Practical Zero-Knowledge Protocols Based on the Discrete Logarithm Assumption 学习笔记 2

1. 引言

Stephanie Bayer 2013年博士论文 《Practical Zero-Knowledge Protocols Based on the Discrete Logarithm Assumption》。

前序博客为 Practical Zero-Knowledge Protocols Based on the Discrete Logarithm Assumption 学习笔记 1,在该博客中主要关注论文前5章的内容。

本博客主要关注论文第6章内容——polynomial evaluation argument (单变量、多变量以及batch)。


要点:

  • 1)Polynomial evaluation argument,证明 p ( u ) = v p(u)=v p(u)=v,其中多项式的系数为public info, u , v u,v u,v为secret info。相应的各项研究对比为:
    在这里插入图片描述
    与 Brands等人[BDD07] 2007年论文《A practical system for globally revoking the unlinkable pseudonyms of unknown users》中隐含的polynomial evaluation argument 对比为:
    在这里插入图片描述
  • 2)多变量Polynomial evaluation argument,证明 p ( u 1 m ⋯   , u N ) = v p(u_1m\cdots,u_N)=v p(u1m,uN)=v,其中多项式的系数为public info, u 1 , ⋯   , u N , v u_1,\cdots,u_N,v u1,,uN,v为secret info。相应的各项研究对比为:
    在这里插入图片描述
  • 3)batch polynomial argument,同时证明 L L L个不同的单变量多项式的 batch polynomial evaluation argument 对比为:
    在这里插入图片描述

2. Zero-Knowledge Polynomial Arguments

2.1 相关的zero-knowledge polynomial arguments介绍

在很多密码学应用中,a party wants to prove possession of a secret value u u u that fulfills a certain property,因此可将该问题转为:given a polynomial P ( X ) P(X) P(X) and a value v v v whether the secret u u u satifies P ( u ) = v P(u)=v P(u)=v in prime order field Z q \mathbb{Z}_q Zq。实际的应用可为:

  • non-membership proof 或 membership proof
  • possession of a digital signature
  • electronic cash protocols

本文的polynomial evaluation argument 考虑的场景为:

  • public info:commitment c u , c v c_u,c_v cu,cv,以及多项式 P ( X ) = ∑ i = 0 D a i X i P(X)=\sum_{i=0}^{D}a_iX^i P(X)=i=0DaiXi的系数 a 0 , ⋯   , a D a_0,\cdots,a_D a0,,aD
  • witness: u , v u,v u,v
  • relation: c u = C o m ( u ) c_u=Com(u) cu=Com(u) c v = C o m ( v ) c_v=Com(v) cv=Com(v) P ( u ) = ∑ i = 0 D a i u i = v P(u)=\sum_{i=0}^{D}a_iu^i=v P(u)=i=0Daiui=v

本文构建的polynomial evaluation argument,相应的:

  • communication complexity为 O ( log ⁡ D ) O(\log D) O(logD) group and field elements,之前[BDD07,Gro09] 论文中基于discrete logarithm logarithm assumption实现的为 O ( D ) O(\sqrt{D}) O(D )
  • Prover computation complexity为: O ( log ⁡ D ) O(\log D) O(logD) exponentiations 和 O ( D log ⁡ D ) O(D\log D) O(DlogD) multiplications in Z q \mathbb{Z}_q Zq
  • Verifier computation complexity为: O ( log ⁡ D ) O(\log D) O(logD) exponentiations 和 O ( D ) O(D) O(D) multiplications in Z q \mathbb{Z}_q Zq

可扩展至多变量多项式 P ( X 1 , ⋯   , X n ) P(X_1,\cdots, X_n) P(X1,,Xn),相应的多变量polynomial evaluation argument 具有:

  • communication 仅为 O ( ( log ⁡ D ) n ) O((\log D)^n) O((logD)n) elements,其中 D D D为the maximum degree of each variable X i X_i Xi,少于the statement size of D n D^n Dn field elements。
  • Prover和Verifier的computation complexity为: O ( ( log ⁡ D ) n ) O((\log D)^n) O((logD)n) exponentiations。

本文实现了prove correctness of evaluation of L L L polynomials P i ( X ) P_i(X) Pi(X) at the same time。[FO97, Bra97, CS97, BDD07, CD98, Gro09, Gro11, KZG10] 等论文需要 L L L times the original cost,as the argument has to be repeated L L L times in parallel。
Repeating our new polynomial arument in parallel would lead to O ( L log ⁡ D ) O(L\log D) O(LlogD) cost,但是本文可reduce为 O ( L log ⁡ D ) O(\sqrt{L} \log D) O(L logD)。Verifier的computation complexity可由 O ( L log ⁡ D ) O(L\log D) O(LlogD) exponentiations reduce为 O ( L log ⁡ D ) O(\sqrt{L}\log D) O(L logD) exponentiations,而round complexity仍然为3。

本文将 Brands等人[BDD07] 2007年论文《A practical system for globally revoking the unlinkable pseudonyms of unknown users》的polynomial argument和本文的polynomial argument进行了实现对比:

  • 对于big degree polynomials,[BDD07] 的communication cost为MB级,而本文的为KB级。
  • 本文的Verifier 运行效率优于 [BDD07]。
  • 本文的Prover 运行效率优于 [BDD07] for reasonable degree D D D

因此对于big size D D D,本文的算法效率更高。

2.1.1 相关技术

在很多multi-exponentiation 技术中,the exponentes a i a_i ai 以二进制表示,将有助于提升运算性能。本文借助该思路,将communication cost reduce 为logarithmic cost,即将 X i X^i Xi 表示为:
X i = ∏ j = 0 d ( X 2 j ) i j X^i=\prod_{j=0}^{d}(X^{2^j})^{i_j} Xi=j=0d(X2j)ij
其中 i i i以二进制形式表示为 i = i 0 ⋯ i d i=i_0\cdots i_d i=i0id

从而可仅commit to log ⁡ D = d \log D=d logD=d values u , u 2 , u 4 , ⋯   , u D u,u^2,u^4,\cdots,u^D u,u2,u4,,uD,利用commitment的同态属性,可获得任意 u i , i ∈ { 1 , 2 , 3 , 4 , ⋯   , D } u^i,i\in\{1,2,3,4,\cdots,D\} ui,i{1,2,3,4,,D} 对应的commitment值,从而可获得相应的argument for P ( u ) = v P(u)=v P(u)=v,相应的communication cost为 O ( log ⁡ ( D ) ) O(\log(D)) O(log(D)) group elements。
但是该reduction会带来high computation complexity。主要瓶颈在于计算a new polynomial Q ( X ) Q(X) Q(X) is expensive。不过,calculation the polynomial in a binary tree fashion 将reduce the computation complexity,且相应的performance 将efficient for medium range parameters。

