COMPUTER-IMPLEMENTED SYSTEM AND METHOD FOR ENABLED ZERO-KNOWLEDGE PROOFS

Abstract

To provide a method for efficient zero knowledge verification of composite statements that require both arithmetic circuit satisfiability and dependent statements about the validity of public keys simultaneously.SOLUTION: A method is implemented in a computer to enable zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that the statement is true while keeping a witness (w) to the statement a secret. In addition, a reciprocal method employed by the verifier who verifies the proof includes the prover sending the verifier a set of data including a statement for a given function circuit output and an elliptic curve point. A function circuit input is equal to a corresponding elliptic curve point multiplier (s). The data includes individual wire commitments and / or a batched commitment for the circuit of the statement, an input and an output.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] This specification generally relates to computer-implemented methods and systems suitable for implementation in a computer processor or a group of such processors, such as nodes of a blockchain network. An improved method for generating proofs that allow efficient zero-knowledge verification of statements is provided. The method is suitable for incorporation into existing discrete logarithm-based zero-knowledge proof protocols for circuit satisfiability that do not require the use of bilinear pairing-friendly elliptic curves. The invention is particularly suited to, but not limited to, methods performed by a prover to create a proof, and by a verifier to verify the proof, and collaboration between two or more participants. To achieve secure trustless exchange between participants, one of the parties can prove knowledge of a key or a statement without revealing the statement. [Background technology]

[0002] In this document, the term 'blockchain' includes all forms of electronic, computer-based, distributed ledgers. These include consensus-based blockchain and transaction chain technologies, permissioned and permissionless ledgers, shared ledgers, and variations thereof. The most widely known use of blockchain technology is the Bitcoin ledger, although other blockchain implementations have been proposed and developed.

[0003] For convenience and explanation, reference may be made herein to Bitcoin, but it should be noted that the present invention is not limited to use with the Bitcoin blockchain, and alternative blockchain implementations and protocols are within the scope of the present invention. The term "user" herein refers to a human or processor-based resource. A blockchain is a peer-to-peer electronic ledger implemented as a computer-based, decentralized, distributed system that is made up of blocks of transactions.

[0004] Each transaction is a data structure that encodes the transfer of control of digital assets between participants in the blockchain system and contains at least one input and at least one output. Each block contains a hash of the previous block with which it is chained, creating a permanent and immutable record of all transactions written to the blockchain before its inception. Transactions contain small programs known as scripts that are embedded in their inputs and outputs, which specify how the transaction's outputs can be accessed and by whom. On the Bitcoin platform, these scripts are written using a stack-based scripting language.

[0005] Furthermore, this document refers to the structure of known zero-knowledge proof protocols and systems that use arithmetic circuits. Blockchain has provided a decentralized, permissionless, global mechanism that allows a solution to the problem of fair exchange between two mutually untrusted parties without the need for third-party arbitration or escrow. The fair exchange of data or information, for monetary reward or in exchange for information, e.g. digital goods, is embodied in a transaction protocol known as ZKCP (Zero-Knowledge Contingent Payments) (Non-Patent Document 2). In ZKCP, specified data is transferred from the seller to the buyer only if the payment is confirmed, and payment from the buyer to the seller is completed only if this specified data is valid according to the terms of the sale. The details of such a protocol are known (Non-Patent Document 1), but it is essentially based on a combination of hash-time-locked contracts (HTLCs) and zero-knowledge proofs, which simultaneously verify that the encrypted information ('digital goods') is valid / correct and that the 'password' that decrypts this information is the data that must be revealed on the blockchain to claim the payment.

[0006] The central component of the ZKCP protocol is a zero-knowledge proof for a set of dependent statements about the validity or accuracy of the data / information, the validity of the key, and the corresponding hash value. Such complex compound statements require an efficient zero-knowledge proof system for general computation, which ultimately allows one party to run an arbitrary program with a secret input and prove to other parties that the program recognized the input as valid and executed correctly, without revealing any information about the secret input or the program's execution. In known ZKCP examples, the general-purpose zero-knowledge proof system employed has been based on the succinct non-interactive arguments of knowledge (SNARK) framework, as implemented in the Pinocchio protocol (Non-Patent Document 3) and the C++ libsnark library (Non-Patent Document 4).

[0007] Zero-knowledge SNARKs (zkSNARKs) provide a way to prove, with zero knowledge, the validity of any computation that can be expressed as an arithmetic circuit. Two main distinguishing properties of zkSNARKs are that they are non-interactive (the prover sends the proof to the verifier in one move) and succinct (proofs are small and easy to verify). However, they have significant limitations: - Proof generation is extremely computationally demanding. - The authentication key is very large and proportional to the circuit size. - They rely on strong, untested cryptographic assumptions (i.e., knowledge of the exponential assumption and the pairing-based assumption). - For a given program (circuit), they require that a common reference string (CRS) be calculated by a third party who must be trusted to remove the configuration parameters. Anyone with knowledge of the configuration parameters has the ability to create fake proofs.

[0008] Constructing a zkSNARK to prove statements involving arbitrary cryptographic elliptic curve key operations has not been attempted to date, but would hypothetically consist of arithmetic circuits with hundreds of thousands or even millions of gates, resulting in proof generation times of minutes and proof keys hundreds of megabytes in size.

[0009] Technical background A basic system for interactive zero-knowledge proofs can use the Σ (sigma) protocol, which involves several communication steps between the prover and the verifier. Typically, the Σ protocol requires three moves: the prover sends an initial commitment (a) to the verifier, then the verifier responds with a random challenge (x), and finally the prover responds with a final response or 'opening' (z). The verifier then accepts or rejects a statement based on the transcript (a,x,z).

[0010] The Σ protocol can be used to prove knowledge of or statements about a piece of evidence (w) known only to the prover. If the commitment does not reveal any information about the evidence, i.e., secrets, to the verifier, except for the fact that the statement about the evidence is true, then the protocol is zero-knowledge (Non-Patent Document 5).

[0011] Central to many interactive zero-knowledge protocols is a commitment scheme, which is used for the satisfiability of arithmetic circuits. A commitment allows a prover to commit to a secret value up front and then verifiably reveal (open) the secret value. A commitment scheme has two main properties: first, it is hidden, the commitment keeps the value secret; second, it is tied, the commitment can only be opened to the original committed value. The Pedersen commitment (Non-Patent Document 5) scheme involves two elliptic curve generator points, G and F, in a group G of prime order p known to all parties. A committer must provide a prime integer Zp Generate a secure random number r on the field and make a commitment to a secret value s: Com(s,r) = s × G + r × F (by elliptic curve addition / multiplication), where × represents elliptic curve point multiplication.

[0012] The committer can fully open the commitment (i.e., it can be verified) at a later stage by providing the values ​​s and r. The committer can also open the commitment in response to a specific challenge value as part of the Σ protocol, without revealing the secret s or the random number r.

[0013] Pedersen commitments are additively homomorphic, i.e. adding two commitments (on an elliptic curve) yields a commitment to the sum of the committed values, i.e.: (s1×G+r1×F)+(s2×G+r2×F)=(s1+s2)×G+(r1+r2)×F It is.

[0014] Proof of arithmetic circuit satisfiability can be achieved with 'zero knowledge' (field Z p An arithmetic circuit (above) is a virtual configuration of arithmetic gates connected by wires (forming a directed acyclic graph) that is capable of performing arbitrarily complex computations, which must be limited to integer arithmetic and have no data-dependent loops or mutable state.

