Computer-implemented systems and methods for enabling zero-knowledge proofs

Abstract

This invention provides a method and system for efficient zero-knowledge verification of compound statements that simultaneously require both arithmetic circuit satisfiability and dependent statements regarding the validity of the public key. [Solution] The method involves a prover P transmitting a set of data to a verifier V, which includes a statement S relating to a given function circuit output and an elliptic curve point. The data includes individual wire commitments and / or batched commitments, inputs, and outputs for the circuit of the statement. The prover transmits an opening in response to a challenge from the verifier. Alternatively, the prover may further include a proof key. Using the data received from the prover, the verifier determines that the circuit is satisfied, verifies the statement, and determines that the prover holds evidence for the statement. Upon receiving the data, the verifier determines, through calculation, that the data fits the statement.

Description

[Technical Field]

[0001] This specification relates in general to computer-implemented methods and systems suitable for implementation on computer processors or groups of such processors, such as nodes in a blockchain network. An improved method is provided for generating proofs that enable efficient zero-knowledge verification of statements. The method is suitable for integration into discrete log-based zero-knowledge proof protocols for existing circuit satisfiability that do not require the use of bilinear pairing-friendly elliptic curves. The invention is not limited to, but particularly, methods performed by a prover to create proofs and methods performed by a verifier to verify proofs, and is suitable for collaborative work between two or more participants. To enable secure, trustless interaction between participants, one of the parties can prove knowledge of a key or statement without revealing the statement. [Background technology]

[0002] In this document, the term 'blockchain' encompasses all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permitted and unauthorized ledgers, shared ledgers, and variations thereof. While the Bitcoin ledger is the most widely known application of blockchain technology, other blockchain implementations are also being proposed and developed.

[0003] For convenience and illustrative purposes, Bitcoin may be referenced here, but it should be noted that the present invention is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are also within the scope of the invention. The term “user” here refers to a human or processor-based resource. A blockchain is a peer-to-peer electronic ledger implemented as a computer-based, decentralized, distributed system consisting of multiple blocks of transactions.

[0004] Each transaction is a data structure that encodes the transfer of control of digital assets between participants in a blockchain system, and includes at least one input and at least one output. Each block creates a permanent and immutable record of all transactions written to that blockchain before its inception, by including the hash of the preceding block to which that block is chained together. Transactions include small programs known as scripts embedded in their inputs and outputs, which specify who can access the transaction's output and how. On the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0005] Furthermore, this document refers to the structure of known zero-knowledge proof protocols and systems that use arithmetic circuits. Blockchain has provided a decentralized, permissionless global mechanism that enables a solution to the problem of fair transactions between two mutually untrusted parties without requiring third-party arbitration or third-party deposits. The fair exchange of data or information, for monetary rewards or in exchange for information such as digital goods, is embodied in a transaction protocol known as ZKCP (Zero-Knowledge Contingent Payments) (Non-Patent Literature 2). In ZKCP, specified data is transferred from seller to buyer only when payment is confirmed, and payment from buyer to seller is completed only if this specified data is valid according to the terms of the sale. Details of such protocols are known (Non-Patent Literature 1), but it is basically based on a combination of hash-time-locked contracts (HTLCs) and zero-knowledge proof, which simultaneously verifies that encrypted information ('digital goods') is valid / accurate and that the 'password' to decrypt this information is data that must be revealed on the blockchain in order to claim payment.

[0006] The core component of the ZKCP protocol is a zero-knowledge proof against a set of dependent statements concerning the validity or accuracy of data / information, the validity of keys, and the corresponding hash values. Such complex compound statements require an efficient zero-knowledge proofing system for overall computation, which ultimately allows one party to run an arbitrary program using secret inputs and prove to the other party that the program validated the inputs and executed correctly, without revealing any information about the secret inputs or the program's execution. In known ZKCP examples, the general-purpose zero-knowledge proofing systems employed have been based on succinct non-interactive arguments of knowledge (SNARK) frameworks, such as those implemented in the Pinocchio protocol (Non-Patent Document 3) and the C++ libsnark library (Non-Patent Document 4).

[0007] Zero-knowledge SNARKs (zkSNARKs) provide a zero-knowledge method for proving the validity of any computation that can be represented as an arithmetic circuit. Two main characteristic properties of zkSNARKs are that they are non-interactive (the prover sends the proof to the verifier in one move) and concise (the proof is small and easy to verify). However, they have considerable limitations: - Proof generation is extremely computationally intensive. - The proof key is very large and proportional to the circuit size. - They rely on strong, untested cryptographic assumptions (i.e., knowledge of the explosion assumption and pairing-based assumption). - For a given program (circuit), they require that a common reference string (CRS) be computed by a trusted third party in order to remove the configuration parameters. The person with knowledge of the configuration parameters has the ability to create a false proof.

[0008] The construction of a zkSNARK that proves statements involving arbitrary cryptographic elliptic curve key operations has not yet been attempted, but hypothetically, it would consist of an arithmetic circuit with hundreds of thousands or millions of gates, resulting in a proof generation time of several minutes and proof keys of several hundred megabytes in size.

[0009] Technical background A basic system for interactive zero-knowledge proofing can use the Σ (sigma) protocol, which involves several communication steps between the prover and the verifier. Typically, the Σ protocol requires three moves: the prover sends an initial commitment (a) to the verifier, the verifier responds with a random challenge (x), and finally the prover responds with a final response, i.e., an 'opening' (z). The verifier then accepts or rejects the statement based on the transcript (a,x,z).

[0010] The Σ protocol can be used to prove knowledge of evidence (w) known only to the prover, or a statement about said evidence (w). If the commitment does not reveal to the verifier any information, i.e., secrets, about the evidence, except the fact that the statement about the evidence is true, then the protocol is zero knowledge (Non-Patent Literature 5).

[0011] At the heart of many interactive zero-knowledge protocols is the commitment scheme, which is used for the satisfiability of arithmetic circuits. A commitment allows a prover to commit to a secret value beforehand, and then to reveal (open) the secret value in a verifiable manner. A commitment scheme has two main properties: First, it is hidden, and the commitment keeps the value secret. Second, it is bound, and the commitment can only be opened to the original committed value. The Pedersen commitment (Non-Patent Literature 5) scheme involves two elliptic curve generating points, G and F, in a group G of prime order p known to all parties. The committer is a prime integer Zp Generate a secure random number r in the field and commit to the secret value s: Com(s,r) = s × G + r × F This is calculated (by elliptic curve addition / multiplication), where × represents elliptic curve point multiplication.

[0012] The committer can fully open the commitment (i.e., it can be verified) at a later stage by providing the values ​​s and r. The committer can also open the commitment in response to a specific challenge value as part of the Σ protocol without revealing the secret s or the random number r.

[0013] Pedersen commitments are additively homomorphic, meaning that adding two commitments (on an elliptic curve) results in a commitment to the sum of the committed values, i.e.: (s1×G+r1×F)+(s2×G+r2×F)=(s1+s2)×G+(r1+r2)×F That is the case.

[0014] The proof of satisfiability of an arithmetic circuit can be achieved with 'zero knowledge'. (Field Z) p The arithmetic circuit shown above is a virtual configuration of arithmetic gates connected by wires (forming a directed acyclic graph), which is capable of performing any complex calculation, and the calculation must be limited to integer operations and must not have data-dependent loops or variable states.

[0015] Each gate has two input wires and one output wire, and performs multiplication (×) or addition (+) operations on the input. Figure 1(a) shows the left (w L ) and right (w R ) Wire input and one wire output (w O Figure 1(b) shows a schematic diagram of a multiplication gate having ), and Figure 1(b) shows a schematic diagram of a simple arithmetic circuit having three gates, three input wires (w1, w2, w3), one output wire (w6), and two internal wires (w4, w5).

[0016]

[0017]

[0018] (For generating a proof that the circuit is satisfied), first the prover i generates commitments for each wire w W i =Com(w i ,r i ) in the circuit (where the number of wires is n and i = 1, …, n), and sends these to the verifier.

