A cryptographic method for proving that a vector is binary

Abstract

Some embodiments are directed to demonstrating by a prover to a verifier that a principal vector is a binary vector using a vector commitment scheme, which may include a principal commitment to the principal vector and may include generating a first proof that demonstrates that a further vector, the further vector including, in each component, the product of a randomized vector and the principal vector minus one, is orthogonal to the principal vector.

Description

[Technical Field]

[0001] The present invention relates to a cryptographic method for a prover to prove to a verifier that a principal vector is a binary vector, and to a cryptographic method, system, and computer storage medium for verifying a proof by a verifier. [Background technology]

[0002] A commitment scheme has a sender, e.g., a prover or committer, commit to a secret message that remains secret until the commitment is opened. In a non-interactive commitment, the commitment and opening phases may each involve a single message from the committer to the verifier. A commitment scheme has two properties called hiding and binding. The former means that the commitment string C does not disclose information about the committed message. The latter means that an attacker cannot compute a commitment that can be opened over two different messages.

[0003] An example of a commitment scheme is the Pedersen commitment.

number

number

number

number

number

number

number

number

number

[0004] Vector commitment is a method where a prover commits a vector m=(m1,…,m n )∈D nLater, the committer can succinctly disclose the individual coordinates of m. Here, "succinctly" means that the partial unsealing information, also called a proof, has a constant size, e.g., independent of the dimension of the committed vector, yet still convinces the verifier that the unsealed coordinates are valid. Similar to standard commitments, vector commitment schemes preferably satisfy the following two security properties: (i) the binding property, which asserts that no efficient attacker can generate a commitment that can be unsealed to two different values ​​at the same position i ∈ [n]; and (ii) the hiding property, which guarantees that disclosing a subset of the components does not reveal information about messages at undisclosed positions. Vector commitments allow for significant savings in terms of storage by storing only constant-size commitments to vectors instead of commitments to individual coordinates, and also allow for significant savings in terms of bandwidth by being able to provably unseal individual positions succinctly.

[0005] Other succinct vector commitments may be based on the RSA assumption, or on Diffie-Hellman-like assumptions in pairing-friendly groups.

[0006] One limitation of all known vector commitments with short proofs is that there is no efficient way to generate a short proof that the committed vector m is small, e.g., has elements that are within a given range, e.g., below and / or above a threshold, e.g., binary. One solution to this problem is to use concise non-interactive zero-knowledge proofs (SNARKs) that are generic to all NP languages. SNARKs can give proofs of constant size, but require the statement to be expressed as an arithmetic circuit, which computes the unsealing algorithm of the commitment scheme (and thus the group

number

[0007] [Non-Patent Document 1] Gorbunov et al., “Pointproofs: Aggregating Proofs for Multiple Vector Commitments.” [Non-patent document 2] E. Kachisa, E. Schaefer, and M. Scott, "Constructing Brezing-Weng pairing-friendly elliptic curves using elements in the cyclotomic field" [Non-patent document 3] D. Aranha, Y. El Housni, and A. Guillevic, “A survey of elliptic curves for proof systems” [Non-patent document 4] Y.El Housni and A.Guillevic, “Optimized and secure pairing friendly elliptic curves suitable for one layer proof composition” [Non-patent document 5] Steven D. Galbraith et al., “Pairings for cryptographers” [Non-patent document 6] B. Libert and M. Yung, “Concise Mercurial Vector Commitments and Independent Zero-Knowledge Sets with Short Proofs” [Non-Patent Document 7] B. Libert, S. Ramanna, and M. Yung, “Functional Commitment Schemes: From Polynomial Commitments to Pairing-Based Accumulators from Simple Assumptions” [Non-patent document 8] G. Fuchsbauer, E. Kiltz, and J. Loss, "The Algebraic Group Model and its Applications." [Non-Patent Document 9] Benedikt Buenz et al., "Bulletproofs: Short Proofs for Confidential Transactions and More" (see, e.g., section 1.2.1, which discusses Confidential Transactions) [Non-Patent Document 10] Vadim Lyubashevsky et al., “On Ideal Lattices and Learning with Errors Over Rings” [Non-Patent Document 11] Sergey Gorbunov et al., “Pointproofs: Aggregating Proofs for Multiple Vector Commitments” Summary of the Invention [Means for solving the problem]

[0008] It is desirable to provide an improved method for a prover to prove to a verifier that a principal vector is a binary vector. The accompanying claims describe a proof method, a verification method, a system, and a computer-readable medium. The dependent claims describe specific embodiments of the invention. In one embodiment, a commitment is calculated with respect to the principal vector. The prover can then prove binaryness by showing that the auxiliary vector is orthogonal to the principal vector, e.g., by showing that their dot product is zero. The auxiliary vector comprises the Hadamard product of the principal vector and a randomized vector. The proof can be verified with respect to the principal commitment and a first auxiliary commitment. The first auxiliary commitment may be calculated with respect to the auxiliary vector, but in the reverse order of the principal vector.

[0009] A second proof may be computed to show that the first auxiliary commitment was indeed computed in reverse order with respect to the Hadamard product of the primary vector and the randomized vector. The second proof may be obtained by aggregating the randomized unwrappings with respect to the vector elements with the primary commitment and the first auxiliary commitment.

[0010] An advantage of these embodiments is that the primary commitment, auxiliary commitment, first proof, and second proof each have a size that is independent of the dimension of the primary vector. In one embodiment, the proof of binaryness fits within 87 bytes for a suitable choice of elliptic curve, e.g., the KSS18 curve, while the complete proof of validity of the FHE ciphertext fits within 225 bytes using, e.g., the BLS12-446 curve.

[0011] In one embodiment, the primary commitment is computed by directly evaluating the commitment function of the vector commitment scheme on the primary vector. This is not strictly necessary; for example, a vector commitment scheme with additive homomorphism properties can be used to apply the commitment function to any linear combination of the primary vector and a vector known to the verifier. For example, the primary commitment can alternatively be computed by evaluating the commitment function on the sum of the primary vector and a vector known to the verifier. From the alternative commitment and the known vector, the verifier can derive the directly applied commitment mentioned above. However, it is typical to apply the commitment function to the primary vector itself.

[0012] Similarly, with regard to the auxiliary commitment, a commitment function can be applied to any linear combination of the auxiliary vector and a public vector, in particular the randomization vector. Two typical options are to apply the commitment function directly to the auxiliary vector, or to the auxiliary vector minus the randomization vector; in one embodiment, one of these two options is computed by the prover and shared with the verifier, who computes the other commitment itself.

[0013] For convenience, most of the embodiments detailed herein assume that the primary commitments are obtained by applying a commitment function to the primary vector, and the auxiliary commitments are obtained by applying a commitment function to the auxiliary vector, although other choices can be made in this regard.

[0014] Proofs and commitments can be expressed as group elements. A bilinear map can be defined between the first and second groups. The reverse order has the effect that when the bilinear map is applied to the corresponding commitments in the first and second groups, respectively, the dot product of two vectors is computed with the exponent. This can be applied to the primary commitment and the auxiliary commitment. This can be the auxiliary commitment computed by the prover or the second auxiliary commitment. The second auxiliary commitment can be computed from the first auxiliary commitment, for example, using the additive homomorphism property of the vector commitment scheme.