[0015] Each gate has two input wires and one output wire, and performs a multiplication (×) or addition (+) operation on the inputs. L ) and right (w R ) wire input and one wire output (w O ), and FIG. 1(b) shows a schematic diagram of a simple arithmetic circuit with three gates, three input wires (w1, w2, w3), one output wire (w6), and two internal wires (w4, w5).

[0016] In reality, a complete circuit has free input and output wires that define the external (circuit) input and output values. A legal assignment is one that defines the values ​​of the wires as satisfying the circuit, i.e., each wire is assigned a value, and the output of each gate corresponds exactly to the product or sum of its inputs (i.e., the gate is consistent).

[0017] For a given arithmetic circuit, a prover can prove to a verifier that he knows the legal assignments for the circuit without revealing the wire values, by first committing to each wire value in a legal assignment (using a Pedersen commitment), and then running special Σ protocols with the verifier for each gate in the circuit (which can be run in parallel), with the wire values ​​as evidence. These Σ protocols exploit the isomorphism of Pedersen commitments, as we will see below.

[0018] To generate a proof (that a circuit is satisfied), the prover first computes the proof for each wire w in the circuit. i Commitment for (i=1,…,n, where n is the number of wires): W i =Com(w i ,r i ) and send them to the verifier.

[0019] For each 'add' gate in the circuit (one is shown in Figure 1(b)), zero The protocol is executed, which is L +w R -w O = 0 (i.e., the input wire w L and w R Output wire w O and the addition gate is satisfied). This involves the following steps: 1. The prover makes a commitment to zero: B = Com(0,rB ) and send it to the verifier. 2. The verifier generates a random challenge value: x←Z p Respond with. 3. Next, the prover determines the opening value: z = x(r L +r R -r O )+r B and send it to the verifier. 4. The verifier is L +w R -w O = 0, Com(0,z) = x × (W L +W R -W O )+B. B represents the curve point similar to the public key; B=r×F+0×G r B represents the private key of the corresponding pair.

[0020] For each 'multiplication' gate (shown in Fig. 1(a)), Σ prod The protocol is executed, which is to calculate w for each multiplication gate. L ·w R =w O (i.e., the multiplication gate is satisfied). 1. The prover creates five random binding values: t1, t2, t3, t4, t5 ← Z p Generate. 2. The prover has C1 = Com(t1,t3), C2 = Com(t2,t5), C3 = t1 × W R +t4×F and send them to the verifier. 3. The verifier generates a random challenge value: x←Z p Respond with. 4. The prover opens the value: e1=w L x+t1 e2=w R x+t2 z1=r L x+t3 z2=r R x+t5 z3=(r O -w L r R )x+t4 and send these to the verifier. 5. Then, the verifier, L ·w R =w O As proof, the following formula: Com(e1,z1) = x × W L +C1 Com(e2,z2)=x×W R +C2 e1×W R +z3×F=x×W O +C3 Inspect the following.

[0021] Σ zero Protocol and Σ prod The protocol can be run in parallel for verification of each gate in the circuit and can use the same verification challenge value (x) for all gates.

[0022] As an example, consider the circuit in Figure 1(b). In order for the prover to prove to the verifier with zero knowledge that it knows the legal assignments (i.e., the wire values ​​that fill the circuit), the prover first sends to the verifier the wire commitments for each gate (W1, ..., W6) and the Σ protocol commitments (i.e., one additional commitment for each addition gate and five additional commitments for each multiplication gate).

[0023] Next, the verifier generates a random challenge x←Z p The prover responds with,“,and calculates the value that can be opened for each gate (one for each addition, five for each multiplication) and sends it back to the verifier. Then, the verifier performs the,Σ,protocol check, w1 w2 = w4 w4 w5 = w6 w2+w3=w5 and hence, we verify that the commitments W1, ..., W6 correspond to satisfying the wire values ​​w1, ..., w6.

[0024] If the prover wishes to show that a particular wire has a particular value in addition to filling the circuit, they can fully open their commitments to the relevant wires. In this example, the verifier can further send the values ​​w6 and r6 to the verifier (and the verifier can verify that W6=Com(w6,r6)) to show that w6 is an actual output from a particular legal assignment.

[0025] The example in Figure 1(b) is a simple circuit. In practice, useful circuits consist of many more gates. Of particular interest is an arithmetic circuit for the SHA-256 hash function, which allows a prover to show knowledge of a preimage (input) to the SHA-256 function that hashes to a particular (output) value, without revealing the preimage. One of the most efficient implementations of a circuit for the SHA-256 algorithm consists of 27,904 arithmetic gates (Zcash2016). Proving knowledge of a SHA-256 preimage would then require transmitting about 5MB of data in both the initial commitment and opening rounds of the protocol above, and would require about 200,000 elliptic curve operations for both the prover and the verifier (each taking several seconds of processor time).

[0026] There are several methods that have been developed to significantly improve the performance of the parallel Σ-protocol approach for proving arithmetic circuit satisfiability. Known approaches (Non-Patent Document 5, Non-Patent Document 6) involve batching commitments to circuit wire values ​​to substantially reduce the size of the data that must be sent from the prover to the verifier (i.e., reduce the communication complexity). These methods enable proof systems in which the communication complexity is reduced from O(n) to O(√n) or O(log(n)).

[0027] Also, for comparison, proving the satisfiability of the same SHA circuit, the protocol (Non-Patent Document 5) has a proof key size of only 5 KB and a key generation time of 180 ms. The proof size is 24 KB and takes about 4 seconds to generate, and the proof also takes about 4 seconds to verify.

[0028] These methods will not be described in full here, except to explain the main vector batching protocol they employ in the following steps. This follows the same properties as the usual Pedersen commitment, but can be implemented for n elements (m = m1,…,m n ) only requires sending a single group element: 1. The prover and verifier agree on a group element F ← G. 2. The prover generates n random numbers x1,…,x n ←Z p Generate. 3. The prover finds point K. i =x i × F for i = 1, ..., n. These values ​​form the proof key PrK that is sent to the verifier. 4. The prover generates a random number: r ← Z p Generate. 5. The prover makes a commitment:

number

[0029] [Non-Patent Document 1] Campanelli, Matteo, et al. "Zero-knowledge contingent payments revisited: Attacks and payments for services." Commun. ACM (2017). [Non-Patent Document 2] https: / / github.com / zcash-hackworks / pay-to-sudoku [Non-Patent Document 3] Parno, Bryan, et al. "Pinocchio: Nearly practical verifiable computation." Security and Privacy (SP), 2013 IEEE Symposium on. IEEE, 2013. [Non-Patent Document 4] https: / / github.com / scipr-lab / libsnark [Non-Patent Document 5] Bootle, Jonathan, et al. "Efficient zero-knowledge proof systems." Foundations of Security Analysis and Design VIII. Springer, Cham, 2015. 1-31. [Non-Patent Document 6] Groth, Jens. "Linear Algebra with Sub-linear Zero-Knowledge Arguments." CRYPTO. Vol. 5677. 2009. [Non-Patent Document 7] https: / / bitcointalk.org / index.php?topic=81865.msg901491#msg901491 [Non-Patent Document 8] Bootle, Jonathan, et al. "Efficient zero-knowledge arguments for arithmetic circuits in the discrete log setting." Annual International Conference on the Theory and Applications of Cryptographic Techniques. Springer, Berlin, Heidelberg, 2016. [Non-Patent Document 9] Standards for Efficient Cryptography (SEC) (Certicom Research, http: / / www.secg.org / sec2-v2.pd [Non-Patent Document 10] Bitcoin Developer Reference (http: / / bitcoin.org / en / developer-reference) Summary of the Invention

[0030] Generally, the present invention resides in a computer-implemented method for enabling zero-knowledge proofs or verifications of statements. Using the methods herein, a prover can prove to a verifier that statements are true while keeping evidence for the statements private. These statements are compound statements that simultaneously require both arithmetic circuit satisfiability and a dependent statement about the validity of the public key (a key statement proof).