为了prove correctness of many polynomial P ( 1 ) ( X ) , ⋯   , P ( L ) ( X ) P^{(1)}(X),\cdots,P^{(L)}(X) P(1)(X),,P(L)(X) at the same time,将使用batch verification来reduce the communication cost。将这些polynomials排布为 a m × n m\times n m×n matrix, L = m n L=mn L=mn,然后 show the correctness of n n n polynomials at the same time using Lagrange interpolation polynomials [GGPR13] and the length property of the general Pedersen commitment。

2.1.2 相关的研究成果

本文关注的是:
Given two committed values u , v u,v u,v,实现a zero-knowledge argument that P ( u ) = v P(u)=v P(u)=v for a public polynomial P ( X ) P(X) P(X) of degree D D D

即相应的polynomial evaluation argument 考虑的场景为:

  • public info:commitment c u , c v c_u,c_v cu,cv,以及多项式 P ( X ) = ∑ i = 0 D a i X i P(X)=\sum_{i=0}^{D}a_iX^i P(X)=i=0DaiXi的系数 a 0 , ⋯   , a D a_0,\cdots,a_D a0,,aD
  • witness: u , v u,v u,v
  • relation: c u = C o m ( u ) c_u=Com(u) cu=Com(u) c v = C o m ( v ) c_v=Com(v) cv=Com(v) P ( u ) = ∑ i = 0 D a i u i = v P(u)=\sum_{i=0}^{D}a_iu^i=v P(u)=i=0Daiui=v

相关的研究成果有:

  • [Kil92] 不是基于discrete logarithm assumption的,需要costly NP-reduction。
  • [FO97] 基于RSA-based context,但是具有 linear complexity in the degree of the polynomial and both parties have to perform a linear number of exponenetiations。
  • [Bra97,CS97]是基于discrete logartihm的,但是也需要linear complexity for the communication and the computation。
  • [BDD07] 是基于discrete logarithm的,其中的non-membership proof是当前效率最高的polynomial evaluation argument。其communication complexity为 O ( D ) O(\sqrt{D}) O(D ) D D D为the number of elements in the set,Prover和Verifier均需要perform in O ( D ) O(\sqrt{D}) O(D ) time。
  • [KZG10]基于pairings构建了新的polynomial commitment,在该论文中阐述的是prove evaluation of secret polynomials in a public know value x x x,但是可以将其转换为a general polynomial evaluation argument。这种基于pairing构建的polynomial argument,其communication cost非常轻量级,但是 the computation complexity is O ( D ) O(D) O(D) exponentiations for both parties。
  • [CD98]基于prime order group setting,具有linear communication complexity 和 linear computation。
  • [Gro09] 基于prime order group setting,communication complexity为 O ( D ) O(\sqrt{D}) O(D ) group elements,Verifier仅需 O ( D ) O(\sqrt{D}) O(D ) number of exponentiations,Prover需commit themselves to all gates which cost a linear number of exponenetiations。
  • [Gro11] (Groth 2011年论文《Efficient zero-knowledge arguments from two-tiered homomorphic commitments》)中基于stronger assumption和pairing assumption,将communication cost reduce 为 O ( D 1 3 ) O(D^{\frac{1}{3}}) O(D31) group elements。Verifier仅需计算 O ( D 1 3 ) O(D^{\frac{1}{3}}) O(D31) exponentiations,但是Prover仍然需要commit themselves to the values in each gate, which cost O ( D ) O(D) O(D) commitment operations for the prover。These operations are either exponentiations or calculation of a pairing。

这些研究成果要么需要 high computation complexity for the prover, high computation for the verifier,要么需要 high communication complexity, 要么两者都需要。
[KZG10] 具有迄今为止最小的communication complexity,同时[Gro11] (Groth 2011年论文《Efficient zero-knowledge arguments from two-tiered homomorphic commitments》)也具有low communication cost,但是这两个方案都需要high computation,且都基于 stronger assumption,which are not as well studied as the discrete logarithm assumption。
[BDD07] 基于discret logarithm assumption,实现了the best asymptotic computation cost for both parties的同时还具有a low communication of O ( D ) O(\sqrt{D}) O(D ) elements。

2.2 具有logarithmic cost的polynomial evaluation argument

相关成果已发表在 Eurocrypt 2013年论文《Zero-knowledge argument for polynomial evaluation with application to blacklists》,具体也可参见博客 Zero-Knowledge Argument for Polynomial Evaluation with Application to Blacklists 学习笔记

polynomial evaluation argument 考虑的场景为:

  • public info:commitment c u , c v c_u,c_v cu,cv,以及多项式 P ( X ) = ∑ i = 0 D a i X i P(X)=\sum_{i=0}^{D}a_iX^i P(X)=i=0DaiXi的系数 a 0 , ⋯   , a D a_0,\cdots,a_D a0,,aD
  • witness: u , v u,v u,v
  • relation: c u = C o m ( u ) c_u=Com(u) cu=Com(u) c v = C o m ( v ) c_v=Com(v) cv=Com(v) P ( u ) = ∑ i = 0 D a i u i = v P(u)=\sum_{i=0}^{D}a_iu^i=v P(u)=i=0Daiui=v

By padding with zero-coefficients we can without loss of genrality,假设 D = 2 d + 1 − 1 D=2^{d+1}-1 D=2d+11。以二进制形式表示为 i = i 0 ⋯ i d i=i_0\cdots i_d i=i0id,其中 i j ∈ { 0 , 1 } i_j\in\{0,1\} ij{0,1}
从而可以将term X i X^i Xi表示为:
X i = X ∑ j = 0 d i j 2 j = ∏ j = 0 d ( X 2 j ) i j X^i=X^{\sum_{j=0}^{d}i_j2^j}=\prod_{j=0}^{d}(X^{2^j})^{i_j} Xi=Xj=0dij2j=j=0d(X2j)ij

替换进 P ( X ) P(X) P(X)中有:
P ( X ) = ∑ i = 0 D a i X i = ∑ i 0 , ⋯   , i d = 0 1 a i 0 ⋯ i d ∏ j = 0 d ( X 2 j ) i j P(X)=\sum_{i=0}^{D}a_iX^i=\sum_{i_0,\cdots,i_d=0}^{1}a_{i_0\cdots i_d}\prod_{j=0}^{d}(X^{2^j})^{i_j} P(X)=i=0DaiXi=i0,,id=01ai0idj=0d(X2j)ij