[0015] In one embodiment, the scheme for proving the binary nature of a vector is zero-knowledge and / or non-interactive.

[0016] Proving the binary nature of a vector can be applied in many contexts: for example, it may be used to prove that a committed number is less than a threshold, to prove the validity of a ring LWE ciphertext, or to prove that a vector x is ternary.

[0017] In one embodiment, a system, eg, a device, is configured for a verification and / or validation method.

[0018] An embodiment of the method may be implemented on a computer as a computer-implemented method, or in dedicated hardware, or a combination of both. Executable code for an embodiment of the method may be stored in a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium for performing an embodiment of the method when said program product is run on a computer.

[0019] In one embodiment, the computer program comprises computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.

[0020] Another aspect of the subject matter disclosed herein is a method of making a computer program available for download.

[0021] Further details, aspects and embodiments will now be described, by way of example only, with reference to the drawings, in which elements are illustrated for simplicity and clarity and are not necessarily drawn to scale, and in which elements corresponding to elements already described may have the same reference numerals. [Brief explanation of the drawings]

[0022] [Figure 1] FIG. 1 is a diagram illustrating an example of an embodiment of a demonstration system. [Figure 2] FIG. 1 is a diagram illustrating an example of an embodiment of an attestation system. [Figure 3] FIG. 1 is a diagram illustrating an example of an embodiment of a certification method. [Figure 4a] 1 is a diagram illustrating a computer-readable medium having a writable portion containing a computer program according to an embodiment; [Figure 4b] FIG. 1 is a schematic diagram illustrating a representation of a processor system according to one embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0023] List of Reference Numbers The following list of reference numbers and abbreviations corresponds to Figures 1, 2, 3, 4a, and 4b and is provided to facilitate interpretation of the drawings and shall not be construed as limiting the scope of the claims.

[0024] 100 Proof System 110 Certification Device 113 Processor System 114 Storage 115 Communication Interface 120 Verification Device 123 processor system 124 Storage 125 Communication Interface 200 Proof System 210 Principal Vector Source 211 Major Vector 212 Randomization Vectors 213 Randomization Vectors 219 Committed to Vector 220 Commitment Units 221 Main Commitment 222 First Subsidiary Commitment 230 Proof Units 231 Orthogonality Proof 232 Equivalence Proof 1000, 1001 Computer-readable medium 1010 Writable area 1020 Computer Program 1110 Integrated Circuits 1120 Processing Unit 1122 memory 1124 dedicated integrated circuits 1126 Communication Elements 1130 Interconnect 1140 Processor System

[0025] While the subject matter disclosed herein may take on embodiments in many different forms, one or more specific embodiments have been shown in the drawings and will be described in detail herein. It should be understood that the present disclosure is to be considered as an example of the principles of the subject matter disclosed herein, and is not intended to limit the subject matter to the specific embodiments shown and described.

[0026] In the following, for ease of understanding, elements of the embodiments are described in terms of their operation, but it will be apparent that each element is configured to perform the functions that are described as being performed by it.

[0027] Furthermore, the subject matter disclosed herein is not limited to the embodiments only, but also includes any other combination of features described herein or recited in mutually different dependent claims.

[0028] 1 illustrates an example of an embodiment of an attestation device 110 and an embodiment of a verification device 120. The attestation device 110 and the verification device 120 may be part of an attestation system 100.

[0029] The proving device 110 is configured to cryptographically prove to the verifying device that a vector is a binary vector using a vector commitment scheme. A vector commitment scheme includes at least one commitment function that receives a vector as input and produces a commitment as output. A vector commitment scheme may include multiple, e.g., two, commitment functions, each receiving a vector as input and producing a commitment as output, but the commitment values ​​are produced in different groups. For example, a first commitment function may produce a group element of a first group, and a second commitment function may generate a group element of a second group. A bilinear map may be defined between the first and second groups. A vector commitment scheme may have additional properties, e.g., an additive homomorphism property. This property allows a new commitment for the sum of a first vector and a second vector to be calculated from the second vector and the commitment to the first vector, without knowing the first vector. A commitment scheme allows a prover to prove an element (x i) can be partially unsealed. The verifier can verify that the proof proves that the committed vector has a value at that position.

[0030] The verification device 120 is configured to verify the cryptographic proof provided by the prover device, which is also called a prover. The verification device is also called a verifier.

[0031] One embodiment of the cryptographic method described herein is particularly advantageous because the size of the cryptographic proof does not depend on the dimension of the vector whose binary nature is being proven. This property is sometimes referred to as succinctness or simplicity, i.e., the proof is concise. Because the size of the proof does not depend on the vector dimension, the size per dimension decreases as the vector dimension increases. The vector can have any length, and by way of example, one embodiment can be applied to vectors of at least 10, 100, 1000, or 10,000 elements, e.g., bits.

[0032] While system 100 can be used standalone, there are many applications in which proving whether a vector is binary can be used as a fundamental tool. For example, many mathematical objects can be represented as vectors of bits, e.g., as sequences of bits. Properties of the mathematical object can then be verified by demonstrating properties of the vector, e.g., by disclosing one or more bits, by computing an inner product, e.g., a dot product, on the vector or a portion thereof and proving the result, or by performing other linear operations. For good security, the binary nature of the vector should also be proven. Otherwise, a prover could attempt to cheat by committing to a non-binary vector.

[0033] Two specific uses will be discussed in some detail, but many others are possible. For example, proving that a vector is binary can be used to prove that a certain number known to the prover is within a certain range, e.g., less than some upper bound. To do this, the number may be converted into a binary vector and then an appropriate linear operation may be performed on it, e.g., the most significant bit may be unsealed; once the verifier is convinced that the committed vector contains an l-bit representation of an integer x, they can prove that x is 2 l Know that it is smaller than

[0034] If a prover can commit to a non-binary vector, they can cheat and trick a verifier into believing that the prover's numerical value is smaller than a limit, when in fact it is not. Another application is in advanced cryptosystems such as multi-party computation and homomorphic encryption. In homomorphic encryption, homomorphic encryption allows complex mathematical operations to be performed on encrypted data without compromising the encryption. Encryption schemes that allow computations to be performed on encrypted data are known per se but suffer from several limitations. For example, a homomorphic encryption device can homomorphically encrypt data. A homomorphic computing device can perform algorithms, such as software programs or arithmetic procedures, on data without decrypting the data. Existing methods for homomorphic computing devices to verify whether received data is actually legitimately encrypted data have drawbacks; for example, SNARK proofs are very computationally expensive. Using one embodiment, data can be converted into a binary vector, which can then be used to prove the validity of homomorphically encrypted data. By using a non-interactive proof that the committed vector is binary, we can obtain a short proof to convince a homomorphic computing device that the ciphertext is well-formed.

[0035] Cryptographically demonstrating that a vector is a binary vector can involve various phases.

[0036] In the initialization phase, common parameters are shared between the prover device and the verifier device. Typically, cryptographic methods perform their calculations on various finite groups or rings rather than on natural numbers. In the initialization phase, shared parameters are established between the prover and the verifier. In non-interactive zero-knowledge proofs, a set of trusted public parameters is often generated by a trusted party and made available to the prover and verifier. Such shared parameters are sometimes called a common reference string (CRS) or public parameters. The shared parameters may be obtained, e.g., generated, by the trusted party and sent to the prover and verifier. The shared parameters may also be generated jointly by the prover and verifier, possibly with the involvement of the trusted party. Note that most embodiments use a trusted party. Preferably, the trusted party erases all of its private randomness used to generate the CRS after delivery to the prover and verifier.

