Zero-knowledge proof system, method, and program

Abstract

A zero knowledge certification system according to one aspect of the present disclosure executes zero knowledge certification that provides safety to a solution of a lattice problem defined on a finite field, the system including: a commitment unit configured so as to, by means of a lattice-based string commitment satisfying statistical secrecy and computational amount constraint, generate three combinations CMT = (C1, C2, C3) of commitments C1, C2, and C3, including commitment C1 when a string obtained by converting an integer on the finite field to binary is used as input; a challenge unit configured so as to generate a challenge Ch that takes a value randomly sampled from {1, 2, 3}; a response unit configured so as to generate, by the Stern protocol, a response RSP corresponding to the challenge Ch value; and a verification unit configured so as to verify the response RSP by means of the Stern protocol, by using two commitments Ci and Cj (i≠j, i, j∈{1, 2, 3}) included in the three combinations CMT, in accordance with the challenge Ch value.

Description

[Technical Field]

[0001] The present disclosure relates to a zero-knowledge proof system, method, and program. [Background technology]

[0002] The number of transactions with electronic signatures is increasing, especially in the blockchain industry. A typical electronic signature (hereinafter referred to simply as a "signature") has a one-to-one correspondence with a public key (verification key) used to verify the signature. Therefore, the signer's public key can be traced from the signature attached to each transaction, thereby identifying the signer. In other words, a typical electronic signature is traceable.

[0003] On the other hand, there are an increasing number of use cases where the privacy of signers needs to be protected, and in blockchain, AOS ring signatures, which make it impossible to identify the actual signer from the number of ring members N, and traceable ring signatures, which allow public members to identify the signer only in the case of double signatures, have been put into practical use.

[0004] Methods for constructing digital signatures can be broadly divided into methods that use trapdoors and methods that do not. Methods that use trapdoors are characterized by small signature size and complex parameter settings, while methods that do not use trapdoors are characterized by fast key generation and large signature size.

[0005] The method of constructing a digital signature using a trapdoor is a method of converting from a zero-knowledge proof to a digital signature, and is called the Fiat-Shamir transformation. Generally, a trapdoor is not necessarily required to construct a zero-knowledge proof, so a digital signature that does not require a trapdoor can be constructed using the Fiat-Shamir transformation. Therefore, to construct a digital signature using a method that does not use a trapdoor, it is necessary to construct a zero-knowledge proof.

[0006] A conventional method for constructing a digital signature without using a trapdoor is described in Non-Patent Document 1. Non-Patent Document 1 proposes a quantum-safe ring signature with a signature size of O(logN) by converting a zero-knowledge proof using the Fiat-Shamir transformation, where N is the number of participants. In many cases, the signature size of existing ring signatures is proportional to the number of participants N (i.e., O(N)), and the one proposed in Non-Patent Document 1 is thought to be the first quantum-safe digital signature with a signature size of O(logN).

[0007] In the above-mentioned Non-Patent Document 1, a zero-knowledge proof with a proof size of O(logN) is first constructed, and then a ring signature is constructed from the zero-knowledge proof using the Fiat-Shamir transformation. The security of this method is based on the SIS (Small Integer Solution) problem. The SIS problem is a type of lattice problem, and is the problem of finding a solution with a small norm for a homogeneous simultaneous linear equation. [Prior art documents] [Non-patent literature]

[0008] [Non-Patent Document 1] Libert, B., Ling, S., Nguyen, K. and Wang, H.: Zero-Knowledge Arguments for Lattice-Based Accumulators:Logarithmic-Size Ring Signatures and Group Signatures Without Trapdoors, EUROCRYPT 2016. Summary of the Invention [Problem to be solved by the invention]

[0009] However, the SIS problem on which the security of the ring signature proposed in Non-Patent Document 1 is based is not a general SIS problem, but an SIS problem in which the solution is restricted to binary. This is because the zero-knowledge proof constructed in Non-Patent Document 1 is based on a zero-knowledge proof for a coding problem called the Stern protocol, and the Stern protocol cannot be used unless the solution is binary.

