, thereby determining whether the secret value falls within the specified range.

[0155] [Item 15] A proving device (2) that holds a secret value, and a verification device (3) configured to be capable of data communication with the proving device, wherein the computer of the proving device in a proof system (1) that executes range proof for proving to the verification device that the secret value remains within a predetermined range while keeping the secret value secret from the verification device, Execute proof generation for generating a proof value for proving that the secret value remains within the predetermined range, using one or more arithmetic circuit shape information indicating the shape of one or more preset arithmetic circuits into which the secret value is input, and execute generation and transmission processing (L8, L9) for transmitting the proof value to the verification device. A proof program configured as such.

[0156] [Item 16] A proving device (2) that holds a secret value, and a verification device (3) configured to be capable of data communication with the proving device, wherein the computer of the verification device in a proof system (1) that executes range proof for proving to the verification device that the secret value remains within a predetermined range while keeping the secret value secret from the verification device, Execute proof verification for verifying the proof value, using one or more arithmetic circuit shape information indicating the shape of one or more preset arithmetic circuits into which the secret value is input and the proof value for proving that the secret value remains within the predetermined range, and execute verification processing (L10) for determining whether or not the secret value remains within the predetermined range. A proof program configured as such.

Explanation of Reference Numerals

[0157] 1... Proof system, 2... Proving device, 3... Verification device

Claims

1. A proof system (1) comprising a proof device (2) that holds a secret value and a verification device (3) configured to be capable of data communication with the proof device, wherein the proof device executes a range proof to prove to the verification device that the secret value remains within a predetermined range while keeping the secret value secret from the verification device, the proof device and the verification device include one or more arithmetic circuit shape information indicating the shape of one or more preset arithmetic circuits into which the secret value is input, the proof device executes proof generation to generate a proof value for proving that the secret value remains within the predetermined range using the one or more arithmetic circuit shape information, and is configured to transmit the proof value to the verification device, the verification device is configured to determine whether the secret value remains within the predetermined range by executing proof verification to verify the proof value using the one or more arithmetic circuit shape information and the proof value.

2. The proof system according to claim 1, as a preprocessing phase, the proof device and the verification device are each configured to acquire a proof-side correlated random number and a verification-side correlated random number having a preset correlation with each other by a preset number of random number acquisitions corresponding to the number of the one or more arithmetic circuits, the proof device is configured to execute the proof generation using the proof-side correlated random numbers of the number of random number acquisitions, the secret value, and the one or more arithmetic circuit shape information, and to transmit the proof value to the verification device, the verification device is configured to determine whether the secret value remains within the predetermined range by executing the proof verification using the verification-side correlated random numbers of the number of random number acquisitions, the one or more arithmetic circuit shape information, and the proof value.

3. The proof system according to claim 1 or claim 2, the proof device is configured to acquire a challenge value from an oracle and to generate and transmit the proof value to the verification device.

4. The proof system according to claim 3, the proof device is configured to acquire the challenge value by using the Fiat-Shamir transformation.

5. The proof system according to claim 1 or claim 2, As a dialogue phase, the proof device receives a challenge value for one or more of the arithmetic circuits from the verification device, and generates the proof value for one or more of the arithmetic circuits using the received challenge value. The proof system is configured as such.

6. The proof system according to claim 1 or claim 2, wherein the proof device is configured to execute the proof generation using only multiplication and addition, and the verification device is configured to execute the proof verification using only multiplication and addition. The proof system is configured as such.

7. The proof system according to claim 2, wherein the proof-side correlated random number and the verification-side correlated random number have a relationship of "M[μ]=K[μ] - Δμ", the proof-side correlated random number is a pair of (μ, M[μ]), and the verification-side correlated random number is a pair of (Δ, K[μ]). The proof system is configured as such.

8. The proof system according to claim 7, Let the output value of the arithmetic circuit be w ｏｕｔ and The proof device is configured to calculate a pair (w ｏｕｔ , M[w ｏｕｔ ) for each of one or more of the arithmetic circuits using the proof-side correlation random number based on IT-MACs. The verification device is configured to calculate a pair of (Δ, K[w ｏｕｔ ) for each of one or more of the arithmetic circuits using the verification-side correlation random number based on IT-MACs.

9. The proof system according to claim 1 or claim 2, wherein one or more of the arithmetic circuits are circuits representing the following formula (1) and formula (2). The proof system is configured as such. 【Number 1】 【Number 2】

10. The proof system according to claim 9, The plurality of the arithmetic circuits express the above formula (1) as the following formula (3) and the above formula (2) as "w ｉ (w ｉ - 1) = 0", and is a proof system of a circuit thus expressed. [Number 3]

11. The proof system according to claim 9, wherein one of the arithmetic circuits combines formula (1) and formula (2) together and is represented as a circuit having (n + 1) inputs and (n + 1) outputs. The proof system is configured as such.

12. The proof system according to claim 5, wherein the proof device is configured to generate the proof value by combining the proofs for the challenge value for one or more of the arithmetic circuits into one. The proof system is configured as such.

13. The proof system according to claim 2, wherein when the same secret value is input to one or more of the arithmetic circuits, the common proof-side correlated random number and the verification-side correlated random number are used for the same plurality of secret values. The proof system is configured as such.

14. A proof method executed in a proof system (1) comprising a proof device (2) holding a secret value and a verification device (3) configured to be capable of data communication with the proof device, wherein the proof device executes range proof to prove to the verification device that the secret value remains within a predetermined range while keeping the secret value secret from the verification device. The proving device and the verifying device include one or more arithmetic circuit shape information indicating the shapes of one or more preset arithmetic circuits into which the secret value is input. The proving device executes a proof generation for generating a proof value for proving that the secret value is within the predetermined range by using one or more pieces of the arithmetic circuit shape information, transmits the proof value to the verifying device. The verifying device executes a proof verification for verifying the proof value by using one or more pieces of the arithmetic circuit shape information and the proof value, and determines whether the secret value is within the predetermined range by performing the proof verification.

15. A proving system (1) comprising a proving device (2) holding a secret value and a verifying device (3) configured to be capable of data communication with the proving device, wherein the proving device executes a range proof for proving to the verifying device that the secret value is within a predetermined range while keeping the secret value secret from the verifying device. On the computer of the proving device of the proving system (1), A proof program configured to execute a generation and transmission process (L8, L9) of generating a proof value for proving that the secret value is within the predetermined range by using one or more pieces of the arithmetic circuit shape information indicating the shapes of one or more preset arithmetic circuits into which the secret value is input, and transmitting the proof value to the verifying device.

16. A proving system (1) comprising a proving device (2) holding a secret value and a verifying device (3) configured to be capable of data communication with the proving device, wherein the proving device executes a range proof for proving to the verifying device that the secret value is within a predetermined range while keeping the secret value secret from the verifying device. On the computer of the verifying device of the proving system (1), A proof program configured to execute a verification process (L10) of determining whether the secret value is within the predetermined range by executing a proof verification for verifying the proof value by using one or more pieces of the arithmetic circuit shape information indicating the shapes of one or more preset arithmetic circuits into which the secret value is input and the proof value for proving that the secret value is within the predetermined range.

Images