Zero-knowledge proof (zk-SNARK) (1)

The full name is Zero-Knowledge Succinct Non-Interactive Argument of Knowledge, a concise non-interactive zero-knowledge proof. The simplicity makes the protocol run, even if the statement is very large, its proof size is only a few hundred bytes, and a proof is verified The time can reach millisecond level.
The main scenario to be solved is that Prover proves to Verifier that the calculation result of a commonly recognized computational problem is correct, requires zero knowledge, and cannot disclose any information.
The core method is to use R1CS, QAP and other methods to turn computational problems into polynomials, cleverly transform the correctness of calculation results into polynomial problems with special solutions, generate corresponding proofs, and then use polynomial proof methods to complete the proof and verification.

Non-Interactive Argument of Knowledge of a Polynomial

(Note that the calculation and parameter selection are in the domain, that is, modulo operation)

Proof of General Polynomials

The scenario is as follows: Verifier has a polynomial $f\left(x\right)$ , Prover proves to Verifer that he knows this polynomial.
Suppose the polynomial known by the Prover is$p\left(x\right)$ , then what we need to prove now is$f(x)=p\left(x\right)$ , if the two polynomials are of order up to$d$ , then the curve represented by the two polynomials will have at most$d$ intersection points, when the Verifier randomly takes a value ssin a large range$s$ , then$s$ and$The\; probability\; of\; d$ being the same will be very low, so there is the following agreement

• Verifier randomly selects a value ss in a large range$s$ , and locally compute$f\left(s\right)$ , then put$s$ to Prover
• Prover calculates $p\left(s\right)$ , then sent to Verifier
• Verifier verifies $f(s)\stackrel{?}{=}p(s)$
  

Proving the roots of a polynomial

Some polynomials can decompose the product of multiple polynomials, such as assuming $p(x)=(x-a)(x-b)(x-c)$ Then
suppose Prover has a polynomial$p\left(x\right)$ , now he wants to prove that his polynomial holds some roots (partial polynomial), that is, prove that his polynomial$p\left(x\right)=t\left(x\right)h\left(x\right)$ contains$t\left(x\right)$ is assumed to be$(x-a)(x-b)$ , and at this time$t\left(x\right)$ is called the target polynomial, which is public. It should be noted that the Prover cannot reveal the original polynomial. Then there is the following protocol

• Verifier randomly selects the value ss in a large range$s$ , calculate$t=t\left(s\right)$ , then$s$ to Prover
• Proer calculates $h(x)=\frac{p(x)}{t(x)}$,$h(s)$,$p\left(s\right)$ , then send the last two to Verifier
• Verfier verify $p(s)\stackrel{?}{=}t(s)h(s)$

It is obvious that the above variables are all limited to integers, if $p$ does divide$t$ , then the equation must be established, if not, then there will be a remainder in the formula, and there is a great probability that it is not an integer.
Of course, this protocol still has a lot of loopholes, for example, Prover may not know$p\left(x\right)$ , but knowing the public$t\left(x\right)$ , so h ( x ) can be completely fabricated$h\left(x\right)$ satisfies the condition.

homomorphic encryption

Obviously, we cannot transmit plaintext in the protocol, but we need to calculate ciphertext, so we need an algorithm that satisfies both encryption and calculation characteristics.
Homomorphic encryption algorithm $E(x)$，如$E(atx+by)=g^{ax+by}=g^{ax}\cdot g^{by}={\left(g^x\right)}^a\cdot {\left(g^y\right)}^b=E(x{)}^a\cdot E(and{)}^b.$（$g$ is the generator), based on the discrete logarithm problem and the CDH assumption (that is, given$g^a,g^b$ , get$g^{ab}$ is difficult). Obviously, this is homomorphic encryption that only satisfies homomorphic addition, and does not support ciphertext multiplication.
Then the algorithm does not support multiplication, only one$In\; the\; case\; of\; s$ , how to calculate the polynomial homomorphically? Obviously not, so I tried to convert homomorphic multiplication into homomorphic addition, and noticed that the polynomial$P\left(x\right)$ can be regarded as a linear combination of a set of coefficients and unknowns, that is, to calculatessEach power of$s$$d$ , which is equivalent to limiting the order of the polynomial, so that$s^1,\dots ,s^d$ , and then calculate the addition of each part of the polynomial.
The specific use is as follows,

1. Verifier randomly selects an ss in a large range$s$ , calculate ssfirstPower of$s$$s^1,\dots ,s^d$ , then calculate$t(s)$，最后$E(1),E(s),\dots ,E(s^d)$and sent to Prover
2. Prover calculates after receiving the data, $h(x)=\frac{p(x)}{t(x)}$, and then calculate E ( p ( s ) ) E(p(s)) with the coefficients of the polynomial$E(p(s))$，$E\left(h\right(s))$ and send to Verifier
3. Verifier for verification $E(p(s))\stackrel{?}{=}E(t(s))E(h(s))$，即$g^{p(s)}=(g^{h(s)}{)}^{t(s)}$