[0010] On the other hand, zero-knowledge proofs are often used as components for constructing various cryptographic protocols, and therefore must be compatible with other cryptographic protocols. For this reason, it is preferable that the problem underlying the security of other cryptographic protocols is the same, and if the solution is restricted to binary, it will be difficult to use them as components of other cryptographic protocols.

[0011] The present disclosure has been made in consideration of the above points, and aims to provide a technology for constructing a zero-knowledge proof whose proof size is logarithmic and whose security is reduced to the SIS problem with a general solution. [Means for solving the problem]

[0012] A zero-knowledge proof system according to one aspect of the present disclosure is a zero-knowledge proof system that executes a zero-knowledge proof that reduces security to a solution to a lattice problem defined over a finite field, and includes a commitment unit configured to generate a triplet CMT=(C1, C2, C3) of commitments C1, C2, and C3, including a commitment C1 when a string obtained by converting an integer over the finite field into binary is used as input, using a lattice-based string commitment that satisfies statistical secrecy and computational complexity constraints; a challenge unit configured to generate a challenge Ch that takes a value randomly sampled from {1, 2, 3}; a response unit configured to generate a response RSP according to the value of the challenge Ch using the Stern protocol; and a response unit configured to generate two commitments C included in the triplet CMT according to the value of the challenge Ch. i ,C jand a verifying unit configured to verify the response RSP by the Stern protocol using (i≠j, i, j∈{1, 2, 3}). [Effects of the Invention]

[0013] We provide a technology to construct zero-knowledge proofs with logarithmic proof size that reduces security to the SIS problem with a general solution. [Brief explanation of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram illustrating an example of the overall configuration of a zero-knowledge proof system according to an embodiment of the present invention. [Figure 2] FIG. 10 is a sequence diagram showing an example of the flow of a zero-knowledge proof process according to the present embodiment. [Figure 3] FIG. 2 illustrates an example of a hardware configuration of a computer. DETAILED DESCRIPTION OF THE INVENTION

[0015] An embodiment of the present invention will be described below, which is a zero-knowledge proof system 1 capable of constructing a zero-knowledge proof in which the proof size is logarithmic and security is reduced to an SIS problem with a general solution.

[0016] <Theoretical structure> The theoretical configuration of this embodiment will be described below.

[0017] ≪Preparation≫ Randomly sampling an element from a set U and substituting it for a is expressed as a←U. Let n be a security parameter and β = poly(n). Here, poly(n) is an unspecified polynomial with respect to n.

[0018]

number

[0019] Also, define [n,m] as the set {n,n + 1,···,m} (where n < m). Furthermore,

[0020]

Number

[0021] Also, define the matrix G as follows.

[0022]

Number

[0023] Hereinafter, unless otherwise specified, all operations are assumed to be performed as modular arithmetic (mod q) with respect to q.

[0024] · Lattice problem Definition 1: SIS n,m,q,β ∞ Define the problem as follows. For a matrix A sampled uniformly at random from Z q n×m , for |x| ∞A nonzero vector x∈Z that satisfies ≦β and A·x=0 q m Find it.

[0025] Lattice-based collision-resistant hash function We define a lattice-based collision-resistant hash function based on the conventional method described in Non-Patent Document 1 above.

[0026] Definition 2: Function family H∋h A Define A as follows, where A=[A0|A1]∈Z q n×nk ×Z q n×nk Let's say.

[0027]

number

[0028] Lattice-based Accumulator N=2 based on the conventional method described in Non-Patent Document 1 above l We define a Merkle tree-based Accumulator with (l is lowercase L) leaves as follows:

[0029] TSetup(n):A to Z q n×m Sample uniformly at random from

[0030] TAcc A (R={d0, ,d N-1}): for any j∈[0,N-1], (j1, ,j l )∈{0,1} l Let j be the binary representation of j (i.e., 2-bin(j)=(j1, ,j l )) as d j =u j_1,···,j_l However, j_i(i∈[l]) is j iRepresents.

