Computer-implemented systems and methods for enabling zero-knowledge proofs

Abstract

To provide a method and a system for efficient zero-knowledge verification of compound statements that simultaneously require both arithmetic circuit satisfiability and dependent statements about the validity of a public key.SOLUTION: In a method, a prover sends, to a verifier, a set of data including a statement that is about an elliptic curve point and the output of a given function circuit whose input is equal to the corresponding elliptic curve point multiplier. The data includes individual wire commitments and batched commitments for the circuit, inputs and outputs of the statement. The prover sends an opening in response to a challenge from the verifier. Using the data received from the prover, the verifier determines that the circuit is filled, computes the elliptic curve point to verify the statement, and determines that it holds evidence for the statement. Upon receiving the data, the verifier determines through computation that the data fits the statement.SELECTED DRAWING: None

Claims

1. A computer-implemented method for enabling a zero-knowledge proof or verification of a statement (S), wherein a proofer computer proves to a verifier computer that the statement is true, while keeping the evidence (w) for the statement secret, the method is The certifier computer becomes the verifier computer: A statement (S) is represented by an arithmetic circuit having m gates and n wires configured to implement a function circuit and determine whether the function circuit input (s) to the wires of the function circuit is equal to the corresponding elliptic curve point multiplier (s) for a given function circuit output (h) and elliptic curve point (P), Individual wire commitments and / or batched commitments for the wires of the circuit, The output of the function circuit (h), Proof Key (PrK), Including sending, This enables the verifier computer to determine that the circuit is satisfied, calculate the elliptic curve point (P), and verify the statement, and thus determine that the verifier computer holds the evidence (w) for the statement. A computer-implemented method.

2. The computer-implemented method according to claim 1, wherein the certifying computer transmits individual wire commitments to certify knowledge of the evidence (w) and communicates with the certifying computer using the Σ protocol.

3. The computer-implemented method according to claim 1 or 2, wherein the certifying computer receives a challenge value (x) from the verifying computer and responds with an opening.

4. The computer-implemented method according to claim 1 or 2, wherein the certifying computer transmits a random value (x) to the verifying computer that enables the verifying computer to determine that the statement is true and to calculate the elliptic curve point (P).

5. The computer-implemented method according to claim 4, wherein the random value (x) is a function of at least one commitment.

6. The computer-implemented method according to claim 4 or 5, wherein the random value (x) is calculated by hashing the concatenation of all the commitments generated by the prover computer and transmitted to the verifier computer.

7. The aforementioned commitment W ｉ is, W ｉ =Com(w ｉ ,r ｉ ) and Com is a commitment to the aforementioned function circuit, lol ｉ This is the wire value, r ｉ This is a different random number for each wire commitment, i is the wire type, Com(w,r) ​​= w × G + r × F, F and G are points on an elliptic curve. The computer-implemented method according to any one of claims 1 to 6.

8. The input to wire l in the arithmetic circuit is ko = r ｌ ×F, ko is a key opening input, r ｌ It is a random number, F is a point on an elliptic curve. The computer-implemented method according to claim 7.

9. The verifier computer confirms that the circuit is satisfied and performs elliptic curve point subtraction: pk ｌ =Com( / ) ｌ ,r ｌ )-か ｌ The computer-implemented method according to claim 8, which can compute a public key for wire l via the method.

10. The computer-implemented method according to claim 1, wherein the certifier computer transmits a batch of wire commitments and generates random numbers for calculating elliptic curve points for each wire to form the certifier key (PrK).

11. The commitment made to the aforementioned batch with respect to the aforementioned evidence is, [Math 1] And, r is a random number generated by the proofer computer, The certifying computer is wire value w ｉ Calculate the commitment to the vector w for (for i = 1, ..., n), and w ｎ This is something that will be opened by key, K ｉ These are the calculated elliptic curve points, lol ｉ This is the wire value, F is a point on an elliptic curve. The computer-implemented method according to claim 10.

12. The input to wire n in the arithmetic circuit is, [Math 2] And, ko ｎ This is a key opening input, r is a random number, F is a point on an elliptic curve. The computer-implemented method according to claim 11.

13. The aforementioned verifier computer performs elliptic curve calculations: [Math 3] A computer-implemented method according to claim 12, comprising computing the public key opening of a key statement wire via

14. The computer-implemented method according to any one of claims 1 to 13, wherein the certifying computer further sends a fully open commitment to at least one wire.

15. The computer-implemented method according to any one of claims 1 to 14, wherein the method uses a Pedersen commitment.

16. The computer-implemented method according to any one of claims 1 to 15, wherein the statement uses only one arithmetic circuit for the function circuit.

17. The computer-implemented method according to any one of claims 1 to 16, wherein the function circuit implements a hash function which is preferably a SHA-256 hash function.