** KCA（The Knowledge of Coefficient Test and Assumption）**

The above protocol still has a lot of loopholes. For example, when Prover calculates polynomials, he does not use the format of polynomials (linear combination of constant coefficients and unknowns), but uses another method. The algorithm finds an algorithm that satisfies zp = ( zh $z_p=(z_h{)}^{}$Two values ​​of${}^t$${}^{(}$${}^s$${}^{)}$$z_p,z_h$To replace $g^{p(s)},g^{h\left(s\right)}$ , that is, no polynomial is used at all, and the result that satisfies the condition is directly imitated.
Here it is necessary to restrict Prover, so that he must use a polynomial that satisfies the conditions, which is limited to a constant, and the exponent is also limited, and the exponent cannot be changed arbitrarily. SoKCAcan also be calledKEA(Knowledge of exponent)
as follows,
define a pair of elements$(a,b=a\cdot a)$ (called an$\alpha$ - 对）,$a\cdot a$ means$aaaaa$ _$a$ addition, that is,$a^{\alpha }$ , then a KC process is as follows:

1. First Verifier will randomly select a non-zero $\alpha$，calculationb$b=a\cdot a$ , obviously this is an$a-shift$。
2. Verifier sends this challenge pair $(a,b)$ To Prover.
3. At this time, Prover will respond a pair of different, but with the same nature pair $(a^{\prime },b^{\prime })$, it should be$a-shift$
4. If received is an $a-shift$ , then Verifier accepts this response

Note that this satisfies the DL problem, and it is difficult for Prover to find an $\alpha$ , then how should she construct a new$a-Whataboutshift$ ?$\_$In an obvious way, Prover chooses a constant coefficient$\gamma$ , direct construction$(a^{\prime },b^{\prime })=c(a,b)$ .
Suppose Verifier sends not one, but$d$组$a-shift$ , then Prover will also choose a set of coefficients$c_1,\dots ,c_d$，respond 一个
$(a^{\prime },b^{\prime })=({\sum }_{i=1}^d{c}_i{a}_i,{\sum }_{i=1}^d{c}_i{b}_i)$ , obviously this pair also satisfies$a-shift$ .$\_$If the content sent by Verifier is optimized, it constitutesKCA.

Blind Evaluation of Polynomials Verifiable Protocol

A complete polynomial blind verification protocol.
Two properties need to be satisfied to solve the whole problem:

• **Blindness: **That is, Prover cannot obtain $s$ , the same Verifier can not get$p\left(x\right)$ (homomorphism).
• **Verifiability:** is to ensure that the Prover sends $E\left(p\right(x))$ is indeed a polynomial$p\left(x\right)$ is calculated instead of completely uncorrelated data (KCA)

Then use KCA to optimize the previous protocol as follows,

1. Verifier randomly chooses $\alpha$ (non-zero) and$s$ , then calculate$t\left(s\right)$ , then construct$a-shift$$(g,g^a),(g^s,g^{\alpha \cdot s}),\dots ,(g^{s^d},g^{\alpha \cdot s^d})$
2. Prover uses the polynomial p ( x ) p(x)The coefficient c 1 of$p$$($$x$$)$$c_1,\dots ,c_d$, and then calculate $E(h(s))$以及$(E(p(s)),E(\alpha p(s)))=(g^{{\sum }_{i=1}^d{c}_i{s}^i},g^{{\sum }_{i=1}^d{c}_i\alpha \cdot s^d})$, sent to Verifier
3. Verifier for verification $E(p(s))\stackrel{?}{=}E(\alpha p(s))$和$E\left(p\right(s))\stackrel{?}{=}E\left(t\right(s$ )$)$$E$$($$h$$($$s$$))$

This scheme can also solve the previous problem, that is, the Prover cannot be constructed arbitrarily to satisfy the similar $z_p=(z_h{)}^{}$h(s) h(s)of${}^t$${}^{(}$${}^s$${}^{)}$$h\left(s\right)$ , so it is easy not to satisfy$a-Shiftconstraints$ .$\_$$\_$