[0019] For each ‘addition’ gate (one shown in Fig. 1(b)) in the circuit, a Σ zero protocol is executed, which involves proving (in zero - knowledge) that w L +w R -w O =0 (i.e., the input wires w L and w R are equal to the output wire w O and the addition gate is satisfied). This involves the following steps, namely: 1. The prover generates a commitment to zero: B = Com(0,rB Generate and send to the verifier. 2. The verifier determines the random challenge value: x ← Z p Respond with: 3. Next, the prover declares the opening value: z = x(r L +r R -r O )+r B Calculate it and send it to the verifier. 4. The verifier said, lol L + w R -w O As proof that = 0, Com(0,z) = x × (W L +W R -W O Prove ) + B. B represents a curve point similar to the public key; B = r × F + 0 × G r B This represents the private key of the corresponding pair.

[0020] For each 'multiplication' gate (shown in Figure 1(a)), Σ prod The protocol is executed, which is w for each multiplication gate. L ·w R =w O This involves proving (with zero knowledge) that this is true (i.e., that the multiplication gate is satisfied). 1. The prover sets five random binding values: t1, t2, t3, t4, t5 ← Z p Generates. 2. The prover has C1=Com(t1,t3), C2=Com(t2,t5), and C3=t1×W. R Calculate +t4×F and send these to the verifier. 3. The verifier determines the random challenge value: x ← Z p Respond with: 4. The value revealed by the prover: e1=w L x+t1 e²=w R x+t² z1=r L x+t3 z²=r R x+t5 z3=(r O -w L r R )x+t4 Calculate these values ​​and send them to the verifier. 5. And the verifier, w L ·w R =w O As proof that this is true, consider the following equation: Com(e1,z1) = x × W L +C1 Com(e2,z2)=x×W R +C2 e1×W R +z³×F=x×W O +C3 To inspect.

[0021] Σ zero Protocol and Σ prod The protocol can be operated in parallel to verify each gate in the circuit, and the same verification challenge value (x) can be used for all gates.

[0022] As an example, considering the circuit in Figure 1(b), in order for the prover to prove to the verifier with zero knowledge that they know the legal assignments (i.e., the wire values ​​that satisfy the circuit), the prover first sends the verifier the wire commitments (W1, ..., W6) for each gate and the Σ protocol commitments (i.e., one additional commitment for each adder gate and five additional commitments for each multiplier gate).

[0023] Next, the verifier attempts a random challenge x←Z p The prover responds by calculating the values ​​to open each gate (one for each addition, five for each multiplication) and sending them back to the verifier. The verifier then performs a Σ protocol check. w1·w2=w4 w4·w5=w6 w2 + w3 = w5 Therefore, we verify that commitments W1, ..., W6 correspond to satisfying wire values ​​w1, ..., w6.

[0024] If a prover wishes to show that, in addition to satisfying the circuit, a particular wire has a specific value, they can fully open the commitment to the relevant wire. In this example, the prover could further send the values ​​w6 and r6 to the prover to show that w6 is the actual output from a particular legal allocation (and the prover could then verify that W6 = Com(w6,r6)).

[0025] The example in Figure 1(b) is a simple circuit. In reality, useful circuits consist of many more gates. Of particular interest is the arithmetic circuit for the SHA-256 hash function, which allows a prover to show that they know the preimage (input) to the SHA-256 function that hashes to a particular (output) value, without revealing the preimage. One of the most efficient implementations of a circuit for the SHA-256 algorithm consists of 27,904 arithmetic gates (Zcash2016). Thus, proving knowledge of the SHA-256 preimage would require sending approximately 5 MB of data in both the initial commitment and opening round of the protocol above, requiring approximately 200,000 elliptic curve operations for both the prover and the verifier (each taking several seconds of processor time).

[0026] Several methods have been developed to significantly improve the performance of parallel Σ protocol approaches for proving arithmetic circuit satisfiability. Known approaches (Non-Patent Documents 5 and 6) involve batching commitments to circuit wire values ​​to substantially reduce the size of data that must be sent from the prover to the verifier (i.e., reducing communication complexity). These methods enable proof systems in which communication complexity is reduced from O(n) to O(√n) or O(log(n)).

[0027] Again, as a comparison for proving the satisfiability of the same SHA circuit, the protocol (Non-Patent Document 5) has a proof key size of only 5KB and a key generation time of 180ms. The proof size is 24KB, takes about 4 seconds to generate, and the proof also takes about 4 seconds to verify.

[0028] These methods will not be fully explained here, except that the main vector batching protocol employed will be described in the following steps. This follows the same properties as the usual Pedersen commitment, but with n elements (m=m1,…,m n The commitment to ) only requires the submission of a single group element: 1. The prover and verifier agree on group element F←G. 2. The prover has n random numbers x1, ..., x n ←Z p Generates. 3. The prover, point K i =x i Calculate ×F(for i=1,…,n). These values ​​form the proof key PrK that is sent to the verifier. 4. The prover, random number: r ← Z p Generates. 5. The certifier makes a commitment:

number

[0029] [Non-Patent Document 1] Campanelli, Matteo, et al. "Zero-knowledge contingent payments revisited: Attacks and payments for services." Commun. ACM (2017). [Non-Patent Document 2] https: / / github.com / zcash-hackworks / pay-to-sudoku [Non-Patent Document 3] Parno, Bryan, et al. "Pinocchio: Nearly practical verifiable computation." Security and Privacy (SP), 2013 IEEE Symposium on. IEEE, 2013. [Non-Patent Document 4] https: / / github.com / scipr-lab / libsnark [Non-Patent Document 5] Bootle, Jonathan, et al. "Efficient zero-knowledge proof systems." Foundations of Security Analysis and Design VIII. Springer, Cham, 2015. 1-31. [Non-Patent Document 6] Groth, Jens. "Linear Algebra with Sub-linear Zero-Knowledge Arguments." CRYPTO. Vol. 5677. 2009. [Non-Patent Document 7] https: / / bitcointalk.org / index.php?topic=81865.msg901491#msg901491 [Non-Patent Document 8] Bootle, Jonathan, et al. "Efficient zero-knowledge arguments for arithmetic circuits in the discrete log setting." Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, Berlin, Heidelberg, 2016. [Non-Patent Document 9] Standards for Efficient Cryptography (SEC) (Certicom Research, http: / / www.secg.org / sec2-v2.pd [Non-Patent Document 10] Bitcoin Developer Reference (http: / / bitcoin.org / en / developer-reference) [Overview of the project]

[0030] Overall, the present invention relates to a computer-implemented method for enabling zero-knowledge proofs or verifications of statements. Using the method herein, a prover can prove to a verifier that a statement is true while keeping the evidence against the statement secret. These statements are compound statements that simultaneously require both arithmetic circuit satisfiability and dependent statements (key statement proofs) concerning the validity of the public key.

[0031] The method described here can be used in known protocols concerning circuit satisfiability, such as existing discrete logarithm-based zero-knowledge proof protocols. This method is particularly suitable for protocols that do not require the use of bilinear pairing-friendly elliptic curves.

[0032] The method involves the prover sending a set of data to the verifier, including a statement relating to a given function circuit output and an elliptic curve point, where the function circuit input is equal to the corresponding elliptic curve point multiplier (s). The data includes individual wire commitments and / or batched commitments, inputs, and outputs for the circuit of the statement. The prover may include, or has previously shared, the elliptic curve used in the statement or the specifications of each elliptic curve. The prover then sends an opening in response to a challenge from the verifier. Alternatively, the prover may further include a proof key.

[0033] Using the data received from the prover, the verifier can determine that the circuit is satisfied and verify the statement, thus determining that the prover holds evidence for the statement. Elliptic curve points can also be computed. Upon receiving the data, the verifier determines through computation that the data fits the statement. This invention is particularly suitable for zero-knowledge proofs of equivalence between hash preimages and elliptic curve secret keys.

[0034] Accordingly, the present invention provides the methods and systems defined in the appended claims.

[0035] Therefore, it is desirable to provide a computer-implemented method for enabling a zero-knowledge proof or verification of a statement (S), in which a prover proves to a verifier that the statement is true while keeping the evidence (W) against the statement secret. This proof can be an explicit proof.