[0037] Typically, the initialization phase only needs to be performed once. This phase is often implicit. For example, this phase may be performed as part of another cryptographic method executed by the prover and verifier. Parameters of the other cryptographic method may then be used in the verification method according to one embodiment. For example, the shared parameters may be implicitly known, e.g., part of computer software provided to the prover and verifier.

[0038] For example, the shared parameters may include one or more groups, e.g., a first, second, and third group. For example, the shared parameters may include a bilinear mapping that maps from the first group and the second group to the third group. For example, the shared parameters may include a set of generators for the groups, in particular the first group and the second group.

[0039] In the commitment phase, the prover determines the vector x=(x1,…,x n) from the vector and the shared parameters. The prover computes a commitment according to a commitment scheme. The commitment allows the prover to commit to a value, in this case a vector, while keeping it hidden from others, especially the verifier. The commitment is sent to the verifier, which allows the prover to later reveal the committed value or part of it; this is also called unsealing the commitment. A commitment may be used for this function, for example, to prevent the prover from changing a value, e.g., vector x, after committing it. However, a commitment may also be used as part of another demonstration. For example, in one embodiment, the prover demonstrates to the verifier that a committed vector is binary, without necessarily unsealing any part of the vector.

[0040] The commitment phase may involve the computation of one or more commitments as well as one or more proofs; for example, a proof that the committed vector has a particular property. The commitments and proofs are shared with the verifier, e.g., transmitted to the verifier over a computer network. The proofs and commitments may be separated into their own phases, e.g., a commitment phase and a proof phase.

[0041] In the verification phase, the verifier may, for example, verify that the proof provided with the commitment is correct. Interestingly, this allows the prover to prove a fact about a vector without disclosing anything else about said vector. This so-called zero-knowledge property is particularly desirable in cryptography.

[0042] For example, in the commitment phase, the attestation device may compute a primary commitment to commit to a particular vector of interest, e.g., a primary vector. This commitment may allow the prover to later disclose one or more values ​​of the primary vector. The verifier can then verify that the commitment indeed corresponds to the disclosed values. Interestingly, the attestation device may also compute one or more proofs that demonstrate properties of the primary vector. Such proofs can also be verified using the commitment. For example, the attestation device may compute one or more proofs that demonstrate properties of the primary vector, e.g., (y1(x1-1),...,y n (x n -1)) is orthogonal to the vector defined by n ) randomizes this sum.

[0043] To aid in this proof, the proving device may compute one or more auxiliary commitments that commit to other vectors related to the primary vector. For example, the auxiliary commitments may be to the Hadamard product of the primary vector and a randomized vector. It was the inventor's insight that reversing the order of the vectors would allow subsequent verification to use a bilinear map. The proving device may generate further proofs. For example, the proving device may prove that the primary commitment defined above and one or more auxiliary commitments were indeed obtained from the same primary vector.

[0044] The primary and auxiliary commitments are typically obtained by applying the commitment function of the vector commitment scheme to the primary and auxiliary vectors, respectively. In most embodiments, this typical case is assumed. However, the homomorphic property of the commitment scheme makes this unnecessary; i.e., given a valid commitment, the verifier can use the homomorphic property to derive additional commitments. This is particularly useful for auxiliary commitments. The auxiliary commitments can be obtained not only by applying the commitment function of the vector commitment scheme to the auxiliary vectors, but also by applying the commitment function to the auxiliary vectors minus a randomization vector. In the former case, the verifier can derive the latter commitment; in the latter case, the verifier can derive the former commitment.

[0045] Being able to prove that a vector is binary without necessarily disclosing the complete vector itself is useful in many situations. In general, mathematical objects are sometimes encoded as binary vectors, e.g., as sequences of bits. Properties of the mathematical object can then be demonstrated, e.g., by unwrapping specific elements of the vector, by computing a dot product over the vector or parts of it, or by computing other operations on the vector, possibly linear operations. However, for this approach to have good security, the verifier must be confident that the vector is binary. For example, to prove that a number known to the prover is within a certain range, e.g., less than an upper bound, the prover can encode the number as a binary vector and commit to it. Using a constant-sized, e.g., concise, proof, by unwrapping the last (nl) elements of the binary vector, e.g., the (nl) most significant bits to zero, the prover can prove that the integer is 2. lHowever, if the prover can cheat by committing to a non-binary vector, the number will appear to be less than the bound when in fact it is not.

[0046] Another use is as a basic tool in other encryption schemes, such as homomorphic encryption, where data is shared in encrypted form but operations are still performed on the data. For example, data may be homomorphically encrypted by a homomorphic encryption device. The data may then be sent to a homomorphic computing device. The homomorphic computing device performs a calculation on the encrypted data without decrypting the data, e.g., without knowledge of the plaintext of the data. The result of the calculation, still encrypted, may be sent back to the encryption device, where it may be decrypted. Homomorphic encryption relies on data being provided legitimately according to the specific rules of a particular homomorphic encryption scheme. The computing device typically cannot verify whether the data was encrypted legitimately, e.g., because it cannot decrypt the data. Interestingly, this is possible using one embodiment. The encryption device converts the data and / or encryption randomness into a binary vector and then proves that the provided encrypted data legitimately reflects the plain data according to the rules. This also relies on being able to efficiently prove that the vector is binary.

[0047] The attestation device 110 may include a processor system 113, storage 114, and a communication interface 115. The verification device 120 may include a processor system 123, storage 124, and a communication interface 125. The storage 114 and 124 may be, for example, electronic storage or magnetic storage. The storage may include local storage, such as a local hard drive or electronic memory. The storage 114 and 124 may also include non-local storage, such as cloud storage. In the latter case, the storage 114 and 124 may include a storage interface to the non-local storage. The storage may include multiple individual sub-storages, which together make up the storage 114, 124. The storage may include a volatile, writable portion, such as RAM, a non-volatile, writable portion, such as flash, and a non-volatile, non-writable portion, such as ROM.

[0048] In various embodiments of communication interface 115 and / or 125, the communication interface may be selected from a variety of alternatives. For example, the interface may be a network interface to a local or wide area network such as the Internet, a storage interface to internal or external data storage, an application program interface (API), etc.

[0049] Storage 114 and 124 may be non-transitory storage. For example, storage 114 and 124 may be a volatile memory device, such as random access memory (RAM), that can store data when power is present. For example, storage 114 and 124 may be a non-volatile memory device, such as flash memory, that can store data both when power is present and when power is absent.

[0050] Devices 110 and 120 can communicate internally, with each other, or with other devices, external storage, input devices, output devices, and / or one or more sensors over a computer network. The computer network may be the Internet, an intranet, a LAN, a WLAN, etc. The computer network may be the Internet. Devices 110 and 120 include connection interfaces configured to communicate within or outside system 100 as needed. For example, the connection interfaces may include connectors, such as wired connectors, e.g., Ethernet connectors, optical connectors, etc., or wireless connectors, such as antennas, e.g., Wi-Fi, 4G, or 5G antennas.

