Device and method

Abstract

A device according to one aspect of the present invention: calculates a first random number from a random seed; executes an interactive proof satisfying a predetermined characteristic taking the proposition of predictable proof and the first random number as a first proposition and the seed as first evidence, and thereby calculates a plurality of first messages transmitted in order by a verifier of the interactive proof to a prover of the interactive proof, a plurality of second messages transmitted in order by the prover of the interactive proof to the verifier of the interactive proof, and a second random number used by the prover of the interactive proof; transmits the first random number and the second random number to another device that will be the prover of the interactive proof; and verifies whether or not the i-th second message and the i-th third message received from the other device are identical for all i's. The i-th third message is calculated by executing processing of the prover of the interactive proof when the first messages up to the i-th position have been sequentially obtained by using the first proposition, the evidence of predictable proof, and the second random number in the other device.

Description

Apparatus and method

[0001] The present disclosure relates to an apparatus and a method.

[0002] A protocol called interactive proof is known as one type of cryptographic protocol, and one type of it is a protocol called predictable proof (Non-Patent Document 1). Existing configurations related to predictable proof include a configuration based on evidential encryption (Non-Patent Document 2) and a configuration based on deterministic prover zero-knowledge proof (Non-Patent Document 3).

[0003] Antonio Faonio, Jesper Buus Nielsen, and Daniele Venturi. "Predictable arguments of knowledge," In Serge Fehr, editor, PKC 2017, Part I, volume 10174 of LNCS, pages 121-150. Springer, Heidelberg, March 2017. Antonio Faonio, Jesper Buus Nielsen, and Daniele Venturi. "Predictable arguments of knowledge," knowledge," Cryptology ePrint Archive, Report 2015 / 740, 2015. Nir Bitansky and Arka Rai Choudhuri. "Characterizing deterministic-prover zero knowledge," In Rafael Pass and Krzysztof Pietrzak, editors, TCC 2020, Part I, volume 12550 of LNCS, pages 535-566. Springer, Heidelberg, November 2020.

[0004] In general, it is desirable in cryptography for multiple known constructions to be based on different components. However, predictable proofs have the problem that only a limited number of constructions are known.

[0005] The present disclosure has been made in view of the above points, and aims to construct predictable proofs.

[0006] An apparatus according to one aspect of the present disclosure is an apparatus that serves as a verifier of a predictable proof, which calculates a first random number from a randomly selected seed, and performs an interactive proof that satisfies predetermined properties using a pair of a proposition of the predictable proof and the first random number as a first proposition and the seed as a first evidence, thereby calculating multiple first messages that the verifier of the interactive proof sends in sequence to the prover of the interactive proof, multiple second messages that the prover of the interactive proof sends in sequence to the verifier of the interactive proof, and a second random number used by the prover of the interactive proof, and sends the first random number and the second random number to another apparatus that serves as a prover of the predictable proof, and verifies whether the i-th second message and the i-th third message received from the other apparatus are identical for all i, and the i-th third message is calculated by performing the processing of the prover of the interactive proof in the other apparatus when the first messages up to the i-th message are obtained in sequence using the first proposition, the evidence of the predictable proof, and the second random number.

[0007] Predictable proofs can be constructed.

[0008] Fig. 1 is a diagram showing an example of the overall configuration of a predictable proof system according to an embodiment; Fig. 2 is a diagram showing an example of the functional configuration of a prover device according to an embodiment; Fig. 3 is a diagram showing an example of the functional configuration of a verifier device according to an embodiment; Fig. 4 is a sequence diagram showing an example of predictable proof processing according to an embodiment; Fig. 5 is a diagram showing an example of the hardware configuration of a computer;

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0010] <Interactive Proof> Interactive proof is a cryptographic protocol executed by two parties, a prover and a verifier, exchanging messages, and is defined with respect to some ordinary NP language L. As input at the start of the protocol, both the prover and the verifier are given an instance x of the NP language L as a proposition, and the prover is also given a proof w that the proposition x belongs to the NP language L (that is, w is the NP-witness of x∈L). Note that the proposition x is considered true if it belongs to the NP language L, and false if it does not belong to the NP language L.

[0011] The verifier does not know whether proposition x is true or false, and the purpose of an interactive proof is for the prover to prove to the verifier that proposition x is true. Note that since both the prover and the verifier are represented as randomized algorithms, they both use random numbers they generate themselves during the execution of the interactive proof.

[0012] <Predictable Proof> A predictable proof is a type of interactive proof that has the property that the verifier can predict the message that the prover will send to the verifier. Predictable proofs have known applications, such as being used as a component of evidence encryption.

