本博文主要研究的是 Benedikt Bünz 等人（standford,ethereum,berkeley） 2019年论文《Proofs for Inner Pairing Products and Applications 》中的Pairing-based polynomial commitment schemes，其本质为 a generalization of two-tiered commitment scheme from Groth [Gro11] （Groth等人2011年论文EfficientZero-KnowledgeArgumentsfromTwo-Tiered HomomorphicCommitments ）。
前序博文为：Proofs for Inner Pairing Products and Applications 学习笔记
以下的“本文”是指：Benedikt Bünz 等人（standford,ethereum,berkeley） 2019年论文《Proofs for Inner Pairing Products and Applications 》。
Polynomial commitment由[KZG10] Kate等人 2010年论文《Constant-Size Commitments to Polynomials and Their Applications 》 首次提出，具体是指：
committer输出一个short commitment to polynomial；
committer输出一个short proof （或者opening），用于证明the correctness of an evaluation of that committed polynomial at any point。
Polynomial commitment (PC) 在很多领域用于reduce communication and computation costs，如：
proofs of storage and replication [XYZW16] [Fis18]；
anonymous credentials [CDHK15] [FHS19]；
verifiable secret sharing [KZG10] [BDK13]；
zero-knowledge arguments [WTSTW18] [MBKM19] [Gab19] [Set19] [GWC19] [XZZPS19] [CHMMVW20]。
本文将polynomial commitment与inner product argument结合，构建了a pairing based inner product argument，具有constant-sized commitments、logarithmic-sized openings 和 square root reference string。
本文采用了与[Gro11] 中类似的two-tiered homomorphic commitment，同时支持单变量和双变量多项式。本文提供了一种实例化方式，使得其同时具有public-coin setup, achieving square root verifier time以及upadatable SRS [GKMMM18]，achieving log-time verification。
The transparent variant is secure in the plain model under the standard SXDH assumption，而本文的trusted setup scheme is secure in the algebraic group model (AGM) [FKL18]。本文的这种trusted setup scheme 具有的优势主要体现在produce opening proofs的时效上：
对于单变量多项式，opening cost为square root in the degree of the polynomial；
对于双变量多项式，opening cost为linear in the degree of one variable。
[KZG10] 的trusted setup scheme 支持constant proof size and verifier time （而本文的算法是logarithmic），但是本文的算法quadratically improve the opening efficiency，同时the maximum degree polynomial supported by a SRS of a given size。更小的SRS有助于节约storage，提升setup效率，而且还有助于security。
[Gro11] 论文中 designed a pairing based “batch product argument” secure under SXDH。该argument可看作是一种类型的polynomial commitment scheme。
[BG13] 论文中 Bayer和Groth designed a zero-knowledge proving system to show that a committed value is the correct evaluation of a known polynomial, under discrete-logarithm assumption。
[WTSTW18] 论文中 Wahby等人证明了可借用Bulletproofs中的inner product argument 来构建polynomial commitment scheme。
[BGH19] 论文中 Bowe等人证明了Bulletproofs的inner product argument 是可highly aggregatable to the point where aggregated proofs can be verified using a one off linear cost and an additional logarithmic factor per proof。