[0051] The communication interface 115 may be used to send and receive digital data, such as commitments and proofs, and vectors, such as binary vectors. The communication interface 125 may be used to send and receive digital data, such as commitments and proofs.

[0052] The attestation device 110 and the verification device 120 may have a user interface, which may include familiar elements such as one or more buttons, a keyboard, a display, a touchscreen, etc. The user interface may be configured to accommodate user interaction to initiate a cryptographic protocol. The user interface may be configured for higher-level protocols, such as homomorphic computation on the encrypted data, e.g., initiating a neural network evaluation. As part of the higher-level protocol, a vector may be generated along with a proof that the vector is binary. Other properties of the vector may also be demonstrated by the proof. For example, the encrypted data is effectively encrypted according to a homomorphic encryption scheme. Because the attestation device and the verification device can operate automatically, the user interface is optional.

[0053] Execution of devices 110 and 120 may be implemented in a processor system. Devices 110 and 120 may include functional units for implementing aspects of some embodiments. The functional units may be part of the processor system. For example, the functional units shown herein may be implemented in whole or in part by computer instructions stored in a storage of the device and executable by the processor system.

[0054] A processor system may include one or more processor circuits, such as a microprocessor, a CPU, a GPU, etc. Devices 110 and 120 may include multiple processors. A processor circuit may be implemented in a distributed manner, such as multiple sub-processor circuits. For example, devices 110 and 120 may use cloud computing.

[0055] Typically, the attestation device 110 and the verification device 120 each include a microprocessor that executes appropriate software stored on the device; for example, the software may be downloaded and / or stored in corresponding memory, e.g., volatile memory such as RAM or non-volatile memory such as Flash.

[0056] Instead of using software to implement functions, devices 110 and / or 120 may be implemented, in whole or in part, in programmable logic, for example as a field programmable gate array (FPGA). The devices may be implemented, in whole or in part, as so-called application specific integrated circuits (ASICs), e.g., integrated circuits (ICs) customized for a particular application. For example, the circuitry may be implemented in CMOS, for example using a hardware description language such as Verilog or VHDL. In particular, attestation device 110 and verification device 120 may comprise circuitry for, for example, cryptographic and / or arithmetic processing.

[0057] In hybrid embodiments, the functional units are implemented partly in hardware as coprocessors, for example cryptographic and / or mathematical coprocessors, and partly in software stored and executed on the device.

[0058] FIG. 2 illustrates an example of one embodiment of a certification system 200 .

[0059] The proof system 200 uses a vector commitment scheme to provide a principal vector 211, x=(x1,...,x n ) is a binary vector. For example, system 200 can be implemented in device 110.

[0060] The main vector 211 may be obtained from a main vector source 210. Typically, the main vector source 210 may be part of a further cryptographic method. For example, a cryptographic object may be converted into a binary vector. By proving properties of the vector, those properties can be efficiently demonstrated to a verifier. An embodiment may be used to efficiently prove that the main vector is binary. The main vector may be obtained, for example, from storage or may be received from a third party.

[0061] In addition to the primary vector, various additional vectors may be used, for example, to randomize calculations or aggregate them into a single value. Randomization vector 212 and randomization vector 213 are shown. Typically, the randomization vector is not secret and is available to the verifier or made available to the verifier by the prover. In principle, an agreement scheme between the prover and verifier may be adapted to select the randomization vector. Preferably, the randomization vector is selected by the prover system, as this allows for a non-interactive scheme. To prevent a dishonest prover from unfairly controlling the randomization, the randomization vector may be generated from a hash value, for example, by applying a cryptographic hash function to data including one or more previous protocol parts, such as one or more previously obtained vectors, commitments, proofs, etc. This has the added advantage that the verifier can generate the randomization vector itself without needing to receive the randomization vector, thus reducing transmission costs.

[0062] In one embodiment, the randomization vector is chosen by the verifier or derived from the output of a hash function, for example, and applied to a previously computed commitment. Security is improved if the prover cannot choose the randomization vector before committing to the vector. Generating the randomization vector from a hash function accomplishes this.

[0063] Randomizing vectors, e.g., hash functions, are sometimes modeled as random oracles. This is not required, but it is convenient to prove their mathematical properties.

[0064] For example, in one embodiment, the randomized vector (y=(y1,...,y n)) may be obtained from a scalar (u) chosen by the verifier, or may be derived, for example, by the prover from the output of a hash function. The randomization vector may then be obtained by a series of polynomial functions applied to the scalar. For example, the randomization vector may be determined by the prover as (f0(u),f2(u),..,f n-1 The polynomial may be reconstructed as y = (1, u, u). The polynomial may be chosen by the protocol designer or by the verifier. The polynomial may be used repeatedly over multiple iterations of the protocol. This has the advantage of reducing the data sent by the verifier. For example, the verifier may choose a random scalar u and send it to the prover, which can then reconstruct the randomization vector. In one embodiment, the polynomial is chosen as follows: y = (1, u, u 2 ,…,u n-1 ).

[0065] One or more of the randomization vectors may be used in the calculation of the auxiliary commitment, while some may not. This is illustrated in Figure 2, where the randomization vector y = (y1, ..., y n ), 212 is the input to the commitment unit 220, while the randomization vector t=(t1,...,t n ), 213 are not. Both randomization vector 212 and randomization vector 213 may be obtained by hashing previous commitments, for example commitments 221, 222 discussed below.

[0066] The proof system 200 comprises a commitment unit 220 configured to compute a vector commitment. A primary commitment 221 is shown in Figure 2. The primary commitment commits to a primary vector x, 211. Later, the prover can choose to unseal all or part of the vector 211, and the verifier can verify that the unsealed part is indeed the same as the primary vector 211 when the commitment 221 was computed.

[0067] The commitment unit 220 may be used to compute further commitments that are useful in constructing later proofs. For example, the commitment unit 220 may be used to compute a first auxiliary commitment 222. The auxiliary commitment does not directly randomize the vector 212, since the verifier has access to the vector 212 and can, for example, generate the vector 212 himself. However, the first auxiliary commitment 222 does randomize the element x i y i The insight was that reversing the order in which the commitments for the primary commitment 221 and the auxiliary commitment 222 are computed allows for efficient verification using a bilinear map. The first auxiliary commitment 222 is in the reverse order of the order of the primary vectors. For example, a primary commitment is a vector x=(x1,...,x n ), while the first auxiliary commitment 222 may commit to the auxiliary vector, e.g., (y n x n , ..., y1x1). Note that the order in which the primary vectors are used in the primary and auxiliary commitments is reversed. In this example, the primary commitment uses the natural order of the primary vectors, e.g., the order in which they were received or generated, while the auxiliary vector reverses the order in which the elements of the primary vectors are used. However, this could also be reversed, with the primary commitment reversing the natural order and the auxiliary commitment reversing this, i.e., using the natural order again.

[0068] In one embodiment, the vector commitment scheme is homomorphic, e.g., additive homomorphic. This has the consequence that, given a received commitment, e.g., a primary commitment and a first auxiliary commitment, the verifier can construct additional commitments. For example, given that the verifier has the randomized vector 212, the verifier can construct an additional vector (y nx n -y n , ..., y1x1-y1), the second auxiliary commitment can be calculated from the first auxiliary commitment.