[0036] A computer-implemented method can be provided for enabling a zero-knowledge proof or verification of a statement (S), in which a prover proves to a verifier that the statement is true while keeping the evidence (w) for the statement secret, and such method is The certifier to the verifier: A statement (S) is represented by an arithmetic circuit having m gates and n wires configured to implement a function circuit and determine whether the function circuit input (s) to the wires of the function circuit is equal to the corresponding elliptic curve point multiplier (s) for a given function circuit output (h) and elliptic curve point (P), Individual wire commitments and / or batch commitments for the wires of the circuit, The output of the function circuit (h), Proof Key (PrK), Including sending, This allows the verifier to determine that the circuit is satisfied, calculate the elliptic curve point (P), and verify the statement, thus determining that the prover holds evidence (w) for the statement.

[0037] The method involves a prover sending a set of data to a verifier. The set of data includes a statement having an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine, for a given function circuit output (h) and elliptic curve point (P), whether a function circuit input (s) to or within the function circuit is equal to the corresponding elliptic curve point multiplier (s). The function circuit may be a circuit that implements the functionality of a hash function. The preimage to or within the hash function circuit can be equal to the corresponding elliptic curve point multiplier.

[0038] The data also includes individual wire commitments and / or batched commitments. Each commitment may be a wire input and output (these are encrypted) for the gates of the circuit. The data also includes inputs. The inputs act as key openings for the wires of the arithmetic circuit [elliptic curve point (P)]. Either the prover or the verifier may name the wires. The inputs or key openings may be for the first wire in the circuit. The data also includes function circuit outputs. The data may include the elliptic curves used in the statement or the specifications of each elliptic curve.

[0039] After sending the data, the prover receives a challenge value from the verifier and responds with an opening. The opening can be a value statement following the Σ (sigma) protocol. The opening value can be for each gate in the circuit that allows the verifier to determine that the statement is true and compute the elliptic curve point.

[0040] Instead of waiting for a challenge, the prover may send a proof key to the verifier. The proof key may be generated from data that is part of the proof. The proof key may be a hash of one or more random numbers used in the proof.

[0041] The data sent to the verifier allows the verifier to determine if the circuit is satisfied, calculate the elliptic curve points, verify the statement, and thus determine that the prover holds evidence for the statement.

[0042] The set of data sent to the verifier, and / or the opening to the challenge sent to the verifier, can function like a key created independently of the verifier. The challenge from the verifier is analogous to determining the identity of the prover and the integrity of the key.

[0043] The input or key opening may be directed to the first wire in the arithmetic circuit. However, since proving knowledge of an intermediate wire is more difficult than proving knowledge of the first wire, it is preferable to select a random wire. Furthermore, selecting a random wire other than the first wire is more robust and prevents malicious third parties from discovering proof or evidence.

[0044] It is equally desirable to provide a complementary computer-implemented method for enabling zero-knowledge proofs or verifications of statements, where a verifier verifies that a statement is true without knowing the evidence (w) for the statement by analyzing data received from a prover. To clarify, the method of the present invention extends to the reverse action taken by the verifier in a plug-and-socket fashion. The present invention extends to a complete collaboration between the prover and the verifier.

[0045] In addition to waiting for a challenge value, the prover may send the verifier a random value that enables the verifier to determine that the statement is true and compute the elliptic curve point. Upon receiving data from the prover, the verifier may instead receive a random value that enables the verifier to determine that the statement is true and compute the elliptic curve point. The random value may be a function of at least one commitment. This function may be a hash function.

[0046] Random values ​​or challenges can be replaced to improve the convenience and efficiency of the process. There is also a risk associated with verifiers generating non-random challenges in attempts to extract information about the evidence. Furthermore, replacing the challenge value with a random value provided by the prover transforms this method from interactive to non-interactive. The prover can generate proof offline that can be independently and publicly verified. The random value can be the output of a hash function. Using the output of a hash of one or more commitments instead of a random value (x) utilizes the Fiat-Shamir principle.

[0047] A random value can be calculated by hashing the concatenation of all commitments generated by the prover and sent to the verifier.

[0048] Commitment is W i =Com(w i ,r i ) can be made to be, Com is a commitment to a functional circuit, w i This is the wire value, r i This is a random number, meaning it differs for each wire commitment. i is the wire type, Com(w,r) ​​= w × G + r × F, F and G are points on an elliptic curve.

[0049] The input to wire l in the arithmetic circuit is ko=r l It can be expressed as ×F. ko is a key opening input, r l It is a random number, F is a point on an elliptic curve.

[0050] A wire can be the first wire in a circuit.

[0051] The verifier can confirm that the circuit satisfies the elliptic curve point subtraction: pk l =Com(w l ,r l )-ko l The public key for wire l can be calculated via this method.

[0052] The prover may submit a batch of wire commitments and generate random numbers for each wire to compute an elliptic curve point, thereby forming a proof key.

[0053] The batched commitments regarding evidence are,

number

[0054] The input to wire n in the arithmetic circuit is:

number

[0055] The input can be that of the first wire.

[0056] The verifier performed elliptic curve calculations:

number

[0057] The prover may further send a fully open commitment to at least one wire. The method may use a Pedersen commitment. The statement may use only one arithmetic circuit for a function circuit. The function circuit may implement a hash function, preferably the SHA-256 hash function.

[0058] The method can be used by a prover to enable zero-knowledge-attached transactions (which may be zero-knowledge-attached transactions) on data such as cryptographic keys, the prover works with a verifier to verify the data provided (which may be a vanity address) and the data received (which may be a payment in the form of a UTXO), establishes a communication channel (which may be open) with the verifier, and the prover receives from the verifier an elliptic curve public key pk generated by the verifier from a secure random private key skB. B Receive, pk V =sk V ×G, and G is a point on an elliptic curve. The prover is data=pk V The provided data is protected by a lock value i such that it is +i × G.

[0059] The prover may be performing a search for the required pattern in the Base58 encoded address obtained by changing i. The prover is pk P The public keys, which are equal to i × G, and the output f(i) from the function circuit whose input (e.g., preimage) is the locked value i, are sent to the verifier.

[0060] The prover states that the input to the function circuit is pk P A statement proof can be sent to the verifier proving that it is the corresponding private key, and therefore the verifier can verify the proof and pk=pk V +pk P By verifying that the corresponding address matches an agreed pattern, knowing the lock value i may enable the derivation of a complete secret key for the data, and it may also enable the identification of the lock value i as a function circuit input to a function circuit.

[0061] The prover may receive transaction Tx1, which contains an output including data to be received, accessible by the prover's signature and the input to the function circuit. This transaction may be a hash-time lock function. The received data may provide access to a UTXO.

[0062] The certifier can sign the transaction and broadcast it on the blockchain, which is mined into a block and provides a second transaction Tx2 that supplies the signature and value i to unlock the transaction, thereby enabling the certifier to access the data from the output of transaction Tx1, and the transaction is revealed on the blockchain, thus enabling the verifier to identify the lock value i and access the data provided by the certifier. sk=sk B +i, pk = sk × G.

[0063] The data provided by the verifier may include a vanity address. The data received from the verifier may include a cryptocurrency payment (e.g., UTXO).

[0064] Transactions can be completely atomic and trustless, with the buyer only receiving payment if they provide a valid value i, and this value i is publicly revealed on the blockchain. The splitting of the private key ensures that the value revealed on the blockchain is useless to anyone else and does not compromise the security of the complete private key.

[0065] A computer-implemented method may involve a prover performing a trustless, fair data exchange with a verifier (without using a centralized exchange by a third party). This can be described as a cross-chain atomic swap or atomic trade, because in this context it refers to a fair exchange where either both parties complete the transaction or neither completes it. This swap can be performed between blockchains that support scripting capabilities enabling hashed, time-locked contracts.

[0066] The prover has access to first data, such as 1 Bitcoin UTXO, on the first blockchain, and the verifier has access to second data, such as 100 LTC, on the second blockchain, and the prover and verifier agree to exchange data. The method involves the prover generating a key pair for the second blockchain, sending the public key to the verifier, and holding the private key, and the prover receiving the verifier's public key for the first blockchain, and the verifier generating a key pair for the first blockchain and holding the private key (s B The proof includes holding a statement, one or more commitments, an input or key opening and a function circuit output (h), and an elliptic curve specification.

[0067] The prover can create a first blockchain transaction Tx that sends the first data to a common public key address, and broadcast the transaction on the first blockchain network. The address is determined by the sum of the input and the verifier's public key. This data can be accessed by the prover after the swap has not been executed within 24 hours. A After the swap has not been executed within 24 hours, this data can be accessed by the prover.