[0031] In this case, N leaf u 0,0,···,0 ,···,u 1,1,···,1 Construct a Merkle tree of depth l=logN with

[0032] (a) At depth i∈[l], any (b1, ,b i )∈{0,1} i Node u in b_1,···,b_i ∈{-β, ,β} nk U b_1,···,b_i =h A (u b_1,···,b_i,0 ,u b_1,···,b_i,1 )

[0033] (b) At depth 0, i.e., at the root node u, u=h A Output u as (u0,u1).

[0034] Twitness A (R,d): Stop if d is not an element of R. Otherwise (i.e., if d∈R), for j∈[0,N-1], find the next w∈{0,1} l ×(Z q nk ) l is output as a witness.

[0035]

number

[0036] Tver A,β (u,d,w):Let witness w be as follows.

[0037] w=((j1, ,j l ),(w l ,···,w1))∈{0,1} l ×(Zq nk ) l Then, for some i∈[l], |w i | ∞ >β i If exists, return 0. Otherwise, calculate the Merkle tree path from d to u. That is, v l = d, v l ,···,v1,v0∈{-β,···,β} nk is calculated using the hash function family H defined in Definition 2 as follows:

[0038] For any i∈{l-1, ,1,0}, j i+1 When =0, v i =h A (v i+1 ,w i+1 ) j i+1 When =1, v i =h A (w i+1 ,v i+1 ) Then, if v0=u, return 1, otherwise return 0.

[0039] The above Accumulator satisfies the security of Definition 3 in Non-Patent Document 1. The proof can be shown in the same way as the proof of Theorem 1 in Non-Patent Document 1.

[0040] ·Commitment Definition 3:COM:{0,1} * ×{0,1} m →Z q n Let be a lattice-based string commitment that satisfies statistical secrecy and computational constraints. The existence of such a lattice-based string commitment has been shown, for example, in Reference 1.

[0041] <Proposed Protocol> Accumulator-based zero-knowledge proof The zero-knowledge proof protocol proposed in this embodiment proves to a verifier V that a prover P knows a secret leaf node that leads to the root node of a Merkle tree. The difference from Non-Patent Document 1 is that the components of the vector representing the secret leaf node are not binary, but Z q These can be precisely defined using relations as follows:

[0042] Definition 4: R acc_β ={((A,u),(d,w))∈Z q n×2nk ×Z q nk ×Z q nk ×({0,1} l ×(Z q nk ) l )|Tver A,β (u,d,w)=1} Next, we define some sets and functions necessary for explaining the proposed protocol. Set B 3nk nk nk numbers of 1, 0, and -1 are {-1,0,1} 3nk Let S be the set of all vectors on m Let be the set of all permutations that permute m components.

[0043] The function ext is defined below.

[0044]

number

[0045]

number

[0046]

number

[0047]

number

[0048]

number

[0049] Then, for any i∈[0, ,l-1], v i ,w i ∈{-β, ,β} nk , so by binary expansion, we get

[0050]

number

[0051]

number

[0052]

number

[0053]

number

[0054]

number

[0055] Step 1 (Commitment): The prover P uses ρ1,ρ2,ρ3∈{0,1} m and randomly sample the

[0056]

number

[0057]

number

[0058] Step 2 (Challenge): When the verifier V receives the commitment CMT, it sends the challenge Ch to the prover P as Ch←{1,2,3}.

[0059] Step 3 (Response): When the prover P receives the challenge Ch, it calculates the response RSP as RSP1, RSP2, or RSP3 according to the value of the challenge Ch as follows, and then transmits the response RSP to the verifier V.

[0060] (a) When Ch=1 For each i∈[l-1] and each j∈[0,k'-1],

[0061]

number

[0062]

number

[0063]

number

[0064] (b) When Ch=2 For each i∈[l-1] and each j∈[0,k'-1],

[0065]

number

[0066]

number

[0067]

number

[0068] (c) When Ch=3 For each i∈[l-1] and each j∈[0,k'-1],

[0069]

number

[0070]

number

[0071]

number

[0072] Step 4 (Verification): When the verifier V receives the response RSP, it verifies the response RSP according to the value of the challenge Ch as follows: If the verification is successful, the verifier V outputs 1 (accepted), otherwise it outputs 0 (discarded).