[0069] Furthermore, the vector commitment scheme preferably involves determining the element (x i ), which allows for the construction of proofs by computing the product and / or quotient of the proofs over a range of indices with corresponding vectors, e.g., the main and / or auxiliary vectors.

[0070] For example, the vector commitment scheme may be a Pedersen commitment scheme.

[0071] Proof system 200 further comprises a proof unit 230. Proof unit 230 is configured to generate proofs of statements regarding vectors, which can be verified using commitments regarding said vectors, without requiring knowledge of the vectors themselves.

[0072] The proof unit 230 provides an orthogonal proof 231, e.g., a first proof π y An orthogonality proof allows the verifier to construct additional vectors (y1x1-y1,…,y n x n -y n ) is orthogonal to the principal vector. This means that the sum y1(x1-1)x1+…y n (x n -1)x n = 0, which means that y i randomizes this sum, e.g., y i is random, for example, x i Since the selection is independent of x, each x i This means that x is either 0 or 1. i If one of the is not in {0,1}, then the probability that the sum is 0 is only 1 / p.

[0073] This proof is a second proof π that links the primary commitment 221 with the first auxiliary commitment 222. eq , is complemented by an equivalence proof 232. For example, the equivalence proof 232 proves that the principal vector in the Hadamard product committed in the first auxiliary commitment is the principal vector committed in the primary commitment. More precisely, the equivalence proof 232 may prove that the principal vector in the Hadamard product committed in the first auxiliary commitment is the principal vector committed in the primary commitment. More precisely, the first auxiliary commitment commits to the auxiliary vectors in reverse order, i.e., in the reverse order of the Hadamard product of the primary vector (x) and the randomized vector (y).

[0074] Interestingly, the main commitment, the auxiliary commitment, the first proof, and the second proof may each have a size that is independent of the dimension of the main vector, i.e., they are compact.

[0075] The proof system may be further configured to make the commitment and the auxiliary commitment available to a verifier, and to make the first proof and / or the second proof, or an aggregation thereof, available to the verifier. The verifier can verify that the orthogonality proof and / or the equivalence proof matches the primary commitment and the first auxiliary commitment.

[0076] In some cases, additional proofs may be generated by the proof system at a later state. For example, the proof system may generate proofs regarding further properties of the principal vector. For example, the principal vector may be unsealed in whole or in part; for example, a linear operator may be applied to the principal vector and the result may be unsealed. For example, a dot product of the principal vector with another vector may be calculated, which may be a known vector. The result of the dot product may be revealed to the verifier, and its correctness may be demonstrated using the principal commitment and possibly further auxiliary commitments.

[0077] In one embodiment, the commitment and the proof are group elements. For example, the first group

number

number

number

[0078] For example, the verification of the orthogonality proof 221 can be performed by the first proof and the bilinear mapping to the generators of the second group:

number

number

[0079] Similarly, the equivalence proof π eq is a bilinear map to the second proof

number

number

number

[0080] If the proof is valid, a bilinear map can be applied to the product of the chosen group generators, chosen to be equal, so that the comparison in the third group is balanced, e.g., chosen to be equal. For example, in the case of an equivalence proof, this is the case when both the primary commitment and the first auxiliary commitment correspond to the same primary vector.

[0081] The inventors have found that the embodiment is

number

number

number

number

number

number

number

number

number

number

number

[0082] Some embodiments are also provided that are special cases of the above formula, e.g., m1=1, m2=0, l1=1, l2=0, and

number

[0083] These embodiments have various advantages: The common reference string has a linear size in the dimension of the committed vector.

number

number

number

[0084] For example, one embodiment may involve a vector commitment scheme in which a prover provides a verifier with a principal vector (x=(x1,...,x n )) is a binary vector, and the bilinear map (e( , )) is a binary vector of a first group and a second group

number

number

number

number

number

[0085] The first proof may be taken as a proof that the dot product of two vectors is zero. The reason for reversing the order of the Hadamard product between the principal vector (x) and the randomized vector (y) is to make it possible to verify the proof using a bilinear map. The bilinear map between the principal and auxiliary commitments computes the product of polynomials in exponents. In the product, one of the coefficients is the dot product of the two vectors.

[0086] for example,

number

number

number

number

[0087] For example, one embodiment may involve the verifier generating a principal vector (x=(x1,...,x n)) is a binary vector, - The verification of the first proof is based on the first proof and the bilinear mapping to the generators of the second group.

number

number

number

[0088] Some embodiments may be implemented as a non-interactive zero-knowledge (NIZK) proof system. Such a proof system typically includes the following algorithms: CRS-Gen, Prove, Verify.

[0089] The CRS-Gen algorithm may be used, for example, in the initialization phase. Security parameters

number

[0090] In the following, some further optional refinements, details and embodiments are exemplified.

[0091] Message space for prime modulus p

number

[0092] Some embodiments may be implemented using small infinity-norm vectors x or even binary values ​​x∈{0,1} n to obtain a constant-size commitment C. It is then possible to generate a short proof that x has two-valued entries. In one embodiment, the proof contains only two group elements. In particular, the CRS can be O(n) sized, allowing for concise unpacking of commitments for individual vector positions. Also, the committed vector

number

number

number

[0093] For purposes of illustrating some detailed embodiments,

number

number

number

number

number

number

number

number

number

number

number

number

[0094] Preferably, the group

number

number

number

number

[0095] In a practical embodiment,

number

number

number

[0096] In the art, three types of pairing are sometimes distinguished: Type-1 pairing:

number

number

number

[0097] Vector Commitment In one embodiment, the vector commitment is a constant size, e.g.

number

number

[0098] In a vector commitment scheme, a Structured Common Reference String (SRS) is of the form

number

number

number

number

number

number

number

[0099] m's position i∈[n] is m i To open the commit, the committer must

number

number

[0100] A malicious committer may have two different m i ≠m i’Regarding the commitment C that satisfies (1) and the valid proof π i , π i’ If you can come up with the missing element of SRS,

number

[0101] As shown in the paper "Functional Commitment Schemes: From Polynomial Commitments to Pairing-Based Accumulators from Simple Assumptions" by B. Libert, S. Ramanna, and M. Yung, this vector commitment scheme uses aggregation to reduce the size of the committed vector.

number

number

number

number

[0102] By assuming a random oracle H, we can prove that i} i∈S is the random aggregation coefficient

number

number

number

[0103] Proving the Binary Nature of Committed Vectors In one embodiment, the vector commitment common reference string is a bilinear map

number

number

number

number

number

number

[0104] Using the aggregation property of commitments, for each i ∈ [n], x i ·(x i -1)=0 mod p, we can prove that for each i∈[n], x i ∈{0,1}. Since p is prime, this means that x i ∈{0,1}. This can be shown by aggregating the individual equations using a randomized vector:

number

number

number

number

number

number

number

number

[0105] To prove a statement using a fixed number of group elements, first, we take a random

number

number

number

[0106] C y is of the form (y n x n ,…,y1·x1), e.g., an equivalence proof is computed that demonstrates the commitment to the inverse of the auxiliary vector. Commitment (3) satisfies:

number

number

number

number

[0107] Randomized vector with respect to a random exponent

number

number

number

[0108] π eq But C y (y n x n ,…,y1·x1) is a convincing proof that C y is a vector (z1,…,z n ) Commitment