待证明的问题变为:
∑ i 0 , ⋯   , i d = 0 1 a i 0 ⋯ i d ∏ j = 0 d ( u 2 j ) i j = v \sum_{i_0,\cdots,i_d=0}^{1}a_{i_0\cdots i_d}\prod_{j=0}^{d}(u^{2^j})^{i_j}=v i0,,id=01ai0idj=0d(u2j)ij=v

相应的场景可变为:

  • public info:commitment c u 0 , c u 1 , ⋯   , c u d , c v c_{u_0},c_{u_1},\cdots,c_{u_d},c_v cu0,cu1,,cud,cv,以及多项式 P ( X ) = ∑ i = 0 D a i X i P(X)=\sum_{i=0}^{D}a_iX^i P(X)=i=0DaiXi的系数 a 0 , ⋯   , a D a_0,\cdots,a_D a0,,aD
  • witness: u , v u,v u,v
  • relation: c u 0 = C o m ( u 2 0 ) , c u 1 = C o m ( u 2 1 ) , ⋯   , c u d = C o m ( u 2 d ) c_{u_0}=Com(u^{2^0}),c_{u_1}=Com(u^{2^1}),\cdots,c_{u_d}=Com(u^{2^d}) cu0=Com(u20),cu1=Com(u21),,cud=Com(u2d) c v = C o m ( v ) c_v=Com(v) cv=Com(v) P ( u ) = ∑ i 0 ⋯ i d = 0 1 a i 0 ⋯ i d ∏ j = 0 d ( u 2 j ) i j = v P(u)=\sum_{i_0\cdots i_d=0}^{1}a_{i_0\cdots i_d}\prod_{j=0}^{d}(u^{2^j})^{i_j}=v P(u)=i0id=01ai0idj=0d(u2j)ij=v

由于 d = ⌊ log ⁡ D ⌋ d=\left \lfloor \log D\right \rfloor d=logD,Prover仅需make a logarithmic number of commitments,将有助于keep the communication cost low。
同时可借助标准技术来证明 the commitments c u 1 , ⋯   , c u d c_{u_1},\cdots, c_{u_d} cu1,,cud to u 2 1 , ⋯   , u 2 d u^{2^1},\cdots,u^{2^d} u21,,u2d are well-formed and indeed contain the correct powers of u u u

为了证明 the committed powers of u u u in c 0 , c 1 , ⋯   , c d c_0,c_1,\cdots,c_d c0,c1,,cd evaluate to the committed v v v,Prover选择随机值 f 0 , ⋯   , f d ← Z p f_0,\cdots,f_d\leftarrow \mathbb{Z}_p f0,,fdZp,构建新的多项式:
Q ( X ) = ∑ i 0 ⋯ i d = 0 1 a i 0 , ⋯   , i d ∏ j = 0 d ( X u 2 j + f j ) i j X 1 − i j = X d + 1 P ( u ) + X d δ d + ⋯ + X δ 1 + δ 0 Q(X)=\sum_{i_0\cdots i_d=0}^{1}a_{i_0,\cdots,i_d}\prod_{j=0}^{d}(Xu^{2^j}+f_j)^{i_j}X^{1-i_j}=X^{d+1}P(u)+X^d\delta_d+\cdots+X\delta_1+\delta_0 Q(X)=i0id=01ai0,,idj=0d(Xu2j+fj)ijX1ij=Xd+1P(u)+Xdδd++Xδ1+δ0

构建该新多项式 Q ( X ) Q(X) Q(X)的核心思想为:
for each i j i_j ij either an X u 2 j Xu^{2^j} Xu2j factor is included or an X X X factor is included,因此 P ( u ) P(u) P(u) X d + 1 X^{d+1} Xd+1的系数。每个 f j f_j fj仅影响 the lower degree coefficients δ 0 , ⋯   , δ d \delta_0,\cdots,\delta_d δ0,,δd of Q ( X ) Q(X) Q(X)

接下来Prover需要证明 the coefficient of X d + 1 X^{d+1} Xd+1 in the secret Q(X) is the same as v v v, in a way that cancels out the δ 0 , ⋯   , δ d \delta_0,\cdots,\delta_d δ0,,δd coefficients。Prover将给Verifier发送 commitements c f 0 , ⋯   , c f d c_{f_0},\cdots,c_{f_d} cf0,,cfd to f 0 , ⋯   , f d f_0,\cdots,f_d f0,,fd 和 commitments c δ 0 , ⋯   , c δ d c_{\delta_0},\cdots,c_{\delta_d} cδ0,,cδd to δ 0 , ⋯   , δ d \delta_0,\cdots,\delta_d δ0,,δd
Prover收到Verifier发送的challenge x ← Z q ∗ x\leftarrow\mathbb{Z}_q^* xZq 之后,将open suitable products of the commitments in a way such that the verifier can check that the committed values u , v u,v u,v 满足:
Q ( x ) = x d + 1 v + x d δ d + ⋯ + δ 0 Q(x)=x^{d+1}v+x^d\delta_d+\cdots+\delta_0 Q(x)=xd+1v+xdδd++δ0

准确地,Prover将:

  • open each product c j x c f j c_j^xc_{f_j} cjxcfj to f ˉ j = x u 2 j + f j \bar{f}_j=xu^{2^j}+f_j fˉj=xu2j+fj
  • open c v x d + 1 ∏ j = 0 d c δ j x j c_v^{x^{d+1}}\prod_{j=0}^{d}c_{\delta_j}^{x^j} cvxd+1j=0dcδjxj to δ ˉ = ∑ i 0 ⋯ i d = 0 1 a i 0 ⋯ i d ∏ j = 0 d ( f ˉ j i j ) i j x 1 − i j \bar{\delta}=\sum_{i_0\cdots i_d=0}^{1}a_{i_0\cdots i_d}\prod_{j=0}^{d}(\bar{f}_j^{i_j})^{i_j}x^{1-i_j} δˉ=i0id=01ai0idj=0d(fˉjij)ijx1ij

注意其中 δ ˉ \bar{\delta} δˉ可由Verifier自己计算,因此以上两个条件都验证通过,则 P ( u ) = v P(u)=v P(u)=v成立。