[0073] (a) When Ch=1 After parsing the response RSP1, first, for all i∈[l] and all j∈[0,k'-1],

[0074]

number

[0075]

number

[0076]

number

[0077]

number

[0078]

number

[0079] ≪Safety≫ The zero-knowledge proof protocol proposed above satisfies perfect completeness and the proof size is O ~ (l·nk·k')=O ~ (l·n). Perfect completeness is the property that a proof generated by a valid prover is always accepted during verification.

[0080] <Overall configuration example of zero-knowledge proof system 1> An example of the overall configuration of a zero-knowledge proof system 1 that realizes zero-knowledge proof using the proposed protocol described above is shown in Fig. 1. As shown in Fig. 1, the zero-knowledge proof system 1 according to this embodiment includes a prover device 10 corresponding to prover P and a verifier device 20 corresponding to verifier V. Furthermore, prover device 10 and verifier device 20 are connected to each other so that they can communicate with each other via a communication network 30 that may include, for example, the Internet.

[0081] The prover device 10 has a proof processing unit 101 that executes the above-mentioned procedure 1 (commitment) and procedure 3 (response). The proof processing unit 101 is realized, for example, by one or more programs installed in the prover device 10 that are executed by a processor such as a CPU (Central Processing Unit).

[0082] The verifier device 20 has a verification processing unit 201 that executes the above-mentioned procedure 2 (challenge) and procedure 4 (verification). The verification processing unit 201 is realized, for example, by a process in which one or more programs installed in the verifier device 20 are executed by a processor such as a CPU.

[0083] <Zero-knowledge proof processing flow> Next, the flow of the zero-knowledge proof process according to this embodiment will be described with reference to FIG.

[0084] First, the proof processing unit 101 of the prover device 10 generates a commitment CMT=(C1, C2, C3) according to the above procedure 1 (commitment) and transmits it to the verifier device 20 (step S101).

[0085] Next, upon receiving the commitment CMT, the verification processing unit 201 of the verifier device 20 generates a challenge Ch according to the above procedure 2 (challenge) and transmits it to the prover device 10 (step S102).

[0086] Next, when the proof processing unit 101 of the prover device 10 receives the challenge Ch, it generates a response RSP according to the above procedure 3 (response) and transmits it to the verifier device 20 (step S103).

[0087] Then, when the verification processing unit 201 of the verifier device 20 receives the response RSP, it verifies the response RSP according to the above procedure 4 (verification), and outputs 1 (accepted) if the verification is successful, or 0 (discarded) if not (step S104).

[0088] <Example of Hardware Configuration of Prover Device 10 and Verifier Device 20> The prover device 10 and verifier device 20 according to this embodiment are realized, for example, by the hardware configuration of a computer 500 shown in Fig. 3. The computer 500 shown in Fig. 3 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0089] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0090] The external I / F 503 is an interface with an external device such as a recording medium 503a. The computer 500 can read from and write to the recording medium 503a via the external I / F 503. Examples of the recording medium 503a include a flexible disk, a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0091] The communication I / F 504 is an interface for connecting the computer 500 to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a storage device (storage device) such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory. The processor 508 is an arithmetic device such as a CPU.

[0092] The prover device 10 and verifier device 20 according to this embodiment can realize the above-described zero-knowledge proof processing by having, for example, the hardware configuration of a computer 500 shown in Fig. 3. Note that the hardware configuration of the computer 500 shown in Fig. 3 is an example, and the hardware configuration of the computer 500 is not limited to this. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0093] <Summary> As described above, the zero-knowledge proof system 1 according to this embodiment can realize a zero-knowledge proof whose proof size is logarithmic and whose security is reduced to the SIS problem that has a general solution. Therefore, the zero-knowledge proof realized by the zero-knowledge proof system 1 according to this embodiment is compatible with other cryptographic protocols, and therefore it is possible to realize various cryptographic protocols by using the zero-knowledge proof as a component.