number

number

number

number

number

number

number

number

number

number

number

[0109] Proof π eq is the product

number

number

number

number

number

[0110] To reduce the proof size, we use the linearity of the verification equations (6) and (8) to calculate the random aggregation coefficient

number

number

[0111] Finally, the proof

number

number

[0112] In the above embodiment, the first auxiliary commitment is:

number

number

number

number

[0113] As mentioned above, some embodiments use a bilinear map

number

number

number

number

number

number

number

number

number

number

number

[0114] The above embodiment is a special case of the above formula, where m1=1, m2=0, l1=1, l2=0, and

number

[0115] Example 1, detailed embodiment Given a security parameter λ and a committed vector of maximum dimension n∈poly(λ), do the following: - A function

number

number

number

number

number

number

number

number

number

number

[0116] The public parameters are:

number

[0117] Major Vector

number

number

number

[0118] Main Commitment

number

number

[0119] Commitment

number

number

number

number

number

number

number

[0120] Then, the randomization vector

number

number

number

number

number

number

number

number

number

[0121] Former

number

number

number

[0122] Final Proof

number

[0123] The public parameters, the final proof, and the primary commitment may be shared with the verifier.

[0124] The verifier can proceed as follows: Commitment

number

number

number

number

[0125] Regarding the length of the proof, π is

number

number

number

number

number

number

[0126] Commitment

number

number

number

number

number

number

[0127] Interestingly, this construction can be mathematically proven to be completely zero-knowledge against algebraic attackers. Furthermore, knowledge-soundness can also be proven in algebraic group models, such as those formulated in "The Algebraic Group Model and Its Applications" by G. Fuchsbauer, E. Kiltz, and J. Loss, and in random oracle models. This means that an algebraic attacker who has devised a valid proof can extract a witness or violate the (2n,n)-DLOG assumption. Under the (2n,n)-DLOG assumption, this scheme provides knowledge-soundness in algebraic group models and random oracle models.

[0128] Example 2, detailed embodiment In a second exemplary embodiment, where the vector commitment is:

number

number

[0129] Given a security parameter λ and a committed vector of maximum dimension n∈poly(λ), do the following: - A function

number

number

number

number

number

number

number

number

number

number

[0130] The public parameters are:

number

[0131] Major Vector

number

number

number

[0132]

number

number

[0133] The primary commitment C and the primary vector

number

number

number

number

number

number

[0134] Then, the randomization vector

number

number

number

number

number

number

number

[0135] Former

number

number

number

[0136] Final Proof

number

[0137] Commitment

number

number

number

number

[0138] In both the first and second exemplary embodiments, the second auxiliary commitment is computed for verification of the orthogonality proof, and the equivalence proof directly uses the first auxiliary commitment, but this can be reversed in either embodiment.

[0139] Exemplary Uses The preferred embodiment can be used in many applications, and exemplary applications are discussed below.

[0140] A short proof that the committed vector is short The first use is to construct proofs that a committed scalar belongs to a certain interval. This can be useful, for example, in blockchain transactions. The need for such proofs is explained, for example, in Benedikt Buenz et al., "Bulletproofs: Short Proofs for Confidential Transactions and More" (see, for example, section 1.2.1, which describes Confidential Transactions). We briefly explain the idea of ​​a committed scalar, e.g., a vector of dimension n=1.

[0141]

number

[0142] The prover uses the second source group of the bilinear mapping

number

number

number

number

[0143] Using the aggregation property of commitments, the committed vector

number

number

number

number

number

number

[0144]

number

number

number

number

number

number

[0145] The construct outlined above is a vector commitment

number

[0146] We can also handle the range [0,B] where B+1 is not a power of 2. The standard approach to this problem is to l-1 ≦B<2 l An integer such that

number

number

number

[0147] A short proof for ring LWE ciphertexts. A second application is to prove the validity of ring LWE ciphertexts using only three group elements. This uses an embodiment of a short proof that the committed vector is binary. This example also exploits the fact that the underlying vector commitments allow for the proof of an inner product relation.

[0148] For a cyclotomic polynomial of degree d, the polynomial ring

number

number

number

number

number

number

number

number

number

number

[0149]

number

number

number

number

number

number

number

number

number

number

[0150] To prove (19), the prover uses the Pedersen commitment to find the vector

number

number

number

number

number

[0151] In particular, this approach makes it possible to prove that a committed vector is a solution to an instance of the partial sum problem, which is useful in many applications.

[0152] While this example proves the validity of ring LWE ciphertexts, using statement (16), the reasoner is easily extended to handle more general statements of the form (16).

[0153] The statement is a public key

number

number

number

[0154] The prover tells the verifier

number

number

[0155] The above statement,

number

number

number

number

number

number

number

[0156] To make the proof shorter, we can commit directly to the bits of w.

[0157] any integer

number

number

number

number

number

number

number

number

number

[0158] Therefore, the prover must have a witness w∈{0,1} D where D = 2d(2 + log B + log d). Since relation (22) holds modulo p (and therefore both elements have infinity norm less than p / 2),

number

number

number

number

number

number

number

number

[0159] By applying the above idea, we can find three group elements (i.e.,

number

number

number

number

[0160] Furthermore, structured random strings are obtained that are half as short as those obtained using a general-purpose SNARK in terms of the arithmetic circuit. In the SNARK-based approach, the number of multiplication gates in the arithmetic circuit is estimated to be about 142,000. Therefore, the prover must

number

number

number

number

number

number

[0161] Proving that a committed vector is ternary Using the preferred embodiment, the commitment

number

[0162] One approach is to define x as two binary vectors x0, x1∈{0,1} l The prover must first prove two vector commitments to x0 and x1, respectively, before proving

number

number

number

number

number

number

number

number

number

[0163] At the cost of doubling the CRS size, we can reduce the size of the proof by

number

number

number

number

number

number

[0164] We can prove (i) as in the previous construction. For (ii), we can use properties of the underlying commitments:

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0165] Proof of exact Hamming weights for binary vectors. binary x∈{0,1} n Commitment to

number

number

number

number

number

number

[0166] Proof of restricted Hamming weights for arbitrary vectors. where:

number

number

[0167] To prove this statement, we first consider a random vector w = (w1,…,w) with Hamming weight HW(w) = B. n )∈{0,1} n Commitment to C w and in this respect, for all i∈[n], i = 1, so x i≠ 0. Now we can prove that: (i) w is binary and has Hamming weight B; (ii) for each i ∈ [n], x i When ≠ 0, always w i = 1, which implies that HW(x) ≤ HW(w).

[0168] As explained in the previous paragraph, we can prove (i). To prove (ii), we use the random vector

number

number

number

[0169] More specifically, the prover uses a random

number

number

number

number

number

number

number

number

[0170] FIG. 3 illustrates an example of an embodiment of a proof method 300. The method 300 may be computer-implemented. The method 300 involves proving a primal vector (x=(x1,...,x2)) by a prover to a verifier using a vector commitment scheme. n )) is a binary vector. - The prover makes a primary commitment

number

number

[0171] An aspect further relates to a cryptographic method for verifying, by a verifier, a proof generated in accordance with any of the preceding claims.

[0172] For example, the verification and validation method may be a computer-implemented method. The vectors, proofs, and commitments may be represented by a plurality of bits. For example, the vectors may have at least 10, 100, or 1000 vectors. For example, the proofs and commitments may be digitally represented bit by bit and may include at least 100 bits and at least 500 bits, respectively.

