Sun, SF., Au, M.H., Liu, J.K., Yuen, T.H. (2017). RingCT 2.0: A Compact Accumulator-Based (Linkable Ring Signature) Protocol for Blockchain Cryptocurrency Monero. In: ESORICS 2017(CCF-B).https://doi.org/10.1007/978-3-319-66399-9_25
RingCT 2.0
- Preliminaries
- RingCT protocol
- RingCT 2.0
- Setup ( 1 λ ) → p p \operatorname{Setup}(1^\lambda)\rightarrow pp Setup(1λ)→pp
- KeyGen ( p p ) → ( p k , s k ) \operatorname{KeyGen}(pp)\rightarrow (pk,sk) KeyGen(pp)→(pk,sk)
- Mint ( p k , a ) → ( c n , c k ) \operatorname{Mint}(pk, a)\rightarrow(cn, ck) Mint(pk,a)→(cn,ck)
- Spend ( m , K s , A s , A , R ) → ( t x , π , S ) \operatorname{Spend}(m, K_s, A_s, A, R)\rightarrow(tx, \pi, S) Spend(m,Ks,As,A,R)→(tx,π,S)
- Verify ( t x , π , S ) → 0 / 1 \operatorname{Verify}(tx, \pi, S)\rightarrow 0/1 Verify(tx,π,S)→0/1
- Instantiations
- 对RingCT协议给出了严格的安全性定义和要求。
- 减小RingCT协议的大小。
Preliminaries
Accumulators with One-Way Domain
ACC
=
(
ACC.Gen,ACC.Eval,ACC.Wit
)
\operatorname{ACC}= (\operatorname{ACC.Gen, ACC.Eval,ACC.Wit})
ACC=(ACC.Gen,ACC.Eval,ACC.Wit)
多个值累加成一个值,这样,对于每一个累加的值,都有证据证明它确实被累加了。
F
=
{
F
λ
}
\mathcal{F}=\{F_\lambda\}
F={Fλ}:函数族序列
X
=
{
X
λ
}
\mathcal{X}=\{X_\lambda\}
X={Xλ}:有限集序列
F
λ
=
{
f
:
U
f
×
X
f
→
U
f
}
X
λ
⊆
X
f
F_\lambda=\{f:U_f\times X_f\rightarrow U_f\}~X_\lambda \subseteq X_f
Fλ={f:Uf×Xf→Uf} Xλ⊆Xf
Accumulator family with one-way domain:
(
F
,
X
)
(\mathcal{F,X})
(F,X)必须满足:
- quasi-commutativity(拟交换性): f ( f ( u , x 1 ) , x 2 ) = f ( f ( u , x 2 ) , x 1 ) f(f(u_, x_1), x_2) = f(f(u, x_2), x_1) f(f(u,x1),x2)=f(f(u,x2),x1), { X λ } \{X_\lambda\} {Xλ}被称为这个累加器的域。对于任意 X = { x 1 , x 2 , ⋅ ⋅ ⋅ , x n } ⊂ X λ X = \{x_1, x_2,···,x_n\}\subset X_\lambda X={x1,x2,⋅⋅⋅,xn}⊂Xλ,我们称 f ( ⋅ ⋅ ⋅ f ( f ( u , x 1 ) , x 2 ) ⋅ ⋅ ⋅ ) , x n ) f(···f(f(u, x_1),x_2)···),x_n) f(⋅⋅⋅f(f(u,x1),x2)⋅⋅⋅),xn)为 X o v e r u X~over~ u X over u的累加值,根据拟交换律,用 f ( u , X ) f(u, X) f(u,X)表示。(意思就是序列 X X X里的值以任意顺序做广义的加法)
- 抗碰撞性:敌手给出一个 A ( f , U f , u ) → ( ω , x , X ) \mathcal{A}(f,U_f,u)\rightarrow(\omega,x,X) A(f,Uf,u)→(ω,x,X)使 f ( ω , x ) = f ( u , X ) f(\omega,x)=f(u,X) f(ω,x)=f(u,X)的优势可忽略。
- one-way domain:设 { Y λ } \{Y_\lambda\} {Yλ} { R λ } \{R_\lambda\} {Rλ}是与 { X λ } \{X_\lambda\} {Xλ}有关的两个序列集合,其中 { R λ } \{R_\lambda\} {Rλ}是 Y λ × R λ Y_\lambda \times R_\lambda Yλ×Rλ上有效的可验证,可采样的关系。敌手 A \mathcal{A} A无法从随机采样的 x x x中计算出有效的witness y y y。
