Stephanie Bayer和Jens Groth 2012年论文《Efficient Zero-Knowledge Argument for Correctness of a Shuffle 》中提出了shuffle argument算法，该算法主要由Multi-exponentiation Argument和product argument两部分组成。Efficient Zero-Knowledge Argument for Correctness of a Shuffle学习笔记（1） 中介绍了Shuffle argument总体算法以及Multi-exponentiation Argument算法，在本博客中，将重点介绍product argument算法。
Witness 向量A = { a i j } i , j = 1 n , m A=\{a_{ij}\}_{i,j=1}^{n,m} A = { a i j } i , j = 1 n , m A = ( a 11 a 12 ⋯ a 1 m a 21 a 22 ⋯ a 2 m ⋯ ⋯ ⋯ ⋯ a n 1 a n 2 ⋯ a n m ) = ( a ⃗ 1 , a ⃗ 2 , ⋯ , a ⃗ m ) A=\begin{pmatrix}
a_{11} & a_{12} & \cdots & a_{1m} \\
a_{21} & a_{22} & \cdots & a_{2m} \\
\cdots & \cdots & \cdots & \cdots \\
a_{n1} & a_{n2} & \cdots & a_{nm}
\end{pmatrix}=(\vec{a}_1,\vec{a}_2,\cdots,\vec{a}_m) A = ⎝ ⎜ ⎜ ⎛ a 1 1 a 2 1 ⋯ a n 1 a 1 2 a 2 2 ⋯ a n 2 ⋯ ⋯ ⋯ ⋯ a 1 m a 2 m ⋯ a n m ⎠ ⎟ ⎟ ⎞ = ( a 1 , a 2 , ⋯ , a m )
Public info for both Prover AND Verifier，对A A A a i ⃗ \vec{a_i} a i c ⃗ A = c o m c k ( A ; r ⃗ ) = ( c o m c k ( a ⃗ 1 ; r 1 ) , ⋯ , c o m c k ( a ⃗ m ; r m ) ) \vec{c}_A=com_{ck}(A;\vec{r})=(com_{ck}(\vec{a}_1;r_1),\cdots,com_{ck}(\vec{a}_m;r_m)) c A = c o m c k ( A ; r ) = ( c o m c k ( a 1 ; r 1 ) , ⋯ , c o m c k ( a m ; r m ) ) b = ∏ i = 1 n ∏ j = 1 m a i j = ∏ i = 1 n ( ∏ j = 1 m a i j ) b=\prod_{i=1}^{n}\prod_{j=1}^{m}a_{ij}=\prod_{i=1}^{n}(\prod_{j=1}^{m}a_{ij}) b = ∏ i = 1 n ∏ j = 1 m a i j = ∏ i = 1 n ( ∏ j = 1 m a i j )
思路如下：b ⃗ = ( ∏ j = 1 m a 1 j , ⋯ , ∏ j = 1 m a n j ) = ( b 1 , ⋯ , b n ) \vec{b}=(\prod_{j=1}^{m}a_{1j},\cdots,\prod_{j=1}^{m}a_{nj})=(b_1,\cdots,b_n) b = ( ∏ j = 1 m a 1 j , ⋯ , ∏ j = 1 m a n j ) = ( b 1 , ⋯ , b n ) c b = c o m c k ( b 1 , ⋯ , b n ; s ) c_b=com_{ck}(b_1,\cdots,b_n;s) c b = c o m c k ( b 1 , ⋯ , b n ; s ) b = ∏ i = 1 n ∏ j = 1 m a i j = ∏ i = 1 n ( ∏ j = 1 m a i j ) b=\prod_{i=1}^{n}\prod_{j=1}^{m}a_{ij}=\prod_{i=1}^{n}(\prod_{j=1}^{m}a_{ij}) b = ∏ i = 1 n ∏ j = 1 m a i j = ∏ i = 1 n ( ∏ j = 1 m a i j ) a 11 , ⋯ , a n m a_{11},\cdots,a_{nm} a 1 1 , ⋯ , a n m c b = c o m c k ( b 