[0173] Those skilled in the art will appreciate that many different ways of performing this method are possible. For example, while the order of steps may be performed in the order shown, the order of steps may be changed or some steps may be performed in parallel. Furthermore, other method steps may be inserted between steps. The inserted steps may represent improvements to the method as described herein or may be unrelated to the method. For example, some steps may be performed at least partially in parallel. Furthermore, a given step may not be completely completed before the next step is initiated.

[0174] Method embodiments may be implemented using software including instructions for causing a processor system to perform method 300. The software may include only steps performed by a particular sub-entity of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy, memory, optical disk, etc. The software may be transmitted wired or wirelessly or as a signal using a data network such as the Internet. The software may be made available for download and / or for remote use on a server. Method embodiments may be implemented using a bitstream configured to configure programmable logic, such as a field programmable gate array (FPGA), to perform the method.

[0175] It should be understood that the subject matter disclosed herein also extends to computer programs, particularly computer programs on or in a carrier adapted for practicing the subject matter disclosed herein. The program may be in the form of object code, such as source code, object code, code intermediate source, and partially compiled form, or any other form suitable for use in implementing method embodiments. An embodiment relating to a computer program product includes computer-executable instructions corresponding to each of at least one processing step of the described method. These instructions may be subdivided into subroutines and / or stored in one or more files that may be statically or dynamically linked. Another embodiment relating to a computer program product includes computer-executable instructions corresponding to each of at least one device, unit, and / or component of the described system and / or product.

[0176] The following clauses represent preferred embodiments.

[0177] Clause 1. The prover provides the verifier with a vector commitment scheme to determine the principal vector (x = (x1, ..., x n 1. A cryptographic method (300) for verifying that a binary vector is a binary vector, the method comprising: - The prover makes a primary commitment

number

number

[0178] Article 2. - Primary Commitment

number

number

[0179] Article 3. - A second proof (π eq ) to generate (350) 3. The method according to clause 1 or 2, comprising:

[0180] Clause 4. The commitment scheme determines the element (xi ), and the second proof comprises a product of proofs over a range of indices in the main vector divided by a product of proofs over a range of indices in the auxiliary vector.

[0181] Clause 5. The method of any of clauses 1 to 4, wherein the primary commitment, the auxiliary commitment, the first proof, and the second proof each have a size that is independent of the dimension of the primary vector.

[0182] Clause 6. The method of any of clauses 1 to 5, wherein the vector commitment scheme is an additive homomorphism.

[0183] Clause 7. Verification is based on a first subsidiary commitment to a second subsidiary commitment.

number

[0184] Clause 8. The method of clause 7, wherein the second auxiliary commitment is obtained from the first auxiliary commitment and the randomization vector using an additive homomorphic property of the commitment scheme.

[0185] Article 9. First and second groups

number

number

number

number

[0186] Clause 10. The verification of the first proof is a bilinear mapping to the main and auxiliary commitments.

number

[0187] Clause 11. Verification of the first proof is a bilinear mapping to the main commitment and the second auxiliary commitment.

number

[0188] Article 12. Second Proof (π eq ) is the first group

number

number

number

number

[0189] Clause 13. The method of clause 12, wherein the application of the bilinear map is by a product of selected group generators, and a group generator is selected for comparison and balancing when the primary commitment and the first auxiliary commitment both correspond to the same primary vector.

[0190] Article 14. - a bilinear map applied to selected group elements and principal commitments of the first group

number

number

number

number

number

number

[0191] Article 15. - making the commitment and auxiliary commitments available to the verifier, and making the first proof and / or the second proof or an aggregation thereof available to the verifier; 15. The method of any of clauses 1 to 14, comprising:

[0192] Clause 16. The method of any of clauses 1 to 15, wherein the vector commitment scheme comprises a Pedersen commitment scheme.

[0193] Clause 17. A method for verifying that a numerical value (x) is less than a threshold value, comprising: - bit representation of a number (x) ((x1,…,x l )∈{0,1} l ), computing a commitment on the vector and generating at least a first proof according to any of clauses 1 to 16; - Generate proofs demonstrating the equivalence of bit vectors to numbers A method comprising:

[0194] Article 18. Circle

number

number

number

number

[0195] Clause 19. A method for demonstrating that a vector x is ternary, comprising the steps of: l 17. A method comprising: writing x as the difference between x=x0-x1 and generating at least a first proof according to any of clauses 1 to 16 for a concatenation of two binary vectors.

[0196] Clause 20. A cryptographic method for verifying a proof generated by a verifier in accordance with any of Clauses 1 to 19.

[0197] Clause 21. A system comprising one or more processors and one or more storage devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations related to a method described in any of clauses 1 to 20.

[0198] Clause 22. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform the actions set forth in any of clauses 1 to 20.

[0199] FIG. 4a illustrates a computer-readable medium 1000 having a writable portion 1010 and a computer-readable medium 1001 also having a writable portion. The computer-readable medium 1000 is illustrated in the form of an optically readable medium. The computer-readable medium 1001 is illustrated in the form of an electronic memory, in this case a memory card. The computer-readable media 1000 and 1001 can store data 1020, which, when executed by a processor system, can represent instructions that cause the processor system to perform an embodiment of a verification and / or validation method according to one embodiment. The computer program 1020 may be embodied on the computer-readable medium 1000 as a physical mark or by magnetization of the computer-readable medium 1000. However, any other suitable embodiment is also contemplated. Furthermore, while the computer-readable medium 1000 is illustrated here as an optical disk, it should be understood that the computer-readable medium 1000 may be any suitable computer-readable medium, such as a hard disk, solid-state memory, flash memory, or the like, and may be non-recordable or recordable. The computer program 1020 includes instructions for causing a processor system to perform the verification and / or validation method.

[0200] FIG. 4b shows a schematic diagram of a processor system 1140 according to one embodiment of a verification and / or validation system. The processor system includes one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is shown schematically in FIG. 4b. The circuit 1110 includes a processing unit 1120, e.g., a CPU, for executing computer program components to perform a method according to one embodiment and / or implement a module or unit thereof. The circuit 1110 includes a memory 1122 for storing programming code, data, etc. A portion of the memory 1122 may be read-only. The circuit 1110 may include a communication element 1126, e.g., an antenna, a connector, or both. The circuit 1110 may include a dedicated integrated circuit 1124 for performing some or all of the processing defined in the method. The processor 1120, the memory 1122, the dedicated IC 1124, and the communication element 1126 may be interconnected via an interconnect 1130, e.g., a bus. The processor system 1110 may be configured for contact and / or contactless communication using antennas and / or connectors, respectively.

[0201] For example, in one embodiment, the processor system 1140, e.g., a verification and / or validation system, may include a processor circuit and a memory circuit, where the processor is configured to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, or the like. The memory circuit may be a ROM circuit or a non-volatile memory, e.g., a flash memory. The memory circuit may also be a volatile memory, e.g., an SRAM memory. In the latter case, the device may include a non-volatile software interface, e.g., a hard drive, a network interface, or the like, configured to provide the software.

