SYSTEM AND METHOD FOR SECURELY SHARING CRYPTOGRAPHIC MATERIAL

Abstract

Systems and methods described herein relate to techniques in which multiple parties each generate and exchange quantities that are based on a shared secret (e.g., powers of the shared secret) without exposing the shared secret. According to a protocol, two or more parties may exchange sets of elliptic curve points generated over polynomials that can be used, by each of the two or more parties, to determine a power of a shared secret. The protocol may be utilised as part of determining parameters for a smart contract that is broadcast to a blockchain network (e.g., Bitcoin). Based on the protocol, an additional party (e.g., a third party different from the two or more parties) may perform a computational task such as execution of the smart contract.

Description

FIELD OF INVENTION

This invention relates generally to computer security and verification, and more particularly to techniques that allow multiple (e.g., more than two) parties to share elements of a group, whose exponent or multiplicative coefficient depends on powers of a shared secret. Quantities may be shared such that the multiple parties exchange quantities that are based on the shared secret (e.g., powers of the shared secret) without exposing the shared secret. The invention is particularly suited, but not limited to, use in smart contracts, where the multiple parties may be respective parties of the smart contract that agree upon parameters for the smart contract. The invention may utilise cryptographic and mathematical techniques to share quantities for security-related advantages.

BACKGROUND OF INVENTION

A blockchain may refer to a peer-to-peer, electronic ledger which is implemented as a computer-based decentralised, distributed system made up of blocks which in turn may be made up of transactions and other information. In some examples, a “blockchain transaction” refers to an input message encoding a structured collection of field values comprising data and a set of conditions, where fulfilment of the set of conditions is prerequisite for the set of fields to be written to a blockchain data structure. For example, with Bitcoin each transaction is a data structure that encodes the transfer of control of a digital asset between participants in the blockchain system, and includes at least one input and at least one output. In some embodiments, a “digital asset” refers to binary data that is associated with a right to use. Examples of digital assets include Bitcoin, ether, and Litecoins. In some implementations, transferring control of a digital asset can be performed by reassociating at least a portion of a digital asset from a first entity to a second entity. Each block of the blockchain may contain a hash of the previous block to that blocks become chained together to create a permanent, unalterable record of all transactions which have been written to the blockchain since its inception. Transactions contain small programs known as scripts embedded into their inputs and outputs, which specify how and by whom the outputs of the transactions can be accessed. On the Bitcoin platform, these scripts are written using a stack-based scripting language.

Although blockchain technology is most widely known for the use of cryptocurrency implementation, digital entrepreneurs have begun exploring the use of both the cryptographic security system Bitcoin is based on and the data that can be stored on the Blockchain to implement new systems. It would be highly advantageous if the blockchain could be used for automated tasks and processes which are not limited to the realm of cryptocurrency. Such solutions would be able to harness the benefits of the blockchain (e.g. a permanent, tamper proof records of events, distributed processing, etc.) while being more versatile in their applications.

The present disclosure describes technical aspects of one or more blockchain-based computer programs. A blockchain-based computer program may be a machine readable and executable program recorded in a blockchain transaction. The blockchain-based computer program may comprise rules that can process inputs in order to produce results, which can then cause actions to be performed dependent upon those results. One area of current research is the use of blockchain-based computer programs for the implementation of “smart contracts”. Unlike a traditional contract which would be written in natural language, smart contracts may be computer programs designed to automate the execution of the terms of a machine-readable contract or agreement.

SUMMARY OF INVENTION

Thus, it is desirable to provide a protocol for multi-party verification key recording on a blockchain by exchanging quantities that can be used to determine powers of a shared secret between two or more parties. In various embodiments, it may be desirable for two or more parties of a smart contract to exchange quantities that are usable to determine a common reference string that comprises a verification key and an evaluation key. In various embodiments, the techniques described herein allow two or more parties to exchange powers of a shared secret without the use of cryptographic techniques such as encryption, and furthermore does not require the parties to establish a communications channel that requires cryptographically verifiable assurances confidentiality of data exchanged over said communications channel. Thus, the invention provides improved security and verification solutions.

Such an improved solution has now been devised.

Thus, in accordance with the present invention there are provided systems and methods as defined in the appended claims.

In accordance with the invention there may be provided a computer-implemented method for a node of a blockchain network, the computer-implemented method comprising: determining, at a participant of a plurality of participants, a function usable to map finite field elements; generating, based on a number of participants, polynomials evaluated in a set of points; distributing the polynomials to corresponding participants of the plurality of participants; determining a sum of polynomials of each participant of the plurality of participants, wherein the sum corresponds to a power of a secret; and collectively generating, among the plurality of participants and based on the secret, a blockchain transaction.

Preferably, the set of points are a set of elliptic curve points.

Preferably, the determination of the sum of polynomials is based on a Lagrange interpolation.

A method as described herein may further comprise determining, based at least in par ton the power of the secret, a common reference string that is determinable by the plurality of participants.

A method as described herein may further comprise receiving corresponding values of polynomials from each participant of the plurality of participant.

Preferably, off-chain communications are utilised in the distribution of the values of the polynomials to the corresponding participants. Off-chain communications may refer to data communications that are not broadcast to and/or not verifiable by the blockchain network.

Preferably, the function usable to map the finite field elements serves as a coefficients or exponent of a generator of a group.

Preferably, the plurality of participants is exactly two participants.

The secret may be determined based on the sum of polynomials evaluated at a particular point, such as a particular elliptic curve point.

The particular point may be an intersection point, such as the sum of the polynomials of each participant makes up the (master) polynomial, of which the intersection with the y-axis is the secret.