[0031] The methods herein can be used in known protocols for circuit satisfiability, such as existing discrete logarithm-based zero-knowledge proof protocols, and are particularly suited to protocols that do not require the use of bilinear pairing-friendly elliptic curves.

[0032] The method includes a prover sending a verifier a set of data including a statement that is about a given function circuit output and elliptic curve point, where the function circuit input is equal to the corresponding elliptic curve point multiplier(s). The data includes individual and / or batched wire commitments for the circuit, inputs, and outputs of the statement. The prover may include in the data, or may have previously shared, a specification of the or each elliptic curve used in the statement. The prover then sends an opening in response to a challenge from the verifier. Alternatively, the prover may further include a proof key.

[0033] Using the data received from the prover, the verifier can determine that the circuit is filled, verifying the statement and therefore determining that the prover holds evidence for the statement. Elliptic curve points can also be computed. Upon receiving the data, the verifier determines, through computation, that the data matches the statement. The present invention is particularly suited to zero-knowledge proofs of hash preimages and elliptic curve private key equivalence.

[0034] Thus, in accordance with the present invention there is provided a method and system as defined in the accompanying claims.

[0035] It is therefore desirable to provide a computer-implemented method for enabling zero-knowledge proofs or verifications of a statement (S), in which a prover proves to a verifier that the statement is true while keeping a proof (W) for the statement private. This proof can be an explicit proof.

[0036] A computer-implemented method may be provided for enabling zero-knowledge proofs or verifications of a statement (S) in which a prover proves to a verifier that the statement is true while keeping a proof (w) for the statement private, the method comprising: Prover to Verifier: A statement (S) represented by an arithmetic circuit having m gates and n wires configured to implement a function circuit to determine, for a given function circuit output (h) and elliptic curve point (P), whether a function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s); individual wire commitments and / or batched commitments for the wires of the circuit; Function circuit output (h), A proof key (PrK), and transmitting This allows the verifier to determine that the circuit is satisfied and compute the elliptic curve point (P) to verify the statement, and therefore determine that the prover holds evidence (w) for the statement.

[0037] The method includes a prover sending a set of data (a set of data) to a verifier. The set of data includes statements having an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine, for a given function circuit output (h) and elliptic curve point (P), whether a function circuit input (s) to or on a wire in the function circuit is equal to a corresponding elliptic curve point multiplier (s). The function circuit may be a circuit that implements a hash function function. A preimage for a hash function circuit or on a wire in the function circuit may be equal to the corresponding elliptic curve point multiplier.

[0038] The data also includes individual wire commitments and / or batched commitments. The or each commitment may be the wire inputs and outputs (which are encrypted) for the gates of the circuit. The data also includes the inputs. The inputs serve as key openings for the wires of the arithmetic circuit [elliptic curve point (P)]. Either the prover or the verifier may name the wires. The input or key opening may be for the first wire in the circuit. The data also includes the function circuit outputs. The data may include a specification of the or each elliptic curve used in the statement.

[0039] After sending the data, the prover receives a challenge value from the verifier and responds with an opening, which may be a value statement according to the Σ (Sigma) protocol. An opening value may be for each gate of the circuit that allows the verifier to determine that the statement is true and to compute the elliptic curve point.

[0040] As an alternative to waiting for a challenge, the prover may also send a proof key to the verifier. The proof key may be generated from data that is part of the proof. The proof key may be a hash of one or more of the random numbers used in the proof.

[0041] The data sent to the verifier enables the verifier to determine that the circuit is filled, compute the elliptic curve points, and verify the statement, and therefore determine that the prover holds evidence for the statement.

[0042] The set of data sent to the verifier and / or the opening to the challenge sent to the verifier can function like a key that is created independently of the verifier. The challenge from the verifier is analogous to determining the identity of the prover and the integrity of the key.

[0043] The input or key opening may be to the first wire in the arithmetic circuit. However, since proving knowledge of an intermediate wire is more difficult than proving knowledge of the first wire, a random wire is preferably selected. Furthermore, selecting a random wire other than the first wire is more robust and prevents discovery of the proof or evidence by a malicious third party.

[0044] It would be equally desirable to provide a complementary computer-implemented method for enabling zero-knowledge proofs or verifications of a statement, where the verifier verifies that the statement is true without knowing the evidence (w) for the statement by analyzing data received from the prover. To be clear, the method of the present invention extends to the reverse action taken by the verifier in a plug-and-socket fashion. The present invention extends to full collaboration between the prover and the verifier.

[0045] In addition to or instead of waiting for the challenge value, the prover may send the verifier a random value that enables the verifier to determine that the statement is true and to calculate the elliptic curve point. Upon receiving the data from the prover, the verifier may instead receive a random value that enables the verifier to determine that the statement is true and to calculate the elliptic curve point. The random value may be a function of at least one commitment. This function may be a hash function.

[0046] The random value or challenge may be replaced to improve the convenience and efficiency of the process. There are also risks associated with the verifier generating a non-random challenge in an attempt to extract information about the evidence. Furthermore, replacing the challenge value with a random value provided by the prover converts the method from interactive to non-interactive. The prover can generate a proof offline that can be independently and publicly verified. The random value may be the output from a hash function. Using the output from a hash of one or more commitments instead of a random value (x) exploits the Fiat-Shamir principle.

[0047] The random value may be computed by hashing the concatenation of all the commitments generated by the prover and sent to the verifier.

[0048] Commitment is W i =Com(w i ,r i ), Com is a commitment to function circuits, w i is the wire value, r i is a random number, i.e., it is different for each wire commitment, i is the wire type, Com(w,r)=w×G+r×F, F and G are elliptic curve points.

[0049] The input to wire l in the arithmetic circuit is ko=r l ×F, ko is the key opening input, r l is a random number, F is a point on an elliptic curve.

[0050] The wire may be the first wire in a circuit.

[0051] The verifier can verify that the circuit satisfies elliptic curve point subtraction: pk l =Com(w l ,r l )-ko l We can compute the public key for wire l via

[0052] The prover may send a batch of wire commitments and may generate random numbers to compute elliptic curve points for each wire to form a proof key.

[0053] Batched commitments regarding evidence include:

number

[0054] The input to wire n in an arithmetic circuit is

number

[0055] The input may be to the first wire.

[0056] The verifier performs elliptic curve operations:

number

[0057] The prover may further send a fully open commitment on at least one wire. The method may use Pedersen commitments. The statement may use only one arithmetic circuit for the function circuit. The function circuit may implement a hash function, preferably a SHA-256 hash function.

[0058] The method can be used to enable zero-knowledge attached transactions (which may be zero-knowledge attached transactions) for data such as cryptographic keys by a prover, where the prover cooperates with a verifier to verify the data provided (which may be a vanity address) and the data received (which may be a payment in the form of a UTXO), establishes a communication channel with the verifier (which may be open), and the prover receives from the verifier an elliptic curve public key pkB that the verifier generated from a secure random private key skB. B Receive the pk V =sk V ×G, where G is an elliptic curve point, The prover is, data = pk V +i×G.