借助标准技术来证明 the commitments c u 1 , ⋯   , c u d c_{u_1},\cdots, c_{u_d} cu1,,cud to u 2 1 , ⋯   , u 2 d u^{2^1},\cdots,u^{2^d} u21,,u2d are well-formed and indeed contain the correct powers of u u u 的方法为:
Prover 发送commitments c f u j c_{fu_j} cfuj to f j u 2 j f_ju^{2^j} fju2j 给Verifier,然后open the commitments c u j + 1 x c u j − f ˉ j c f u j c_{u_{j+1}}^xc_{u_j}^{-\bar{f}_j}c_{fu_j} cuj+1xcujfˉjcfuj to
x u 2 j + 1 − ( x u 2 j + f j ) u 2 j + f j u 2 j = 0 xu^{2^{j+1}}-(xu^{2^j}+f_j)u^{2^j}+f_ju^{2^j}=0 xu2j+1(xu2j+fj)u2j+fju2j=0

完整的证明过程为:
在这里插入图片描述
在这里插入图片描述
整个证明算法的效率分析为:
在这里插入图片描述
在这里插入图片描述
实际实现的性能分析为:
在这里插入图片描述
在这里插入图片描述
在这里插入图片描述

2.3 多变量polynomial argument

关注的多变量多项式为:
P ( X 1 , ⋯   , X N ) = ∑ i 1 , ⋯   , i N = 0 D a i 1 ⋯ i N X 1 i 1 ⋯ X N i N P(X_1,\cdots,X_N)=\sum_{i_1,\cdots,i_N=0}^{D}a_{i_1\cdots i_N}X_1^{i_1}\cdots X_N^{i_N} P(X1,,XN)=i1,,iN=0Dai1iNX1i1XNiN

多变量polynomial evaluation argument 考虑的场景为:

  • public info:commitment c u 1 , ⋯   , c u N , c v c_{u_1},\cdots,c_{u_N},c_v cu1,,cuN,cv,以及多项式 P ( X 1 , ⋯   , X N ) = ∑ i 1 , ⋯   , i N = 0 D a i 1 ⋯ i N X 1 i 1 ⋯ X N i N P(X_1,\cdots,X_N)=\sum_{i_1,\cdots,i_N=0}^{D}a_{i_1\cdots i_N}X_1^{i_1}\cdots X_N^{i_N} P(X1,,XN)=i1,,iN=0Dai1iNX1i1XNiN的系数 a 0 ⋯ 0 , ⋯   , a D ⋯ D a_{0\cdots 0},\cdots,a_{D\cdots D} a00,,aDD
  • witness: u 1 , ⋯   , u N , v u_1,\cdots,u_N,v u1,,uN,v
  • relation: c u 1 = C o m ( u 1 ) , ⋯   , c u N = C o m ( u N ) c_{u_1}=Com(u_1),\cdots,c_{u_N}=Com(u_N) cu1=Com(u1),,cuN=Com(uN) c v = C o m ( v ) c_v=Com(v) cv=Com(v) P ( u 1 , ⋯   , u N ) = ∑ i 1 , ⋯   , i N = 0 D a i 1 ⋯ i N u 1 i 1 ⋯ u N i N = v P(u_1,\cdots,u_N)=\sum_{i_1,\cdots,i_N=0}^{D}a_{i_1\cdots i_N}u_1^{i_1}\cdots u_N^{i_N}=v P(u1,,uN)=i1,,iN=0Dai1iNu1i1uNiN=v

By padding with zero-coefficients we can without loss of genrality,假设 D = 2 d + 1 − 1 D=2^{d+1}-1 D=2d+11。以二进制形式表示为 i j = i j 0 ⋯ i j d i_j=i_{j0}\cdots i_{jd} ij=ij0ijd,其中 i j k ∈ { 0 , 1 } i_{jk}\in\{0,1\} ijk{0,1}
从而可以将term X j i j X_j^{i_j} Xjij表示为:
X j i j = X j ∑ k = 0 d i j k 2 k = ∏ k = 0 d ( X j 2 k ) i j k X_j^{i_j}=X_j^{\sum_{k=0}^{d}i_{jk}2^k}=\prod_{k=0}^{d}(X_j^{2^k})^{i_{jk}} Xjij=Xjk=0dijk2k=k=0d(Xj2k)ijk

替换进 P ( X ) P(X) P(X)中有:
P ( X 1 , ⋯   , X N ) = ∑ i 1 , ⋯   , i N = 0 D a i 1 ⋯ i N ∏ k = 0 d ( X 1 2 k ) i 1 k ⋯ ∏ k = 0 d ( X N 2 k ) i N k = ∑ i 10 , ⋯   , i N d = 0 1 a i 10 ⋯ i N d ∏ j = 1 N ∏ k = 0 d ( X j 2 k ) i j k P(X_1,\cdots,X_N)=\sum_{i_1,\cdots,i_N=0}^{D}a_{i_1\cdots i_N}\prod_{k=0}^{d}(X_1^{2^k})^{i_{1k}}\cdots \prod_{k=0}^{d}(X_N^{2^k})^{i_{Nk}}=\sum_{i_{10},\cdots,i_{Nd}=0}^{1}a_{i_{10}\cdots i_{Nd}}\prod_{j=1}^{N}\prod_{k=0}^{d}(X_j^{2^k})^{i_{jk}} P(X1,,XN)=i1,,iN=0Dai1iNk=0d(X12k)i1kk=0d(XN2k)iNk=i10,,iNd=01ai10iNdj=1Nk=0d(Xj2k)ijk

待证明的问题变为:
∑ i 10 , ⋯   , i N d = 0 1 a i 10 ⋯ i N d ∏ j = 1 N ∏ k = 0 d ( u j 2 k ) i j k = v \sum_{i_{10},\cdots,i_{Nd}=0}^{1}a_{i_{10}\cdots i_{Nd}}\prod_{j=1}^{N}\prod_{k=0}^{d}(u_j^{2^k})^{i_{jk}}=v i10,,iNd=01ai10iNdj=1Nk=0d(uj2k)ijk=v