[ZXZS19] 论文中使用Reed-Solomon codes构建了polynomial commitment scheme。该论文中的commtiment使用了highly efficient symmetric key primitives，however the protocols that use them require soundness boosting techniques that result in large constant overheads。
[BFS19] 论文中 Bünz等人借助groups of unkown order such as RSA groups or class groups构建了polynomial commitment scheme，具有efficient verifier time and small proof size，但是需要super-linear commitment and prover time。
本文采用的是Groth [Gro11] （Groth等人2011年论文EfficientZero-KnowledgeArgumentsfromTwo-Tiered HomomorphicCommitments ） 中的 two-tiered homomorphic commitments，即：commitments to commitments。
假设要commit to a polynomial：f ( X , Y ) = f 0 ( Y ) + f 1 ( Y ) X + ⋯ + f m − 1 ( Y ) X m − 1 = ∑ i = 0 m − 1 f i ( Y ) X i f(X,Y)=f_0(Y)+f_1(Y)X+\cdots+f_{m-1}(Y)X^{m-1}=\sum_{i=0}^{m-1}f_i(Y)X^i f ( X , Y ) = f 0 ( Y ) + f 1 ( Y ) X + ⋯ + f m − 1 ( Y ) X m − 1 = ∑ i = 0 m − 1 f i ( Y ) X i
可将polynomial f ( X , Y ) f(X,Y) f ( X , Y ) m − 1 m-1 m − 1 X X X l − 1 l-1 l − 1 Y Y Y f ( X , Y ) = ( 1 , X , X 2 , ⋯ , X m − 1 ) ( a 0 , 0 a 0 , 1 a 0 , 2 ⋯ a 0 , l − 1 a 1 , 0 a 1 , 1 a 1 , 2 ⋯ a 1 , l − 1 a 2 , 0 a 2 , 1 a 2 , 2 ⋯ a 2 , l − 1 ⋮ ⋱ ⋮ a m − 1 , 0 a m − 1 , 1 a m − 1 , 2 ⋯ a m − 1 , l − 1 ) ( 1 Y Y 2 ⋯ Y l − 1 ) = ( 1 , X , X 2 , ⋯ , X m − 1 ) A ( 1 Y Y 2 ⋯ Y l − 1 ) f(X,Y)=(1,X,X^2,\cdots,X^{m-1})\begin{pmatrix}
a_{0,0} & a_{0,1} & a_{0,2} & \cdots & a_{0,l-1}\\
a_{1,0} & a_{1,1} & a_{1,2} & \cdots & a_{1,l-1}\\
a_{2,0} & a_{2,1} & a_{2,2} & \cdots & a_{2,l-1}\\
\vdots & & & \ddots & \vdots\\
a_{m-1,0} & a_{m-1,1} & a_{m-1,2} & \cdots & a_{m-1,l-1}
\end{pmatrix} \begin{pmatrix}
1\\
Y\\
Y^2\\
\cdots \\
Y^{l-1}
\end{pmatrix}=(1,X,X^2,\cdots,X^{m-1})\mathcal{A}\begin{pmatrix}
1\\
Y\\
Y^2\\
\cdots \\
Y^{l-1}
\end{pmatrix} f ( X , Y ) = ( 1 , X , X 2 , ⋯ , X m − 1 ) ⎝ ⎜ ⎜ ⎜ ⎜ ⎜ ⎛ a 0 , 0 a 1 , 0 a 2 , 0 ⋮ a m − 1 , 0 a 0 , 1 a 1 , 1 a 2 , 1 a m − 1 , 1 a 0 , 2 a 1 , 2 a 2 , 2 a m − 1 , 2 ⋯ ⋯ ⋯ ⋱ ⋯ a 0 , l − 1 a 1 , l − 1 a 2 , l − 1 ⋮ a m − 1 , l − 1 ⎠ ⎟ ⎟ ⎟ ⎟ ⎟ ⎞ ⎝ ⎜ ⎜ ⎜ ⎜ ⎛ 1 Y Y 2 ⋯ Y l − 1 ⎠ ⎟ ⎟ ⎟ ⎟ ⎞ = ( 1 , X , X 2 , ⋯ , X m − 1 ) A ⎝ ⎜ ⎜ ⎜ ⎜ ⎛ 1 Y Y 2 ⋯ Y l − 1 ⎠ ⎟ ⎟ ⎟ ⎟ ⎞
于是，polynomial f ( X , Y ) = ∑ i = 0 m − 1 f i ( Y ) X i f(X,Y)=\sum_{i=0}^{m-1}f_i(Y)X^i f ( X , Y ) = ∑ i = 0 m − 1 f i ( Y ) X i f i ( Y ) = ∑ j = 0 l − 1 a i , j Y j f_i(Y)=\sum_{j=0}^{l-1}a_{i,j}Y^j f i ( Y ) = ∑ j = 0 l − 1 a i , j Y j
则commit to f ( X , Y ) f(X,Y) f ( X , Y )
先对polynomials f 0 ( Y ) , ⋯ , f m − 1 ( Y ) f_0(Y),\cdots,f_{m-1}(Y) f 0 ( Y ) , ⋯ , f m − 1 ( Y ) A 0 , ⋯ , A m − 1 A_0,\cdots,A_{m-1} A 0 , ⋯ , A m − 1
再对A 0 , ⋯ , A m − 1 A_0,\cdots,A_{m-1} A 0 , ⋯ , A m − 1 T = C M ( A 0 , ⋯ , A m − 1 ) T=CM(A_0,\cdots,A_{m-1}) T = C M ( A 0 , ⋯ , A m − 1 )
( x , y ) (x,y) ( x , y )