[0059] The prover may perform a search for the required pattern in the Base58 encoded addresses obtained by varying i. P = i × G, and the output f(i) from a function circuit whose function circuit input (e.g., preimage) is the lock value i, to the verifier.

[0060] The prover proves that the input to the function circuit is pk P Therefore, the verifier can verify the proof and determine that pk=pk. V +pk P By verifying that the address corresponding to matches the agreed upon pattern, knowing the lock value i may enable derivation of a perfect secret key for the data and identify that the lock value i is a function circuit input to the function circuit.

[0061] The prover may receive a transaction Tx1 that includes an output that includes the received data, which may be accessed by a signature from the prover and a function circuit input. The transaction may be a hash time lock function. The received data may provide access to the UTXO.

[0062] the prover can sign the transaction and broadcast it on the blockchain, which is mined into a block, allowing the prover to access the data from the output of transaction Tx1 by providing a second transaction Tx2 that provides a signature and a value i to unlock the transaction, which is then revealed on the blockchain, thus allowing the verifier to identify the lock value i and access the data provided by the prover; sk=sk B +i, pk=sk×G.

[0063] The data provided by the prover may include a vanity address, and the data received from the verifier may include a cryptocurrency payment (e.g., a UTXO).

[0064] The transaction can be made completely atomic and trustless, and the buyer only gets paid if they provide a valid value i, which is openly revealed on the blockchain. Due to the splitting of the private key, the value revealed on the blockchain is useless to anyone else and does not compromise the security of the full private key.

[0065] A computer-implemented method may involve a prover performing a trustless and fair data exchange with a verifier (without a third-party centralized exchange). This can be described as a cross-chain atomic swap or atomic trade, since in this context it refers to a fair exchange where either both parties complete the transaction or neither completes it. This swap can be performed across blockchains that support scripting functionality that allows for hashed time-locked contracts.

[0066] The prover has access to a first piece of data, e.g., a UTXO of 1 Bitcoin on a first blockchain, and the verifier has access to a second piece of data, e.g., 100 LTC on a second blockchain, and the prover and verifier agree to exchange data. The method includes the prover generating a key pair for the second blockchain and sending the public key to the verifier and retaining the private key; the prover receiving the verifier public key for the first blockchain, and the verifier generating a key pair for the first blockchain and sending the private key (s B ), and the prover transmits the statement, one or more commitments, the input or key-opening and function circuit output (h), and the elliptic curve specification.

[0067] The prover creates a first blockchain transaction Tx that sends the first data to the common public key address. A and broadcast the transaction on the first blockchain network, the address being determined by the sum of the input and the verifier public key. This data can be accessed by the prover after no swap has been performed within 24 hours.

[0068] The prover creates a second blockchain transaction, Tx B The transaction can be verified by adding a first blockchain transaction Tx A A transaction is created by the verifier and broadcast on a second blockchain network after verifying that the transaction contains the 100 LTC token, the transaction sending a second data in the form of 100 LTC to the prover public key address that is accessible by the prover with a valid signature on the prover public key address and a value that is a function circuit input that determines the function circuit output. This data can be accessed by the verifier after no swap has been performed within 24 hours.

[0069] The prover creates a second blockchain transaction, Tx B is included on the second blockchain, and accesses the second data by providing a signature and the above value, which is the function circuit input of the function circuit output, and thus the verifier observes the above value, which is the function circuit input that determines the function circuit output, and (from the isomorphism of elliptic curve point multiplication, s B +s P C The first data may be accessed by providing a signature using the second (secret) private key.

[0070] The data exchanged may be cryptocurrency, the first data corresponding to an amount of the first cryptocurrency, preferably Bitcoin, and the second data corresponding to an amount of the second cryptocurrency, preferably Litecoin.

[0071] As mentioned above, every action by the prover requires a reverse action by the verifier to verify the proof. The invention extends to methods or actions performed by the verifier. Thus, there is provided a computer-implemented method for enabling zero-knowledge proof or verification of a statement, in which the prover attests to the verifier that the statement is true, preferably explicitly, while keeping the evidence for the statement private, the method comprising the verifier receiving from the prover: a statement having an arithmetic circuit with m gates and n wires configured to implement a function circuit, preferably a hash function, to determine whether a function circuit input or preimage to the function circuit is equal to an elliptic curve point multiplier for a given function circuit, and preferably for a specified function circuit output and elliptic curve point. The verifier also receives individual wire commitments and / or batched commitments, which are encrypted wire inputs and outputs for the wires of the circuit, inputs or key openings for wires in the arithmetic circuit (preferably wires other than the first wire), and the function circuit output (h). The verifier may also receive a specification of the or each elliptic curve used in the statement. The verifier can send a challenge value to the prover and then receive an opening. The opening can follow the Σ protocol and can include values ​​for each gate of the circuit that allows the verifier to determine that the statement is true and to compute the elliptic curve point. Additionally or alternatively, the verifier can receive a proof key from the prover.

[0072] The verifier then determines that the circuit is satisfied, computes the elliptic curve point (P), and therefore determines that the prover holds evidence (w) for the statement.

[0073] This may be accomplished by proving with zero knowledge that the prover knows the values ​​for each gate of the statement circuit, using the Sigma protocol if the proof is interactive, or using a proof key if the Fiat-Shamir heuristic is used. The verifier may receive the Σ_zero and Σ_prod commitments for each gate from the prover, respond with a challenge value, receive an opening value from the prover, and check against the commitments. The verifier may verify that the circuit is filled by computing the public key for wire l via elliptic curve point subtraction. The verifier may verify that each public key for each wire matches the key(s) specified in the statement. The verifier may determine that the fully opened wires match the specifiable values ​​in the statement, completing the verification.

[0074] It is also desirable to provide a computer-readable storage medium having computer-executable instructions which, when executed, configure a processor to perform a method performed by a prover, by a verifier, or by a prover and a verifier working together.

[0075] It is also desirable to provide an electronics device having an interface device, one or more processors coupled to the interface device, and a memory coupled to the one or more processors, the memory storing computer-executable instructions that, when executed, configure the one or more processors to perform the methods claimed herein. It is also desirable to provide a node of a blockchain network configured to perform the methods claimed herein. It is also desirable to provide a blockchain network having such a node. [Brief description of the drawings]

[0076] BRIEF DESCRIPTION OF THE DRAWINGS Aspects of the invention will be elucidated and elucidated with reference to the embodiments described herein. Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, which include: FIG. [Figure 1] 1(a) and (b) are diagrams used above in the technical background section to describe the basic system for interactive zero-knowledge proofs. FIG. 1(a) is a schematic diagram of a multiplication gate with left and right wire inputs and one wire output, and FIG. 1(b) is a schematic diagram of an arithmetic circuit with three gates, three input wires, one output wire, and two internal wires. [Diagram 2] FIG. 1 is a schematic diagram of a composite circuit for a statement, including arithmetic circuits for a hash function and an elliptic curve multiplication. [Diagram 3] FIG. 2 is an alternative schematic diagram of the arithmetic circuit for the compound statement of FIG. 1 in which only one arithmetic circuit is required. [Figure 4] FIG. 1 is a schematic diagram of an arithmetic circuit with four gates and five wires, each of which has its own public key that is revealed or opened from a wire commitment with a key-opening value. [Diagram 5] is a schematic representation of the data exchanged between prover and verifier for proof of a statement S with a circuit description and the first wire carrying the corresponding public key. [Figure 6] 4 is another schematic representation of the data exchanged between the prover and the verifier. [Figure 7] FIG. 5 is a schematic diagram of the checks performed by a verifier to verify that the circuit of FIG. 4 is satisfied, that the input wires have the required public keys, and that the hashes of the output wires have the required values. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0077] Overview The present invention enables efficient zero-knowledge verification of compound statements that simultaneously require both arithmetic circuit satisfiability and dependent statements about the validity of a public key (key statement proofs). A public-key elliptic curve specification is employed within an isomorphic commitment function to prove circuit satisfiability. This enables the proof of public-key statements that correspond to private keys used as circuit inputs and / or outputs in an efficient manner.