[0068] The prover can verify a second blockchain transaction Tx, which is created by the verifier and broadcast on the second blockchain network after confirming that the first blockchain transaction Tx is included in the first blockchain. The transaction sends the second data in the form of 100 LTC to the prover's public key address, which can be accessed by the prover using a valid signature regarding the prover's public key address and a value that is the function circuit input for determining the function circuit output. This data can be accessed by the verifier after the swap has not been executed within 24 hours. B The transaction sends the second data in the form of 100 LTC to the prover's public key address, which can be accessed by the prover using a valid signature regarding the prover's public key address and a value that is the function circuit input for determining the function circuit output. This data can be accessed by the verifier after the swap has not been executed within 24 hours. A This data can be accessed by the verifier after the swap has not been executed within 24 hours.

[0069] The prover confirms that the second blockchain transaction Tx is included on the second blockchain, accesses the second data by providing the signature and the above value that is the function circuit input of the function circuit output, and thus enables the verifier to observe the above value that is the function circuit input for determining the function circuit output and access the first data by providing a signature using the secret key of (P of s + s from the homomorphism of elliptic curve point multiplication). B The prover confirms that the second blockchain transaction Tx is included on the second blockchain, accesses the second data by providing the signature and the above value that is the function circuit input of the function circuit output, and thus enables the verifier to observe the above value that is the function circuit input for determining the function circuit output and access the first data by providing a signature using the secret key of (P of s + s from the homomorphism of elliptic curve point multiplication). B P of s + s C and access the first data by providing a signature using the secret key.

[0070] The data to be exchanged can be cryptocurrency, where the first data corresponds to the amount of a first cryptocurrency, preferably Bitcoin, and the second data corresponds to the amount of a second cryptocurrency, preferably Litecoin.

[0071] As described above, all actions by the prover require the reverse action by the verifier to verify the proof. The present invention extends to methods or actions performed by the verifier. Accordingly, a computer-implemented method is provided for enabling a zero-knowledge proof or verification of a statement in which the prover proves to the verifier that the statement is true, preferably explicitly, while keeping the evidence against the statement secret, the method comprising the verifier receiving from the prover a statement having an arithmetic circuit having m gates and n wires configured to implement a function circuit, preferably a hash function, to determine whether a function circuit input or preimage to the function circuit is equal to an elliptic curve point multiplier for a given function circuit, and preferably a specified function circuit output and elliptic curve point. The verifier also receives individual wire commitments and / or batched commitments, which are encrypted wire inputs and outputs, for the wires of the circuit, inputs or key openings to the wires in the arithmetic circuit (preferably wires other than the first wire), and the function circuit output (h). The verifier may also receive the elliptic curve used in the statement or the specification of each elliptic curve. The verifier can send a challenge value to the prover and then receive an opening. The opening can follow the Σ protocol and may include values ​​for each gate of a circuit that allows the verifier to determine that the statement is true and compute the elliptic curve point. In addition, or alternatively, the verifier may receive a proof key from the prover.

[0072] The verifier then determines that the circuit is satisfied, calculates the elliptic curve point (P), and therefore determines that the prover has evidence (w) for the statement.

[0073] This can be achieved by proving with zero knowledge that the prover knows the values ​​for each gate of the statement circuit, using the sigma protocol if the proof is interactive, or using the proof key if the Fiat-Shamir heuristic is used. The verifier can receive Σ_zero and Σ_prod commitments for each gate from the prover, respond with challenge values, receive opening values ​​from the prover, and match them with the commitments. The verifier can verify that the circuit is satisfied by computing the public key for wire l via elliptic curve point subtraction. The verifier can verify that each public key for each wire matches one or more keys specified in the statement. The verifier can complete the verification by determining that the fully open wires match the configurable values ​​in the statement.

[0074] It is also desirable to provide a computer-readable storage medium having computer-executable instructions, wherein the processor is configured such that, when the computer-executable instructions are executed, they are executed by a demonstrator, a verifier, or by a demonstrator and a verifier working together.

[0075] It is also desirable to provide an electronic device having an interface device, one or more processors coupled to the interface device, and memory coupled to the one or more processors, wherein the memory stores computer executable instructions, and the one or more processors are configured to perform the claimed method when the computer executable instructions are executed. It is also desirable to provide a node of a blockchain network configured to perform the claimed method. It is also desirable to provide a blockchain network having such nodes. [Brief explanation of the drawing]

[0076] Aspects of the present invention will be revealed by reference to the embodiments described herein. Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings, including, merely as examples. [Figure 1] Figures 1(a) and 1(b) are the diagrams used when describing the basic system for interactive zero-knowledge proofs in the technical background section. Figure 1(a) is a schematic diagram of a multiplication gate having left and right wire inputs and one wire output, and Figure 1(b) is a schematic diagram of an arithmetic circuit having three gates, three input wires, one output wire, and two internal wires. [Figure 2] This is a schematic diagram of a compound circuit for statements, including arithmetic circuits for hash functions and elliptic curve multiplication. [Figure 3] This is an alternative schematic diagram of the arithmetic circuit for the compound statement in Figure 1, which requires only one arithmetic circuit. [Figure 4] This is a schematic diagram of an arithmetic circuit with four gates and five wires, where each wire has its own public key, and that public key has its own public key that is revealed or opened from the wire commitment with a key opening value. [Figure 5] This is a schematic representation of the data exchanged between the prover and the verifier for the proof of Statement S, which has a circuit description and whose first wire corresponds to a public key. [Figure 6] This is another schematic representation of the data exchanged between the prover and the verifier. [Figure 7] This is a schematic diagram of the checks performed by a verifier to verify that the circuit in Figure 4 is satisfied, that the input wire has the required public key, and that the hash of the output wire has the required value. [Modes for carrying out the invention]

[0077] Overview This invention enables efficient zero-knowledge verification of compound statements that simultaneously require both arithmetic circuit satisfiability and dependent statements (key statement proofs) concerning the validity of the public key. The public-key elliptic curve specification is employed within an isomorphic commitment function to prove circuit satisfiability. This allows for the efficient proof of the public-key statement corresponding to the private key used as the circuit input and / or output.

[0078] The proof size and computational cost of generating proofs for statements containing both circuit satisfiability and elliptic curve key pairs can be significantly reduced. The method presented here can be readily incorporated into existing discrete log-based zero-knowledge proof protocols for circuit satisfiability, which do not require the use of bilinear pairing-friendly elliptic curves. The method is fully compliant with the Bitcoin secp256k1 standard.

[0079] Two applications are described that relate to fair exchange transactions between two parties on a blockchain, such as the Bitcoin blockchain. The first involves zero-knowledge ancillary payments for trustless sales of outsourced vanity addresses, which requires a zero-knowledge proof that the SHA256 hash preimage and the elliptic curve (e.g., Bitcoin) private key are equal. The second involves improving the security of cross-chain atomic swaps, which requires a proof that the SHA256 hash preimage is equal to an unknown private key (with a provided public key) multiplied by a provided nonce.

[0080] General Solutions This invention relates to a method for enabling the proof of a particular class of compound statements, including relationships with elliptic curve public / private key pairs (based on elliptic curve point multiplication).

[0081] It is considered impractical to use zkSNARK to prove statements involving arbitrary cryptographic elliptic curve key operations; therefore, this method uses information about elliptic curve public keys extracted directly from "homomorphic hiding" (or commitment schemes) used to construct proofs for general circuit satisfiability. The specific types of elliptic curves involved in the statements of this method are the same as those used in circuit commitment schemes.

[0082] However, the SNARK method requires a pairing operation, and therefore a special bilinear pairing-friendly elliptic curve. This makes the use of zk-SNARK impossible because the elliptic curves used on some blockchains are incompatible with bilinear pairing-friendly elliptic curves.

[0083] For example, statements related to Bitcoin public keys use the incompatible Bitcoin secp256k1 curve.

[0084] Therefore, the method of the present invention is compatible with other protocols for proving arithmetic circuit satisfiability that have fewer cryptographic assumptions and do not rely on pairing. Overall, the method of the present invention is more efficient than zkSNARKS because it requires less computation and has a smaller proof size for trustless exchange applications.