[0013] <Preparation> The components that make up the predictable proof proposed in this embodiment will be prepared below. In the following, a certain NP language is denoted as L, and a predictable proof for this NP language L is constructed. Furthermore, the prover of the predictable proof for NP language L is denoted as P, and the verifier is denoted as V, and the prover P is given a proposition x and evidence w as input, and the verifier V is given the proposition x as input.

[0014] <Pseudo-random number generator> The pseudo-random number generator PRG receives a seed w' as input and outputs a (pseudo) random number x'=PRG(w').

[0015] <<Interactive Proof Protocol>> Let L' be an NP language defined by L' = {x' | ∃ w' s.t. PRG(w') = x'}. Also, L Π L Π = {(x, x') | x∈L ∨ x'∈L'}. In this case, let L be an NP language that satisfies the following properties: ΠLet Π be the interactive proof protocol for Π. In the following, the interactive proof protocol Π will also be simply written as "interactive proof Π". Also, let P be the prover of the interactive proof Π. Π , the verifier is V Π It is expressed as:

[0016] Property: When w is used as evidence and when w' is used as evidence, the prover P Π is the verifier V Π There is a high probability that the message you send to will not change.

[0017] An example of an interactive proof that satisfies the above properties is an arbitrary resettable statistical zero-knowledge proof (Reference 1).

[0018] Based on the above preparation, a predictable proof system 1 that realizes predictable proofs for an NP language L will be described.

[0019] <Example of Overall Configuration of Predictable Proof System 1> An example of the overall configuration of the predictable proof system 1 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the overall configuration of the predictable proof system 1 according to this embodiment.

[0020] 1, a predictable proof system 1 according to this embodiment includes a prover device 10 and a verifier device 20. The prover device 10 and the verifier device 20 are communicatively connected via an arbitrary communication network 30 such as the Internet.

[0021] The prover device 10 is any of various devices that serves as a prover P of a predictable proof for an NP language L. As the prover device 10, for example, a PC (personal computer), a smartphone, a tablet terminal, a general-purpose server, industrial equipment, digital home appliances, a wearable device, an IoT device, etc. can be used.

[0022] The verifier device 20 is a device that serves as a verifier V of a predictable proof for an NP language L. The verifier device 20 may be, for example, a PC, a smartphone, a tablet terminal, a general-purpose server, an industrial device, a digital home appliance, a wearable device, an IoT device, or the like.

[0023] 1 is merely an example, and is not intended to be limiting. For example, the predictable proof system 1 may include multiple prover devices 10 and multiple verifier devices 20.

[0024] <Example of Functional Configuration of Prover Device 10 and Verifier Device 20> <Prover Device 10> An example of the functional configuration of the prover device 10 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the functional configuration of the prover device 10 according to this embodiment.

[0025] 2, the prover device 10 according to this embodiment has a communication unit 101 and a proving unit 102. These units are realized, for example, by one or more programs installed in the prover device 10, which are executed by a processor such as a CPU (Central Processing Unit). The prover device 10 according to this embodiment also has a storage unit 103. The storage unit 103 is realized, for example, by a storage area of ​​a storage device such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory.

[0026] The communication unit 101 receives messages sent from the verifier device 20 and sends messages to the verifier device 20 .

[0027] The proving unit 102 receives the proposition x and the evidence w as input, and proves to the verifier device 20 that the proposition x is true by means of messages sent and received between the proving unit 102 and the verifier device 20 .

[0028] The storage unit 103 stores various data (e.g., proposition x, evidence w, etc.) necessary for predictable proof regarding the NP language L. Note that w is evidence that the proposition x belongs to the NP language L (i.e., NP-witness of x∈L).

[0029] <Verifier Device 20> An example of the functional configuration of the verifier device 20 according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a diagram showing an example of the functional configuration of the verifier device 20 according to this embodiment.

[0030] 3, the verifier device 20 according to this embodiment includes a communication unit 201 and a verification unit 202. These units are realized, for example, by a processor such as a CPU executing one or more programs installed in the verifier device 20. The verifier device 20 according to this embodiment also includes a storage unit 203. The storage unit 203 is realized, for example, by a storage area of ​​a storage device such as an HDD, SSD, or flash memory.

[0031] The communication unit 201 transmits messages to the prover device 10 and receives messages transmitted from the prover device 10 .

[0032] The verification unit 202 receives a proposition x as an input and verifies that the proposition x is true based on messages sent and received between the prover device 10 and the verification unit 202 .

[0033] The storage unit 203 stores various data (for example, proposition x) necessary for predictable proofs regarding the NP language L.