1 , ⋯ , b n ; s ) = c o m c k ( ∏ j = 1 m a 1 j , ⋯ , ∏ j = 1 m a n j ; s ) c_b=com_{ck}(b_1,\cdots,b_n;s)=com_{ck}(\prod_{j=1}^{m}a_{1j},\cdots,\prod_{j=1}^{m}a_{nj};s) c b = c o m c k ( b 1 , ⋯ , b n ; s ) = c o m c k ( ∏ j = 1 m a 1 j , ⋯ , ∏ j = 1 m a n j ; s ) c b = c o m c k ( b 1 , ⋯ , b n ; s ) c_b=com_{ck}(b_1,\cdots,b_n;s) c b = c o m c k ( b 1 , ⋯ , b n ; s ) b = ∏ i = 1 n b i b=\prod_{i=1}^{n}b_i b = ∏ i = 1 n b i
证明Prover知道相应的witness a 11 , ⋯ , a n m a_{11},\cdots,a_{nm} a 1 1 , ⋯ , a n m c b = c o m c k ( b 1 , ⋯ , b n ; s ) = c o m c k ( ∏ j = 1 m a 1 j , ⋯ , ∏ j = 1 m a n j ; s ) c_b=com_{ck}(b_1,\cdots,b_n;s)=com_{ck}(\prod_{j=1}^{m}a_{1j},\cdots,\prod_{j=1}^{m}a_{nj};s) c b = c o m c k ( b 1 , ⋯ , b n ; s ) = c o m c k ( ∏ j = 1 m a 1 j , ⋯ , ∏ j = 1 m a n j ; s ) a 11 , ⋯ , a n m a_{11},\cdots,a_{nm} a 1 1 , ⋯ , a n m b 1 , ⋯ , b n b_1,\cdots,b_n b 1 , ⋯ , b n
（2）Public info for both Prover AND Verifier：
对A A A a i ⃗ \vec{a_i} a i c ⃗ A = c o m c k ( A ; r ⃗ ) = ( c o m c k ( a ⃗ 1 ; r 1 ) , ⋯ , c o m c k ( a ⃗ m ; r m ) ) \vec{c}_A=com_{ck}(A;\vec{r})=(com_{ck}(\vec{a}_1;r_1),\cdots,com_{ck}(\vec{a}_m;r_m)) c A = c o m c k ( A ; r ) = ( c o m c k ( a 1 ; r 1 ) , ⋯ , c o m c k ( a m ; r m ) )
c b = c o m c k ( b ⃗ ; s ) = c o m c k ( b 1 , ⋯ , b n ; s ) c_b=com_{ck}(\vec{b};s)=com_{ck}(b_1,\cdots,b_n;s) c b = c o m c k ( b ; s ) = c o m c k ( b 1 , ⋯ , b n ; s )
（3）待证明：b i = ∏ j = 1 m a i j b_i=\prod_{j=1}^{m}a_{ij} b i = ∏ j = 1 m a i j b ⃗ = ( b 1 , ⋯ , b n ) = ∏ i = 1 m a ⃗ i \vec{b}=(b_1,\cdots,b_n)=\prod_{i=1}^{m}\vec{a}_i b = ( b 1 , ⋯ , b n ) = ∏ i = 1 m a i ∏ i = 1 m \prod_{i=1}^{m} ∏ i = 1 m
思路如下：
Prover构建新的矩阵B = ( b ⃗ 1 , ⋯ , b ⃗ m ) B=(\vec{b}_1,\cdots,\vec{b}_m) B = ( b 1 , ⋯ , b m ) b ⃗ 1 = a ⃗ 1 , b ⃗ 2 = ∏ i = 1 2 a ⃗ i , ⋯ , b ⃗ m − 1 = ∏ i = 1 m − 1 a ⃗ i , b ⃗ m = ∏ i = 1 m a ⃗ i \vec{b}_1=\vec{a}_1,\vec{b}_2=\prod_{i=1}^{2}\vec{a}_i,\cdots,\vec{b}_{m-1}=\prod_{i=1}^{m-1}\vec{a}_i,\vec{b}_m=\prod_{i=1}^{m}\vec{a}_i b 1 = a 1 , b 2 = ∏ i = 1 2 a i , ⋯ , b m − 1 = ∏ i = 1 m − 1 a i , b m = ∏ i = 1 m a i B B B c ⃗ B = c o m c k ( B ; s ⃗ ) = ( c o m c k ( b ⃗ 1 ; s 1 ) , ⋯ , c o m c k ( b ⃗ m ; s m ) ) = ( c B 1 , ⋯ , c B m ) \vec{c}_B=com_{ck}(B;\vec{s})=(com_{ck}(\vec{b}_1;s_1),\cdots,com_{ck}(\vec{b}_m;s_m))=(c_{B_1},\cdots,c_{B_m}) c B = c o m c k ( B ; s ) = ( c o m c k ( b 1 ; s 1 ) , ⋯ , c o m c k ( b m ; s m ) ) = ( c B 1 , ⋯ , c B m ) c B 1 = c A 1 c_{B_1}=c_{A_1} c B 1 = c A 1 c b = c B m c_b=c_{B_m} c b = c B m b ⃗ 1 = a ⃗ 1 \vec{b}_1=\vec{a}_1 b 1 = a 1 b ⃗ m = b ⃗ \vec{b}_m=\vec{b} b m = b i = 1 , ⋯ , m − 1 i=1,\cdots,m-1 i = 1 , ⋯ , m − 1 b ⃗ i + 1 = a ⃗ i + 1 b ⃗ i \vec{b}_{i+1}=\vec{a}_{i+1}\vec{b}_i b i + 1 = a i + 1 b i b ⃗ 1 = a ⃗ 1 \vec{b}_1=\vec{a}_1 b 1 = a 1 b ⃗ m = b ⃗ \vec{b}_m=\vec{b} b m = b b ⃗ = ∏ i = 1 m a ⃗ i \vec{b}=\prod_{i=1}^{m}\vec{a}_i b = ∏ i = 1 m a i
Verifier->Prover: challenge x x x
改为证明：b ⃗ i + 1 = a ⃗ i + 1 b ⃗ i ⇒ ∑ i = 1 m − 1 x i b ⃗ i + 1 = ∑ i = 1 m − 1 a ⃗ i + 1 ( x i b ⃗ i ) \vec{b}_{i+1}=\vec{a}_{i+1}\vec{b}_i\Rightarrow \sum_{i=1}^{m-1}x^i\vec{b}_{i+1}=\sum_{i=1}^{m-1}\vec{a}_{i+1}(x^i\vec{b}_i) b i + 1 = a i + 1 b i ⇒ ∑ i = 1 m − 1 x i b i + 1 = ∑ i = 1 m − 1 a i + 1 ( x i b i ) x x x D = ( d ⃗ 1 , d ⃗ 2 , ⋯ , d ⃗ m − 1 , d ⃗ ) = ( x b ⃗ 1 , x 2 b ⃗ 2 , ⋯ , x m − 1 b ⃗ m − 1 , ∑ i = 1 m − 1 x i b ⃗ i + 1 ) D=(\vec{d}_1,\vec{d}_2,\cdots,\vec{d}_{m-1},\vec{d})=(x\vec{b}_1,x^2\vec{b}_2,\cdots,x^{m-1}\vec{b}_{m-1},\sum_{i=1}^{m-1}x^i\vec{b}_{i+1}) D = ( d 1 , d 2 , ⋯ , d m − 1 , d ) = ( x b 1 , x 2 b 2 , ⋯ , x m − 1 b m − 1 , ∑ i = 1 m − 1 x i b i + 1 ) d ⃗ = ∑ i = 1 m − 1 x i b ⃗ i + 1 \vec{d}=\sum_{i=1}^{m-1}x^i\vec{b}_{i+1} d = ∑ i = 1 m − 1 x i b i + 1 B B B i = 1 , ⋯ , m − 1 i=1,\cdots,m-1 i = 1 , ⋯ , m − 1 c D i = c B i x i c_{D_i}=c_{B_i}^{x^i} c D i = c B i x i c D = ∏ i = 1 m − 1 x i b ⃗ i + 1 c_D=\prod_{i=1}^{m-1}x^i\vec{b}_{i+1} c D = ∏ i = 1 m − 1 x i b i + 1