The set of points may exclude the intersection point—in other words, the intersection point, in at least some cases, is not a member of the set of points.

The polynomials evaluated in the set of points may be of at least order 2.

Preferably, each point of the set of points is a different point such that there are no duplicate points in the set of points.

It is also desirable to provide a system, comprising: a processor; and memory including executable instructions that, as a result of execution by the processor, causes the system to perform any of the methods as claimed.

It is also desirable to provide a non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least perform any of the methods as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other aspects of the present invention will be apparent from and elucidated with reference to, the embodiment described herein. An embodiment of the present invention will now be described, by way of example only, and with reference to the accompanying drawings, in which:

FIG. 1 illustrates a computing environment in which multiple parties of a smart contract enter into an agreement with a third party to execute the smart contract;

FIG. 2 illustrates a computing environment where a first computing entity and a second computing entity exchange quantities that can be used to determine powers of a shared secret between two or more parties;

FIG. 3 illustrates a computing environment in which a first computing entity and a second computing entity exchange a set of parameters that renders a zero-knowledge;

FIG. 4 illustrates a diagram of a protocol based on a two-party common reference string (CRS) and corresponding proof-of-correctness (POC) or proof of correct execution;

FIG. 5 illustrates a process for generating a two-party common reference string comprising a verification key and evaluation key, in accordance with an embodiment;

FIG. 6 illustrates a process for sharing powers of a shared secret between multiple parties, in accordance with at least one embodiment; and

FIG. 7 illustrates a simplified block diagram of a computing device that can be used to practice at least one embodiment of the present disclosure.

DETAILED DESCRIPTION

FIG. 1 illustrates a blockchain environment in which various embodiments can be implemented.

This disclosure describes techniques that may be utilised to implement systems and methods that allow multiple parties to securely share elements of a group, whose exponent or multiplicative coefficient depends on powers of a shared secret. Quantities may be shared such that the multiple parties exchange quantities that are based on the shared secret (e.g., powers of the shared secret) without exposing the shared secret. Accordingly, in various embodiments, a plurality of n participants establishes a representation of powers (e.g., sⁱ, in the multiplicative case) of a shared secret.

In an embodiment, a protocol utilising techniques and methods described herein are used by two parties of a smart contract to share quantities that can be used by the parties to determine powers of a shared secret without sharing the secret itself and without revealing information that would allow another computing entity (e.g., a computing entity that is not a party to the smart contract) to determine the secret. In one embodiment, the protocol comprises a first party of a smart contract computing a first set of parameters that are transmitted to a second party of the smart contract, the second party computing a second set of parameters and submitting those parameters to the first party, wherein, upon the exchange of the parameters as described above, both parties are able to calculate the identical common reference string, which comprises a verification key. The parties may then agree on a transaction in which they make proportionate contributions of digital assets to the smart contract which are locked to an address (e.g., address of a worker node of a blockchain network) and can be unlocked (e.g., spent). In an embodiment, off-chain communications between the parties of the smart contract are limited to the exchange of the parameters used to generate the common reference string, while ensuring security is maintained (e.g., the secret value is not divulged or otherwise determinable, based on the parameters exchanged, by an adversary or other computing entity that is not a party to the smart contract). In an embodiment, the two parties (or, in the more general case, two or more parties) utilise techniques that share powers of a shared secret, such as in the manner described elsewhere in this document, for example, in connection with FIGS. 1-7.

References may be made to FIG. 1, which illustrates an example computing environment 100 in which various embodiments of the present disclosure may be practiced. Systems and methods described herein may relate to a protocol for parties of a smart contract to exchange quantities that the first and second computing entities can use to calculate the identical common reference string. FIG. 1 illustrates a computing environment 100 comprising a first computing entity 102 and a second computing entity 104 that exchange a set of parameters that, allow both the first computing entity and the second computing entity to determine a common reference string 108. The common reference string may be utilised by the parties to generate a smart contract 110 that locks digital assets which either or both of the computing entities contributes as transaction inputs. The common reference string may comprise an evaluation key 112 and a verification key 114. The smart contract 110 may be published to a blockchain, such as the blockchain 118 illustrated in FIG. 1. The smart contract 110 may be executed by a third computing entity 106 that is not a party to the smart contract 110. As part of or in association with executing the smart contract, the third computing entity (e.g., worker) may generate a proof of correct execution 116 of the smart contract based at least in part on the evaluation key of the common reference string. The proof of correct execution 116 may be computationally verifiable by any suitable computing system (e.g., parties of the smart contract or a node of the blockchain network that acts as a verifier node). In an embodiment, the verification key 114 is utilised by a fourth computing entity (e.g., verifier computer system) to verify the proof that is published to the blockchain network 118 is correct.

The first computing entity 102 and the second computing entity 104 are computer systems that are parties to a smart contract, according to at least one embodiment. Parties of a smart contract may refer to two or more computing entities that agree (e.g., pursuant to user input provided through associated user input devices) on the terms to the execution of a smart contract. The first computing entity 102 and the second computing entity 104 may both agree upon a smart contract and contribute transaction inputs to the smart contract such that the respective transaction inputs of the smart contract are encumbered by a locking script that can be unlocked (e.g., spent) as a result of a worker node providing a proof of correct execution of the smart contract. Systems and methods described herein relate to enabling a locking script to secure the verification key V_K from alteration and checking validity of a proof π, thereby allowing execution of a zero-knowledge protocol on a blockchain during transaction validation.