[0034] <Predictable Proof Processing> An example of predictable proof processing according to this embodiment (i.e., processing for realizing predictable proof for an NP language L) will be described with reference to Fig. 4. Fig. 4 is a sequence diagram showing an example of predictable proof processing according to this embodiment. In the following, it is assumed that proposition x and evidence w are provided to the prover device 10 and stored in the memory unit 103, and similarly, proposition x is provided to the verifier device 20 and stored in the memory unit 203.

[0035] The proving unit 102 of the prover device 10 receives the proposition x and the evidence w from the storage unit 103 (step S101).

[0036] The verification unit 202 of the verifier device 20 inputs the proposition x from the storage unit 203 (step S102).

[0037] The verification unit 202 of the verifier device 20 randomly selects a seed w' for the pseudo-random number generator PRG (step S103).

[0038] The verification unit 202 of the verifier device 20 calculates a random number x' by x'=PRG(w') (step S104).

[0039] The verification unit 202 of the verifier device 20 Π = (x, x') and the evidence w' (step S105). Π The input to the proposition x Π and evidence w', verifier V Π The input to the proposition x Π Then, the prover P Π and verifier V Π The interactive proof Π is executed by virtually executing both the

[0040] Hereafter, Prover P Π and verifier V Π The messages sent by (β １ , α １ , ..., β ρ , α ρ ) That is, first, the verifier V Π is message β １ Prover P Π Then, the prover P Π is message α １ Verifier V Π and then to the verifier V Π is message β ２ Prover P Π Continue sending it to the prover P Π is message α ρ Verifier V Π At this time, the prover P Π The random number used by rand Ｐ Note that since both the prover and verifier of the interactive proof are randomized algorithms, they use random numbers that they generate themselves during the execution of the interactive proof.

[0041] The communication unit 201 of the verifier device 20 receives (x', rand Ｐ ) to the prover device 10 (step S106).

[0042] The following steps S107 to S109 are executed in ascending order for each iε{1, ..., ρ}. Steps S107 to S109 for a certain iε{1, ..., ρ} will be described below.

[0043] The communication unit 201 of the verifier device 20 receives the message β ｉ to the prover device 10 (step S107).

[0044] The proving unit 102 of the prover device 10 receives a proposition (x, x'), a proof w, a random number rand, Ｐ Using this, message β １ , ..., β ｉ In order, the verifier V Π The prover P of the interactive proof Π when received from Π (Step S108). Π is the verifier V Π Message α to be sent to ｉ ' is obtained.

[0045] The communication unit 101 of the prover device 10 receives the message α ｉ ' is transmitted to the verifier device 20 (step S109).

[0046] By performing the above steps S107 to S109 for each i∈{1, . . . , ρ} in ascending order, the verifier device 20 obtains α １ ', ..., α ρ ' is obtained.

[0047] The verification unit 202 of the verifier device 20 calculates α for all i∈{1, . . . , ρ}. ｉ = α ｉ It is verified whether or not the following holds true (step S110).

[0048] The verification unit 202 of the verifier device 20 determines whether the result of the verification in step S110 is α for all i∈{1, . . . , ρ}. ｉ = α ｉ If the result indicates that proposition x' is true, "accept" is output, otherwise "reject" is output (step S111). Note that "accept" means that proposition x is true, and "reject" means that proposition x is not true.

[0049] The interactive proof Π has the above property (i.e., when w is used as evidence and when w' is used as evidence, the prover P Π is the verifier V ΠSince the message sent to α has the property of being unchanged with a high probability, ｉ = α ｉ Therefore, the above steps S101 to S111 constitute a predictable proof.

[0050] <Example of Hardware Configuration of Prover Device 10 and Verifier Device 20> The prover device 10 and verifier device 20 according to this embodiment can be realized, for example, by the hardware configuration of a computer 500 shown in Fig. 5. Fig. 5 is a diagram showing an example of the hardware configuration of the computer 500.

[0051] 5 includes an input device 501, a display device 502, an external I / F 503, a communication I / F 504, a RAM (Random Access Memory) 505, a ROM (Read Only Memory) 506, an auxiliary storage device 507, and a processor 508. Each of these pieces of hardware is connected to each other via a bus 509 so as to be able to communicate with each other.

[0052] The input device 501 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 502 is, for example, a display, a display panel, etc. Note that the computer 500 does not necessarily have to have at least one of the input device 501 and the display device 502, for example.