[0078] The proof size and computational cost of generating proofs for statements involving both circuit satisfiability and elliptic curve key pairs can be greatly reduced. The method herein can be easily incorporated into existing discrete logarithm-based zero-knowledge proof protocols for circuit satisfiability that do not require the use of bilinear pairing-friendly elliptic curves. The method is fully compatible with the Bitcoin secp256k1 standard.

[0079] Two applications are described that involve fair exchange transactions between two parties on a blockchain, such as the Bitcoin blockchain. The first involves zero-knowledge collateral payments for trustless sales of outsourced vanity addresses, which requires a zero-knowledge proof of equality of a SHA256 hash preimage and an elliptic curve (e.g. Bitcoin) private key. The second involves improving the security of cross-chain atomic swaps, which requires a proof that a SHA256 hash preimage equals an unknown private key (with a provided public key) multiplied by a provided nonce.

[0080] General Solution The present invention relates to a method that allows the proof of a certain class of compound statements involving an elliptic curve public / private key pair (based on elliptic curve point multiplication).

[0081] It is believed to be impractical to use zkSNARKs to prove statements involving arbitrary cryptographic elliptic curve key operations, and therefore the method uses information about elliptic curve public keys that is extracted directly from the "homomorphic hiding" (or commitment scheme) used to construct general circuit satisfiability proofs. The particular type of elliptic curve involved in the method's statements is the same as that used in the circuit commitment scheme.

[0082] However, SNARK methods require pairing operations and therefore require special bilinear pairing-friendly elliptic curves, which makes the use of zk-SNARKs impossible, as the elliptic curves used on some blockchains are not compatible with bilinear pairing-friendly elliptic curves.

[0083] As an example, the statement pertaining to Bitcoin public keys uses the Bitcoin secp256k1 curve, which is incompatible.

[0084] Our method is therefore compatible with other protocols for proving arithmetic circuit satisfiability that do not rely on pairings and have fewer cryptographic assumptions. Overall, our method is more efficient than zkSNARKS because fewer computations are required, resulting in smaller proof sizes for trustless exchange applications.

[0085] As an example, the schematic in Figure 2, which represents a composite circuit for "Statement 1" below, includes both a hash function and an elliptic curve multiplication subcircuit. In Figure 2, the schematic has three inputs: a private key 's' with its corresponding counterpart public key 'P' and a value 'h' (which is a hash of the private key 's'). The schematic includes two arithmetic circuits, one that performs a hash on the private key and a second that performs an elliptic curve multiplication on the private key. The outputs of these circuits are compared to the inputs.

[0086] Note that these internal gates are for illustration purposes only. The circuit checks that the output of the hash is equal to an Elliptic Curve (EC) public key. Only the input 'h', 'P', and the output are fully revealed to the verifier. All other values ​​are encrypted.

[0087] Statement 1 “Given the output h of a hash function (H) and an elliptic curve point P (the public key), the preimage of the hash s (i.e., h = H(s)) is equal to the elliptic curve point multiplier (the private key, i.e., P = s × G, where G is the elliptic curve generator point).”

[0088] The method allows the prover to prove this particular statement with zero-knowledge. Examples of applications that benefit from such a method are described below for trustless data exchange (e.g., outsourced Bitcoin vanity address sales) and anonymized secure cross-chain atomic swaps.

[0089] Verification that statement 1 is true can be determined, as an example, using the following pseudocode function which takes inputs 'h', 'P', and 's' and outputs '1' if the statement is true, and '0' otherwise: int verify(h,P,s) { if(h == H(s) && P == sx G) { return 1 } else { return 0 } }

[0090] Verifying ‘Statement 1’ with zero knowledge, i.e., in a zkSNARK system where the prover keeps the value of ‘s’ secret from the verifier, would require arithmetic circuits for both the hash function and the elliptic curve point multiplication, as shown in Figure 2.

[0091] While arithmetic circuits for the SHA-256 hash function are widely used and optimized, typically containing fewer than 30,000 multiplication gates, there are no known examples of arithmetic circuits for cryptographic elliptic curve point multiplication implementations in the literature, and even if such circuits were known, they would be impractical due to their size and complexity and would contain many more gates.

[0092] The method works with a complete arithmetic circuit for a single hash function as shown in Figure 2, which has a schematic diagram of the arithmetic circuit for the key statement proof and compound statement 1 using only one arithmetic circuit for the hash function. The circuit checks that the output of the hash is correct and that the public key is equal to the EC encrypted input (the key statement proof). The values ​​highlighted in blue, i.e. input 'h', 'P' and output '1', are revealed to the verifier, all other values ​​are encrypted.

[0093] Using the circuit in Figure 3, a prover can explicitly prove, via circuit satisfiability, that the hash of a private key 's' is 'h', and that the corresponding public key 'P' of the key pair is equal to 's × G', where G is the elliptic curve generator point. The private key 's' is the preimage of the hash, or input to the function, and is not revealed to the verifier when proving the statement.

[0094] Needless to say, verifying that 's × G' is equal to 'P' can be extracted from the circuit proof with negligible additional computational cost by using the elliptic curve required in the commitment scheme as part of the proof protocol. Such an operation is called a 'key-statement proof' and uses a commitment-opening procedure called 'key-opening'.

[0095] Technical effects The well-known zk-SNARK (Zero-knowledge Succinct Non-interactive Arguments of Knowledge) is one implementation of a general-purpose proof system for arithmetic circuit satisfiability. In the SNARK framework, a statement encoded as an arithmetic circuit is transformed into a construction called a Quadratic Arithmetic Program (QAP) consisting of a set of polynomials. The statement can then be proved by demonstrating the validity of this set of expressions at a single point. The main advantages of the SNARK method are that the verifier only needs to perform a few elliptic curve (pairing) operations (taking a few milliseconds), and the proofs are very small (288 bytes) and independent of the circuit size.

[0096] The very small proof and verification times achieved by SNARK methods come at the expense of a trust setup, non-standard cryptographic assumptions, and a much heavier computational burden imposed on the prover. SNARK methods also require the use of elliptic curve bilinear pairings. However, the use of computationally feasible bilinear pairings requires the use of special 'pairing-friendly' elliptic curves. This precludes the use of many standard cryptographic elliptic curve parameter sets, including Bitcoin secp256k1. Statements involving general elliptic curve point multiplication must then use explicit circuits, which can be very large.

[0097] As a comparison with the Σ protocol approach to proving SHA circuit satisfiability described in the previous section, when using the SNARK (Pinocchio) framework, the proof key takes about 10 seconds to generate, is about 7MB in size, and the proof also takes about 10 seconds to generate. However, the proof size is 288B and takes only about 5ms to verify (Non-Patent Document 8).

[0098] Furthermore, incorporating explicit elliptic curve multiplication (the key statement) into the circuitry multiplies both the proof key size and the proof generation time by at least an order of magnitude.

[0099] The present invention enables zero-knowledge proofs of statements involving elliptic curve public-private key relations, along with general arithmetic circuit satisfiability. This is achieved with negligible computational cost beyond proving arithmetic circuit satisfiability, obviating the need to create explicit arithmetic circuits for elliptic curve point multiplication operations, which would significantly increase the computational cost of the proofs.