In various embodiments, the first computing entity 102 and the second computing entity 104 may agree upon a smart contract, in an embodiment, by exchanging a set of messages that encode parameters for the smart contract, such as dates, times, conditions, and actions (e.g., transfer of control of digital assets) that are used to control the execution of the smart contract. For example, a smart contract (e.g., an executable program) may insure a party against delays of a particular flight, and execution of the program may include determining whether the particular flight was delayed using external data such as flight information of a particular commercial flight on a particular day. If the flight was delayed, a party of the program may receive a transfer of assets (e.g., a smart contract that provides travel insurance against delays).

In an embodiment, the smart contract 110 is encoded in a high-level programming language as source code such as C, C++, or Java. These are merely illustrative examples and the smart contract may be encoded using other suitable programming languages. In an embodiment, software such as a compiler, interpreter, and/or assembler may be utilized to transform the smart contract 110 to an arithmetic circuit which consists of “wires” that carry values from a field and connect to addition and multiplication gates. It should be noted that the arithmetic circuit may refer to a logical circuit that can be implemented by a physical circuit comprising a series of physical gates (e.g., using transistor-transistor logic (TTL) integrated circuits such as 7400-series gates, flip-flops, buffers, decoders, multiplexers, and the like) connected by physical wires. While the execution of a smart contract 110 is described in the context of FIG. 1 and elsewhere, the use of a smart contract is merely one non-limiting example of source code that can be transformed to an arithmetic circuit. In an embodiment, a client (e.g., the first computing entity 102, either alone or in conjunction with the second computing entity 104) determines source code for performing a task defined by a set of operations, wherein execution of the task is delegated to a third computing entity 106 (referred to as a worker or prover). Generally speaking, a verifier may perform tasks associated with determining that the prover executed the task correctly, such as by verifying the validity of a proof of correct execution 116 generated by the prover.

A verifiable computation is a technique that allows the generation of proofs of computation. In an embodiment, such a technique is utilized by a client to outsource, to another computing entity referred to herein as a prover, the evaluation of a function f on an input x. In some cases, the client is computationally limited so that it is infeasible for the client to perform the evaluation of the function (e.g., the expected runtime of the calculation using computing resources available to the client exceeds a maximum acceptable threshold), although such need not be the case, and the client may, generally, speaking, delegate evaluation of the function f on the input x based on any suitable criterion, such as computational runtime, computational cost (e.g., the financial cost of allocating computing resources to perform the evaluation of the function), and more.

A prover, in an embodiment, is any suitable computing entity such as a blockchain node as described in greater detail elsewhere in the present disclosure. In an embodiment, a prover (e.g., a blockchain node) evaluates the function f on input x and generates an output y and a proof π of the correctness of the output y that can be verified by other computing entities such as the client as described above and/or other nodes of the blockchain network. Proofs, which may also be referred to as arguments, can be verified faster than doing the actual computational—accordingly, computational overhead can be reduced (e.g., reducing power overhead and the cost associated with powering and running computing resources) by verifying the correctness of the proof instead of re-computing the function f over input x to determine the correctness of the output generated by the prover described above. In zero-knowledge verifiable computation the prover provides an attestation to the client that the prover knows an input with a particular property.

An efficient variant of a zero-knowledge proof of knowledge is zk_SNARK (Succinct Non-interactive ARgument of Knowledge). In an embodiment, all pairings-based zk-SNARKs include a process where the prover computes a number of group elements using generic group operations and the verifier checks the proof using a number of pairing product equations. In an embodiment, the linear interactive proof works over a finite field and the prover's and verifier's message include, encode, reference, or otherwise include information usable to determine vectors of field elements.

In an embodiment, the first computing entity and/or the second computing entity agree on terms of execution of a smart contract by exchanging a set of messages that encode proposed parameters for the execution of the smart contract, such as one or more Boolean expressions that encodes a set of conditions that determine whether and/or how to execute the smart contract and a set of operations to perform based on a condition being satisfied. In an embodiment, one computing entity sends a set of parameters to the second computing entity as part of a protocol, and the second computing entity determines whether the parameters are acceptable for the smart contract. If the parameters are not accepted, the second computing entity may provide a different set of parameters to the first computing entity as a second proposed set of parameters for execution of the smart contract. The second computing entity may also provide a signal that the first set of parameters were not acceptable, and the first computing entity determines a second set of parameters to provide. In either case, once all parties have signalled agreement to the parameters, either computing entity can, in an embodiment, generate a locking transaction wherein one of the outputs is locked by the program (e.g., a smart contract script) and sends it to a counterparty of the smart contract. The locking transaction may refer to a transaction that initialises constraints upon which an unlocking transaction can be validated. In some examples, an “unlocking transaction” refers to a blockchain transaction that reassociates (e.g., transferring ownership or control) at least a portion of a digital asset, indicated by an UTXO of a previous transaction, to an entity associated with a blockchain address.

In an embodiment, the first computing entity generates a locking transaction and adds a transaction input that covers a portion of the worker fee. It should be noted that at this point, the locking transaction is not yet valid because the value of the transaction inputs is not equal to the value of the transaction outputs of the locking transaction. Continuing with the example, when the second computing entity receives the locking transaction, the second computing entity verifies the smart contract (e.g., verifies the common reference string and parameters for execution of the smart contract) and adds an input to the locking transaction and unlocks a UTXO to transfer to the issuer agreed upon digital assets and also a fee that is to be paid to the worker for execution of the program (e.g., smart contract) and an output that has a value of the fee to the worker. In cases where both the first computing entity and the second computing entity contribute transaction inputs to the smart contract, the smart contract may be jointly owned by both parties, and the transfer (e.g., exchange or sale) of the smart contract may require an attestation from both parties.