Prover选择随机数 f j k ← Z q f_{jk}\leftarrow \mathbb{Z}_q fjkZq for j = 1 , ⋯   , N j=1,\cdots,N j=1,,N and k = 0 , ⋯   , d k=0,\cdots,d k=0,,d,构建新的多项式:
Q ( X 1 , ⋯   , X N ) = ∑ i 10 , ⋯   , i N d = 0 1 a i 10 ⋯ i N d ∏ j = 1 N ∏ k = 0 d ( X j 2 k + f j k ) i j k X j 1 − i j k = X 1 d + 1 ⋯ X N d + 1 v + X 1 d X 2 d + 1 ⋯ X N d + 1 δ ν + ⋯ + X N δ 1 + δ 0 = X 1 d + 1 ⋯ X N d + 1 v + ∑ k 1 , ⋯   , k N = 0 ∖ { k 1 = ⋯ = k N = d + 1 } ∧ l = ∑ i = 1 d + 1 k i ( d + 1 ) i d + 1 X 1 k 1 ⋯ X N k N δ l Q(X_1,\cdots,X_N)=\sum_{i_{10},\cdots,i_{Nd}=0}^{1}a_{i_{10}\cdots i_{Nd}}\prod_{j=1}^{N}\prod_{k=0}^{d}(X_j^{2^k}+f_{jk})^{i_{jk}}X_j^{1-i_{jk}}=X_1^{d+1}\cdots X_N^{d+1}v+X_1^dX_2^{d+1}\cdots X_N^{d+1}\delta_{\nu}+\cdots+X_N\delta_1+\delta_0=X_1^{d+1}\cdots X_N^{d+1}v+\sum_{k_1,\cdots,k_N=0\setminus \{k_1=\cdots=k_N=d+1\}\wedge l=\sum_{i=1}^{d+1}k_i(d+1)^i}^{d+1}X_1^{k_1}\cdots X_N^{k_N}\delta_l Q(X1,,XN)=i10,,iNd=01ai10iNdj=1Nk=0d(Xj2k+fjk)ijkXj1ijk=X1d+1XNd+1v+X1dX2d+1XNd+1δν++XNδ1+δ0=X1d+1XNd+1v+k1,,kN=0{k1==kN=d+1}l=i=1d+1ki(d+1)id+1X1k1XNkNδl

其中 ν = ( d + 1 ) N − 1 \nu=(d+1)^N-1 ν=(d+1)N1

具体的证明思路与2.2节的单变量polynomial evaluation argument 类似。
在这里插入图片描述
在这里插入图片描述
整个多变量polynomial evaluation argument的运行效率分析如下:
在这里插入图片描述
在这里插入图片描述

2.4 Batch Polynomial Argument

针对的场景为:
有a batch of polynomials P ( 1 ) ( X ) , ⋯   , P ( L ) ( X ) P^{(1)}(X),\cdots,P^{(L)}(X) P(1)(X),,P(L)(X) of the form
P ( l ) ( X ) = ∑ i = 0 D a i ( l ) X i = ∑ i 0 , ⋯   , i d = 0 1 a i 0 ⋯ i d ( l ) ∏ j = 0 d ( X 2 j ) i j P^{(l)}(X)=\sum_{i=0}^{D}a_i^{(l)}X^i=\sum_{i_0,\cdots,i_d=0}^{1}a_{i_0\cdots i_d}^{(l)}\prod_{j=0}^{d}(X^{2^j})^{i_j} P(l)(X)=i=0Dai(l)Xi=i0,,id=01ai0id(l)j=0d(X2j)ij
commitments to evaluations v 1 = P ( 1 ) ( u 1 ) , ⋯   , v L = P ( L ) ( u L ) v_1=P^{(1)}(u_1),\cdots,v_L=P^{(L)}(u_L) v1=P(1)(u1),,vL=P(L)(uL) in committed values u 1 , ⋯   , u L u_1,\cdots,u_L u1,,uL,满足 v i = P ( i ) ( u i ) v_i=P^{(i)}(u_i) vi=P(i)(ui) for all i i i

若并行执行2.2节的polynomial argument的花,则communication complexity为 O ( L log ⁡ D ) O(L\log D) O(LlogD) group and field elements。
而借助博客 Practical Zero-Knowledge Protocols Based on the Discrete Logarithm Assumption 学习笔记 1 5.4节的Hadamard product argument算法,可将communication cost reduce为 O ( L log ⁡ D ) O(\sqrt{L}\log D) O(L logD) when L = m n L=mn L=mn and m ≈ n ≈ L m\approx n\approx \sqrt{L} mnL

在Hadamard product argument中,有针对a set of values Ω = { w 1 , ⋯   , w m } ⊂ Z q \Omega=\{w_1,\cdots,w_m\}\subset\mathbb{Z}_q Ω={w1,,wm}Zq,相应的Langrange interpolation polynomials为:
l i ( X ) = ∏ j ≠ i ( X − w j ) ∏ j ≠ i ( w i − w j )  for  i = 1 , ⋯   , m l_i(X)=\frac{\prod_{j\neq i}(X-w_j)}{\prod_{j\neq i}(w_i-w_j)}\ \text{for}\ i=1,\cdots,m li(X)=j=i(wiwj)j=i(Xwj) for i=1,,m

可定义 l ( X ) = ∏ j = 1 m ( X − w j ) l(X)=\prod_{j=1}^{m}(X-w_j) l(X)=j=1m(Xwj)。本文只要求 w 1 , ⋯   , w m w_1,\cdots,w_m w1,,wm为不同的,不过为了效率,通常选择为 n n n-th root of unity值。当为 n n n-th root of unity时,可借助FFT来加速相关计算。

Lagrange polynomials具有如下关键特性:
l i ( X ) = { 1 m o d    X − w i 0 m o d    l ( X ) X − w i  for  i = 1 , ⋯   , m l_i(X)= \left\{\begin{matrix} 1 & \mod X-w_i\\ 0& \mod \frac{l(X)}{X-w_i} \end{matrix}\right.\ \text{for}\ i=1,\cdots,m li(X)={10modXwimodXwil(X) for i=1,,m

还有:

  • l i ( X ) ≡ 1 m o d    X − w i l_i(X)\equiv 1\mod X-w_i li(X)1modXwi
  • l i ( X ) ≡ 0 m o d    X − w k  for  i ≠ k l_i(X)\equiv 0\mod X-w_k\ \text{for}\ i\neq k li(X)0modXwk for i=k
  • l ( X ) ≡ 0 m o d    X − w k  for  ∀ k l(X)\equiv 0\mod X-w_k \ \text{for}\ \forall k l(X)0modXwk for k
  • l i ( X ) ( X − w i ) ≡ 0 m o d    l ( X )  for  ∀ i l_i(X)(X-w_i)\equiv 0 \mod l(X)\ \text{for}\ \forall i li(X)(Xwi)0modl(X) for i

该思路也可用于batch-verify many polynomials simultaneously to reduce the communication cost。具体为:
将 the polynomials 和 the committed values 以 m × n m\times n m×n 矩阵表示,其中 L = m n L=mn L=mn