先在第一层 evalute at x x x A A A f ( x , Y ) f(x,Y) f ( x , Y )
然后在第二层 open commitment A A A y y y e v a l = f ( x , y ) eval=f(x,y) e v a l = f ( x , y ) Bulletproofs: Short Proofs for Confidential Transactions and More ）方式来实现，则对应的是transparent version。
具体的信息为：
public info：v ⃗ ∈ G 2 m , T ∈ G T , A ∈ G 1 , b ⃗ ∈ F m \vec{v}\in\mathbb{G}_2^m,T\in\mathbb{G}_T, A\in\mathbb{G}_1,\vec{b}\in\mathbb{F}^m v ∈ G 2 m , T ∈ G T , A ∈ G 1 , b ∈ F m
private info：A ⃗ ∈ G 1 m \vec{A}\in\mathbb{G}_1^m A ∈ G 1 m
待证明：T = A ⃗ ∗ v ⃗ = e ( A 0 , v 0 ) ⋯ e ( A m − 1 , v m − 1 ) ∧ A = < A ⃗ , b ⃗ > = A 0 b 0 ⋯ A m − 1 b m − 1 T=\vec{A}*\vec{v}=e(A_0,v_0)\cdots e(A_{m-1},v_{m-1})\wedge A=<\vec{A},\vec{b}>=A_0^{b_0}\cdots A_{m-1}^{b_{m-1}} T = A ∗ v = e ( A 0 , v 0 ) ⋯ e ( A m − 1 , v m − 1 ) ∧ A = < A , b > = A 0 b 0 ⋯ A m − 1 b m − 1
整个relation表示为：
假设f ( X , Y ) = ∑ i = 0 m − 1 f i ( Y ) X i , f i ( Y ) = ∑ j = 0 l − 1 a i , j Y j f(X,Y)=\sum_{i=0}^{m-1}f_i(Y)X^i,f_i(Y)=\sum_{j=0}^{l-1}a_{i,j}Y^j f ( X , Y ) = ∑ i = 0 m − 1 f i ( Y ) X i , f i ( Y ) = ∑ j = 0 l − 1 a i , j Y j m − 1 m-1 m − 1 X X X l − 1 l-1 l − 1 Y Y Y
则commitment key 应包含 l l l G 1 \mathbb{G}_1 G 1 m m m G 2 \mathbb{G}_2 G 2 c k = ( g 0 , ⋯ , g l − 1 ) ∈ G 1 l , ( v 0 , ⋯ , v m − 1 ) ∈ G 2 m ck=(g_0,\cdots,g_{l-1})\in\mathbb{G}_1^l,(v_0,\cdots,v_{m-1})\in\mathbb{G}_2^m c k = ( g 0 , ⋯ , g l − 1 ) ∈ G 1 l , ( v 0 , ⋯ , v m − 1 ) ∈ G 2 m
进行commit，实际实现为：
首先，生成m m m A 0 , ⋯ , A m − 1 A_0,\cdots,A_{m-1} A 0 , ⋯ , A m − 1 f 0 ( Y ) , ⋯ , f m − 1 ( Y ) f_0(Y),\cdots,f_{m-1}(Y) f 0 ( Y ) , ⋯ , f m − 1 ( Y ) A \mathcal{A} A A i = P e d e r s e n C o m m i t ( a i , 0 , ⋯ , a i , l − 1 ) = g 0 a i , 0 ⋯ g l − 1 a i , l − 1 A_i=PedersenCommit(a_{i,0},\cdots,a_{i,l-1})=g_0^{a_{i,0}}\cdots g_{l-1}^{a_{i,l-1}} A i = P e d e r s e n C o m m i t ( a i , 0 , ⋯ , a i , l − 1 ) = g 0 a i , 0 ⋯ g l − 1 a i , l − 1
然后，计算pairing commitment to the Pedersen commitments：T = P a i r i n g C o m m i t ( A 0 , ⋯ , A m − 1 ) = ∏ i = 0 m − 1 e ( A i , v i ) T=PairingCommit(A_0,\cdots,A_{m-1})=\prod_{i=0}^{m-1}e(A_i,v_i) T = P a i r i n g C o m m i t ( A 0 , ⋯ , A m − 1 ) = ∏ i = 0 m − 1 e ( A i , v i )
于是对双变量多项式的commitment为：T = e ( g 0 a 0 , 0 ⋯ g l − 1 a 0 , l − 1 , v 0 ) ⋯ e ( g 0 a m − 1 , 0 ⋯ g l − 1 a m − 1 , l − 1 , v m − 1 ) T=e(g_0^{a_{0,0}}\cdots g_{l-1}^{a_{0,l-1}},v_0)\cdots e(g_0^{a_{m-1,0}}\cdots g_{l-1}^{a_{m-1,l-1}},v_{m-1}) T = e ( g 0 a 0 , 0 ⋯ g l − 1 a 0 , l − 1 , v 0 ) ⋯ e ( g 0 a m − 1 , 0 ⋯ g l − 1 a m − 1 , l − 1 , v m − 1 )
该commitment 在q q q
x x x A A A f ( x , Y ) f(x,Y) f ( x , Y )
Transparent版本的MIPP算法为M I P P t r a n s MIPP_{trans} M I P P t r a n s
Setup：commitment key ( v 0 , ⋯ , v m − 1 ) ∈ G 2 m , h ^ ∈ G 2 (v_0,\cdots,v_{m-1})\in\mathbb{G}_2^m,\hat{h}\in\mathbb{G}_2 ( v 0 , ⋯ , v m − 1 ) ∈ G 2 m , h ^ ∈ G 2