The smart contract 110 may be executed by a third computing entity 106 such as a node of a blockchain network. The third computing entity 106 may be referred to as a worker or a prover. In an embodiment, the worker executes the smart contract by at least performing a computational task that involves the computation of a function on an input. In an embodiment, the worker is any suitable computer system that the owner(s) of the smart contract may delegate a computational task to. An input, in an embodiment, includes information that attests to the worker's identity, such as a digital signature generated using a private key associated with the worker. In an embodiment, the worker is a computer system that the first and second computing entities agree to transfer digital assets to in return for successfully completing a computational task. The owner(s) of the smart contract, in an embodiment provides an input x and the evaluation key E_K 112 to a prover, the prover uses an evaluation module to a compute routine to compute the output y (i.e., y=f(x) wherein the input is x and the function is f) and uses the evaluation key E_K to produce a proof of correct execution 116, which may also be referred to as a proof-of-correctness elsewhere in this disclosure. In an embodiment, the worker is a computer system comprising hardware and/or software that includes instructions that, if executed by one or more processors of the computer system, cause the computer system to evaluate the values of the internal circuit wires of a QAP and produce an output y of the QAP.

In embodiments, an output , values of the internal circuit wires (or a subset thereof), and the evaluation key E_K are used to produce the proof-of-correctness. The proof π can be stored on the blockchain and verified by multiple parties without requiring the worker to separately interact with the multiple parties. In this manner, a fourth computing entity (e.g., a verifier computer system) can validate the broadcasted transaction using the public verification key V_K 114 and the proof π, thereby validating the smart contract. In some cases, the owner(s) of the smart contract may reclaim digital assets encumbered by the broadcasted transaction if the verification fails. In some cases, the owner(s) of the smart contract can perform the verification of the proof.

In an embodiment, the verification key 114 and the corresponding proof 116 are generated according to techniques described above and/or below. Accordingly, a verifier is given verification key V_K and proof π:

$V_K={\left\{\begin{array}{c}𝒫\\ Q\\ {\alpha }_{v}Q\\ {\alpha }_{w}Q\\ {\alpha }_w𝒫\\ {\alpha }_{y}Q\\ \beta 𝒫\\ \beta Q\\ r_{y}t\left(s\right)𝒫\\ r_v{v}_i\left(s\right)𝒫\\ r_w{w}_i\left(s\right)Q\\ r_y{y}_i\left(s\right)𝒫\end{array}\right\}}_{i=0\dots N}\mathrm{Proof}\pi =\left\{\begin{array}{c}\sum _{i=N+1}^m{a}_i{r}_v{v}_i\left(s\right)𝒫\\ \sum _{i=N+1}^m{a}_i{\alpha }_v{r}_v{v}_i\left(s\right)𝒫\\ {\sum }_{i=N+1}^m{a}_i{r}_w{w}_i\left(s\right)Q\\ {\sum }_{i=N+1}^m{a}_i{\alpha }_w{r}_w{w}_i\left(s\right)𝒫\\ {\sum }_{i=N+1}^m{a}_i{r}_y{y}_i\left(s\right)𝒫\\ {\sum }_{i=N+1}^m{a}_i{\alpha }_y{r}_y{y}_i\left(s\right)𝒫\\ {\sum }_{i=N+1}^m{a}_i\left(r_v\beta v_i\left(s\right)+r_w\beta w_i\left(s\right)+r_y\beta y_i\left(s\right)\right)𝒫\\ {\sum }_{i=0}^d{h}_i{s}^{i}Q\end{array}\right\}$

such that the verifier computes a plurality of elliptic curve multiplications (e.g., one for each public input variable) and five pair checks, one of which includes an additional pairing multiplication.

Given verification key V_K, proof π, and (a₁, a₂, . . . , a_N), to verify that t(x) divides p(x) and hence (x_N+1, . . . , x_m)=f(x₀, . . . , x_N), the verifier proceeds as follows. First it checks all the three α terms:

$e\left({\alpha }_v{r}_v{V}_{\mathrm{mid}}\left(s\right),\right)=e\left(r_v{V}_{\mathrm{mid}}\left(s\right),{\alpha }_v\right)$ $e\left({\alpha }_w{r}_w{V}_{\mathrm{mid}}\left(s\right),\right)=e\left({\alpha }_w,r_w{W}_{\mathrm{mid}}\left(s\right)\right)$ $e\left({\alpha }_y{r}_y{V}_{\mathrm{mid}}\left(s\right),\right)=e\left(r_y{Y}_{\mathrm{mid}}\left(s\right),{\alpha }_y\right)$

wherein V_mid(s)=Σ_i=N+1^ma_iv_i(s), W_mid(S)=Σ_i=N+1^ma_iw_i(s), and Y_mid(s)=Σ_i=N+1^ma_iy_i(s). Then, the verifier checks the term β:

$e\left(r_v{V}_{\mathrm{mid}}\left(s\right)+r_y{Y}_{\mathrm{mid}}\left(s\right),\beta \right)·e\left(\beta ,r_w{W}_{\mathrm{mid}}\left(s\right)\right)=e\left(Z_{\mathrm{mid}}\left(s\right),,\right)$

and Z_mid(s)=Σ_i=N+1^ma_i(r_vβv_i(s)+r_wβw_i(s)+r_yβy_i(s). Finally, the verifier checks the divisibility requirement:

$e\left(r_{v}V\left(s\right),r_{w}W\left(s\right)\right)=e\left(r_{y}Y\left(s\right),\right)·e\left(r_{y}t\left(s\right),h\left(s\right)\right)$ $\mathrm{wherein}{r}_{v}V\left(s\right)={\sum }_{i=0}^m{r}_v{a}_i{v}_i\left(s\right),$ $r_{w}W\left(s\right)={\sum }_{i=0}^m{r}_w{a}_{i}w\left(s\right),r_{y}Y\left(s\right)={\sum }_{i=0}^m{r}_y{a}_{i}y\left(s\right),\mathrm{and}$ $h\left(s\right)={\sum }_{i=0}^d{h}_i.$

Thus, upon considering the notation from the sections described above and the examples described in this disclosure, the verification comprises a set of pair checks of the following elements, in accordance with one embodiment:

$e\left({\pi }_2,V_K^2\right)=e\left({\pi }_1,V_K^3\right)$ $e\left({\pi }_4,V_K^2\right)=e\left(V_K^5,{\pi }_3,\right)$ $e\left({\pi }_6,V_K^2\right)=e\left({\pi }_5,V_K^6\right)$ $e\left(\left({\pi }_1+{\pi }_6\right),V_K^2\right)=e\left({\pi }_7,V_K^2\right)$ $e\left(\left(a_0{V}_K^{10}+a_1{V}_K^{11}+a_2{V}_K^{12}+a_3{V}_K^{13}+a_4{K}_K^{14}+{\pi }_2+a_7{V}_K^{15}\right),\left(a_0{V}_K^{16}+a_1{V}_K^{17}+a_2{V}_K^{18}+a_3{V}_K^{19}+a_4{V}_K^{20}+{\pi }_4+a_7{V}_K^{21}\right)\right)=\left(\left(a_0{V}_K^{22}+a_1{V}_K^{23}+a_2{V}_K^{24}+a_3{V}_K^{25}+a_4{V}_K^{26}+{\pi }_6+a_7{V}_K^{15}\right),V_K^2\right)*e\left(V_K^9,{\pi }_8\right)$

FIG. 2 illustrates a computing environment 200 where a first computing entity 202 and a second computing entity 204 exchange quantities that can be used to determine powers of a shared secret between two or more parties. The first computing entity 202 and the second computing entity 204 may exchange quantities (as illustrated below the horizontal arrow illustrated in FIG. 2) that are used to calculate an identical common reference string. In an embodiment, the first computing entity and the second computing entity are nodes of a blockchain network that are in accordance with those described in connection with FIG. 1. In accordance with at least one embodiment, let F: → be a function on field, and let be the corresponding arithmetic circuit, and =(t(x), , , ) the corresponding QAP (quadratic arithmetic program) of size m and degree d. Furthermore, let e: ×→_T be a bilinear mapping, and G a generator of . In an embodiment, the additive representation (as opposed to the exponential representation) is chosen. In an embodiment, an evaluation key and a verification key are chosen by: choosing random r_v, r_w, s, α_v, α_w, α_y, β, γ∈, and setting r_y=r_v·r_w, r_v·G=g_v (generally: a=a·G), and correspondingly g_w, g_y, to construct the keys:

$\mathrm{EK}=\left({\left\{\langle v_k\left(s\right)\rangle \right\}}_{k\in I_{\mathrm{mid}}},{\left\{\langle w_k\left(s\right)\rangle \right\}}_{k\in I_{\mathrm{mid}}},{\left\{\langle y_k\left(s\right)\rangle \right\}}_{k\in I_{\mathrm{mid}}},{\left\{\langle {\alpha }_v{v}_k\left(s\right)\rangle \right\}}_{k\in I_{\mathrm{mid}}},{\left\{\langle {\alpha }_w{w}_k\left(s\right)\rangle \right\}}_{k\in I_{\mathrm{mid}}},{\left\{\langle {\alpha }_y{y}_k\left(s\right)\rangle \right\}}_{k\in I_{\mathrm{mid}}},{\left\{\langle s^i\rangle \right\}}_{i\in \left[d\right]},{\left\{\langle \beta v_k\left(s\right)\rangle \langle \beta w_k\left(s\right)\rangle \langle \beta y\left(s\right)\rangle \right\}}_{k\in I_{\mathrm{mid}}}\right)\mathrm{and}$ $\mathrm{VK}=\left(\langle 1\rangle ,\langle {\alpha }_v\rangle ,\langle {\alpha }_w\rangle ,\langle {\alpha }_y\rangle ,\langle \gamma \rangle ,\langle \beta \gamma \rangle ,\langle t\left(s\right)\rangle ,{\left\{\langle v_k\left(s\right)\rangle \langle w_k\left(s\right)\rangle \langle y_k\left(s\right)\rangle \right\}}_{k\in \left\{0\right\}\bigcup \left[N\right]}\right).$

where N=N_in+N_out, i.e., the number of in-and outputs. In an embodiment where an asymmetric pairing is considered, the pairing mapping would be defined as: e: ₁×₂→_T, and G_i a generator of _i, i=1,2. In that case the CRS would change slightly and the VK would be

$\mathrm{VK}=\left({\langle 1\rangle }_1,{\langle 1\rangle }_2,{\langle {\alpha }_v\rangle }_2,{\langle {\alpha }_w\rangle }_2,{\langle {\alpha }_w\rangle }_1,{\langle {\alpha }_y\rangle }_2,{\langle \beta \rangle }_1,{\langle \beta \rangle }_2,{\langle r_{y}t\left(s\right)\rangle }_1,{\left\{{\langle v_k\left(s\right)\rangle }_1{\langle w_k\left(s\right)\rangle }_2{\langle y_k\left(s\right)\rangle }_1\right\}}_{k\in \left[0\right]\bigcup \left[N\right]}\right)\mathrm{where}$ $r_y=r_v·r_w\mathrm{and}{\langle a\rangle }_i=a·G_i.$

As indicated, circuits are described by means of polynomials v, w, which, in turn, are evaluated in a secret s, which is only known to the party owning/creating the circuits and corresponding QAP (e.g., the owners of the smart contract).