[0085] As an example, the schematic diagram in Figure 2, which represents the composite circuit for “Statement 1” described later, includes sub-circuits for both hash functions and elliptic curve multiplication. In Figure 2, the schematic diagram has three inputs: a private key 's', its corresponding public key 'P', and a value 'h' (which is the hash of the private key 's'). This schematic diagram includes two arithmetic circuits: the first performs a hash on the private key, and the second performs elliptic curve multiplication (EC mult) on the private key. The outputs of these circuits are compared with the inputs.

[0086] Note that these internal gates are for illustrative purposes only. This circuit verifies that the hash output is equal to the elliptic curve (EC) public key. Only the inputs 'h' and 'P', and the output are fully revealed to the verifier. All other values ​​are encrypted.

[0087] Statement 1 "Given the output h of a hash function (H) and an elliptic curve point P (public key), the preimage of the hash s (i.e., h = H(s)) is equal to the elliptic curve point multiplier (private key, i.e., P = s × G, where G is an elliptic curve generating point)."

[0088] This method allows a prover to prove a particular statement with zero knowledge. Examples of applications that would benefit from such a method are discussed later regarding trustless data exchange (e.g., the sale of outsourced Bitcoin vanity addresses) and anonymized, secure cross-chain atomic swaps.

[0089] The validity of statement 1 can be determined, for example, using the following pseudocode function, which takes inputs 'h', 'P', and 's' and outputs '1' if the statement is true, and '0' otherwise: int verify(h,P,s) { if(h == H(s) && P == sx G) { return 1 } else { return 0 } }

[0090] Verifying 'Statement 1' with zero knowledge, that is, verifying it in a zkSNARK system while keeping the value of 's' secret from the verifier, would require arithmetic circuits for both the hash function and elliptic curve point multiplication, as shown in Figure 2.

[0091] While arithmetic circuits for the SHA-256 hash function are widely used and optimized, typically containing fewer than 30,000 multiplication gates, no examples of arithmetic circuits for cryptographic elliptic curve point multiplication implementations are known in the literature. Even if such circuits were known, they would likely be impractical due to their size and complexity, and would contain many more gates.

[0092] The method works with a complete arithmetic circuit for a single hash function, as shown in Figure 2, which has a schematic diagram of an arithmetic circuit for a key statement proof and a compound statement 1 that uses only one arithmetic circuit for the hash function. This circuit verifies that the hash output is correct and that the public key is equal to the encrypted input of EC (key statement proof). The values ​​highlighted in blue, namely input 'h', 'P' and output '1', are revealed to the verifier, while all other values ​​are encrypted.

[0093] Using the circuit in Figure 3, the prover can explicitly prove, via circuit satisfiability, that the hash of the private key 's' is 'h', and that, with G being an elliptic curve generator point, the corresponding public key 'P' of the key pair is equal to 's × G'. The private key 's' is the hash preimage or input to a function and is not revealed to the verifier when proving the statement.

[0094] Needless to say, verifying that 's × G' is equal to 'P' can be extracted from circuit proofs with negligible additional computational cost by using the elliptic curve required in the commitment scheme as part of the proof protocol. Such an operation is called a 'key-statement proof' and uses a commitment open procedure called a 'key-opening'.

[0095] Technical effects The known zk-SNARK (Zero-knowledge Succinct Non-interactive Arguments of Knowledge) is an implementation of a general proof system for arithmetic circuit satisfiability. In the SNARK framework, a statement encoded as an arithmetic circuit is transformed into a structure called a Quadratic Arithmetic Program (QAP), which consists of a set of polynomials. The statement can then be proven by demonstrating the validity of this set of expressions at a single point. The main advantages of the SNARK method are that the verifier only needs to perform a few elliptic curve (pairing) operations (taking a few milliseconds), the proof is very small (288 bytes), and it is independent of circuit size.

[0096] The extremely small proof and verification times achieved by the SNARK method come at the cost of a trustworthy setup, non-standard cryptographic assumptions, and a much heavier computational burden on the prover. The SNARK method also requires the use of elliptic curve bilinear pairings. However, the use of computationally feasible bilinear pairings requires the use of special 'pairing-friendly' elliptic curves. This eliminates the use of many standard cryptographic elliptic curve parameter sets, including Bitcoin's secp256k1. Consequently, statements involving general elliptic curve point multiplication must use explicit circuits (which can be very large).

[0097] In comparison to the Σ protocol approach for proving the satisfiability of SHA circuits, as explained in the previous section, using the SNARK (Pinocchio) framework requires approximately 10 seconds to generate a proof key, resulting in a size of approximately 7MB, and also requires approximately 10 seconds to generate a proof. However, the proof size is 288B, and verification takes only about 5ms (Non-Patent Literature 8).

[0098] Furthermore, incorporating explicit elliptic curve multiplication (key statements) into the circuit will multiply both the proof key size and proof generation time by at least one order of magnitude.

[0099] This invention enables zero-knowledge proofs of statements involving elliptic curve public-key-private-key relations, simultaneously with general arithmetic circuit satisfiability. This is achieved with a computational cost negligible beyond the scope of proving arithmetic circuit satisfiability, eliminating the need to construct explicit arithmetic circuits for elliptic curve point multiplication operations, which would significantly increase the computational cost of the proof.

[0100] implementation The following describes implementations of the present invention in both batch-based and non-batch-based commitment-based zero-knowledge proof systems.

[0101] In these examples, a zero-knowledge proof protocol involves two parties: a prover (P) and a verifier (V). The purpose of this protocol is for the prover to convince the verifier that a given statement (S) is true, while keeping the information about the evidence for that statement secret. The statement is an arithmetic circuit (C) having m gates and n wires, and an elliptic curve public key: pk corresponding to one (or more) of the circuit wire values. l It consists of a dependent assertion about the key statement, where the subscript 'l' is the wire index of the key statement. Furthermore, the statement may also include assertions about fully open (public) wire values ​​(i.e., public inputs / outputs of the circuit).

[0102] The elliptic curve public keys (one or more) specified in the statement correspond to the target elliptic curve specification (which is defined by the entire set of elliptic curve parameters: T=(p,a,b,G,n,h)).

[0103] In the case of Bitcoin scripts, these parameters are defined by the specification of secp256k1 (Non-Patent Document 9). This usage includes a base generation point G. In addition to specifying the base point, the statement must also specify a second point F (where F = f × G, and f is Z). p (It is an element of ). Allowing the prover to freely choose f would allow the prover to generate a false proof, so the value of f must be proofwise random (e.g., the Bitcoin genesis block hash) or a "nothing up my sleeve" number, such as the first 256 bits of the binary representation of pi.

[0104] Batched and unbatched commitments are explained in relation to Figure 4, a typical arithmetic circuit having four gates and five wires. The input wire (w1) has its public key which is revealed or opened from wire commitment W1 having the 'key opening' value ko1.

[0105] Implementation - Individual wire commitments Using Figure 4 as an example, a 'key opening' is an individual commitment to each wire in the circuit, created by the prover and sent to the verifier. These key openings follow a known Σ protocol for arithmetic circuit satisfiability. Figure 5 shows the data exchanged between the prover and the verifier.

[0106] Satisfaction can be achieved by including several steps, as follows: 1. Each wire i (i=1,…,n) in the circuit is committed using Pedersen commitment: W i =Com(w i ,r i ) Here, Com(w,r) ​​= w × G + r × F 2. For circuit wire l that requires illumination of its corresponding public key (key statement proof), the prover also makes a key opening: ko l =r l ×F and also sends it. 3. Optionally, if circuit wire j requires to be publicly revealed (fully disclosed wire), the prover makes a complete opening tuple: (w j ,r j ) and sends it. 4. Then, using the Σ protocol, it is proven in zero knowledge that each gate of the circuit is satisfied, which involves the prover calculating and sending Σ zero and Σ prod commitments (i.e., B or C1, C2, C3 respectively), the verifier responding with a challenge value (x), then the prover sending opening values (z and e values), and the verifier checking against the commitments. 5. When the verifier confirms that the circuit is satisfied, the verifier then calculates the public key for wire l via elliptic curve point subtraction: pk l =Com(w l ,r l ) - ko l 6. And the verifier completes the verification by checking that each pk l matches the (one or more) keys specified in the statement (and that the fully opened wire matches the specified value).