Initialize：Verifier发送a random challege c c c Z = T ⋅ e ( A , h ^ c ) Z=T\cdot e(A,\hat{h}^c) Z = T ⋅ e ( A , h ^ c ) A ⃗ ∣ ∣ A \vec{A}||A A ∣ ∣ A Z Z Z v ⃗ ∣ ∣ h ^ c \vec{v}||\hat{h}^c v ∣ ∣ h ^ c A = A ⃗ b ⃗ A=\vec{A}^{\vec{b}} A = A b
至此，具体信息调整为：【转换为博客 Proofs for Inner Pairing Products and Applications 学习笔记 4.4节中的GIPA证明 】
public info：( v ⃗ , h ^ c ) ∈ G 2 m + 1 , T ∈ G T , A ∈ G 1 , b ⃗ ∈ F m (\vec{v},\hat{h}^c)\in\mathbb{G}_2^{m+1}, T\in\mathbb{G}_T, A\in\mathbb{G}_1,\vec{b}\in\mathbb{F}^m ( v , h ^ c ) ∈ G 2 m + 1 , T ∈ G T , A ∈ G 1 , b ∈ F m ( Z , b ⃗ ∈ F m ) (Z,\vec{b}\in\mathbb{F}^m) ( Z , b ∈ F m )
private info：A ⃗ ∈ G 1 m \vec{A}\in\mathbb{G}_1^m A ∈ G 1 m
待证明：C M ( ( v ⃗ , 1 ⃗ , h ^ c ) , ( A ⃗ , b ⃗ , A ) ) = ( ( A ⃗ ∣ ∣ A ) ∗ ( v ⃗ ∣ ∣ h ^ c ) , b ⃗ ) = ( Z , b ⃗ ) CM((\vec{v},\vec{1},\hat{h}^c),(\vec{A},\vec{b},A))=((\vec{A}||A)*(\vec{v}||\hat{h}^c),\vec{b})=(Z,\vec{b}) C M ( ( v , 1 , h ^ c ) , ( A , b , A ) ) = ( ( A ∣ ∣ A ) ∗ ( v ∣ ∣ h ^ c ) , b ) = ( Z , b ) 【注意，其中b ⃗ \vec{b} b 1 ⃗ \vec{1} 1
接下来为表述简洁，设置h ^ = h ^ c \hat{h}=\hat{h}^c h ^ = h ^ c C M CM C M A ⃗ , b ⃗ \vec{A},\vec{b} A , b v ⃗ \vec{v} v A ⃗ ′ , b ⃗ ′ , v ⃗ ′ \vec{A}',\vec{b}',\vec{v}' A ′ , b ′ , v ′ m ′ = m / 2 m'=m/2 m ′ = m / 2 Z ′ = ( A ⃗ ′ ∗ v ⃗ ′ ) ⋅ e ( A ′ , h ^ ) Z'=(\vec{A}'*\vec{v}')\cdot e(A',\hat{h}) Z ′ = ( A ′ ∗ v ′ ) ⋅ e ( A ′ , h ^ ) A ′ = < A ⃗ ′ , b ⃗ ′ > A'=<\vec{A}',\vec{b}'> A ′ = < A ′ , b ′ >
1）Prover的输入为( A ⃗ , b ⃗ , v ⃗ , Z , m ) (\vec{A},\vec{b},\vec{v},Z,m) ( A , b , v , Z , m ) m ′ = m / 2 m'=m/2 m ′ = m / 2 A ⃗ ′ = A ⃗ [ m ′ : ] x ∘ A ⃗ [ : m ′ ] \vec{A}'=\vec{A}_{[m':]}^x\circ\vec{A}_{[:m']} A ′ = A [ m ′ : ] x ∘ A [ : m ′ ] b ⃗ ′ = x − 1 b ⃗ [ m ′ : ] + b ⃗ [ : m ′ ] \vec{b}'=x^{-1}\vec{b}_{[m':]}+\vec{b}_{[:m']} b ′ = x − 1 b [ m ′ : ] + b [ : m ′ ] v ⃗ ′ = v ⃗ [ m ′ : ] x − 1 ∘ v ⃗ [ : m ′ ] \vec{v}'=\vec{v}_{[m':]}^{x^{-1}}\circ\vec{v}_{[:m']} v ′ = v [ m ′ : ] x − 1 ∘ v [ : m ′ ] A ′ = < A ⃗ ′ , b ⃗ ′ > = ( < A ⃗ [ m ′ : ] , b ⃗ [ : m ′ ] > ) x ⋅ A ⋅ ( < A ⃗ [ : m ′ ] , b ⃗ [ m ′ : ] > ) x − 1 A'=<\vec{A}',\vec{b}'>=(<\vec{A}_{[m':]},\vec{b}_{[:m']}>)^x\cdot A\cdot (<\vec{A}_{[:m']},\vec{b}_{[m':]}>)^{x^{-1}} A ′ = < A ′ , b ′ > = ( < A [ m ′ : ] , b [ : m ′ ] > ) x ⋅ A ⋅ ( < A [ : m ′ ] , b [ m ′ : ] > ) x − 1 A ⃗ ′ ∗ v ⃗ ′ = ( A ⃗ [ m ′ : ] ∗ v ⃗ [ : m ′ ] ) x ⋅ ( A ⃗ ∗ v ⃗ ) ⋅ ( A ⃗ [ : m ′ ] ∗ v ⃗ [ m ′ : ] ) x − 1 \vec{A}'*\vec{v}'=(\vec{A}_{[m':]}*\vec{v}_{[:m']})^x\cdot (\vec{A}*\vec{v})\cdot (\vec{A}_{[:m']}*\vec{v}_{[m':]})^{x^{-1}} A ′ ∗ v ′ = ( A [ m ′ : ] ∗ v [ : m ′ ] ) x ⋅ ( A ∗ v ) ⋅ ( A [ : m ′ ] ∗ v [ m ′ : ] ) x − 1 Z ′ = ( A ⃗ ′ ∗ v ⃗ ′ ) ⋅ e ( A ′ , h ^ ) Z'=(\vec{A}'*\vec{v}')\cdot