- efficient generation: ACC.Gen ( λ ) → ( d e s c , X ) \operatorname{ACC.Gen}(\lambda)\rightarrow ({\rm desc},X) ACC.Gen(λ)→(desc,X)。( d e s c {\rm desc} desc是对 F λ F_\lambda Fλ中随机元素的描述,和一些辅助信息)。
- efficient evaluation: ACC.Eval ( d e s c , X ) → f ( u , X ) \operatorname{ACC.Eval}({\rm desc},X)\rightarrow f(u, X) ACC.Eval(desc,X)→f(u,X)计算累计值; ACC.Wit ( d e s c , x , X ) → y \operatorname{ACC.Wit}({\rm desc},x,X)\rightarrow y ACC.Wit(desc,x,X)→y计算 f ( u , X ) f(u, X) f(u,X)中 x x x的witness。
Signature of Knowledge
RingCT protocol
定义
( Setup,KeyGen,Mint,Spend,Verify ) (\operatorname{Setup, KeyGen, Mint, Spend, Verify}) (Setup,KeyGen,Mint,Spend,Verify)
- Setup ( 1 λ ) → p p \operatorname{Setup}(1^\lambda)\rightarrow pp Setup(1λ)→pp
- KeyGen ( p p ) → ( p k , s k ) \operatorname{KeyGen}(pp)\rightarrow (pk,sk) KeyGen(pp)→(pk,sk). Monero 中 p k pk pk通常为一次性地址。
- Mint ( p k , a ) → ( c n , c k ) \operatorname{Mint}(pk, a)\rightarrow(cn, ck) Mint(pk,a)→(cn,ck). 数字 a a a是 p k pk pk账户的balance,输出coin c n cn cn 和coin key c k ck ck. coin和地址组成一个账户 a c t = ( p k , c n ) act=(pk,cn) act=(pk,cn),对应的私钥 a s k = ( s k , c k ) ask=(sk,ck) ask=(sk,ck).
- Spend ( m , K s , A s , A , R ) → ( t x , π , S ) \operatorname{Spend}(m, K_s, A_s, A, R)\rightarrow(tx, \pi, S) Spend(m,Ks,As,A,R)→(tx,π,S). 输入一组账户 A s A_s As和对应的账户私钥 K s K_s Ks,包含 A s A_s As的一组输入账户的任意集合 A A A,输出地址集合 R R R,交易串 m ∈ { 0 , 1 } ∗ m\in\{0,1\}^* m∈{0,1}∗.算法输出一个交易 t x tx tx(包含 m , A , A R m,A,A_R m,A,AR, A R A_R AR是 R R R对应的输出账户),证明 π \pi π,序列号集合 S S S
- Verify ( t x , π , S ) → 0 / 1 \operatorname{Verify}(tx, \pi, S)\rightarrow 0/1 Verify(tx,π,S)→0/1.算法验证一组序列号为 S S S的账户是否被正确地用于向地址 R R R发送交易 t x tx tx
安全性
- Perfect Correctness
- Balance:任何恶意用户都不能(1)花费不在其控制下的账户中的硬币;(2)在其可控的账户花费更大的数字。
- Anonymity
- Non-Slanderability:任何恶意用户都不可能产生与之前生成的真实消费共享至少一个序列号的有效消费。(涵盖了可链接性)
RingCT 2.0
RCT=(Setup,KeyGen,Mint,Spend,Verify ) \operatorname{RCT=(Setup, KeyGen, Mint, Spend, Verify}) RCT=(Setup,KeyGen,Mint,Spend,Verify)
Setup ( 1 λ ) → p p \operatorname{Setup}(1^\lambda)\rightarrow pp Setup(1λ)→pp
λ
\lambda
λ:security parameter.
Gen
(
1
λ
)
→
p
a
r
\operatorname{Gen}(1^\lambda)\rightarrow {\rm par}
Gen(1λ)→par
f
f
f:accumulator with one-way domain
G
q
,
d
e
s
c
\mathbb{G}_q,{\rm desc}
Gq,desc,
ACC.Gen
\operatorname{ACC.Gen}
ACC.Gen.