[0100] implementation Below, implementations of the present invention are described for both batch and non-batch commitment-based zero-knowledge proof systems.

[0101] In these examples, the zero-knowledge proof protocol involves two parties, a prover (P) and a verifier (V). The goal of the protocol is for the prover to convince the verifier that a given statement (S) is true, while keeping information about the evidence for that statement private. The statement is given by an arithmetic circuit (C) with m gates and n wires, and an elliptic curve public key: pk corresponding to one (or more) of the circuit wire values. l where the subscript l is the wire index of the key statement. Additionally, the statements may also contain assertions about fully open (public) wire values ​​(i.e., the public inputs / outputs of the circuit).

[0102] The elliptic curve public key(s) specified in the statement correspond to a target elliptic curve specification, which is specified by the complete set of elliptic curve parameters: T = (p, a, b, G, n, h).

[0103] In the case of the Bitcoin script, these parameters are specified by the secp256k1 (Non-Patent Document 9) specification. This specification includes a base generation point G. In addition to specifying the base point, the statement must also specify a second point F, where F = f × G, and f is a factor of Z. p , an element of . Because allowing the prover to freely choose f could allow the prover to generate false proofs, the value of f must be either provably random (e.g., the Bitcoin genesis block hash) or a “nothing up my sleeve” number, such as the first 256 bits of the binary representation of pi.

[0104] Batched and unbatched commitments are described with reference to Figure 4, which is a representative arithmetic circuit with four gates and five wires. An input wire (w1) has its public key revealed or opened from a wire commitment W1 with a 'key-opening' value ko1.

[0105] Implementation – Individual Wire Commitment Using Figure 4 as an example, 'key openings' are individual commitments for each wire in the circuit that are made by the prover and sent to the verifier. These key openings follow the well-known Σ protocol for arithmetic circuit satisfiability. Figure 5 shows the data exchanged between the prover and the verifier.

[0106] Satisfiability is achieved by including several steps: 1. For each wire i in the circuit, i = 1, …, n, a commitment is made using the Pedersen commitment: W i =Com(w i ,r i ) Where: Com(w,r) ​​= w×G+r×F 2. For a circuit wire l that requires the illumination of the corresponding public key (key statement proof), the prover also performs key opening: ko l =r l ×F Also send. 3. Optionally, if the prover requires that the circuit wire j be openly revealed (fully exposed), then the prover must provide the complete opening tuple: (w j ,r j ) Send. 4. Then, each gate in the circuit is proved to be satisfied with zero knowledge using the Σ protocol, which means that the prover can prove that for each gate, zero and Σ prod It involves computing and sending a commitment (i.e., B, or C1, C2, C3, respectively), the verifier responding with a challenge value (x), then the prover sending opening values ​​(z and e values), and the verifier verifying the commitment. 5. Once the verifier confirms that the circuit is satisfied, the verifier then performs elliptic curve point subtraction: pk l =Com(w l ,r l )-ko l Calculate the public key on wire l via 6. Then, the verifier checks each pk l The validation is completed by checking that the match the key(s) specified in the statement (and that all open wires match the specified values).

[0107] Detailed implementation – individual wire commitments With continued reference to Figure 4, we provide an explicit example that details the individual commitments and verifications of this example. It describes verifying the satisfiability of a simple arithmetic circuit with both a key statement proof of one of the wires and full disclosure of one other wire.

[0108] Circuit C shown in Figure 4 has five wires w i (i=1,…,5) and four gates g j (j=1,...,4). Gates 1 and 3 are addition gates, and gates 2 and 4 are multiplication gates.

[0109] The prover and verifier agree on a statement that includes the circuit, the value on wire 5, and the public key on wire 1, along with the elliptic curve and commitment specifications. The statement (S) that the prover wants to prove to the verifier that it is true is: "I am trying to find a satisfying assignment for a circuit C (i.e., a set of wire values ​​{w i} i=1 5 where Wire 1 has public key P (i.e., P = w1 × G) and Wire 5 has value h (i.e., w n =h)” It is.

[0110] The values ​​of wires 1 through 4 are not revealed. The prover and verifier then interact as shown in Figure 6 and described below: 1. The prover generates five random blinding values ​​(r1,…,r5), then computes five wire commitments (W1,…,W5) and sends them to the verifier. 2. The prover computes the key opening for wire 1: ko1 = r1 × F and sends it to the verifier. 3. The prover sends the complete opening information about wire 5 (w5, r5) to the verifier. 4. For the addition gates (g1 and g3), the prover must first determine B1 and r B3 Commitment to zero: B1 = Com(0,r B1 ) and B3 = Com(0,r B3 ) and send them to the verifier. 5. For multiplication gates (g2 and g4), the prover generates a commitment as follows: About Gate 2: C 12 =Com(t 12 ,t 32 ) C2 = Com(t 22 ,t 52 ) and C3=t 12 ×W1+t 42 ×F About Gate 4: C 14 =Com(t 14 ,t 34 ) C2 = Com(t 24 ,t 54 ) and C3=t 14 ×W3+t 44 ×F Generate a commitment as follows, where t xx The values ​​are random blinding nonces. The prover sends these commitments to the verifier. 6. The verifier then generates a random challenge value x and sends it to the prover. Alternatively, the verifier may generate the value x by hashing the concatenation of all the commitments using the Fiat-Shamir heuristic. 7. For addition gates (g1 and g3), suppose the prover does the following opening: z1=x(r1+r1-r2)+r B1 z3=x(r2+r1-r4)+r B3 and send them to the verifier. 8. For multiplication gates (g2 and g4), suppose the prover does the following opening: e 12 =w1x+t 12 e 22 =w2x+t 22 z 12 =r1x+t 32 z 22 =r2x+t 52 z 32 =(r3-w1r2)x+t 42 e 14 =w3x+t 14 e 24 =w4x+t 24 z 14 =r3x+t 34 z 24 =r4x+t 54 z 34 =(r5-w3r4)x+t 44 and send them to the verifier. 9. Finally, the verifier checks for equality. If these pass, the proof is verified.

[0111] The verification performed by the verifier is summarized in Figure 7, where the checks in the inner box verify that the circuit is completed and that the first wire has the required public key and the fifth wire has the required value.

[0112] The challenge 'x' in Figures 5 and 6 provides an interactive proof, with back and forth communication between the prover and the verifier.

[0113] This interaction can be inconvenient when zero-knowledge contingent payments (ZKCPs) are made, since the seller and buyer may not be available or online at the same time. Also, the buyer (verifier) ​​may want the proof to be publicly verifiable, for example, it may be part of an advertisement for a digital good.

[0114] Furthermore, the proof is strictly zero-knowledge only in the perfect special-honest verifier model, i.e., when it is assumed that the verifier generates truly random numbers as challenges and does not choose challenge values ​​to try and extract information about the proof.

[0115] To solve these problems, the Fiat-Shamir heuristic is applied, which replaces the random challenge value 'x' with the output of the hash of the commitment created by the prover. In the random oracle model (where the output of a cryptographic hash function is considered truly random), the prover cannot cheat and the verifier can inspect the generated challenge value.

[0116] Therefore, this example can be improved by using the Fiat-Shamir heuristic to transform the interactive proof system into a non-interactive one, and the prover can generate proofs that can be independently and publicly verified offline.