e(A',\hat{h}) Z ′ = ( A ′ ∗ v ′ ) ⋅ e ( A ′ , h ^ ) A ′ = < A ⃗ ′ , b ⃗ ′ > A'=<\vec{A}',\vec{b}'> A ′ = < A ′ , b ′ > Z L = ( A ⃗ [ m ′ : ] ∗ v ⃗ [ : m ′ ] ) ⋅ e ( < A ⃗ [ m ′ : ] , b ⃗ [ : m ′ ] > , h ^ ) Z_L=(\vec{A}_{[m':]}*\vec{v}_{[:m']})\cdot e(<\vec{A}_{[m':]},\vec{b}_{[:m']}>,\hat{h}) Z L = ( A [ m ′ : ] ∗ v [ : m ′ ] ) ⋅ e ( < A [ m ′ : ] , b [ : m ′ ] > , h ^ ) Z R = ( A ⃗ [ : m ′ ] ∗ v ⃗ [ m ′ : ] ) ⋅ e ( < A ⃗ [ : m ′ ] , b ⃗ [ m ′ : ] > , h ^ ) Z_R=(\vec{A}_{[:m']}*\vec{v}_{[m':]})\cdot e(<\vec{A}_{[:m']},\vec{b}_{[m':]}>,\hat{h}) Z R = ( A [ : m ′ ] ∗ v [ m ′ : ] ) ⋅ e ( < A [ : m ′ ] , b [ m ′ : ] > , h ^ ) Z ′ = Z L x ⋅ Z ⋅ Z R x − 1 Z'=Z_L^x\cdot Z\cdot Z_R^{x^{-1}} Z ′ = Z L x ⋅ Z ⋅ Z R x − 1
2）当m ′ ≠ 1 m'\neq 1 m ′ = 1 ( A ⃗ , b ⃗ , v ⃗ , Z , m ) = ( A ⃗ ′ , b ⃗ ′ , v ⃗ ′ , Z ′ , m ′ ) (\vec{A},\vec{b},\vec{v},Z,m)=(\vec{A}',\vec{b}',\vec{v}',Z',m') ( A , b , v , Z , m ) = ( A ′ , b ′ , v ′ , Z ′ , m ′ )
3）当m ′ = 1 m'=1 m ′ = 1 A = A ⃗ ′ ∈ G 1 , b = b ⃗ ′ , v = v ⃗ ′ , Z = Z ′ A=\vec{A}'\in\mathbb{G}_1,b=\vec{b}',v=\vec{v}',Z=Z' A = A ′ ∈ G 1 , b = b ′ , v = v ′ , Z = Z ′ Z = e ( A , v ) e ( A b , h ^ ) = e ( A , v h ^ b ) Z=e(A,v)e(A^b,\hat{h})=e(A,v\hat{h}^b) Z = e ( A , v ) e ( A b , h ^ ) = e ( A , v h ^ b )
transparent 版本的MIPP实现M I P P t r a n s MIPP_{trans} M I P P t r a n s
在第一层用于evaluate T T T x x x A A A f ( x , Y ) f(x,Y) f ( x , Y )
在第二层用于evaluate the commitment A A A f ( x , y ) f(x,y) f ( x , y ) y y y
第二层的polynomial可表示为f ( x , Y ) = ∑ j = 0 l − 1 a j Y j f(x,Y)=\sum_{j=0}^{l-1}a_jY^j f ( x , Y ) = ∑ j = 0 l − 1 a j Y j A = g 0 a 0 ⋯ g l − 1 a l − 1 = g ⃗ a ⃗ A=g_0^{a_0}\cdots g_{l-1}^{a_{l-1}}=\vec{g}^{\vec{a}} A = g 0 a 0 ⋯ g l − 1 a l − 1 = g a
假设e v a l = f ( x , y ) eval=f(x,y) e v a l = f ( x , y )
public info：commitment key g ⃗ = ( g 0 , ⋯ , g l − 1 ) ∈ G 1 l \vec{g}=(g_0,\cdots,g_{l-1})\in\mathbb{G}_1^l g = ( g 0 , ⋯ , g l − 1 ) ∈ G 1 l b ⃗ = ( 1 , y , ⋯ , y l − 1 ) ∈ F l , e v a l ∈ F , A ∈ G 1 \vec{b}=(1,y,\cdots,y^{l-1})\in\mathbb{F}^l,eval\in\mathbb{F},A\in\mathbb{G}_1 b = ( 1 , y , ⋯ , y l − 1 ) ∈ F l , e v a l ∈ F , A ∈ G 1
private info：a ⃗ ∈ F l \vec{a}\in \mathbb{F}^l a ∈ F l
待证明：A = g ⃗ a ⃗ ∧ e v a l = < a ⃗ , b ⃗ > A=\vec{g}^{\vec{a}}\wedge eval=<\vec{a},\vec{b}> A = g a ∧ e v a l = < a , b >
具体的实现为：
Setup：commitment key g ⃗ = ( g 0 , ⋯ , g l − 1 ) ∈ G 1 l \vec{g}=(g_0,\cdots,g_{l-1})\in\mathbb{G}_1^l g = ( g 0 , ⋯ , g l − 1 ) ∈ G 1 l u ∈ G 1 u\in\mathbb{G}_1 u ∈ G 1
Initialize：Prover 发送e v a l eval e v a l c c c P = A ⋅ u c ⋅ e v a l P=A\cdot u^{c\cdot eval} P = A ⋅ u c ⋅ e v a l a ⃗ \vec{a} a ( a ⃗ , e v a l ) (\vec{a},eval) ( a , e v a l ) P P P ( g ⃗ , u c ) (\vec{g},u^c) ( g , u c ) e v a l = < a ⃗ , b ⃗ > eval=<\vec{a},\vec{b}> e v a l = < a , b >