[0053] The external I / F 503 is an interface with an external device such as a recording medium 503 a. Examples of the recording medium 503 a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0054] The communication I / F 504 is an interface for connecting to a communication network. The RAM 505 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 506 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 507 is a non-volatile storage device such as an HDD, SSD, or flash memory. The processor 508 is, for example, a CPU or other computing device.

[0055] 5 is an example, and is not intended to limit the hardware configuration of the computer 500. For example, the computer 500 may have multiple auxiliary storage devices 507 or multiple processors 508, may not have some of the hardware shown in the figure, or may have various types of hardware other than the hardware shown in the figure.

[0056] <Summary> As described above, the predictable proof system 1 according to this embodiment can realize a new predictable proof configuration that uses interactive proofs (e.g., resettable statistical zero-knowledge proofs, etc.) that satisfy certain appropriate properties. This makes it possible, for example, for progress to be made in technologies such as resettable statistical zero-knowledge proofs to also achieve similar progress in predictable proofs. In other words, for example, if the efficiency or security of technologies such as resettable statistical zero-knowledge proofs improves, it becomes possible to similarly improve the efficiency and security of predictable proofs accordingly.

[0057] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0058] [References] Reference 1: Sanjam Garg, Rafail Ostrovsky, Ivan Visconti, and Akshay Wadia. Resettable statistical zero knowledge. In Ronald Cramer, editor, TCC 2012, volume 7194 of LNCS, pages 494-511. Springer, Heidelberg, March 2012.

[0059] 1 Predictable Proof System 10 Prover Device 20 Verifier Device 30 Communication Network 101 Communication Unit 102 Proving Unit 103 Memory Unit 201 Communication Unit 202 Verification Unit 203 Memory Unit 500 Computer 501 Input Device 502 Display Device 503 External I / F 503a Recording Medium 504 Communication I / F 505 RAM 506 ROM 507 Auxiliary Storage Device 508 Processor 509 Bus

Claims

1. A device that serves as a verifier of a predictable proof, which calculates a first random number from a randomly selected seed, and performs an interactive proof that satisfies predetermined properties using a pair of the proposition of the predictable proof and the first random number as a first proposition and the seed as a first evidence, thereby calculating multiple first messages that the verifier of the interactive proof sends in sequence to the prover of the interactive proof, multiple second messages that the prover of the interactive proof sends in sequence to the verifier of the interactive proof, and a second random number used by the prover of the interactive proof, and sends the first random number and the second random number to another device that serves as a prover of the predictable proof, and verifies whether the i-th second message and the i-th third message received from the other device are identical for all i, and the i-th third message is calculated by performing the processing of the prover of the interactive proof in the other device when the first messages up to the i-th message are obtained in sequence using the first proposition, the evidence of the predictable proof, and the second random number.

2. A device that is a prover of a predictable proof, the device receiving a first random number and a second random number from another device that is a verifier of the predictable proof, receiving the i-th first message from the other device in order for each i, using a pair of the proposition of the predictable proof and the first random number as a first proposition, the first proposition, the evidence of the predictable proof, and the second random number to execute the processing of a prover of an interactive proof that satisfies a predetermined property when the first messages up to the i-th message are obtained in order, to calculate the i-th second message that the prover of the interactive proof will send to the verifier of the interactive proof, and for each i, sending the i-th second message to the other device.

3. A method in which a device that is a verifier of a predictable proof: calculates a first random number from a randomly selected seed; performs an interactive proof that satisfies predetermined properties using a pair of the proposition of the predictable proof and the first random number as a first proposition and the seed as a first evidence, thereby calculating multiple first messages that the verifier of the interactive proof sends in sequence to the interactive proof prover, multiple second messages that the verifier of the interactive proof sends in sequence to the verifier of the interactive proof, and a second random number used by the interactive proof prover in the interactive proof; sends the first random number and the second random number to another device that is a prover of the predictable proof; and verifies whether the i-th second message and the i-th third message received from the other device are identical for all i, and the i-th third message is calculated by performing the processing of the prover of the interactive proof in the other device when the i-th first messages are obtained in sequence using the first proposition, the evidence of the predictable proof, and the second random number.

4. A method in which a device that is a prover of a predictable proof receives a first random number and a second random number from another device that is a verifier of the predictable proof, receives the i-th first message from the other device in order for each i, calculates the i-th second message that the prover of the interactive proof will send to the verifier of the interactive proof by using a pair of the proposition of the predictable proof and the first random number as a first proposition, the first proposition, the evidence of the predictable proof, and the second random number, and executing the process of the prover of the interactive proof that satisfies a predetermined property when the first messages up to the i-th message have been obtained in order, and sends the i-th second message to the other device for each i.

Images