转为证明:
已知 polynomials P ( i , k ) P^{(i,k)} P(i,k) 和 the committed values u i , k , v i , k u_{i,k},v_{i,k} ui,k,vi,k for i = 1 , ⋯   , m i=1,\cdots,m i=1,,m and k = 1 , ⋯   , n k=1,\cdots,n k=1,,n

然后 for each k k k verify the m m m polynomial evaluations P ( i , k ) ( u i , k ) = v i , k P^{(i,k)}(u_{i,k})=v_{i,k} P(i,k)(ui,k)=vi,k simultaneously。

类似地,选择随机值 f ⃗ j ← Z q n \vec{f}_j\leftarrow \mathbb{Z}_q^n f jZqn,构建:
u ⃗ ˉ 2 j = l ( X ) f ⃗ j + ∑ i = 1 m l i ( X ) u ⃗ i 2 j \bar{\vec{u}}_{2^j}=l(X)\vec{f}_j+\sum_{i=1}^{m}l_i(X)\vec{u}_i^{2^j} u ˉ2j=l(X)f j+i=1mli(X)u i2j

此时对于 the k k k-th entries u ˉ 2 j , k \bar{u}_{2^j,k} uˉ2j,k of these vectors,for each i = 1 , ⋯   , m i=1,\cdots,m i=1,,m有:
u ˉ 2 j , k ≡ u i , k 2 j m o d    X − w i \bar{u}_{2^j,k}\equiv u_{i,k}^{2^j}\mod X-w_i uˉ2j,kui,k2jmodXwi
将其替换进polynomial P ( i , k ) P^{(i,k)} P(i,k) 有:
∑ i 0 , ⋯   , i d = 0 1 a i 0 ⋯ i d ( i , k ) ∏ j = 0 d ( u ˉ 2 j , k ) i j ≡ P ( i , k ) ( u i , k ) ≡ v i , k m o d    X − w i \sum_{i_0,\cdots,i_d=0}^{1}a_{i_0\cdots i_d}^{(i,k)}\prod_{j=0}^{d}(\bar{u}_{2^j,k})^{i_j}\equiv P^{(i,k)}(u_{i,k})\equiv v_{i,k}\mod X-w_i i0,,id=01ai0id(i,k)j=0d(uˉ2j,k)ijP(i,k)(ui,k)vi,kmodXwi

为了verify many polynomials at once, Prover仅需向Verifier证明:【注意 l i ( X ) ( X − w i ) ≡ 0 m o d    l ( X ) l_i(X)(X-w_i)\equiv 0 \mod l(X) li(X)(Xwi)0modl(X)
∑ i = 1 m l i ( X ) ∑ i 0 , ⋯   , i d = 0 1 a i 0 ⋯ i d ( i , k ) ∏ j = 0 d ( u ˉ 2 j , k ) i j ≡ ∑ i = 1 m l i ( X ) v i , k m o d    l ( X ) \sum_{i=1}^{m}l_i(X)\sum_{i_0,\cdots,i_d=0}^{1}a_{i_0\cdots i_d}^{(i,k)}\prod_{j=0}^{d}(\bar{u}_{2^j,k})^{i_j}\equiv \sum_{i=1}^{m}l_i(X)v_{i,k}\mod l(X) i=1mli(X)i0,,id=01ai0id(i,k)j=0d(uˉ2j,k)iji=1mli(X)vi,kmodl(X)

详细的证明过程为:
在这里插入图片描述
在这里插入图片描述
其中第4步验证内容为2.2节的 “借助标准技术来证明 the commitments c u i , 2 1 , ⋯   , c u i , 2 d c_{u_{i,2^1}},\cdots, c_{u_{i,2^d}} cui,21,,cui,2d to u i 2 1 , ⋯   , u i 2 d u_i^{2^1},\cdots,u_i^{2^d} ui21,,ui2d are well-formed and indeed contain the correct powers of u i u_i ui” 的并行证明,for i = 1 , ⋯   , m i=1,\cdots,m i=1,,m

整个Batch Polynomial Argument 算法的性能分析为:
在这里插入图片描述
在这里插入图片描述

2.5 具有sqaure root cost的polynomial evaluation argument

Brands等人[BDD07] 2007年论文《A practical system for globally revoking the unlinkable pseudonyms of unknown users》中构建了具有sqaure root complexity的polynomial argument,来源于其中的non-membership proof,可以很容易转换为a polynomial argument。
在该论文中:
为了证明non-membership of a u ∈ Z q u\in\mathbb{Z}_q uZq to a list L = { λ 1 , ⋯   , λ D } \mathcal{L}=\{\lambda_1,\cdots,\lambda_D\} L={λ1,,λD},where without loss of generality D = σ 2 D=\sigma^2 D=σ2
Brandsg构建了 σ = D \sigma=\sqrt{D} σ=D 个polynomials:
P j ( X ) = ∏ i = 1 σ ( X − λ ( j − 1 ) σ + i ) P_j(X)=\prod_{i=1}^{\sigma}(X-\lambda_{(j-1)\sigma+i}) Pj(X)=i=1σ(Xλ(j1)σ+i)
并证明 for each j = 1 , ⋯   , σ j=1,\cdots,\sigma j=1,,σ P j ( X ) P_{j}(X) Pj(X) evaluated in u u u is not equal to 0。
整个证明过程包含了:

  • 证明 P j ( u ) = v j P_j(u)=v_j Pj(u)=vj 确实是the polynomial evaluated on u u u
  • Prover commit themselves to the values u , u 2 , u 3 , ⋯   , u σ u,u^2,u^3,\cdots,u^{\sigma} u,u2,u3,,uσ,然后证明这些commitments 包含了the successive powers of u u u

利用以上两个证明算法,可构建相应的polynomial argument:
Prover和Verifier都知道多项式 P ( X ) = a D X D + ⋯ + a 1 X + a 0 P(X)=a_DX^D+\cdots+a_1X+a_0 P(X)=aDXD++a1X+a0,Prover需证明the committed values u , v u,v u,v 使得 P ( u ) = v P(u)=v P(u)=v
为了实现square root complexity,将多项式 P ( X ) P(X) P(X) 拆分为 σ \sigma σ个多项式 P j ( X ) P_j(X) Pj(X)
P ( X ) = P σ ( X ) X D − σ + ⋯ + P 2 ( X ) X σ + P 1 ( X ) P(X)=P_{\sigma}(X)X^{D-\sigma}+\cdots+P_2(X)X^{\sigma}+P_1(X) P(X)=Pσ(X)XDσ++P2(X)Xσ+P1(X)
其中每个多项式 P j ( X ) P_j(X) Pj(X)的degree为 σ = D \sigma=\sqrt{D} σ=D