[0107] Detailed implementation - individual wire commitments Continuing to refer to Figure 4, an explicit example is provided that details the individual commitments and verification for this example. This describes verifying the satisfiability of a simple arithmetic circuit with both a key statement proof for one of the wires and a complete disclosure for another wire.

[0108] ​ The circuit C shown in Figure 4 has five wires w i (i=1,…,5) and four gates g j It has (j=1,...,4). Gates 1 and 3 are addition gates, and gates 2 and 4 are multiplication gates.

[0109] The prover and verifier agree on a statement containing the circuit, the value of wire 5, and the public key of wire 1, along with the elliptic curve and commitment specification. The statement (S) that the prover wants the verifier to prove to be true is: "I have a satisfaction assignment to circuit C (i.e., a wire value {w} that satisfies all gates i} i=1 5 Wire 1 has the public key P (i.e., P = w1 × G), and Wire 5 has the value h (i.e., w n " = h) has" That is the case.

[0110] The values ​​of wires 1 through 4 are not revealed. Then, as shown in Figure 6 and as described below, the prover and verifier interact: 1. The prover generates five random blinding values ​​(r1, ..., r5), then calculates five wire commitments (W1, ..., W5), and sends them to the prover. 2. The prover calculates the key opening for wire 1: ko1 = r1 × F and sends it to the verifier. 3. The certifier sends the complete opening information (w5,r5) for wire 5 to the certifier. 4. For addition gates (g1 and g3), the prover can use a random nonce r B1 and r B3 (Using) Commitment to zero: B1=Com(0,r B1 ) and B3=Com(0,r B3 ) generate and send them to the verifier. 5. For multiplication gates (g2 and g4), the prover generates a commitment as follows: Regarding Gate 2: C 12 =Com( t 12 ,t 32 ) C2=Com(t 22 ,t 52 ) and C3=t 12 ×W1+t 42 ×F Regarding Gate 4: C 14 =Com( t 14 ,t 34 ) C2=Com(t 24 ,t 54 ) and C3=t 14 ×W3+t 44 ×F A commitment is generated as shown, and here, t xx The values ​​are random blinding nonces. The prover sends these commitments to the verifier. 6. The verifier then generates a random challenge value x and sends it to the prover. Alternatively, the verifier may generate value x by hashing the concatenation of all commitments using the Fiat-Shamir heuristic. 7. Regarding the addition gates (g1 and g3), the prover makes the following opening: z1 = x(r1 + r1 - r2) + r B1 z3 = x(r2 + r1 - r4) + r B3 Calculate them and send them to the verifier. 8. Regarding the multiplication gates (g2 and g4), the prover gives the following opening: e 12 = w1x + t 12 e 22 =w2x+t 22 z 12 =r1x+t 32 z 22 =r²x+t 52 z 32 =(r³-w1r²)x+t 42 e 14 = w3x + t 14 e 24 = w4x + t 24 z 14 =r³x+t 34 z 24 =r4x+t 54 z 34 =(r5-w3r4)x+t 44 Calculate them and send them to the verifier. 9. Finally, the verifier checks for equivalence. If these are passed, the proof is verified.

[0111] The verification performed by the verifier is summarized in Figure 7, and the checks inside the box verify that the circuit is complete, that the first wire has the required public key, and that the fifth wire has the required value.

[0112] The challenge 'x' in Figures 5 and 6 provides an interactive proof, with communication taking place back and forth between the prover and the verifier.

[0113] This interaction can be inconvenient when zero-knowledge contingent payment (ZKCP) is being made, as the seller and buyer may not be able to communicate simultaneously or may not be online. Furthermore, the buyer (verifier) ​​may want the proof to be publicly verifiable, for example, as part of an advertisement for a digital product.

[0114] Furthermore, the proof is strictly zero-knowledge only in the perfect special-honest verifier model, that is, only when it is assumed that the verifier generates true random numbers as a challenge, and does not select a challenge value to test and extract information about the evidence.

[0115] To solve these problems, the Fiat-Shamir heuristic is applied, which replaces the random challenge value 'x' with the output of the hash of the commitment created by the prover. In the random oracle model (where the output of the cryptographic hash function is considered truly random), the prover cannot cheat, and the verifier can inspect the generated challenge value.

[0116] Therefore, this example can be improved by using the Fiat-Shamir heuristic to convert the interactive proof system into a non-interactive one, and the prover can generate a proof that can be verified offline, independently, and publicly.

[0117] More specifically, the challenge value (x) is replaced by a value calculated by hashing (for example, with SHA-256) the concatenation of all the commitments generated by the prover (i.e., all wire commitments and all B and C1, C2, C3 commitments for each of the sum and product gates).

[0118] Implementation - Batched Vector Commitment A compressed proof system for circuit satisfiability involving the batching of vector commitments (Non-Patent Document 8, Non-Patent Document 6) uses the method described below, which enables the extraction of key statement proofs from batched circuit wire commitments.

[0119] To avoid repetition, the complete process will not be described, and the following steps focus on illustrating the generation of a batched wire commitment and that it contains a specified public key. In the following steps, assuming that wire l is given a key opening and n wires are batched together in a vector commitment, the batched commitment is generated as follows: 1. The prover has n-1 random numbers x1, ..., x n-1 ←Z p Generates. 2. The prover, elliptic curve point K i =x i Calculate ×G (for i=1,…,n-1). Apply K to these values. n The sum of =G forms the proof key PrK that is sent to the verifier. 3. The prover, random value: r ← Z p Generates. 4. w n Assuming that the key is opened, the prover states that the wire value w i Commitment to the vector w (for i=1,…,n):

number

number

number

[0120] Invention Summary Proof of equivalence between hash preimages and elliptic curve secret keys can be used in numerous applications. Below, we describe two applications that outline the construction of concrete examples of key statement zero-knowledge proofs for use.

[0121] The following statement S is a more specific version of statement 1 above, for the purpose of providing an example of application: S: "Given a SHA-256 hash function (H) with public output h and a public point P on the secp256k1 elliptic curve, the secret preimage s of the hash (i.e., h = H(s)) is equal to the elliptic curve point multiplier (i.e., the corresponding secret key, i.e., P = s × G)."

[0122] In the provided example, this statement asserts that the input wire (w1) is the secret key of public point P, and that the output wire (wn) is equal to h, along with the SHA-256 hash function C. SHA256 (n wires w i It consists of a single arithmetic circuit relating (i=1,…,n) and m gates, that is,

number

[0123] Therefore, in order to fully verify this statement, the prover demonstrates to the verifier that they know the satisfaction assignment to the SHA256 circuit using a secp256k1-based commitment scheme, and that they know the key opening (ko1) for wire 1 and the full opening (w) for wire n. n ,r n The verifier must simply provide the value of the input wire (w1), i.e., the output wire w is left completely open. n You are not given the values ​​of any of the other wires except for this one.

[0124] Application I The examples of the present invention described in the implementation section above can be applied to ZKCP relating to outsourced Bitcoin vanity addresses that represent data exchanged for payment or access to resources.

[0125] Bitcoin addresses are encoded in a human-readable alphanumeric format (Base58 encoding) to make them easy to publish, copy, and transcribe. The use of this format has led to the popularity of so-called vanity addresses, such as those shown below: [Outside 1] The key space is brute-forced to find a secret key that produces an address containing a desired string (like a name), such as TIFF2026136298000010.tif25170.

[0126] Deriving vanity addresses with significant patterns is computationally expensive (for example, the addresses shown above take approximately 10 minutes to find a match). 13 Since it required the generation of individual different public keys, outsourcing the search is common, and there are several online marketplaces where vanity addresses are sold on consignment. This can be done securely using the isomorphism of elliptic curve point multiplication (Non-Patent Literature 7).