h
0
,
h
1
,
u
∈
G
q
h_0,h_1,u\in\mathbb{G}_q
h0,h1,u∈Gq:Generator
H
H
H:hash function
p
p
=
(
1
λ
,
d
e
s
c
,
p
a
r
,
h
0
,
h
1
,
u
,
H
)
pp=(1^\lambda,{\rm desc,par},h_0,h_1,u,H)
pp=(1λ,desc,par,h0,h1,u,H)
KeyGen ( p p ) → ( p k , s k ) \operatorname{KeyGen}(pp)\rightarrow (pk,sk) KeyGen(pp)→(pk,sk)
- ( s k , p k ) : = ( x , y = h 0 x ) ∈ Z q × G q (sk, pk) :=(x, y = h_0^x) \in \mathbb{Z}_q \times \mathbb{G}_q (sk,pk):=(x,y=h0x)∈Zq×Gq
Mint ( p k , a ) → ( c n , c k ) \operatorname{Mint}(pk, a)\rightarrow(cn, ck) Mint(pk,a)→(cn,ck)
- random choose r ∈ Z q r \in\mathbb{Z}_q r∈Zq,Commitment: c = h 0 r h 1 a c=h_0^rh_1^a c=h0rh1a
- ( c n , c k ) : = ( c , ( r , a ) ) (cn, ck) := (c, (r, a)) (cn,ck):=(c,(r,a)), a c t = ( p k , c n ) act=(pk,cn) act=(pk,cn), a s k = ( s k , c k ) ask = (sk, ck) ask=(sk,ck)
Spend ( m , K s , A s , A , R ) → ( t x , π , S ) \operatorname{Spend}(m, K_s, A_s, A, R)\rightarrow(tx, \pi, S) Spend(m,Ks,As,A,R)→(tx,π,S)
- 输出balance
a
o
u
t
,
j
∈
Z
q
a_{out,j}\in\mathbb{Z}_q
aout,j∈Zq for
p
k
o
u
t
,
j
∈
R
pk_{out,j}\in R
pkout,j∈R,输入输出balance满足
∑
k
=
1
m
a
i
n
,
s
(
k
)
=
∑
j
=
1
t
a
o
u
t
,
j
\sum_{k=1}^ma_{in,s}^{(k)}=\sum_{j=1}^ta_{out,j}
∑k=1main,s(k)=∑j=1taout,j.
选择随机数 r o u t , j ∈ Z q r_{out,j}\in\mathbb{Z}_q rout,j∈Zq铸币: c n o u t , j = c o u t , j = h 0 r o u t , j h 1 a o u t , j cn_{out,j}=c_{out,j}=h_0^{r_{out,j}}h_1^{a_{out,j}} cnout,j=cout,j=h0rout,jh1aout,j.
将账户 a c t o u t , j = ( p k o u t , j , c n o u t , j ) act_{out,j}=(pk_{out,j},cn_{out,j}) actout,j=(pkout,j,cnout,j)加入输出账户集合 A R A_R AR,并将coin key c k o u t , j = ( r o u t , j , a o u t , j ) ck_{out,j}=(r_{out,j},a_{out,j}) ckout,j=(rout,j,aout,j)发送给控制账户地址 p k o u t , j pk_{out,j} pkout,j的用户. - 计算总体密钥:
p k ~ i = ∏ k = 1 m p k i n , i ( k ) ⋅ ∏ k = 1 m c n i n , i ( k ) / ∏ j = 1 t c n o u t , j \widetilde{pk}_i=\prod_{k=1}^{m} pk_{in,i}^{(k)} \cdot \prod_{k=1}^{m} cn_{in,i}^{(k)}/\prod_{j=1}^{t} cn_{out,j} pk i=∏k=1mpkin,i(k)⋅∏k=1mcnin,i(k)/∏j=1tcnout,j
其中, p k ~ s = h 0 s k ~ s \widetilde{pk}_s=h_0^{\widetilde{sk}_s} pk s=h0sk s. - 生成一个证明
π
\pi
π,证明一组硬币
A
s
A_s
As被正确地花费于交易
t
x
:
(
m
,
A
,
A
R
=
{
a
c
t
o
u
t
,
j
}
)
tx:(m,A,A_R=\{act_{out,j}\})
tx:(m,A,AR={actout,j})(如下)
(为了方便,将 p k ~ i \widetilde{pk}_i pk i记为 y i ( m + 1 ) y_i^{(m+1)} yi(m+1),将 s k ~ s \widetilde{sk}_s sk s记为 x s ( m + 1 ) x_s^{(m+1)} xs(m+1);将 s k i n , s ( k ) sk_{in,s}^{(k)} skin,s(k)记为 x s ( k ) , k ∈ [ m ] x_s^{(k)},~k\in[m] xs(k), k∈[m]. 将 p k i n , i ( k ) pk_{in,i}^{(k)} pkin,i(k)记为 y i ( k ) , i ∈ [ n ] k ∈ [ m ] y_i^{(k)},~i\in[n]~k\in[m] yi(k), i∈[n] k∈[m].)