18. This method is used by the certifier computer to enable zero-knowledge associated transactions with data such as cryptographic keys. The certifying computer cooperates with the verifying computer to verify the data provided and the data received, and establishes a communication channel with the verifying computer. The verifyer computer receives the elliptic curve public key pk generated by the verifyer computer from the secure random private key skB. Ｂ Received pk Ｖ =sk Ｖ ×G, and G is a point on an elliptic curve. The aforementioned certifier computer has data = pk Ｖ The provided data is protected by a lock value i such that it is +i × G. The aforementioned certifier computer is pk Ｐ The public keys, which are equal to i × G, and the output f(i) from the function circuit, whose input is the lock value i, are sent to the verifier computer. The certifier computer determines that the input to the function circuit is pk Ｐ A statement (S) proof that it is the corresponding private key is sent to the verifier computer, The verifier computer verifies the proof, and pk = pk Ｖ +pk Ｐ By confirming that the corresponding address matches the agreed pattern, the lock value i can be known, and the data (sk Ｂ This enables the derivation of the complete secret key related to +i) and the identification of the lock value i as the input to the function circuit, The certifier computer accesses a transaction Tx containing the output including the received data, which can be accessed by the signature from the certifier computer and the input to the function circuit. １ The verifier's computer receives the above, The certifier computer signs the transaction and broadcasts it on the blockchain, which is then mined into a block, supplying a signature and value i for unlocking the transaction to a second transaction Tx. ２ By providing the transaction Tx １ The output allows the certifier computer to access the data, and the transaction is revealed on the blockchain. Thus, the verifier computer identifies the lock value i and enables it to access the data provided by the certifier computer. sk = sk Ｂ +i, pk = sk × G The computer-implemented method according to any one of claims 1 to 17.

19. The computer-implemented method according to claim 18, wherein the data provided by the certifier computer includes a vanity address.

20. The computer-implemented method according to claim 18, wherein the data received from the verifier computer includes a cryptocurrency payment.

21. The certifying computer performs a trustless and fair data exchange with the verifying computer. The certifying computer has access to the first data on the first blockchain, the validating computer has access to the second data on the second blockchain, the certifying computer and the validating computer agree to exchange the data, and the method is The proofer computer generates a key pair for the second blockchain and the public key (P Ａ ) is sent to the verifier's computer, and the secret key (s Ａ ) hold, The certifier computer obtains the certifier's public key (P) for the first blockchain. Ｂ The verifier computer receives the ) and generates a key pair for the first blockchain to create a private key (s Ｂ ) holds, The aforementioned certifier computer receives a statement (S), one or more commitments, and input (P ｘ ) and the function circuit output (h), and the elliptic curve specification are transmitted. The certifier computer then accesses the first data to a common public key address (P ｃ The first blockchain transaction Tx to send to Ａ Create and broadcast the transaction on the first blockchain network, and the address is the input (P ｘ ) and the verifier's public key (P ｃ Determined by the sum of ) and P Ｃ = P Ｂ +P ｘ And, The aforementioned certifier computer processes the second blockchain transaction Tx Ｂ The transaction is verified, and the transaction is recorded in the first blockchain as the first blockchain transaction Tx Ａ After confirming that it contains the verifier computer, the transaction is created by the verifier computer and broadcast on the second blockchain network, and the second data is sent to the verifier public key address (P Ａ ) to the certifier's public key address (P Ａ )teeth, The certifier's public key address (P Ａ ) valid signatures, The value that determines the function circuit output (h) is the function circuit input preimage. It is accessible by the certifier's computer using the above method, The certifier computer determines the second blockchain transaction Tx Ｂ The second data is accessed by confirming that it is included on the second blockchain, and by providing a signature and the value which is the input to the function circuit of the function circuit output (h), Thus, the verifier computer observes the value which is the input to the function circuit that determines the output (h) of the function circuit, and from the isomorphism of the elliptic curve point multiplication, s Ｂ P is +s Ｃ By providing a signature using the private key, it becomes possible to access the first data. A computer-implemented method according to any one of claims 1 to 17, including the following:

22. The computer-implemented method according to claim 21, wherein the data to be exchanged is cryptocurrency, the first data corresponds to an amount of the first cryptocurrency, and the second data corresponds to an amount of the second cryptocurrency.

23. A computer-readable storage medium having computer-executable instructions, wherein the computer-executable instructions, when executed, configure a processor to perform the method described in any one of claims 1 to 22.

24. Interface device and One or more processors coupled to the interface device, A memory connected to one or more processors, the memory storing computer executable instructions, and the one or more processors are configured to perform the method described in any one of claims 1 to 22 when the computer executable instructions are executed. Electronic devices for providing services.

25. A node in a blockchain network, configured to perform the method described in any one of claims 1 to 22.

26. A blockchain network having the nodes described in claim 25.

Images