证明算法中需包含的核心要点有:

  • 1)采用标准技术证明 the commitments c u 1 , ⋯   , c u σ c_{u_1},\cdots, c_{u_\sigma} cu1,,cuσ to u 1 , u 2 , ⋯   , u σ u^{1},u^{2},\cdots,u^{\sigma} u1,u2,,uσ are well-formed and indeed contain the correct powers of u u u,思路为:【 c u i = C o m c k ( u i ; r i ) c_{u_i}=Com_{ck}(u^i;r_i) cui=Comck(ui;ri) for i = 1 , ⋯   , σ , r i ← Z q i=1,\cdots,\sigma,r_i\leftarrow \mathbb{Z}_q i=1,,σ,riZq
    – Prover commit to 随机数 r u , t 1 , t 2 , ⋯   , t σ r_u,t_1,t_2,\cdots,t_{\sigma} ru,t1,t2,,tσ,发送给 Verifier f 1 = C o m c k ( r u ; t 1 ) f_1=Com_{ck}(r_u;t_1) f1=Comck(ru;t1) f i = c u i − 1 r u c o m c k ( 0 ; t i ) f_i=c_{u^{i-1}}^{r_u}com_{ck}(0;t_i) fi=cui1rucomck(0;ti) for i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ
    – Verifier 发送challenge x x x
    – Prover 回复 u ˉ = x u + r u \bar{u}=xu+r_u uˉ=xu+ru,以及 r ˉ 1 = x r 1 + t 1 , r ˉ i = x ( r i − u r i − 1 ) + t i  for  i = 2 , ⋯   , σ \bar{r}_1=xr_1+t_1,\bar{r}_i=x(r_i-ur_{i-1})+t_i\ \text{for}\ i=2,\cdots,\sigma rˉ1=xr1+t1,rˉi=x(riuri1)+ti for i=2,,σ
    – Verifier 验证 C o m c k ( u ˉ ; r ˉ 1 ) = f 1 c u 1 x Com_{ck}(\bar{u};\bar{r}_1)=f_1c_{u_1}^x Comck(uˉ;rˉ1)=f1cu1x 以及 c u i − 1 u ˉ C o m c k ( 0 ; r ˉ i ) = f i c u i x c_{u_{i-1}}^{\bar{u}}Com_{ck}(0;\bar{r}_i)=f_ic_{u_i}^x cui1uˉComck(0;rˉi)=ficuix for i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ

  • 2)采用标准技术证明 the commitments c u σ , c u 2 σ ⋯   , c u ( σ − 1 ) σ c_{u_{\sigma}},c_{u_{2\sigma}}\cdots, c_{u_{(\sigma-1)\sigma}} cuσ,cu2σ,cu(σ1)σ to u σ , u 2 σ , ⋯   , u ( σ − 1 ) σ u^{\sigma},u^{2\sigma},\cdots,u^{(\sigma-1)\sigma} uσ,u2σ,,u(σ1)σ are well-formed and indeed contain the correct powers of u u u,思路与1)类似为:【 c u i σ = C o m c k ( u i σ ; r i σ ) c_{u_{i\sigma}}=Com_{ck}(u^{i\sigma};r_{i\sigma}) cuiσ=Comck(uiσ;riσ) for i = 1 , ⋯   , σ − 1 , r i σ ← Z q i=1,\cdots,\sigma-1,r_{i\sigma}\leftarrow \mathbb{Z}_q i=1,,σ1,riσZq
    – Prover 发送给Verifier f i σ = c u ( i − 1 ) σ r u σ C o m c k ( 0 ; t i σ ) f_{i\sigma}=c_{u_{(i-1)\sigma}}^{r_{u_{\sigma}}}Com_{ck}(0;t_{i\sigma}) fiσ=cu(i1)σruσComck(0;tiσ),其中 r u σ , t i σ ← Z q , i = 2 , ⋯   , σ − 1 r_{u_\sigma},t_{i\sigma}\leftarrow \mathbb{Z}_q,i=2,\cdots,\sigma-1 ruσ,tiσZq,i=2,,σ1
    – Verifier发送challenge x x x
    – Prover回复 u ˉ σ = x u σ + r u σ \bar{u}_{\sigma}=xu^{\sigma}+r_{u_{\sigma}} uˉσ=xuσ+ruσ,以及 r ˉ i σ = x ( r i σ − u σ r ( i − 1 ) σ ) + t i  for  i = 2 , ⋯   , σ − 1 \bar{r}_{i\sigma}=x(r_{i\sigma}-u^{\sigma}r_{(i-1)\sigma})+t_i\ \text{for}\ i=2,\cdots,\sigma-1 rˉiσ=x(riσuσr(i1)σ)+ti for i=2,,σ1
    – Verifier 验证 c u ( i − 1 ) σ u ˉ σ C o m c k ( 0 ; r ˉ i σ ) = f i σ c u i σ x c_{u_{(i-1)\sigma}}^{\bar{u}_{\sigma}}Com_{ck}(0;\bar{r}_{i\sigma})=f_{i\sigma}c_{u_{i\sigma}}^x cu(i1)σuˉσComck(0;rˉiσ)=fiσcuiσx for i = 2 , ⋯   , σ − 1 i=2,\cdots,\sigma-1 i=2,,σ1