(1)对每个 k ∈ [ m + 1 ] k\in[m+1] k∈[m+1],计算累加值 v k = ACC.Eval ( d e s c , { y i ( k ) ⋅ u i } ) vk=\operatorname{ACC.Eval}({\rm desc},\{y_i^{(k)}\cdot u^i\}) vk=ACC.Eval(desc,{yi(k)⋅ui})和witness w s ( k ) = ACC.Wit ( d e s c , { y i ( k ) ⋅ u i ∣ i ≠ s } ) w_s^{(k)}=\operatorname{ACC.Wit}({\rm desc},\{y_i^{(k)}\cdot u^i|i\neq s\}) ws(k)=ACC.Wit(desc,{yi(k)⋅ui∣i=s})给出一个事实( y s ( k ) ⋅ u s y_s^{(k)}\cdot u^s ys(k)⋅us已经被累加到 v k vk vk中)的witness w s ( k ) w_s^{(k)} ws(k),即计算witness w s ( k ) w_s^{(k)} ws(k)满足 f ( w s ( k ) , y s ( k ) ⋅ u s ) = v k f(w_s^{(k)},y_s^{(k)}\cdot u^s)=vk f(ws(k),ys(k)⋅us)=vk. 计算 s k = H ( y s ( k ) ) x s ( k ) sk=H(y_s^{(k)})^{x_s^{(k)}} sk=H(ys(k))xs(k) for all k ∈ [ m ] k\in[m] k∈[m].
记 z s ( k ) = y s ( k ) ⋅ u s z_s^{(k)}=y_s^{(k)}\cdot u^s zs(k)=ys(k)⋅us
(2)用 SoK.Sign \operatorname{SoK.Sign} SoK.Sign生成 t x tx tx的签名 π \pi π:
(3)返回 ( t x , π , S ) , S = { s 1 , s 2 , . . . , s m } (tx,\pi,S),~S=\{s_1,s_2,...,s_m\} (tx,π,S), S={s1,s2,...,sm}. 序列号 s k s_k sk由地址私钥 x s ( k ) x_s^{(k)} xs(k)唯一确定,所以可用于防止double-spending.
Verify ( t x , π , S ) → 0 / 1 \operatorname{Verify}(tx, \pi, S)\rightarrow 0/1 Verify(tx,π,S)→0/1
( m , A , A R ) ∈ t x (m,A,A_R)\in tx (m,A,AR)∈tx
- 用
A
=
{
p
k
i
n
,
i
(
k
)
,
c
n
i
n
,
i
(
k
)
}
i
∈
[
n
]
,
k
∈
[
m
]
A=\{pk_{in,i}^{(k)},cn_{in,i}^{(k)}\}_{i\in[n],k\in[m]}
A={pkin,i(k),cnin,i(k)}i∈[n],k∈[m]和
A
R
=
{
p
k
o
u
t
,
i
,
c
n
o
u
t
,
i
}
j
∈
[
t
]
A_R=\{pk_{out,i},cn_{out,i}\}_{j\in[t]}
AR={pkout,i,cnout,i}j∈[t]计算:
p
k
~
i
=
∏
k
=
1
m
p
k
i
n
,
i
(
k
)
⋅
∏
k
=
1
m
c
n
i
n
,
i
(
k
)
/
∏
j
=
1
t
c
n
o
u
t
,
j
\widetilde{pk}_i=\prod_{k=1}^{m} pk_{in,i}^{(k)} \cdot \prod_{k=1}^{m} cn_{in,i}^{(k)}/\prod_{j=1}^{t} cn_{out,j}
pk
i=∏k=1mpkin,i(k)⋅∏k=1mcnin,i(k)/∏j=1tcnout,j for all
i
∈
[
n
]
i\in[n]
i∈[n].