More precisely, as described above, the client generates the elements:

$r_v,r_w,s,{\alpha }_v,{\alpha }_w,{\alpha }_y,\beta ,\gamma \stackrel{ℛ}{\leftarrow }{𝔽}_r^{*}$

Whereas the security of the proposed solution relies on the parameter, s, in some embodiments, exposing the remaining (r_v, r_w, α_v, α_w, α_y, β, γ) may reveal information that does not render the system zero-knowledge and/or that the client does not want other entities to know about.

In an embodiment, for solutions where a worker is required to provide a proof-of-correctness, there may exist an OP_code (or equivalents) for verifying the proof-of-correctness against a verification key.

It should be noted that throughout this disclosure, unless otherwise stated, the polynomials in this paper are defined over a field, _r. Thus, let (_r, +, ·) be a field. Accordingly, a polynomial over _r is given by P: →F′

$P\left(x\right)=\sum _{i=0}^n{a}_i{x}^i$

where a_i∈.

In an embodiment, the common reference string is expressed by means of the polynomials v(x), w(x) evaluated in a secret, s, expressed in the form:

$v\left(s\right)=a_0+a_{1}s+a_2{s}^2+\dots +a_n{s}^n$ $w\left(s\right)=b_0+b_{1}s+b_2{s}^2+\dots +b_n{s}^n$

In an embodiment, techniques described herein are utilised to determine and share elliptic curve points of form: v(s)_G=a_0G+a₁s_G+a₂s²_G+ . . . , for a generator G of the associated group (e.g., of elliptic curve points). Thus, in an embodiment, systems and methods described herein are utilised to determine and distribute s^rG=s^r, for arbitrary integer powers r.

Techniques to share and distribute s^r, in accordance with at least one embodiment, are illustrated in FIG. 2. As an example, the n=2 case is described in greater detail below in connection with FIG. 2, and should be considered a non-limiting example of sharing powers of secrets between parties of a smart contract. Furthermore, it is noted, that in various embodiments described herein, the equivalent of a threshold is given a priori and it is assumed that the necessary number of participants first agree.

FIG. 2 illustrates techniques to share and distributed powers of a shared secret in the case of two participants, in accordance with at least one embodiment. As illustrated in FIG. 2 and in accordance with at least one embodiment, exactly two parties are participants that share powers of a shared secret (i.e., n=2 case). The first and second computing entities may respectively be referred to as A and B. In an embodiment, A and B may exchange the following information: A sends p₁(x_i)_G to B, and receives p₂(x_i)_G in return (i∈{1,2}). In this way, both can calculate

${\langle p\left(x_i\right)\rangle }_G={\langle p_1\left(x_i\right)+p_2\left(x_i\right)\rangle }_G$

Using Lagrange interpolation (Lagrange Polynomial, n.d.) it is possible to express p in terms of p(x₁) and p(x₂):

$p\left(x\right)=p\left(x_1\right)\frac{x-x_2}{x_1-x_2}+p\left(x_2\right)\frac{x-x_1}{x_2-x_1}=\frac{p\left(x_1\right)-p\left(x_2\right)}{x_1-x_2}x+\frac{-p\left(x_1\right)x_2+p\left(x_2\right)x_1}{x_1-x_2}$

and, by extension, p(x)G by means of p(x_i)_G (see WP0559). While the participants cannot reconstruct p(x), they can reconstruct p(x)_G (and in particular p(0)_G), by means of the exchanged points p_i(x_j)_G. This is true about higher powers of pⁿ(x)_G, as well. As a result of the multinomial formula (Multinomial Theorem, n.d.):

${\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+\dots +p_m\left(x_j\right)\right]}^n\rangle }_G={\langle \sum _{k_1+k_2+\dots +k_m=n}\left(\begin{array}{c}n\\ k_1,k_2,\dots ,k_m\end{array}\right)\prod _{t=1}^m{p}_t^{k_t}\left(x_j\right)\rangle }_G$

For m=2 this becomes:

${\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+p_2\left(x_j\right)\right]}^n\rangle }_G={\langle \sum _{k_1+k_2=n}\left(\begin{array}{c}n\\ k_1,k_2\end{array}\right)\prod _{t=1}^2{p}_t^{k_t}\left(x_j\right)\rangle }_G$

which, in turn, yields the following “tower” of terms (here i=1,2):

n     Terms that need to be exchanged (multiplied by G, and j = 1, 2)
1     p1 (xj), p2(xj)
2     p1(xj), p2(xj), p12(xj), p22(xj) (optionally: p1(xj) · p2(xj))
3     p1(xj), p2(xj), p12(xj), p22(xj), p13(xj), p23(xj) (optionally: p1(xj)·
      p2(xj), p12(xj) · p2(xj), p1(xj) · p22(xj)
. . . . . .

Schematically the exchange could look like the following (for some x_i):

Step A ↔ B
1    A: for j = 1,2 and k = 1, 2, . . .: send {(p1k (xj))G} to B
2    B: for j = 1,2 and k, k' = 1, 2, . . .: send {{p2k' (xj))G },
     (and optionally) {   p1k(xj) · p2k'(xj)   G} to A

After this exchange (following certain, pre-arranged conventions) both parties can calculate pⁿ(x_j)_G and, in particular, pⁿ(0)_G=sⁿG.