Parings and bilinear map

The previous protocol basically realizes the interaction scheme between two honest parties. The relevant proof is only valid between the two parties and cannot be reused. However, in practice, there are many malicious parties, which is obviously not realistic. Therefore, some secret parameters need to be reusable or even public, and trusted enough to prevent abuse. First consider the ( t ( s ) , α ) (t(s),\alpha)
generated by Verifier$(t(s),\alpha )$ for encryption protection to prevent leakage. If the previous homomorphic encryption is used, the subsequent multiplication calculation will involve homomorphic multiplication, but the homomorphic algorithm used earlier does not support homomorphic multiplication. So what should we do when we must use something like multiplication? At this time, the elliptic hyperbolic mapping is introduced.
Parings are multiplicative representation functions that deterministically map two encrypted inputs in one set to an output in another set.
That is:$e:\mathbb{G}\times G\to G_T$Satisfy the following properties
$\begin{array}{rl}e(g_1^{\mathrm{a}},{\mathrm{g}}_2^{\mathrm{b}})& =e(g_1,g_2{)}^{\mathrm{ab}}=e(g_1^{\mathrm{ab}},g_2)=e(g_1,g_2^{ab})\end{array}$
$\begin{array}{rl}e(g_1^{\mathrm{a}},{\mathrm{g}}_2^{\mathrm{b}})e(g_1^{\mathrm{c}},g_2^{\mathrm{d}})& =e(g_1,g_2{)}^{\mathrm{ab}+\mathrm{cd}}\end{array}$
Its significance is that to map a pair of elements in a certain group to a new group, if and only if the products of the corresponding exponents of the two preimages are the same, the images are also the same. Moreover, the function is required to be computable (that is, without brute force search, etc.), and it can verify whether the product of a pair of (encrypted) data is the same as another pair (although the product cannot be calculated) Next
, The calculation of the agreement is placed on the elliptic curve group satisfying Parings.

Multiple Parties Composite Common Reference String

First introduce a trusted third party to randomly generate $s$ and$\alpha$ , and calculatethe CRS(Common Reference String), a total of two parts of proof and verification, both of which are public (i ∈ { 0 , … , d } i \in \{0,\dots,d\}i∈{ 0,…,d } ), then you need to delete$s$ and$a$ .

• Proving Key：$E(s^i),E(a{s}^i)=g^{s^i},g^{\alpha s^i}$
• Verification Key：$E(t(s)),E\left(a\right)=g^{t(s)},g^a$

Then, based on CRS, Prover and Verifier can complete the agreement only through CRS. Continue to optimize the protocol as follows, (the following simplifies $p=p(s),t,h$ is also similar)

• For Prover, the public CRS already contains the content of the first step, and the next step is to use the Proving Key to calculate $E\left(h\right(s))$和$(E(p(s)),E(\alpha p(s)))$
• For Verifier, Verfication in CRS is used for verification ( $p^{\prime }=\alpha p$ )
  • First verify that $p=t\cdot h$，即$e(g^p,g^1)=e(g^t,g^h)=e(g,g{)}^p=e(g,g{)}^{t\cdot h}$
  • Then verify $a-shift$，即$e(g^p,g^a)=e(g^{p^{\prime }},g)$

Note: There are also two problems exposed here,

1. E ( α ) E(\alpha) in Proving Key$E\left(\alpha \right)$ is public, that is to say, for Prover, he can break the polynomial restriction.
2. A trusted third party is introduced, but in a more complex reality, it cannot be guaranteed that the third party is not malicious, such as not destroying the random secret of the trusted setup, which will lead to anyone can forge the proof once it is exposed.

So ZKSNARK introduces a multi-party joint setup, each with its own private key $(a,s)$ and the CRS generated by the previous person as input to generate a new CRS, as long as one person destroys the private key, the final CRS can be guaranteed to be safe. The specific implementation is as follows.it is only necessary to use homomorphic
multiplication to add everyone’s private key. )

$(a,s)$ Perform random sampling and provide random numbers to be added to the CRS to achieve the purpose of destroying validity.
So how to verify the consistency of the final CRS? The previous Paring is used to
check$s$ : set$s^1$ as a benchmark, the verification method is as follows,

check$a-shift$ :

In order for participants to honestly use the CRS of other participants in front, each participant (except the first one) needs to be required to encrypt and disclose their own secret parameters, so that each participant can pass$Paring$ Verify that other parties have done so honestly. As follows, suppose Bob exposes
${\left(g^{s_B^i},g^{a_B},g^{a_B{s}_B^i}\right)|}_{i\in [d]}$
Then the participant Alice can verify.

Similarly, the participant Carol can also verify after it is made public.

Complete short non-interactive polynomial proof scheme

这里用 { g s i } i ∈ [ d ] \{g^{s^i}\}_{i\in[d]} { gsi}i∈[d]​Represents $s^1,\dots ,s^d$
First determine the target polynomial$t\left(x\right)$ and prover's polynomial degree$d$ , the prover needs to prove that the polynomial he holds contains$t\left(x\right)$ .
details as follows

reference

A Brief Talk on Zero-Knowledge Proof: Background and Origin
zcash Official Popular Science
Exploring Elliptic Curve Pairings
Quadratic Arithmetic Programs: from Zero to Hero
Why and how zk-SNARK works
ZKSNARK introduces
Li Weihan, Zhang Zongyang, Zhou Zibo, etc. Summary of concise non-interactive zero-knowledge proof [J]. Journal of Cryptography, 2022, 9(03): 379-447. DOI: 10.13868/j.cnki.jcr.000525.