[0127] Outsourcing the generation process is secure, but selling vanity addresses is unreliable. The buyer may receive the required value before the seller receives payment, or the seller may receive payment before providing the required value, or both parties may have to rely on a third-party deposit service. This invention can be used to enable trustless sales of vanity addresses via ZKCP. The steps taken between the buyer / verifier and the seller / certifier are described below. 1. The buyer and seller agree on the necessary vanity pattern (Str) and price (a Bitcoin), and establish a communication channel that does not need to be secure. 2. The buyer generates a secure random private key skB and a corresponding elliptic curve public key, and the public key pk B =sk B It is ×G. 3. Buyer gives seller a PK B Send. 4. Next, the seller changes i to pk=pk B The system searches for the required pattern in the Base58 encoded address derived from +i × G. 5. If an address with the required pattern is found, the seller saves i and signals to the buyer, pk s Send =i × G and the SHA256 hash H(i). 6. The seller also states that the preimage for H(i) is pk s The buyer is provided with proof that it is the corresponding private key. 7. The buyer verifies the proof, and also pk=pk B +pk s Verify that the corresponding address matches the agreed pattern. At this point (through proof), the buyer, by being told the value i, obtains the complete private key (sk) related to the vanity address. B It becomes possible to derive (+i), and we learn that a specific value i hashes to h=H(i). 8. The buyer then constructs a hash-time lock contract (HTLC) transaction Tx1, which includes an output containing the agreed-upon fee (a). This output can be unlocked in two ways, namely: i. At any time, using the seller's signature and hash preimage i, ii. For example, using the CHECKLOCKTIMEVERIFY (OP_CLTV) script opcode, which can be used to prevent the output from being consumed up to a specified time or block height, after a specified time with a signature from the buyer, It can be unlocked. 9. Next, the buyer signs this transaction and broadcasts it to the blockchain, where it is mined into a block. 10. Once confirmed, the seller can charge a fee on the output of Tx1 by providing transaction Tx2, which supplies their signature and the value i to unlock the hash lock, and the value i is revealed on the blockchain. 11. The buyer will receive the final vanity address and private key sk=sk B +i can be calculated, and pk = sk × G. 12. If the buyer does not supply value i before the specified OP_CLTV time, the seller may re-charge the fee by providing a signature (to prevent the fee from being lost due to an uncooperative buyer).

[0128] The transaction is then completely atomic and trustless, with the buyer only receiving payment if they provide a valid value i, and this value i is publicly revealed on the blockchain. Due to the splitting of the private key, this value is not useful to anyone else and does not compromise the security of the complete private key.

[0129] Application II The examples of the present invention described in the implementation section above can be applied to private data exchange between two parties, each having data to be exchanged recorded on different blockchains.

[0130] More specifically, the present invention can be applied to privacy-protecting cross-chain atomic swaps, which are trustless, fair exchange protocols that leverage blockchain transaction mechanisms, also known as atomic trades. This protocol is used to trade two different cryptocurrency tokens on two different blockchains without using a third-party centralized exchange. In this context, the word 'atomic' refers to the fair nature of the exchange, where either both parties complete the transaction or neither completes it.

[0131] A known example of a basic protocol is performed according to the following steps. For security, both cryptocurrencies used in the swap must have scripting capabilities that enable hashed and time-locked contracts. Two parties, Alice and Bob, are involved in this swap. In this example, Alice holds 1 Bitcoin and has agreed to trade it for Bob's 100 Litecoins. 1. Alice sends Bob the Litecoin public key P. A Generates. 2. Bob sends Alice the Bitcoin public key P. B Generates. 3. Alice generates a secure random number x. 4. Alice calculates the SHA-256 hash of x: h=H(x). 5. Alice's Bitcoin transaction Tx A , in other words, i. Use a valid signature AND the value to hash h to P B Pay to ii. OR refund Alice 1 Bitcoin in 24 hours. Bitcoin transactions Tx A Create. 6. Alice broadcasts the transaction to the Bitcoin network. 7. Bob, on the Bitcoin blockchain, A Upon observation that this has been confirmed, the following Litecoin transaction Tx B , in other words, i. Use a valid signature AND the value to hash h to P A Pay to ii. OR refund Bob 100 Litecoins in 24 hours. Bitcoin transactions Tx B Create. 8. Bob broadcasts the transaction to the Litecoin network. 9. Once the transaction is confirmed, Alice can claim the Litecoin output by providing her signature and the value x. 10. Bob can claim a Bitcoin output by observing the value x on the Litecoin blockchain and providing his signature and the value x.

[0132] This example ensures that either both parties receive coins or neither receives any. Alice generates a hash value, and only she knows the preimage, but she is required to reveal this preimage in order to claim her coins, which allows Bob to claim his coins. If either party fails to follow the protocol toward completion, both can reclaim their coins after a lockout period.

[0133] One significant drawback of the known protocols mentioned above is that transactions on both blockchains are trivially linkable, and once confirmed, the eigenvalue x becomes permanently and publicly visible on both blockchains. This affects both the exchangeability of coins and the privacy of transactions.

[0134] To avoid linking the two transactions, different keys would have to be used for the output on each chain, but for the protocol to be secure and trustless, Bob would have to be given proof that Alice will tell him the information he needs to unlock his coins when she reveals her hash preimage.

[0135] By employing the key statement proof described in the example above, the hash-locked output on the second blockchain can be converted into a regular pay-to-public-key-hash (P2PKH) output, concealing the nature of the transaction and breaking any possible links.

[0136] Applying this to the above example where Alice owns 1 Bitcoin and has agreed to trade it for Bob's 100 Litecoins, the improved process would include the following actions: 2. Alice sends Bob the Litecoin public key P. A (private keys) A To generate ( ). 3. Bob sends Alice the Bitcoin public key P. B (private keys) B (to generate) 4. Alice uses a secure random number x ← Z p Generates. 5. Alice obtains the SHA-256 hash of x: h=H(x) and the elliptic curve public key corresponding to x: P x Calculate = x × G 6. Alice, h and P x Securely send both to Bob. 7. Alice also said that the preimage of h is P x Send Bob a key statement proof that it is equal to the private key you generated. 8. Alice's Bitcoin transaction Tx A , in other words, i. 1 Bitcoin public key P C =P B +P x Pay to ii. OR refund Alice 1 Bitcoin in 24 hours. Bitcoin transactions Tx A Create. 9. Alice broadcasts the transaction to the Bitcoin network. 10. When Bob observes that Tx on the Bitcoin blockchain has been confirmed, he creates a Litecoin transaction Tx, which is as follows: A i. Pay 100 Litecoins to P using a valid signature AND a value that is SHA-256 hashed to h, B ii. OR pay back 100 Litecoins to Bob after 24 hours. That is, A B 11. Bob broadcasts the transaction to the Litecoin network. 12. When the transaction is confirmed, Alice can claim the Litecoin output by providing her signature and the value x. 13. When Bob observes the value x on the Litecoin blockchain, he can claim the Bitcoin output by providing a signature using the private key of P which is s + x from the homomorphism of elliptic curve point multiplication. B C

[0137] General Use The present invention is suitable for zero-knowledge proof or verification of a statement (S) where a prover proves to a verifier that a statement is true while keeping the evidence (w) for the statement secret. The secret can be processed by a function such as a hash function, and can further include cryptographic elliptic curve key operations such as the validity of a statement regarding a public key. In the above example, the method of the present invention is used to enable trustless ZKCP regarding vanity addresses. This can also be applied to, for example, password derivation, verification of a valid machine-readable document such as a passport or identity certificate, or other such confidential transactions.

[0138] ​​​​​​The embodiments described above are illustrative and not limiting to the present invention, and those skilled in the art can design numerous alternative embodiments without departing from the scope of the present invention as defined by the appended claims.

[0139] In the claims, no symbols enclosed in parentheses should be construed as limiting the claims. The terms “having” and “having” and similar terms do not exclude the existence of elements or steps other than those enumerated in any claim or the entire specification. In this specification, “having” means “including or consisting of,” and “having” means “including or consisting of.”

[0140] A singular reference to an element does not preclude a plural reference to that element, and vice versa. The present invention can be implemented by hardware having several distinct elements, and by a appropriately programmed computer.

[0141] In a device claim listing several means, some of those means may be embodied by the same hardware item. The mere fact that certain means are described in different dependent claims does not imply that a combination of those means cannot be used advantageously.

Claims

1. A computer-implemented method wherein the certifying computer communicates to the verifying computer: A statement (S) is represented by an arithmetic circuit having m gates and n wires configured to implement a function circuit and determine whether the function circuit input (s) to the wires of the function circuit is equal to the corresponding elliptic curve point multiplier (s) for a given function circuit output (h) and elliptic curve point (P), Individual wire commitments and / or batched commitments for the wires of the circuit, The output of the function circuit (h), Proof Key (PrK), Includes the step of sending, This enables the verifier computer to determine that the circuit is satisfied, calculate the elliptic curve point (P), and verify the statement, and thus determine that the verifier computer holds evidence (w) for the statement. A computer-implemented method.