使用如上committed值，改为证明d ⃗ = ∑ i = 1 m − 1 x i b ⃗ i + 1 = ∑ i = 1 m − 1 a ⃗ i + 1 ( x i b ⃗ i ) = ∑ i = 1 m − 1 a ⃗ i + 1 d ⃗ i \vec{d}=\sum_{i=1}^{m-1}x^i\vec{b}_{i+1}=\sum_{i=1}^{m-1}\vec{a}_{i+1}(x^i\vec{b}_i)=\sum_{i=1}^{m-1}\vec{a}_{i+1}\vec{d}_i d = ∑ i = 1 m − 1 x i b i + 1 = ∑ i = 1 m − 1 a i + 1 ( x i b i ) = ∑ i = 1 m − 1 a i + 1 d i
Verifier->Prover: challenge y y y
改为证明：d ⃗ = ∑ i = 1 m − 1 a ⃗ i + 1 d ⃗ i ⇒ 0 = ∑ i = 1 m − 1 a ⃗ i + 1 ∗ d ⃗ i − 1 ⃗ ∗ d ⃗ \vec{d}=\sum_{i=1}^{m-1}\vec{a}_{i+1}\vec{d}_i\Rightarrow 0=\sum_{i=1}^{m-1}\vec{a}_{i+1}*\vec{d}_i-\vec{1}*\vec{d} d = ∑ i = 1 m − 1 a i + 1 d i ⇒ 0 = ∑ i = 1 m − 1 a i + 1 ∗ d i − 1 ∗ d ∗ * ∗
Witness: a ⃗ 1 , b ⃗ 0 , ⋯ , a ⃗ m , b ⃗ m − 1 \vec{a}_1,\vec{b}_0,\cdots,\vec{a}_m,\vec{b}_{m-1} a 1 , b 0 , ⋯ , a m , b m − 1 m,\vec{b} {m-1}$。0 = ∑ i = 1 m a ⃗ i ∗ b ⃗ i − 1 0=\sum_{i=1}^{m}\vec{a}_i*\vec{b}_{i-1} 0 = ∑ i = 1 m a i ∗ b i − 1
Prover： 随机选择a ⃗ 0 , b ⃗ m ← Z q n \vec{a}_0,\vec{b}_m\leftarrow \mathbb{Z}_q^n a 0 , b m ← Z q n a ⃗ 0 \vec{a}_0 a 0 b ⃗ m \vec{b}_m b m
( a ⃗ 0 a ⃗ 1 ⋯ a ⃗ m − 1 a ⃗ m ) ( b 0 ⃗ b 1 ⃗ ⋮ b ⃗ m − 1 b ⃗ m ) ( a ⃗ 0 ∗ b ⃗ 0 a ⃗ 1 ∗ b ⃗ 0 ⋱ a ⃗ m − 1 ∗ b ⃗ 0 a ⃗ m ∗ b ⃗ 0 a ⃗ 0 ∗ b ⃗ 1 a ⃗ 1 ∗ b ⃗ 1 ⋱ a ⃗ m − 1 ∗ b ⃗ 1 a ⃗ m ∗ b ⃗ 1 ⋱ ⋱ ⋱ ⋱ ⋱ a ⃗ 0 ∗ b ⃗ m − 1 a ⃗ 1 ∗ b ⃗ m − 1 ⋱ a ⃗ m − 1 ∗ b ⃗ m − 1 a ⃗ m ∗ b ⃗ m − 1 a ⃗ 0 ∗ b ⃗ m a ⃗ 1 ∗ b ⃗ m ⋱ a ⃗ m − 1 ∗ b ⃗ m a ⃗ m ∗ b ⃗ m ) d 2 m d 2 m − 1 ⋮ d m + 1 d m d 0 d 1 ⋯ d m − 1 d m \begin{matrix}
& \begin{pmatrix}
\ \ \ \ \ \ \ \ \vec{a}_0& \ \ \ \ \ \ \ \ \ \ \ \ \vec{a}_1 & \cdots &\ \ \ \ \ \ \ \ \ \ \ \vec{a} _{m-1}&\ \ \ \ \ \ \ \ \vec{a}_m
\end{pmatrix} & \\
\begin{pmatrix}
\vec{b_0}\\
\vec{b_1}\\
\vdots\\
\vec{b}_{m-1}\\
\vec{b}_m
\end{pmatrix} & \begin{pmatrix}
\vec{a}_0*{\vec{b}_0}& \vec{a}_1*{\vec{b}_0} & \ddots & \vec{a}_{m-1}*{\vec{b}_0} & \vec{a}_m*{\vec{b}_0}\\
\vec{a}_0*{\vec{b}_1}& \vec{a}_1*{\vec{b}_1} & \ddots & \vec{a}_{m-1}*{\vec{b}_1} & \vec{a}_m*{\vec{b}_1}\\
\ddots & \ddots & \ddots & \ddots & \ddots\\
\vec{a}_0*{\vec{b}_{m-1}}& \vec{a}_1*{\vec{b}_{m-1}} & \ddots & \vec{a}_{m-1}*{\vec{b}_{m-1}} & \vec{a}_m*{\vec{b}_{m-1}}\\