至此，具体信息调整为：【转换为博客 Proofs for Inner Pairing Products and Applications 学习笔记 4.4节中的GIPA证明 】
public info：( g ⃗ , u c ) ∈ G 1 l + 1 , e v a l ∈ F , A ∈ G 1 , b ⃗ ∈ F l (\vec{g},u^c)\in\mathbb{G}_1^{l+1}, eval\in\mathbb{F}, A\in\mathbb{G}_1,\vec{b}\in\mathbb{F}^l ( g , u c ) ∈ G 1 l + 1 , e v a l ∈ F , A ∈ G 1 , b ∈ F l ( P ∈ G 1 , b ⃗ ∈ F l ) (P\in\mathbb{G}_1,\vec{b}\in\mathbb{F}^l) ( P ∈ G 1 , b ∈ F l )
private info：a ⃗ ∈ F l \vec{a}\in\mathbb{F}^l a ∈ F l
待证明：C M ( ( g ⃗ , 1 ⃗ , u c ) , ( a ⃗ , b ⃗ , e v a l ) ) = ( g ⃗ a ⃗ u c ⋅ e v a l , b ⃗ ) = ( P , b ⃗ ) CM((\vec{g},\vec{1},u^c),(\vec{a},\vec{b},eval))=(\vec{g}^{\vec{a}}u^{c\cdot eval},\vec{b})=(P,\vec{b}) C M ( ( g , 1 , u c ) , ( a , b , e v a l ) ) = ( g a u c ⋅ e v a l , b ) = ( P , b ) 【注意，其中b ⃗ \vec{b} b 1 ⃗ \vec{1} 1
接下来为表述简洁，设置u = u c u=u^c u = u c C M CM C M a ⃗ , b ⃗ \vec{a},\vec{b} a , b g ⃗ \vec{g} g a ⃗ ′ , b ⃗ ′ , g ⃗ ′ \vec{a}',\vec{b}',\vec{g}' a ′ , b ′ , g ′ m ′ = m / 2 m'=m/2 m ′ = m / 2 P ′ = g ⃗ ′ a ⃗ ′ u e v a l ′ P'=\vec{g}'^{\vec{a}'}u^{eval'} P ′ = g ′ a ′ u e v a l ′ e v a l ′ = < a ⃗ ′ , b ⃗ ′ > eval'=<\vec{a}',\vec{b}'> e v a l ′ = < a ′ , b ′ >
1）Prover的输入为( a ⃗ , b ⃗ , g ⃗ , P , m ) (\vec{a},\vec{b},\vec{g},P,m) ( a , b , g , P , m ) m ′ = m / 2 m'=m/2 m ′ = m / 2 a ⃗ ′ = x a ⃗ [ m ′ : ] + a ⃗ [ : m ′ ] \vec{a}'=x\vec{a}_{[m':]}+\vec{a}_{[:m']} a ′ = x a [ m ′ : ] + a [ : m ′ ] b ⃗ ′ = x − 1 b ⃗ [ m ′ : ] + b ⃗ [ : m ′ ] \vec{b}'=x^{-1}\vec{b}_{[m':]}+\vec{b}_{[:m']} b ′ = x − 1 b [ m ′ : ] + b [ : m ′ ] g ⃗ ′ = g ⃗ [ m ′ : ] x − 1 ∘ g ⃗ [ : m ′ ] \vec{g}'=\vec{g}_{[m':]}^{x^{-1}}\circ\vec{g}_{[:m']} g ′ = g [ m ′ : ] x − 1 ∘ g [ : m ′ ] e v a l ′ = < a ⃗ ′ , b ⃗ ′ > = x ( < a ⃗ [ : m ′ ] , b ⃗ [ m ′ : ] > ) ⋅ e v a l ⋅ x − 1 ( < a ⃗ [ m ′ : ] , b ⃗ [ : m ′ ] > ) eval'=<\vec{a}',\vec{b}'>=x(<\vec{a}_{[:m']},\vec{b}_{[m':]}>)\cdot eval \cdot {x^{-1}}(<\vec{a}_{[m':]},\vec{b}_{[:m']}>) e v a l ′ = < a ′ , b ′ > = x ( < a [ : m ′ ] , b [ m ′ : ] > ) ⋅ e v a l ⋅ x − 1 ( < a [ m ′ : ] , b [ : m ′ ] > ) g ⃗ ′ a ⃗ ′ = ( g ⃗ [ : m ′ ] a ⃗ [ m ′ : ] ) x ⋅ g ⃗ a ⃗ ⋅ ( g ⃗ [ m ′ : ] a ⃗ [ : m ′ ] ) x − 1 \vec{g}'^{\vec{a}'}=(\vec{g}_{[:m']}^{\vec{a}_{[m':]}})^x\cdot \vec{g}^{\vec{a}}\cdot (\vec{g}_{[m':]}^{\vec{a}_{[:m']}})^{x^{-1}} g ′ a ′ = ( g [ : m ′ ] a [ m ′ : ] ) x ⋅ g a ⋅ ( g [ m ′ : ] a [ : m ′ ] ) x − 1 P ′ = g ⃗ ′ a ⃗ ′ u e v a l ′ P'=\vec{g}'^{\vec{a}'}u^{eval'} P ′ = g ′ a ′ u e v a l ′ e v a l ′ = < a ⃗ ′ , b ⃗ ′ > eval'=<\vec{a}',\vec{b}'> e v a l ′ = < a ′ , b ′ > P L = g ⃗ [ m ′ : ] a ⃗ [ : m ′ ] ⋅ u < a ⃗ [ : m ′ ] , b ⃗ [ m ′ : ] > P_L=\vec{g}_{[m':]}^{\vec{a}_{[:m']}}\cdot u^{<\vec{a}_{[:m']},\vec{b}_{[m':]}>} P L = g [ m ′ : ] a [ : m ′ ] ⋅ u < a [ : m ′ ] , b [ m ′ : ] > P R = g ⃗ [ : m ′ ] v ⃗ [ m ′ : ] ⋅ u < a ⃗ [ m ′ : ] , b ⃗ [ : m ′ ] > P_R=\vec{g}_{[:m']}^{\vec{v}_{[m':]}}\cdot u^{<\vec{a}_{[m':]},\vec{b}_{[:m']}>} P R = g [ : m ′ ] v [ m ′ : ] ⋅ u < a [ m ′ : ] , b [ : m ′ ] > P ′ = P L x ⋅ P ⋅ P R x − 1 P'=P_L^x\cdot P\cdot P_R^{x^{-1}} P ′ = P L x ⋅ P ⋅ P R x − 1