计算累加值 v k = ACC.Eval ( d e s c , { p k i n , i ( k ) ⋅ u i } ) v_k=\operatorname{ACC.Eval}({\rm desc},\{pk_{in,i}^{(k)}\cdot u^i\}) vk=ACC.Eval(desc,{pkin,i(k)⋅ui}) for all k ∈ [ m ] k\in[m] k∈[m], v m + 1 = ACC.Eval ( d e s c , { p k ~ i ⋅ u i } ) v_{m+1}=\operatorname{ACC.Eval}({\rm desc},\{\widetilde{pk}_i\cdot u^i\}) vm+1=ACC.Eval(desc,{pk i⋅ui}). - Verf ( t x , ( v 1 , . . . , v m + 1 , s 1 , . . . , s m ) , π ) = ? 1 \operatorname{Verf}(tx,(v_1,...,v_{m+1},s_1,...,s_m),\pi)\overset{\text{?}}{=}1 Verf(tx,(v1,...,vm+1,s1,...,sm),π)=?1
Instantiations
ACC的实例:
-
ACC.Gen
(
λ
)
→
(
d
e
s
c
,
X
)
\operatorname{ACC.Gen}(\lambda)\rightarrow ({\rm desc},X)
ACC.Gen(λ)→(desc,X)
G 1 = ⟨ g 0 ⟩ \mathbb{G}_1=\langle g_0\rangle G1=⟨g0⟩
g ∘ f : Z p ∗ × Z p ∗ → G 1 g\circ f:\mathbb{Z}_p^*\times \mathbb{Z}_p^*\rightarrow\mathbb{G}_1 g∘f:Zp∗×Zp∗→G1
f : Z p ∗ × Z p ∗ → Z p ∗ : ( u , x ) → u ( x + α ) f:\mathbb{Z}_p^*\times \mathbb{Z}_p^*\rightarrow\mathbb{Z}_p^*:(u,x)\rightarrow u(x+\alpha) f:Zp∗×Zp∗→Zp∗:(u,x)→u(x+α); g : Z p ∗ → G 1 : x → g 0 x g:\mathbb{Z}_p^*\rightarrow\mathbb{G}_1:x\rightarrow g_0^x g:Zp∗→G1:x→g0x
G q = ⟨ h ⟩ \mathbb{G}_q=\langle h\rangle Gq=⟨h⟩
G q ⊂ Z p ∗ \mathbb{G}_q \subset\mathbb{Z}_p^* Gq⊂Zp∗:被累加的数的域 -
ACC.Eval
(
d
e
s
c
,
X
)
→
f
(
u
,
X
)
\operatorname{ACC.Eval}({\rm desc},X)\rightarrow f(u, X)
ACC.Eval(desc,X)→f(u,X)
g ∘ f ( 1 , X ) = g 0 ∏ i = 1 n ( x i + α ) = ∏ i = 1 n ( g 0 α i ) u i g\circ f(1, X)=g_0^{\prod_{i=1}^{n}(x_i+\alpha)}=\prod_{i=1}^{n}(g_0^{\alpha^i})^{u_i} g∘f(1,X)=g0∏i=1n(xi+α)=∏i=1n(g0αi)ui,其中 u i u_i ui是 α i \alpha^i αi的系数。 -
ACC.Wit
(
d
e
s
c
,
x
s
,
X
)
→
y
\operatorname{ACC.Wit}({\rm desc},x_s,X)\rightarrow y
ACC.Wit(desc,xs,X)→y
累加器被定义为关系 Ω ( w , x , v ) = 1 \Omega(w,x,v)=1 Ω(w,x,v)=1 若满足 e ( w , g 0 x g 0 α ) = e ( v , g 0 ) e(w,g_0^xg_0^\alpha)=e(v,g_0) e(w,g0xg0α)=e(v,g0), w s w_s ws是 x s ∈ X x_s\in X xs∈X的witness,定义为 w s = g ∘ f ( 1 , X / { x s } ) = g 0 ∏ i = 1 , i ≠ s n ( x i + α ) = ∏ i = 1 , i ≠ s n ( g 0 α i ) u i w_s=g\circ f(1,X/\{x_s\})=g_0^{\prod_{i=1,i\neq s}^{n}(x_i+\alpha)}=\prod_{i=1,i\neq s}^{n}(g_0^{\alpha^i})^{u_i} ws=g∘f(1,X/{xs})=g0∏i=1,i=sn(xi+α)=∏i=1,i=sn(g0αi)ui
注意双线性运算隐含的条件: w s x s + α = ( g 0 ∏ i = 1 , i ≠ s n ( x i + α ) ) x s + α = g 0 ∏ i = 1 n ( x i + α ) = v s w_s^{x_s+\alpha}=(g_0^{\prod_{i=1,i\neq s}^{n}(x_i+\alpha)})^{x_s+\alpha}=g_0^{\prod_{i=1}^{n}(x_i+\alpha)}=v_s wsxs+α=(g0∏i=1,i=sn(xi+α))xs+α=g0∏i=1n(xi+α)=vs,所以若等式成立,则 w s w_s ws是对应的witness.