2. The computer-implemented method according to claim 1, wherein the certifying computer transmits individual wire commitments to certify knowledge of the evidence (w) and communicates with the certifying computer using the Σ protocol.

3. The computer-implemented method according to claim 1 or 2, wherein the certifying computer receives a challenge value (x) from the verifying computer and responds with an opening.

4. The computer-implemented method according to claim 1 or 2, wherein the certifying computer transmits a random value (x) to the verifying computer that enables the verifying computer to verify the statement and calculate the elliptic curve point (P).

5. The computer-implemented method according to claim 4, wherein the random value (x) is a function of at least one commitment.

6. The computer-implemented method according to claim 4 or 5, wherein the random value (x) is calculated by hashing the concatenation of all the commitments generated by the prover computer and transmitted to the verifier computer.

7. The aforementioned commitment W ｉ is, W ｉ =Com(w ｉ ,r ｉ ) and Com is a commitment to the aforementioned function circuit, lol ｉ This is the wire value, r ｉ This is a different random number for each wire commitment. i is the wire type, Com(w,r) ​​= w × G + r × F, F and G are points on an elliptic curve. The computer-implemented method according to any one of claims 1 to 6.

8. The input to wire l in the arithmetic circuit is ko = r ｌ ×F, ko is a key opening input, r ｌ It is a random number, F is a point on an elliptic curve. The computer-implemented method according to claim 7.

9. The verifier computer confirms that the circuit is satisfied and performs elliptic curve point subtraction: pk ｌ =Com( / ) ｌ ,r ｌ )-か ｌ The computer-implemented method according to claim 8, which can compute a public key for wire l via the method.

10. The computer-implemented method according to claim 1, wherein the certifier computer transmits a batch of wire commitments and generates random numbers for calculating elliptic curve points for each wire to form the certifier key (PrK).

11. The commitment made to the aforementioned batch with respect to the aforementioned evidence is, [Math 1] And, r is a random number generated by the proofer computer, The aforementioned certifier computer has a wire value w ｉ Calculate the commitment to the vector w for (for i = 1, ..., n), and w ｎ This is something that will be opened by key, K ｉ These are the calculated elliptic curve points, lol ｉ This is the wire value, F is a point on an elliptic curve. The computer-implemented method according to claim 10.

12. The input to wire n in the arithmetic circuit is, [Math 2] And, ko ｎ This is a key opening input, r is a random number, F is a point on an elliptic curve. The computer-implemented method according to claim 11.

13. The aforementioned verifier computer performs elliptic curve calculations: [Math 3] A computer-implemented method according to claim 12, comprising computing the public key opening of a key statement wire via

14. The computer-implemented method according to any one of claims 1 to 13, wherein the certifying computer further sends a fully open commitment to at least one wire.

15. The computer-implemented method according to any one of claims 1 to 14, wherein the method uses a Pedersen commitment.

16. The computer-implemented method according to any one of claims 1 to 15, wherein the statement uses only one arithmetic circuit for the function circuit.

17. The computer-implemented method according to any one of claims 1 to 16, wherein the function circuit implements a hash function which is preferably a SHA-256 hash function.

18. This method is used by the certifier computer to enable zero-knowledge associated transactions with data such as cryptographic keys. The certifying computer cooperates with the verifying computer to verify the data provided and the data received, and establishes a communication channel with the verifying computer. The prover computer receives the elliptic curve public key pk generated by the verifyer computer from the secure random private key skB. Ｂ Received pk Ｖ =sk Ｖ ×G, and G is a point on an elliptic curve. The aforementioned certifier computer has data = pk Ｖ The provided data is protected by a lock value i such that it is +i × G. The aforementioned certifier computer is pk Ｐ The public keys, which are equal to i × G, and the output f(i) from the function circuit, whose input is the lock value i, are sent to the verifier computer. The certifier computer determines that the input to the function circuit is pk Ｐ A statement (S) proof that it is the corresponding private key is sent to the verifier computer, The verifier computer verifies the proof, and pk = pk Ｖ +pk Ｐ By confirming that the corresponding address matches the agreed pattern, the lock value i can be known, and the data (sk Ｂ This enables the derivation of the complete secret key related to +i) and the identification of the lock value i as the input to the function circuit, The certifier computer receives a transaction Tx from the verifier computer, which includes an output containing the received data, accessible by the signature from the certifier computer and the input to the function circuit. １ signal, The certifier computer signs the transaction and broadcasts it on the blockchain, which is then mined into a block, supplying a signature and value i for unlocking the transaction to a second transaction Tx. ２ By providing the transaction Tx １ The output allows the certifier computer to access the data, and the transaction is revealed on the blockchain. Thus, the verifier computer identifies the lock value i and enables it to access the data provided by the certifier computer. sk = sk Ｂ +i, pk = sk × G The computer-implemented method according to any one of claims 1 to 17.

19. The computer-implemented method according to claim 18, wherein the data provided by the certifier computer includes a vanity address.

20. The computer-implemented method according to claim 18, wherein the data received from the verifier computer includes a cryptocurrency payment.

21. The certifying computer performs a trustless and fair data exchange with the verifying computer. The certifying computer has access to the first data on the first blockchain, the validating computer has access to the second data on the second blockchain, the certifying computer and the validating computer agree to exchange the data, and the method is The proofer computer generates a key pair for the second blockchain and the public key (P Ａ ) is sent to the verifier's computer, and the secret key (s Ａ ) hold, The certifier computer obtains the certifier's public key (P) for the first blockchain. Ｂ The verifier computer receives the ) and generates a key pair for the first blockchain to create a private key (s Ｂ ) holds, The aforementioned certifier computer receives a statement (S), one or more commitments, and input (P ｘ ) and the function circuit output (h), and the elliptic curve specification are transmitted. The certifier computer then accesses the first data to a common public key address (P ｃ The first blockchain transaction Tx to send to Ａ Create and broadcast the transaction on the first blockchain network, and the address is the input (P ｘ ) and the verifier's computer public key (P ｃ Determined by the sum of ) and P Ｃ = P Ｂ +P ｘ And, The aforementioned certifier computer processes the second blockchain transaction Tx Ｂ The transaction is verified, and the transaction is recorded in the first blockchain as the first blockchain transaction Tx Ａ After confirming that it contains the verifier computer, the transaction is created by the verifier computer and broadcast on the second blockchain network, and the second data is sent to the verifier computer's public key address (P Ａ ) to the certifier computer's public key address (P Ａ )teeth, The certifier's computer public key address (P Ａ ) valid signatures, The value that determines the function circuit output (h) is the function circuit input preimage. It is accessible by the certifier's computer using the above method, The certifier computer determines the second blockchain transaction Tx Ｂ The second data is accessed by confirming that it is included on the second blockchain, and by providing a signature and the value which is the input to the function circuit of the function circuit output (h), Thus, the verifier computer observes the value which is the input to the function circuit that determines the output (h) of the function circuit, and from the isomorphism of the elliptic curve point multiplication, s Ｂ P is +s Ｃ By providing a signature using the private key, it becomes possible to access the first data. A computer-implemented method according to any one of claims 1 to 17, including the following:

22. The computer-implemented method according to claim 21, wherein the data to be exchanged is a cryptocurrency, the first data corresponds to an amount of a first cryptocurrency which is preferably Bitcoin, and the second data corresponds to an amount of a second cryptocurrency which is preferably Litecoin.

23. A computer-readable storage medium having computer-executable instructions, wherein the computer-executable instructions, when executed, configure a processor to perform the method described in any one of claims 1 to 22.

24. Interface device and One or more processors coupled to the interface device, A memory connected to one or more processors, the memory storing computer executable instructions, and the one or more processors are configured to perform the method described in any one of claims 1 to 22 when the computer executable instructions are executed. Electronic devices for providing services.

25. A node in a blockchain network, configured to perform the method described in any one of claims 1 to 22.

26. A blockchain network having the nodes described in claim 25.

Images