[0117] More specifically, the challenge value (x) is replaced with a value computed by hashing (e.g., with SHA-256) the concatenation of all of the commitments generated by the prover (i.e., all of the wire commitments and all of the B, C1, C2, and C3 commitments for the union and product gates, respectively).

[0118] Implementation – Batched Vector Commitment Compressed proof systems for circuit satisfiability with batching of vector commitments (Non-Patent Document 8, Non-Patent Document 6) use the method described below, which allows to extract key statement proofs from batched circuit wire commitments.

[0119] To avoid repetition, the complete process will not be described, but the following steps focus on illustrating the generation of a batched wire commitment and its inclusion of a specified public key. In the following steps, given a wire l given a key opening, and n wires are batched together in a vector commitment, a batched commitment is generated as follows: 1. The prover generates n-1 random numbers x1,…,x n-1 ←Z p Generate. 2. The prover finds an elliptic curve point K i =x i ×G(for i=1,…,n-1). Add these values ​​to K n =G together form the proof key PrK that is sent to the verifier. 3. The prover generates a random value: r ← Z p Generate. 4. w n is to be keyed, and the prover obtains the wire value w i Commitment to a vector w (for i=1,…,n):

number

number

number

[0120] Summary of the Invention Proofs of hash preimages and elliptic curve private key equivalence can be used in a number of applications. Below we describe two applications that outline the construction of instantiated key-statement zero-knowledge proofs for their use.

[0121] The following statement S is, for example purposes, a more specific version of statement 1 above: S: “Given a SHA-256 hash function (H) with public output h and a public point P on the secp256k1 elliptic curve, the private preimage s of the hash (i.e., h = H(s)) is equal to the elliptic curve point multiplier (i.e., the corresponding private key, i.e., P = s × G).”

[0122] In the example provided, this statement is made by asserting that the input wire (w1) is the private key of the public point P, and that the output wire (wn) is equal to h, together with the SHA-256 hash function C SHA256 (n wires w i (i=1,...,n) and m gates, i.e.

number

[0123] Thus, to fully verify this statement, the prover must demonstrate to the verifier that it knows the satisfying assignment to the SHA256 circuits using a secp256k1-based commitment scheme, and then prove the key-opening (ko1) for wire 1 and the complete-opening (w n ,r n The verifier must simply provide the input wire (w1) and the output wire (w2) that is completely open. n The values ​​of any of the other wires except for

[0124] Application I The example of the present invention described in the implementation section above can be applied to a ZKCP for outsourced Bitcoin vanity addresses, which represent data exchanged for payments or access to resources.

[0125] Bitcoin addresses are encoded in a human-readable alphanumeric format (Base58 encoding) to make them easy to publish, copy and transcribe. The use of this format has led to the popularity of so-called vanity addresses, such as the one shown below: [Outside 1] The key space is brute-force searched to find private keys that produce addresses containing the desired (such as a name) string, such as TIFF0007653211000009.tif25170.

[0126] Deriving vanity addresses with meaningful patterns is computationally expensive (e.g., the address shown above takes roughly 10 13 It is common to outsource the lookup (which previously required the generation of distinct public keys), and there are several online marketplaces where vanity addresses are sold on consignment. This can be done securely using the isomorphism property of elliptic curve point multiplication [7].

[0127] While outsourcing the generation is secure, selling vanity addresses is untrusted: the buyer must get the needed value before the seller is paid, or the seller must be paid before handing over the needed value, or both must trust an escrow service. The present invention can be used to enable trustless sales of vanity addresses via ZKCP. Below we describe the steps taken between the buyer / verifier and the seller / prover. 1. A buyer and seller agree on a desired vanity pattern (Str) and a price (a Bitcoin) and establish a communication channel, which does not need to be secure. 2. The buyer generates a secure random private key skB and a corresponding elliptic curve public key, and sends the public key pk B =sk B ×G. 3. Buyer pk to seller B Send. 4. Then, the seller changes i to pk=pk B + i × G. Perform a search for the required pattern in the Base58 encoded address derived from G. 5. If an address with the required pattern is found, the seller saves i and signals the buyer to send pk s = i × G and send the SHA256 hash H(i). 6. The seller also assumes that the preimage for H(i) is pk s The buyer is provided with a proof that the private key corresponds to the 7. The buyer verifies the proof and confirms that pk=pk B +pk s verifies that the address corresponding to i matches the agreed pattern. At this point (by the proof), the buyer knows that, by learning the value i, he or she has a complete private key (sk B +i) and that a particular value i hashes to h=H(i). 8. The buyer then constructs a hashed time-locked contract (HTLC) transaction Tx1 that contains an output with the agreed upon fee (a). This output can be unlocked in two ways: i. At any time, using the signature from the seller and the hash preimage i, ii. With a signature from the buyer after a specified time, for example using the CHECKLOCKTIMEVERIFY (OP_CLTV) script op code, which can be used to prevent outputs from being consumed until a specified time or block height; Can be unlocked. 9. The buyer then signs and broadcasts this transaction to the blockchain, where it is mined into a block. 10. Once confirmed, the seller can claim the fee on the output of Tx1 by providing a transaction Tx2 supplying his signature and the value i to unlock the hash lock, and the value i is revealed on the blockchain. 11. The buyer will send the final vanity address private key sk=sk B +i can be calculated, where pk = sk × G. 12. If the buyer does not supply a value i before the specified OP_CLTV time, the seller can provide a signature to reclaim the fee (to prevent fees from being lost due to an uncooperative buyer).

[0128] The transaction is then fully atomic and trustless, the buyer only gets paid if they provide a valid value i, which is publicly revealed on the blockchain: due to the private key splitting, this value is not useful to anyone else and does not compromise the security of the full private key.

[0129] Application II The example of the invention described in the implementation section above can be applied to a private data exchange between two parties, each with the data to be exchanged recorded on a respective, different blockchain.

[0130] More specifically, the present invention can be applied to privacy-preserving cross-chain atomic swaps, also known as atomic trades, which are a trustless and fair exchange protocol that leverages blockchain transaction mechanisms. This protocol is used to trade two different cryptocurrency tokens on two different blockchains without a third-party centralized exchange. The word 'atomic' in this context refers to the nature of the fair exchange, where either both parties complete the transaction or neither completes it.

[0131] An example of a known basic protocol is executed according to the following steps: To be secure, both cryptocurrencies used in the swap must have scripting capabilities that allow for hashed and time-locked contracts. The swap involves two parties, Alice and Bob. In this example, Alice holds 1 Bitcoin and agrees to trade it for Bob's 100 Litecoin. 1. Alice sends the Litecoin public key P to Bob. A Generate. 2. Bob sends the Bitcoin public key P to Alice. B Generate. 3. Alice generates a secure random number x. 4. Alice computes the SHA-256 hash of x: h = H(x). 5. Alice submits the following Bitcoin transaction Tx A , i.e. i. Calculate 1 Bitcoin by P using a valid signature AND a value that hashes to h. B Pay to, ii. OR refund 1 Bitcoin to Alice after 24 hours; Bitcoin transaction Tx A Create a. 6. Alice broadcasts the transaction to the Bitcoin network. 7. Bob sends Tx A When we observe that the following Litecoin transaction Tx B , i.e. i. 100 Litecoins is hashed to P using a valid signature AND a value that hashes to h. A Pay to, ii. OR refund Bob the 100 Litecoins after 24 hours, Bitcoin transaction Tx B Create a. 8. Bob broadcasts the transaction to the Litecoin network. 9. Once the transaction is confirmed, Alice can claim the Litecoin output by providing her signature and the value x. 10. When Bob observes a value x on the Litecoin blockchain, he can claim the Bitcoin output by providing his signature and the value x.