[0094] For example, it is possible to configure a ring signature by applying the Fiat-Shamir transformation to the zero-knowledge proof realized by the zero-knowledge proof system 1 according to this embodiment. Furthermore, by using this ring signature as a component, it is possible to configure, for example, a ring signature with linkability or a ring signature with traceability. Note that linkability means that signatures can be linked (or matched) when there are duplicate signatures, and traceability means that signers can be identified (or traced) when there are duplicate signatures.

[0095] The present disclosure is not limited to the above-described specifically disclosed embodiments, and various modifications, alterations, combinations with known technologies, etc. are possible without departing from the scope of the claims.

[0096] [References] Reference 1: Kawachi, A., Tanaka, K. and Xagawa, K.: Concurrently Secure Identification Schemes Based on the Worst-Case Hardness of Lattice Problems, ASIACRYPT 2008, Lecture Notes in Computer Science, Vol. 5350, Springer, pp. 372-389. [Explanation of symbols]

[0097] 1 Zero-knowledge proof system 10 Proving Device 20 Verifier device 30 Communication Network 101 Certification Processing Unit 201 Verification processing unit 500 computers 501 Input Device 502 Display device 503 External I / F 503a Recording media 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary storage 508 processor 509 Bus

Claims

1. A zero-knowledge proof system that performs a zero-knowledge proof that reduces security to a solution to a lattice problem defined over a finite field, By using a lattice-based string commitment that satisfies statistical secrecy and computational constraints, we can obtain the commitment C when the string obtained by converting the integer in the finite field into binary is used as input. １ Commitment C, including １ , C ２ , C ３ The triplet CMT = (C １ , C ２ , C ３ a commitment portion configured to generate a a challenge unit configured to generate a challenge Ch taking a randomly sampled value from {1, 2, 3}; a response unit configured to generate a response RSP according to the value of the challenge Ch using a Stern protocol; Depending on the value of the challenge Ch, two commitments C included in the triplet CMT are ｉ , C ｊ a verifying unit configured to verify the response RSP according to the Stern protocol using (i≠j, i, j∈{1, 2, 3}); A zero-knowledge proof system with

2. The commitment section The commitment C when β=poly(n) (where n is a security parameter) and the string obtained by converting the integer in the finite field expanded into a (β+1)-adic number into binary is input. １ The commitment CMT=(C １ , C ２ , C ３ 2. The zero-knowledge proof system of claim 1, configured to generate a zero-knowledge proof.

3. The solution is a path from the leaf node to the root node of a Merkle tree that realizes a lattice-based Accumulator, 3. The zero-knowledge proof system according to claim 2, wherein the Merkle tree is constructed by a lattice-based collision-resistant hash function that takes vectors each representing two elements in the finite field as input and expands the linear sum of the vectors each representing the two elements into a (β+1)-adic number.

4. The zero-knowledge proof system according to claim 1 , wherein the lattice problem is an SIS problem.

5. A zero-knowledge proof system that performs zero-knowledge proofs that reduce security to solutions to lattice problems defined over finite fields is By using a lattice-based string commitment that satisfies statistical secrecy and computational constraints, we can obtain the commitment C when the string obtained by converting the integer in the finite field into binary is used as input. １ Commitment C, including １ , C ２ , C ３ The triplet CMT = (C １ , C ２ , C ３ ), and a commitment procedure that generates a challenge procedure that generates a challenge Ch that takes a randomly sampled value from {1, 2, 3}; a response procedure for generating a response RSP according to the value of the challenge Ch using the Stern protocol; Depending on the value of the challenge Ch, two commitments C included in the triplet CMT are ｉ , C ｊ a verification step of verifying the response RSP using the Stern protocol, where i≠j, i, j∈{1, 2, 3}; How to do it.

6. A program that causes a computer to function as a commitment unit and a response unit in the zero-knowledge proof system of claim 1, or as a challenge unit and a verification unit in the zero-knowledge proof system of claim 1.

Images