[0202] Although system 1140 is illustrated as including one of each of the described components, various components may be duplicated in various embodiments. For example, processing unit 1120 may include multiple microprocessors configured to independently execute methods described herein or to perform steps or subroutines of methods described herein, where the multiple processors cooperate to provide the functionality described herein. Furthermore, when system 1140 is implemented in a cloud computing system, the various hardware components may reside in separate physical systems. For example, processor 1120 may include a first processor located on a first server and a second processor located on a second server.

[0203] It should be noted that the above-described embodiments are illustrative rather than limiting of the subject matter disclosed herein, and that those skilled in the art will be able to design many alternative embodiments.

[0204] In the claims, reference signs in parentheses shall not be construed as limiting the respective claims. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The use of phrases such as "at least one of" following a list of elements denotes the selection of all or any subset of the elements from the list. For example, the phrase "at least one of A, B, C" is to be understood as including A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter disclosed herein can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In device claims enumerating several components, several of these components may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0205] In the claims, references in parentheses refer to the reference signs in the drawings of the illustrated embodiments or to the formulas of the embodiments, thus facilitating the understanding of the claims, and shall not be construed as limiting the respective claims.

Claims

1. The prover provides the verifier with a vector commitment scheme to determine the principal vector (x = (x １ , ..., x ｎ )) is a binary vector, the vector commitment scheme determining the element (x) at position (i∈[n]) of the committed vector. ｉ ) , wherein the method is configured to calculate a partial opening proof for the The prover makes the primary commitment [Equation 1] Calculating (310) ∑ x = ∑ ... The prover determines the randomized vector (y = (y １ , ..., y ｎ )) (320), wherein the randomization vector is made available to the verifier, the randomization vector being selected by the verifier or derived from the output of a cryptographic hash function (320); The prover makes a first auxiliary commitment [Equation 2] Calculating (330) x, y ... A further vector (y ｉ (x ｉ -1)) is the principal vector (x ｉ The first proof (π ｙ ), wherein the first proof is configured for verification by a verifier; A second proof (π ｅｑ ) (350) A method comprising:

2. Main Commitment [Equation 3] is calculated by evaluating the commitment function of the vector commitment scheme with respect to the principal vector (x), and / or Subsidiary Commitment [Equation 4] 2. The method of claim 1, wherein {overscore (x)} is calculated by evaluating the commitment function of the vector commitment scheme on the auxiliary vector, or a linear combination of the auxiliary vector and the randomization vector, or the auxiliary vector minus the randomization vector.

3. 3. The method of claim 1, wherein the second proof comprises the product of the proofs over the elements of the main vector divided by the product of the proofs over the elements of the auxiliary vector.

4. The method of claim 1 , wherein the primary commitment, the auxiliary commitment, the first proof, and the second proof each have a size that is independent of the dimension of the primary vector.

5. The method of claim 1 , wherein the vector commitment scheme is an additive homomorphism.

6. Verification is performed by converting the first subsidiary commitment to the second subsidiary commitment. [Equation 5] The method of claim 1 , further comprising obtaining:

7. The method of claim 6 , wherein the second auxiliary commitment is obtained from the first auxiliary commitment and the randomization vector using an additive homomorphic property of the commitment scheme.

8. First group and second group [Equation 6] From the third group [Equation 7] A bilinear map (e(, )) to [Equation 8] On the other hand, The verification of the first proof is based on the first proof and a bilinear map to the generators of the second group. [Equation 9] 8. The method of claim 1, comprising first applying:

9. The verification of the first proof is based on a bilinear mapping to the primary and secondary commitments: [Equation 10] and the validation comprises comparing the results of the first and second applications on a third group.

10. Verification of the first proof is a bilinear mapping to the main commitment and the second auxiliary commitment: [0011] and the validation comprises comparing the results of the first and second applications on the third group.

11. Second proof (π ｅｑ ) is the first group [0012] and a second proof is constructed for verification by a verifier, said verification being a bilinear mapping to the second proof: [0013] , a bilinear mapping to the primary commitment [0014] , and a bilinear mapping to auxiliary commitments [Equation 15] 11. The method of claim 8, further comprising comparing the application of a bilinear map to the auxiliary commitment or a second auxiliary commitment derived from the auxiliary commitment and a randomization vector.

12. 12. The method of claim 11, wherein the application of the bilinear map is by a product of selected group generators, and a group generator is selected for comparison to balance if the primary commitment and the first auxiliary commitment both correspond to the same primary vector.

13. A bilinear map applied to selected group elements of the first group and to the principal commitments [0016] is a bilinear map applied to the proof of opening with respect to an element at a position in the third group and a selected group element of the second group. [Equation 17] and a bilinear map applied to a selected group element of the first group and a selected element of the second group, raised to the power of the value of the element at position [Equation 18] and / or A bilinear map applied to the auxiliary commitment and the selected group element of the second group [Equation 19] is a bilinear map applied to the proof of opening with respect to an element at a position in the third group and a selected group element of the second group. [Equation 20] and a bilinear map applied to a selected group element of the first group and a selected element of the second group, raised to the power of the value of the element at position [Equation 21] 13. The method of claim 3, claim 8, and any one of claims 1 to 12, wherein the value of .times. ...

14. Second proof (π ｅｑ 14. The method of claim 1, wherein the vector element is obtained by aggregating randomized openings for the vector elements.

15. Making the commitment and auxiliary commitments available to the verifier, and making the first proof and / or the second proof or an aggregation thereof available to the verifier.

15. The method of any one of claims 1 to 14, comprising:

16. The method of claim 1 , wherein the vector commitment scheme comprises a Pedersen commitment scheme.

17. 1. A method for verifying that a number (x) is less than a threshold value, comprising: Bit representation of a number (x) ((x １ , ..., x ｌ ) ∈ {0, 1} ｌ 17. A method for generating at least a first proof according to claim 1, wherein the first proof is a bit vector including: generating a proof demonstrating the equivalence of the bit representation to a number (x); Verifying that a number (x) is less than a threshold by unscrewing one or more most significant bits of a bit vector A method comprising:

18. ring [Equation 22] A method for validating the above ring-LWE ciphertext, wherein the ciphertext is a first vector s=(s １ , ..., s Ｍ )∈R Ｍ and, [Equation 23] and [0000] Regarding the formula [Equation 25] and a second vector a that satisfies R for an integer q. ｑ = R / (qR), and the method comprises representing the vector s as a binary vector, generating at least a first proof according to any one of claims 1 to 16, and generating a proof that the vector s satisfies the formula.

19. A method for verifying that a vector x is ternary, comprising: ０ , x １ ∈{0, 1} ｌ The difference between x and x ０ -x １ and generating at least a first proof according to any one of claims 1 to 16 for a concatenation vector of two binary vectors.

20. The randomized vector (y = (y １ , ..., y ｎ )) is obtained from a scalar (u) chosen by the verifier or derived from the output of a hash function, and the randomization vector is obtained by a series of polynomial functions applied to the scalar, e.g., y=(1, u, u ２ , ..., u ｎ－１ 20. The method of claim 1, wherein

21. A cryptographic method for verifying, by a verifier, a proof generated in accordance with any one of claims 1 to 20.

22. 22. A system comprising one or more processors and one or more storage devices that store instructions that, when executed by the one or more processors, cause the one or more processors to perform operations related to a method according to any one of claims 1 to 21.

23. 22. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform the operations of any one of claims 1 to 21.

Images