[0132] This example ensures that either they both get their coins or neither gets theirs. Alice generates the hash value and only she knows the preimage, but she is required to reveal this preimage to claim the coins, which allows Bob to claim his coins. If either party does not follow the protocol to completion, they both can reclaim their coins after a lockout period.

[0133] One significant drawback of the known protocols mentioned above is that transactions on both blockchains are trivially linkable, and once confirmed, the unique value x is publicly visible on both blockchains forever, affecting both the fungibility of coins and the privacy of transactions.

[0134] In order to unlink the two transactions, different keys must be used for the outputs on each chain, but for the protocol to be secure and trustless, Bob must be given a proof by Alice that when she reveals her hash preimage, he will be told the information he needs to unlock his coins.

[0135] By employing the key-statement proof described in the example above, the hash-locked output on the second blockchain can be transformed into a regular pay-to-public-key-hash (P2PKH) output, hiding the nature of the transaction and breaking any possible links.

[0136] Applying the above example of Alice holding 1 Bitcoin and agreeing to trade it for Bob's 100 Litecoin, the refinement process would involve the following actions: 2. Alice sends the Litecoin public key P to Bob. A (Secret key s A ) is generated. 3. Bob sends the Bitcoin public key P to Alice. B (Secret key s B ) to generate. 4. Alice creates a secure random number x←Z p Generate. 5. Alice obtains the SHA-256 hash of x: h = H(x) and the elliptic curve public key corresponding to x: P x Calculate = x × G. 6. Alice considers h and P x Securely transmit both to Bob. 7. Alice also knows that the preimage of h is P x Send Bob a key statement proof that the generated private key is equal to the 8. Alice submits the following Bitcoin transaction Tx A , i.e. i. 1 Bitcoin public key P C =P B +P x Pay to, ii. OR refund 1 Bitcoin to Alice after 24 hours; Bitcoin transaction Tx A Create a. 9. Alice broadcasts the transaction to the Bitcoin network. 10. Bob sends Tx A When we observe that the following Litecoin transaction Tx B , i.e. i. Calculate 100 Litecoins using a valid signature AND the SHA-256 hash of h. A Pay to, ii. OR refund Bob the 100 Litecoins after 24 hours, Bitcoin transaction Tx B Create a. 11. Bob broadcasts the transaction to the Litecoin network. 12. Once the transaction is confirmed, Alice can claim the Litecoin output by providing her signature and the value x. 13. When Bob observes a value x on the Litecoin blockchain, he knows that s B +x is P C A user can request a Bitcoin output by providing a signature using the private key of

[0137] General Use The present invention is suitable for zero-knowledge proofs or verifications of a statement (S), where a prover proves to a verifier that the statement is true while keeping a proof (w) for the statement secret. The secret can be handled by a function, e.g. a hash function, but can also include cryptographic elliptic curve key operations, e.g. the validity of the statement on a public key. In the above example, the method of the present invention is used to enable trustless ZKCP for vanity addresses. This can also be applied, for example, to derivation of passwords, verification of valid machine-readable documents, e.g. passports or identity certificates, or other such confidential transactions.

[0138] It should be noted that the above-described embodiments are illustrative rather than limiting of the present invention, and that those skilled in the art can design numerous alternative embodiments without departing from the scope of the present invention as defined by the appended claims.

[0139] In the claims, any signs placed between parentheses shall not be construed as limiting the claim. The words "comprises" and "comprises" and the like do not exclude the presence of elements or steps other than those listed in any claim or the specification as a whole. In this specification, "comprises" means "includes or consists of" and "having" means "includes or consists of."

[0140] The singular reference of an element does not exclude the plural reference of such elements and vice versa. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer.

[0141] In a device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain means are recited in mutually different dependent claims does not indicate that a combination of these means cannot be used to advantage.

Claims

1. 1. A computer-implemented method for enabling zero-knowledge proof or verification of a statement (S), in which a prover computer proves to a verifier computer that the statement is true while keeping a proof (w) for the statement private, the method comprising: The prover computer to the verifier computer: data having a statement (S) represented by an arithmetic circuit having m gates and n wires configured to implement a function circuit to determine, for a given function circuit output (h) and elliptic curve point (P), whether a function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s), the function circuit being a circuit that implements the functionality of a hash function; individual wire commitments and / or batched commitments for wires of said circuit; Function circuit output (h); A certification key (PrK); and transmitting This enables the verifier computer to determine that the circuit is satisfied and to compute the elliptic curve point (P) to verify the statement, and thus determine that the prover computer holds the evidence (w) for the statement. A computer-implemented method.

2. The computer-implemented method of claim 1 , wherein each commitment is encrypted.

3. 2. The computer-implemented method of claim 1, wherein the prover computer sends individual wire commitments and communicates with the verifier computer using a Σ protocol to prove knowledge of the evidence (w).

4. 4. The computer-implemented method of claim 1, wherein the prover computer receives a challenge value (x) from the verifier computer and responds with an opening.

5. 4. The computer-implemented method of claim 1, wherein the prover computer sends the verifier computer a random value (x) that enables the verifier computer to determine that the statement is true and to calculate the elliptic curve point (P).

6. The computer-implemented method of claim 5 , wherein the random value (x) is a function of at least one commitment.

7. 7. The computer-implemented method of claim 5 or 6, wherein the random value (x) is calculated by hashing the concatenation of all the commitments generated by the prover computer and sent to the verifier computer.

8. The commitment W ｉ , W ｉ =Com(w ｉ , r ｉ ) and Com is a commitment to the function circuit, W ｉ is the wire value, r ｉ is a different random number for each wire commitment, i is the wire type, Com(w, r) = w x G + r x F, F and G are elliptic curve points, A computer-implemented method according to any one of claims 1 to 7.

9. The input to wire l in the arithmetic circuit is k o =r ｌ ×F, ko is the key opening input, r ｌ is a random number, F is a point on the elliptic curve, 9. The computer-implemented method of claim 8.

10. The verifier computer verifies that the circuit is satisfied and performs the elliptic curve point subtraction: pk ｌ =Com( / ) ｌ ,r ｌ )-か ｌ 10. The computer-implemented method of claim 9, wherein the public key for wire l can be computed via:

11. 2. The computer-implemented method of claim 1, wherein the prover computer sends a batch of wire commitments and generates random numbers for computing an elliptic curve point for each wire to form the proof key (PrK).

12. The batched commitments regarding the evidence include: [0010] and r is a random number generated by the prover computer, The prover computer calculates the wire value w ｉ Compute the commitments to vector w for i=1,...,n, W ｎ is keyed open, K ｉ is the computed elliptic curve point, W ｉ is the wire value, F is a point on the elliptic curve, 12. The computer-implemented method of claim 11.

13. The input to wire n in the arithmetic circuit is [0025] and k ｎ is the key opening input, r is a random number, F is a point on the elliptic curve, 13. The computer-implemented method of claim 12.

14. The verifier computer performs elliptic curve calculations: [0030] 14. The computer implemented method of claim 13, further comprising: computing a public key opening of the key statement wire via:

15. 15. The computer-implemented method of claim 1, wherein the prover computer further sends the fully open commitment onto at least one wire.

16. 16. A computer-implemented method according to any preceding claim, wherein the method uses Pedersen commitments.

17. 17. The computer-implemented method of claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.

18. 18. A computer-implemented method according to any preceding claim, wherein the function circuit implements a hash function.

Images