FIG. 3 illustrates a computing environment 300 in which a first computing entity 302 and a second computing entity 304 exchange a set of parameters that renders a protocol—such as those described in connection with FIG. 1—zero-knowledge. In accordance with various embodiments, a public verification key may take on the form:

$\mathrm{VK}=\left({\langle 1\rangle }_1,{\langle 1\rangle }_2,{\langle {\alpha }_v\rangle }_2,{\langle {\alpha }_w\rangle }_2,{\langle {\alpha }_w\rangle }_1,{\langle {\alpha }_y\rangle }_2,{\langle \beta \rangle }_1,{\langle \beta \rangle }_2,{\langle r_{y}t\left(s\right)\rangle }_1,{\left\{{\langle v_k\left(s\right)\rangle }_1{\langle w_k\left(s\right)\rangle }_2{\langle y_k\left(s\right)\rangle }_1\right\}}_{k\in \left[0\right]\bigcup \left[N\right]}\right)$

Whereas the security of the proposed solution relies on the parameter, s, in some embodiments, exposing the remaining (r_v, r_w, α_v, α_w, α_y, β, γ) may reveal information that does not render the system zero-knowledge and/or that the client does not want other entities to know about. Accordingly, in an embodiment, some or all of the remaining parameters used to generate a verification key 306 are shared using techniques described in connection with FIG. 3.

In an embodiment, polynomials are exchanged between the first computing entity 302 and the second computing entity 304 (which may be referred to as, respectively, A and B) according to techniques described elsewhere in this disclosure, such as those discussed in connection with FIGS. 1, 2, and 4. Accordingly, in an embodiment, the first computing entity 302 computes and shares a set of elliptic curve points {p₁^k(x_l)_Gi}_{k∈{1, . . . ,n},l∈{1,2},i∈{1,2}} to the second computing entity 304 and the second computing entity 304 computes and shares a set of elliptic curve points {p₂^k(x_l)_Gi}_{k∈{1, . . . ,n},l∈{1,2},i∈{1,2}} to the first computing entity 302. Additionally, other parameters used to generate the verification key 306 may not be revealed in a plaintext format across a communications channel and instead transmitted using techniques described hereinbelow.

Let G_i be a generator of _i, i=1,2, and p_k(s)_i=r_p·p_k(s)·G_i for p=v, w, y, according to an embodiment. Further, in an embodiment, p_kⁱ(s)_Gi are shared, and the other parameters are propagated in a manner that ensures the confidentiality of the parameters (e.g., encryption or other concealment techniques). It is noted that either of the participants may, conversely, generate the parameters r_v, r_w, α_v, α_w, α_y, β, γ∈, and transfer them to the other, either off—or online (e.g., on-chain). Regarding the former—that is, ensuring confidentiality of the other parameters—various techniques may be utilized. For example, by using Shamir's Secret Sharing Scheme (4S) to share the elements α_v2, α_w2, α_w1, α_y2 (and possibly β₁, β₂, depending on implementation/protocol) and/or using a Diffie-Hellman like secret generation for r_v, r_w, β, γ.

In an embodiment, the elements α_v2, α_w2, α_w1, α_y2, β₁, β₂, or some combination thereof are of the form a_i=a·G_i. Like in the case of s, each participant, i, generates a polynomial, q_i, evaluates it in x_j, j∈{1, . . . , m}, and shares the corresponding q_i(x_j) with participant j. Each participant can thus determine q(x)_Gi=Σ_jq_j(x)_Gand, in particular, q(0)·G_i=q(0)_i where q(0) can be α_v, α_w, α_y, β, or some combination thereof, the particular combination of which may be based on a protocol/convention, such as a zk_SNARKs protocol.

In an embodiment, the α-parameters are shared by means of elliptic curve points whereas other parameters may by scalar values. For such values, in accordance with at least one embodiment, a Diffie-Hellman scheme is used to share scalar parameters between the two computing entities, without sharing the parameters themselves. Accordingly, in an embodiment, let P={t₁, . . . , t_N} be a set of N parameters. In an embodiment, it is assumed that A and B have agreed on using a multiplicative group Γ with modulus μ and generator γ, and the participants (A and B) proceed with following the steps (while the exponential representation is used here as an illustrative example, others suitable representations may be utilised): for each i∈{1, . . . , N}, the first and second computing entities create a (private) random number v_A,i, v_B,i, respectively and both derive a (public) element: γ^vA,i and γ^vB,i. The computing entities then exchange γ^vA,i and γ^vB,i, and calculate (γ^vB,i)^vA,i and (γ^vA,i)^vB,i(=(γ^vB,i)^v_A,i=γ^vA,ivB,i), respectively. Accordingly, the parameters are set t_i=γ^vA,ivB,i.

Accordingly, the techniques above have demonstrated that both the first and second computing entities share the parameters t; without having exchanged them by, instead, exchanging γ^vA,i and γ^vB,i. It should be noted that in accordance with at least one embodiment, the number of participants is limited to n=2 as a result of at least one parameter being exchanged in the preceding manner.

FIG. 4 illustrates a diagram 400 of a protocol based on a two-party common reference string (CRS) and corresponding proof-of-correctness (POC) or proof of correct execution. The diagram 400 illustrates a first computing entity 402, a second computing entity 404, and a third computing entity 106 wherein the first computing entity 402 and the second computing entity 404 jointly make contributions to a smart contract that can be unlocked by the third computing entity 406 upon execution of the smart contract. In an embodiment, the protocol is implemented at least in part using a blockchain network.