\vec{a}_0*{\vec{b}_m}& \vec{a}_1*{\vec{b}_m} & \ddots & \vec{a}_{m-1}*{\vec{b}_m} & \vec{a}_m*{\vec{b}_m}
\end{pmatrix} & \begin{matrix}
\\
d_{2m}\\
d_{2m-1}\\
\vdots\\
d_{m+1}\\
d_m
\end{matrix} \\
& \begin{matrix}
\ \ \ \ \ \ \ \ d_0 &\ \ \ \ \ \ \ \ \ \ \ \ d_1 & \cdots & \ \ \ \ \ \ \ \ \ \ \ d_{m-1} & \ \ \ \ \ \ \ \ d_m
\end{matrix}&
\end{matrix} ⎝ ⎜ ⎜ ⎜ ⎜ ⎜ ⎜ ⎛ b 0 b 1 ⋮ b m − 1 b m ⎠ ⎟ ⎟ ⎟ ⎟ ⎟ ⎟ ⎞ ( a 0 a 1 ⋯ a m − 1 a m ) ⎝ ⎜ ⎜ ⎜ ⎜ ⎜ ⎛ a 0 ∗ b 0 a 0 ∗ b 1 ⋱ a 0 ∗ b m − 1 a 0 ∗ b m a 1 ∗ b 0 a 1 ∗ b 1 ⋱ a 1 ∗ b m − 1 a 1 ∗ b m ⋱ ⋱ ⋱ ⋱ ⋱ a m − 1 ∗ b 0 a m − 1 ∗ b 1 ⋱ a m − 1 ∗ b m − 1 a m − 1 ∗ b m a m ∗ b 0 a m ∗ b 1 ⋱ a m ∗ b m − 1 a m ∗ b m ⎠ ⎟ ⎟ ⎟ ⎟ ⎟ ⎞ d 0 d 1 ⋯ d m − 1 d m d 2 m d 2 m − 1 ⋮ d m + 1 d m
有：for k = 0 , ⋯ , 2 m k=0,\cdots,2m k = 0 , ⋯ , 2 m d k = ∑ 0 ≤ i , j ≤ m ; j = ( m − k ) + i a ⃗ i ∗ b ⃗ j d_k=\sum_{0\leq i,j\leq m; j=(m-k)+i}{\vec{a}_i*\vec{b}_j} d k = ∑ 0 ≤ i , j ≤ m ; j = ( m − k ) + i a i ∗ b j d m + 1 = ∑ i = 1 m a ⃗ i ∗ b ⃗ i − 1 = 0 d_{m+1}=\sum_{i=1}^{m}{\vec{a}_i}*\vec{b}_{i-1}=0 d m + 1 = ∑ i = 1 m a i ∗ b i − 1 = 0
因为：∑ k = 0 2 m d k x k = ( ∑ i = 0 m x i a ⃗ i ) ∗ ( ∑ j = 0 m x m − j b ⃗ j ) \sum_{k=0}^{2m}d_kx^k=(\sum_{i=0}^{m}x^i\vec{a}_i)*(\sum_{j=0}^{m}x^{m-j}\vec{b}_j) ∑ k = 0 2 m d k x k = ( ∑ i = 0 m x i a i ) ∗ ( ∑ j = 0 m x m − j b j )
Prover：计算 a ⃗ = ∑ i = 0 m x i a ⃗ i \vec{a}=\sum_{i=0}^{m}x^i\vec{a}_i a = ∑ i = 0 m x i a i b ⃗ = ∑ j = 0 m x m − j b ⃗ j \vec{b}=\sum_{j=0}^{m}x^{m-j}\vec{b}_j b = ∑ j = 0 m x m − j b j a ⃗ \vec{a} a b ⃗ \vec{b} b
Verifier：利用commitment的同态性，只需验证∏ k = 0 2 m c D k x k = c o m c k ( a ⃗ ∗ b ⃗ ; t ) \prod_{k=0}^{2m}c_{D_k}^{x^k}=com_{ck}(\vec{a}*\vec{b};t) ∏ k = 0 2 m c D k x k = c o m c k ( a ∗ b ; t ) d m + 1 = 0 d_{m+1}=0 d m + 1 = 0 x x x x m + 1 x^{m+1} x m + 1 0 = ∑ i = 1 m a ⃗ i ∗ b ⃗ i − 1 0=\sum_{i=1}^{m}\vec{a}_i*\vec{b}_{i-1} 0 = ∑ i = 1 m a i ∗ b i − 1
整个zero argument算法流程如下：
采用的是 J.Groth 2010年论文《A verifiable secret shuffle of homomorphic encryptions》中的算法实现。