2）当m ′ ≠ 1 m'\neq 1 m ′ = 1 ( a ⃗ , b ⃗ , g ⃗ , P , m ) = ( a ⃗ ′ , b ⃗ ′ , g ⃗ ′ , P ′ , m ′ ) (\vec{a},\vec{b},\vec{g},P,m)=(\vec{a}',\vec{b}',\vec{g}',P',m') ( a , b , g , P , m ) = ( a ′ , b ′ , g ′ , P ′ , m ′ )
3）当m ′ = 1 m'=1 m ′ = 1 a = a ⃗ ′ ∈ F , b = b ⃗ ′ ∈ F , P = P ′ ∈ G 1 a=\vec{a}'\in\mathbb{F},b=\vec{b}'\in\mathbb{F},P=P'\in\mathbb{G}_1 a = a ′ ∈ F , b = b ′ ∈ F , P = P ′ ∈ G 1 P = g a u a ⋅ b P=g^au^{a\cdot b} P = g a u a ⋅ b
以上R D L R_{DL} R D L
假设f ( X , Y ) = ∑ i = 0 m − 1 f i ( Y ) X i , f i ( Y ) = ∑ j = 0 l − 1 a i , j Y j f(X,Y)=\sum_{i=0}^{m-1}f_i(Y)X^i,f_i(Y)=\sum_{j=0}^{l-1}a_{i,j}Y^j f ( X , Y ) = ∑ i = 0 m − 1 f i ( Y ) X i , f i ( Y ) = ∑ j = 0 l − 1 a i , j Y j m − 1 m-1 m − 1 X X X l − 1 l-1 l − 1 Y Y Y
选择generator g ∈ G 1 , h ∈ G 2 g\in\mathbb{G}_1,h\in\mathbb{G}_2 g ∈ G 1 , h ∈ G 2 l l l G 1 \mathbb{G}_1 G 1 m m m G 2 \mathbb{G}_2 G 2 α , β \alpha,\beta α , β c k = ( ( g 0 , ⋯ , g l − 1 ) = ( g , g α , ⋯ , g α l − 1 ) ∈ G 1 l , ( v 0 , ⋯ , v m − 1 ) = ( h , h β 2 , ⋯ , h β 2 m − 2 ) ∈ G 2 m ) ck=((g_0,\cdots,g_{l-1})=(g,g^{\alpha},\cdots,g^{\alpha^{l-1}})\in\mathbb{G}_1^l,(v_0,\cdots,v_{m-1})=(h,h^{\beta^2},\cdots,h^{\beta^{2m-2}})\in\mathbb{G}_2^m) c k = ( ( g 0 , ⋯ , g l − 1 ) = ( g , g α , ⋯ , g α l − 1 ) ∈ G 1 l , ( v 0 , ⋯ , v m − 1 ) = ( h , h β 2 , ⋯ , h β 2 m − 2 ) ∈ G 2 m )
进行commit，实际实现为：
首先，生成m m m A 0 , ⋯ , A m − 1 A_0,\cdots,A_{m-1} A 0 , ⋯ , A m − 1 f 0 ( Y ) , ⋯ , f m − 1 ( Y ) f_0(Y),\cdots,f_{m-1}(Y) f 0 ( Y ) , ⋯ , f m − 1 ( Y ) A \mathcal{A} A A i = K Z G C o m m i t ( a i , 0 , ⋯ , a i , l − 1 ) = g 0 a i , 0 ⋯ g l − 1 a i , l − 1 = g ∑ j = 0 l − 1 a i , j α j A_i=KZGCommit(a_{i,0},\cdots,a_{i,l-1})=g_0^{a_{i,0}}\cdots g_{l-1}^{a_{i,l-1}}=g^{\sum_{j=0}^{l-1}a_{i,j}\alpha^j} A i = K Z G C o m m i t ( a i , 0 , ⋯ , a i , l − 1 ) = g 0 a i , 0 ⋯ g l − 1 a i , l − 1 = g ∑ j = 0 l − 1 a i , j α j
然后，计算pairing commitment to the KZG commitments：T = P a i r i n g C o m m i t ( A 0 , ⋯ , A m − 1 ) = ∏ i = 0 m − 1 e ( A i , v i ) = ∏ i = 0 m − 1 e ( A i , h β 2 i ) T=PairingCommit(A_0,\cdots,A_{m-1})=\prod_{i=0}^{m-1}e(A_i,v_i)=\prod_{i=0}^{m-1}e(A_i,h^{\beta^{2i}}) T = P a i r i n g C o m m i t ( A 0 , ⋯ , A m − 1 ) = ∏ i = 0 m − 1 e ( A i , v i ) = ∏ i = 0 m − 1 e ( A i , h β 2 i )
于是对双变量多项式的commitment为：T = e ( g , h ) ∑ i = 0 m − 1 ∑ j = 0 l − 1 a i , j α j β 2 i T=e(g,h)^{\sum_{i=0}^{m-1}\sum_{j=0}^{l-1}a_{i,j}\alpha^j\beta^{2i}} T = e ( g , h ) ∑ i = 0 m − 1 ∑ j = 0 l − 1 a i , j α j β 2 i