  • 3)对拆分后的 σ \sigma σ个多项式 P j ( X ) P_j(X) Pj(X):【需证明 v = v σ u ( σ − 1 ) σ + ⋯ + v 2 u σ + v 1 = v 1 + ∑ i = 2 σ v i u ( i − 1 ) σ v=v_{\sigma}u^{(\sigma-1)\sigma}+\cdots+v_2u^{\sigma}+v_1=v_1+\sum_{i=2}^{\sigma}v_iu^{(i-1)\sigma} v=vσu(σ1)σ++v2uσ+v1=v1+i=2σviu(i1)σ 以及 P j ( u ) = v j P_j(u)=v_j Pj(u)=vj,其中 v , u , v i v,u,v_i v,u,vi 均为secret info。 c v = C o m c k ( v ; s ) c_v=Com_{ck}(v;s) cv=Comck(v;s)。】
    – Prover:计算 v j = P j ( u ) v_j=P_j(u) vj=Pj(u) w j = a j , σ r σ + ⋯ + a j , 2 r 2 + a j , 1 r 1 w_j=a_{j,\sigma}r_{\sigma}+\cdots+a_{j,2}r_2+a_{j,1}r_1 wj=aj,σrσ++aj,2r2+aj,1r1,for j = 1 , ⋯   , σ j=1,\cdots,\sigma j=1,,σ
    计算 c v i = C o m c k ( v i ; w i ) c_{v_i}=Com_{ck}(v_i;w_i) cvi=Comck(vi;wi) i = 1 , ⋯   , σ i=1,\cdots,\sigma i=1,,σ
    计算 c v i ∗ = C o m c k ( v i u ( i − 1 ) σ ; s i ) c_{v_i^*}=Com_{ck}(v_iu^{(i-1)\sigma};s_i) cvi=Comck(viu(i1)σ;si) i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ,其中 s i ← Z q , s σ = s − ∑ i = 2 σ − 1 s i − w 1 s_i\leftarrow \mathbb{Z}_q,s_{\sigma}=s-\sum_{i=2}^{\sigma-1}s_i-w_1 siZq,sσ=si=2σ1siw1
    3.1)为了证明 c v i ∗ = C o m c k ( v i u ( i − 1 ) σ ; s i ) c_{v_i^*}=Com_{ck}(v_iu^{(i-1)\sigma};s_i) cvi=Comck(viu(i1)σ;si) c v i = C o m c k ( v i ; w i ) c_{v_i}=Com_{ck}(v_i;w_i) cvi=Comck(vi;wi) 及两者之间的关系:
    Prover:选择随机数 d i , ρ i d_i,\rho_i di,ρi for i = 1 , ⋯   , σ i=1,\cdots,\sigma i=1,,σ,计算 c d i = C o m c k ( d i ; ρ i ) c_{d_i}=Com_{ck}(d_i;\rho_i) cdi=Comck(di;ρi);选择随机数 e i , σ i e_i,\sigma_i ei,σi for i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ,计算 c e i = C o m c k ( e i ; σ i ) c_{e_i}=Com_{ck}(e_i;\sigma_i) cei=Comck(ei;σi);for i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ,计算 c f i = c u ( i − 1 ) σ d i C o m c k ( 0 ; ρ i ) c_{f_i}=c_{u_{(i-1)\sigma}}^{d_i}Com_{ck}(0;\rho_i) cfi=cu(i1)σdiComck(0;ρi)
    Verifier:发送challenge x x x
    Prover:for i = 1 , ⋯   , σ i=1,\cdots,\sigma i=1,,σ,计算 a ˉ i = d i + x v i , r ˉ i = ρ i + x w i \bar{a}_i=d_i+xv_i,\bar{r}_i=\rho_i+xw_i aˉi=di+xvi,rˉi=ρi+xwi;for i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ,计算 b ˉ i = e i + x u ( i − 1 ) σ , s ˉ i = σ i + x r i σ \bar{b}_i=e_i+xu^{(i-1)\sigma},\bar{s}_i=\sigma_i+xr_{i\sigma} bˉi=ei+xu(i1)σ,sˉi=σi+xriσ;for i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ,计算 t ˉ i = ρ i − x ( r ( i − 1 ) σ v i − s i ) \bar{t}_i=\rho_i-x(r_{(i-1)\sigma}v_i-s_i) tˉi=ρix(r(i1)σvisi)
    Verifier:for i = 1 , ⋯   , σ i=1,\cdots,\sigma i=1,,σ,验证 c v i x c d i = C o m c k ( a ˉ i ; r ˉ i ) c_{v_i}^xc_{d_i}=Com_{ck}(\bar{a}_i;\bar{r}_i) cvixcdi=Comck(aˉi;rˉi);for i = 2 , ⋯   , σ i=2,\cdots,\sigma i=2,,σ,验证 c u ( i − 1 ) σ x c e i = C o m c k ( b ˉ i ; s ˉ i ) c_{u_{(i-1)\sigma}}^xc_{e_i}=Com_{ck}(\bar{b}_i;\bar{s}_i) cu(i1)σxcei=Comck(bˉi;sˉi) c v i ∗ x c f i = c u ( i − 1 ) σ a ˉ i C o m c k ( 0 ; t ˉ i ) c_{v_i^*}^xc_{f_i}=c_{u_{(i-1)\sigma}}^{\bar{a}_i}Com_{ck}(0;\bar{t}_i) cvixcfi=cu(i1)σaˉiComck(0;tˉi)
    3.2)为了证明 v = v σ u ( σ − 1 ) σ + ⋯ + v 2 u σ + v 1 = v 1 + ∑ i = 2 σ v i u ( i − 1 ) σ v=v_{\sigma}u^{(\sigma-1)\sigma}+\cdots+v_2u^{\sigma}+v_1=v_1+\sum_{i=2}^{\sigma}v_iu^{(i-1)\sigma} v=vσu(σ1)σ++v2uσ+v1=v1+i=2σviu(i1)σ
    在3.1)的基础上,Verifier仅需额外验证 c v 1 ∏ i = 2 σ c v i ∗ = c v c_{v_1}\prod_{i=2}^{\sigma}c_{v_i^*}=c_v cv1i=2σcvi=cv 即可。
    3.3)为了证明 P j ( u ) = v j = a j , 0 + a j , 1 u + a j , 2 u 2 + ⋯ + a j , σ u σ P_j(u)=v_j=a_{j,0}+a_{j,1}u+a_{j,2}u^2+\cdots+a_{j,\sigma}u^{\sigma} Pj(u)=vj=aj,0+aj,1u+aj,2u2++aj,σuσ:【batch验证】
    Verifier引入了 σ \sigma σ个随机数 σ j \sigma_j σj for j = 1 , ⋯   , σ j=1,\cdots,\sigma j=1,,σ,实现了batch验证:
    ∏ j = 1 σ c v j σ j = G ∑ j = 1 σ a j , 0 σ j ∏ i = 1 σ c u i ∑ i = 1 σ a j , i σ j \prod_{j=1}^{\sigma}c_{v_j}^{\sigma_j}=G^{\sum_{j=1}^{\sigma}a_{j,0}\sigma_j}\prod_{i=1}^{\sigma}c_{u_i}^{\sum_{i=1}^{\sigma}a_{j,i}\sigma_j} j=1σcvjσj=Gj=1σaj,0σji=1σcuii=1σaj,iσj

整个证明过程为:【论文中有多处typo,具体看上面分析。】
在这里插入图片描述
在这里插入图片描述

相应的算法效率分析为:
在这里插入图片描述
基于不同的modular subgroups的不同security level 进行了实现:
在这里插入图片描述
在这里插入图片描述

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值