Halo2学习笔记——设计之Protocol Description

Posted 2021-10-14 mutourend

1. 引言

security parameter以$\lambda$表示，除非明确说明，所有算法和adversaries都是probabilistic (interactive) Turing machines that run in polynomial time in this security parameter。
$negl(\lambda )$ 表示a function that is negligible in $\lambda$。

1.1 Cryptographic Groups

• $\mathbb{G}$：表示a cyclic group of prime order $p$。

• $\mathcal{O}$：表示the identity of a group。

• $\mathbb{G}$中的scalars of elements 为 scalar field $\mathbb{F}$ of size $p$ 中 的元素。

• 以大写字母来表示group element，以小写或希腊字母来表示scalar。

• 以粗体字来表示向量，即$\mathbf{a}\in {\mathbb{F}}^n$ and $\mathbf{G}\in {\mathbb{G}}^n$。

• group operation为加法运算。

• scalar $a$与group element $G$的乘积表示为$[a]G$。

• $⟨\mathbf{a},\mathbf{b}⟩$表示2个相同长度scalar向量$\mathbf{a},\mathbf{b}\in {\mathbb{F}}^n$的inner product。

• $⟨\mathbf{a},\mathbf{G}⟩$ with $\mathbf{a}\in {\mathbb{F}}^n,\mathbf{G}\in {\mathbb{G}}^n$表示multiscalar multiplication。

• $0^n$表示a vector of length $n$ that only contains zeroes in $\mathbb{F}$。

• Discrete Log Relation Problem：

The advantage metric
$${\text{Adv}}_{\mathbb{G},n}^{\text{dl-rel}}(\mathcal{A},\lambda )=\text{Pr}\left[{\mathsf{G}}_{\mathbb{G},n}^{\text{dl-rel}}(\mathcal{A},\lambda )\right]$$
is defined with respect the following game.
$$\begin{array}{ll}& \underline{\mathbf{G}\mathbf{a}\mathbf{m}\mathbf{e}{\mathsf{G}}_{\mathbb{G},n}^{\text{dl-rel}}(\mathcal{A},\lambda ):}\\ & \mathbf{G}\leftarrow {\mathbb{G}}_{\lambda }^n\\ & \mathbf{a}\leftarrow \mathcal{A}(\mathbf{G})\\ & \text{Return}\left(⟨\mathbf{a},\mathbf{G}⟩=\mathcal{O}\wedge \mathbf{a}\ne 0^n\right)\end{array}$$

即已知$n$-length vector $\mathbf{G}\in {\mathbb{G}}^n$ group elements，discrete log relation problem 会ask for $\mathbf{g}\in {\mathbb{F}}^n$，使得$\mathbf{g}\ne 0^n$ 且 $⟨\mathbf{a},\mathbf{G}⟩=\mathcal{O}$，可将其称为 non-trivial discrete log relation。
该problem的hardness与 JT20 Lemma3中的 hardness of the discrete log problem in the group 紧密相连。可使用game ${\mathsf{G}}_{\mathbb{G},n}^{\text{dl-rel}}$ 来定义该problem。

1.2 Interactive Proofs

interactive proof由3个算法组成 $\text{IP}=(\text{Setup},\mathcal{P},\mathcal{V})$：

• $\text{Setup}(1^{\lambda })$：输出为$\mathbf{p}\mathbf{p}$，为public parameters。

Prover $\mathcal{P}$ 和 Verifier $\mathcal{V}$ 为interactive machines (with access to $\mathbf{p}\mathbf{p}$)，以$⟨\mathcal{P}(x),\mathcal{V}(y)⟩$来表示execute a two-party protocol between Prover $\mathcal{P}$ 和 Verifier $\mathcal{V}$ on inputs $x,y$ 的算法。在协议的最后，Verifier输出a decision bit。

1.3 Zero knowledge Arguments of Knowledge

Proofs of knowledge为：interactive proofs，Prover致力于令Verifier相信，针对某statement $x$，其知道某witness $\omega$，使得$(x,\omega )\in \mathcal{R}$，其中$\mathcal{R}$为polynomial-time decidable relation $\mathcal{R}$。

Halo2中主要关注具有computationally-bounded prover的argument of knowledge。

argument of knowledge主要有以下4个安全视角：

• Completeness：若Prover基于valid witness运算，则其总是可使Verifier信服。
• Soundness：cheating Prover无法在不知道valid witness的情况下，使Verifier信服错误的proof。cheating Prover成功的概率为soundness error。
• Knowledge soundness：若Verifier信服该statement是正确的，Prover是否实际处理的（”知道“）就是相应的valid witness。cheating Prover成功的概率为knowledge error。
• Zero knowledge：即Verifier是否可从proof中知道相应的valid witness。

1.3.1 Completeness

1.3.2 Soundness

• Public coin是指：all of the messages sent by the verifier are each sampled with fresh randomness。

• Fiat-Shamir transformation是指：In this transformation an interactive, public coin argument can be made non-interactive in the random oracle model by replacing the verifier algorithm with a cryptographically strong hash function that produces sufficiently random looking output。

• State-Restoration Soundness：
  详细参见论文 GT20- Tight State-Restoration Soundness in the Algebraic Group Model：
  

• Knowledge Soundness：又名 witness extended emulation，是指：any successful prover algorithm there exists an efficient emulator that can extract a witness from it by rewinding it and supplying it with fresh randomness。
  Halo2中对 witness extended emulation 的定义做了小调整，即Halo2中的provers为state restoration provers，定义为可rewind the verifier。此外，为了避免在witness extraction过程中对state restoration prover的rewind，Halo2中将协议定义在了algebraic group model：
  
  algebraic group支持所谓的“online” extraction：即the extractor can obtain the witness from the representations themselves for a single (accepting) transcript。

• State Restoration Witness Extended Emulation：
  

1.3.3 Zero Knowledge

通常zero-knowledge定义中，要求Verifier act “honestly”，并send challenges that correspond only with their internal randomness，Verifier不可adaptively respond to the prover based on the prover’s messages。Halo2中使用了增强版定义：即强制要求the simulator to output a transcript with the same (adversarially provided) challenges that the verifier algorithm sends to the prover

2. Protocol

参考资料

[1] Halo2 至 Protocol Description