该commitment 在q q q q q q
x x x A A A f ( x , Y ) f(x,Y) f ( x , Y )
Structured版本的MIPP算法为M I P P s r s MIPP_{srs} M I P P s r s
Setup：commitment key ( g β ∈ G 2 , v ⃗ = { h β 2 i } i = 0 m − 1 ∈ G 2 m , h ^ ∈ G 2 ) (g^{\beta}\in\mathbb{G}_2,\vec{v}=\{h^{\beta^{2i}}\}_{i=0}^{m-1}\in\mathbb{G}_2^m,\hat{h}\in\mathbb{G}_2) ( g β ∈ G 2 , v = { h β 2 i } i = 0 m − 1 ∈ G 2 m , h ^ ∈ G 2 ) g β ∈ G 2 , h ^ ∈ G 2 g^{\beta}\in\mathbb{G}_2,\hat{h}\in\mathbb{G}_2 g β ∈ G 2 , h ^ ∈ G 2
Initialize：Verifier发送a random challege c c c Z = T ⋅ e ( A , h ^ c ) Z=T\cdot e(A,\hat{h}^c) Z = T ⋅ e ( A , h ^ c ) A ⃗ ∣ ∣ A \vec{A}||A A ∣ ∣ A Z Z Z v ⃗ ∣ ∣ h ^ c \vec{v}||\hat{h}^c v ∣ ∣ h ^ c A = < A ⃗ , b ⃗ > = A ⃗ b ⃗ A=<\vec{A},\vec{b}>=\vec{A}^{\vec{b}} A = < A , b > = A b
与2.1.2类似，改为证明C M ( ( v ⃗ , 1 ⃗ , h ^ c ) , ( A ⃗ , b ⃗ , A ) ) = ( ( A ⃗ ∣ ∣ A ) ∗ ( v ⃗ ∣ ∣ h ^ c ) , b ⃗ ) = ( Z , b ⃗ ) CM((\vec{v},\vec{1},\hat{h}^c),(\vec{A},\vec{b},A))=((\vec{A}||A)*(\vec{v}||\hat{h}^c),\vec{b})=(Z,\vec{b}) C M ( ( v , 1 , h ^ c ) , ( A , b , A ) ) = ( ( A ∣ ∣ A ) ∗ ( v ∣ ∣ h ^ c ) , b ) = ( Z , b )
借助博客 Proofs for Inner Pairing Products and Applications 学习笔记 中5.2节的R c k R_{ck} R c k v ⃗ \vec{v} v r = 1 r=1 r = 1 v = h f v ( β ) v=h^{f_v(\beta)} v = h f v ( β ) f v ( X ) = ∏ j = 0 l ( x l − j − 1 + X 2 j + 1 ) f_v(X)=\prod_{j=0}^{l}(x_{l-j}^{-1}+X^{2^{j+1}}) f v ( X ) = ∏ j = 0 l ( x l − j − 1 + X 2 j + 1 )
最终Verifier仍然是验证Z = e ( A , v ) e ( A b , h ^ ) = e ( A , v h ^ b ) Z=e(A,v)e(A^b,\hat{h})=e(A,v\hat{h}^b) Z = e ( A , v ) e ( A b , h ^ ) = e ( A , v h ^ b ) v v v M I P P s r s MIPP_{srs} M I P P s r s
f ( x , Y ) = ∑ j = 0 l − 1 a j Y j f(x,Y)=\sum_{j=0}^{l-1}a_jY^j f ( x , Y ) = ∑ j = 0 l − 1 a j Y j A = g 0 a 0 ⋯ g l − 1 a l − 1 = g ∑ j = 0 l − 1 a j α j A=g_0^{a_0}\cdots g_{l-1}^{a_{l-1}}=g^{\sum_{j=0}^{l-1}a_j\alpha^j} A = g 0 a 0 ⋯ g l − 1 a l − 1 = g ∑ j = 0 l − 1 a j α j
假设e v a l = f ( x , y ) eval=f(x,y) e v a l = f ( x , y )
public info：commitment key g ⃗ = { g α i } i = 0 l − 1 ∈ G 1 l \vec{g}=\{g^{\alpha^i}\}_{i=0}^{l-1}\in\mathbb{G}_1^l g = { g α i } i = 0 l − 1 ∈ G 1 l y ∈ F , e v a l ∈ F , A ∈ G 1 y\in\mathbb{F},eval\in\mathbb{F},A\in\mathbb{G}_1 y ∈ F , e v a l ∈ F , A ∈ G 1
private info：a ⃗ ∈ F l \vec{a}\in \mathbb{F}^l a ∈ F l
待证明：A = g ⃗ a ⃗ ∧ e v a l = ∑ j = 0 l − 1 a j y j A=\vec{g}^{\vec{a}}\wedge eval=\sum_{j=0}^{l-1}a_jy^j A = g a ∧ e v a l = ∑ j = 0 l − 1 a j y j
[1] Benedikt Bünz 等人（standford,ethereum,berkeley） 2019年论文《Proofs for Inner Pairing Products and Applications 》。EfficientZero-KnowledgeArgumentsfromTwo-Tiered HomomorphicCommitments Constant-Size Commitments to Polynomials and Their Applications 》