In accordance with this disclosure, and described in greater detail (e.g., in connection with FIG. 4), a scheme and protocol for two participants, A and B, may be utilised to generate a shared secret and, thus, a shared common reference string (CRS) which can be used to verify the correct execution of an associated circuit. In an embodiment, the scheme assumes an off-chain exchange of data, first between A and B, and secondly between A+B (or either) and a worker C that performs a computational task on behalf of at least one of A or B. To cause the worker C to perform the computational task (e.g., execution of a smart contract), A and B both sign a transaction (which may or may not contain a P2SH-type redeem script), which requires the worker C to provide a proof-of-correctness and prove possession of correct verification key (VK) in order to unlock the funds.

Techniques for implementing the protocol as presented in this disclosure, in some embodiments, do not require any protocol changes to existing blockchain networks (e.g., may be implemented on a Bitcoin-based blockchain network using existing commands that are already supported). In some embodiments, extensions to the existing set of commands supported by the Bitcoin protocol are also discussed herein—the extensions may include new commands (e.g., new OP codes) that may have various benefits such as improving efficiency of the execution of smart contracts, reducing the size of the smart contract (which may reduce the amount of storage space needed by nodes of the blockchain network to properly operate), and more. In some embodiments, the cost of confirming a smart transaction to the blockchain is based at least in part on the size of the smart contract.

In an embodiment, the exchange and transfer of elliptic curve points and other data pertaining to the common reference string are transferred off-chain. In an embodiment, the verification key is eventually broadcast or otherwise made available on-chain via the exchange of digital assets for work (e.g., execution of a smart contract) carried out by the worker C and two parties wishing to evaluate their smart contract (A and B). As described herein, several schemes are possible. For instance, A and B may or may not both supply the VK or hashes of VK when preparing the locking transaction. In other words, in an embodiment, the majority of the capacity-intensive workload is done off-chain.

In an embodiment, the protocol includes both off-chain and on-chain components, as denoted by the dotted line illustrated in FIG. 4. Off-chain components may include communications and exchanges of data and information that can occur without storing data to a blockchain ledger. For example, an off-chain component of the protocol may include an exchange of IP packets between a source and destination (e.g., the first computing entity 402 is a source that transmits a first set of parameters to a destination, the second computing entity 404). For example, an on-chain component of the protocol may include broadcasting data to a blockchain ledger that is made available to nodes of the blockchain network.

In an embodiment, the first computing entity 402 computes, based at least in part on a first polynomial, a set of elliptic curve points {p₁^k(x_l)_Gi}_{k∈{1, . . . ,n},l∈{1,2},i∈{1,2}}. The first computing entity 402 may transmit data to the second computing entity 404 comprising at least some of the set of elliptic curve points. For example, the first computing entity 402 may transmit the entire set of elliptic curve points. As a second example, the first computing entity 402 may transmit a subset of the elliptic curve points {p₁^k(x₂)_G}_{k∈{1, . . . ,n}}.

In some embodiments, additional data is transmitted that is not required to maintain the secrecy of a share secret s, but may be necessary to render the system zero-knowledge. For example, {γ^vA,i}_{i∈{1, . . . ,N}}, q_1,I(I=v, w, y), or some combination thereof may also be computed (as described above in connection with FIG. 3) to generate additional parameter values that can be used as part of determining a common reference string. In an embodiment, {γ^vA,i}_{i∈{1, . . . ,N}} is a set of scalar values. In an embodiment, q_1,I(I=v, w, y) refers to a set of elliptic curve points.

In an embodiment, the second computing entity 404 likewise computes, based on a polynomial that may be different from that used by the first computing entity 402, a set of elliptic curve points {p₂^k(x_l)_Gi}_{k∈{1, . . . ,n},l∈{1,2},i∈{1,2}}. The second computing entity 404 may perform similar operations as described above. For example, the second computing entity 404 may transmit a subset of the generated elliptic curve points {p₂^k(x₁)_G}_{k∈{1, . . . ,n}} to the first computing entity 402. Additionally, in an embodiment, optional parameters such as {γ^vB,i}_i, q_2,I(I=v, w, y), or some combination thereof may be exchanged, which, while not being necessary to maintain the secrecy of the shared secret s, may be utilised to ensure that the protocol is zero-knowledge.

In an embodiment, the exchanged quantities can be utilised by both the first computing entity 402 and the second computing entity 404 to calculate the identical common reference string. They may or may not provide the third computing entity (e.g., worker) with the common reference string, as the third computing entity 406 has to prove possession of the correct verification key later on. The determination of the same common reference string by both the first and second computing entities may be performed off-chain.

Continuing with the protocol, in accordance with one embodiment, the first and second computing entities agree on a transaction in which they make proportionate contributions for the execution of the smart contract. In an embodiment, the first and second computing entities agree upon a proportion of contributions and each provide transaction inputs that are encumbered to the smart contract and can be unlocked by the third computing entity upon execution of the smart contract. This may or may not be a pay-to-script-hash (P2SH) type agreement where they both transfer funds to the same address (an address of C). The P2SH type script may or may not contain the elements of the verification key or hash-values of verification key, i.e., h_i=HASH (VK_i). In an embodiment, the key has been divided into chunks. The smart contract may be broadcast to a blockchain as the first transaction 408 illustrated in FIG. 4 having a first transaction input contributed by the first computing entity 402 and a second transaction input contributed by the second computing entity 404 that serves as a worker fee paid in a proportion agreed upon by the first and second computing entities.

In an embodiment, the third computing entity 406—also referred to as a worker—unlocks the funds in a second transaction 410 according to the protocols in U.K. Patent Application No. 1719998.5 and/or U.K. Patent Application No. 1720768.9—and the third computing entity 406 unlocks the funds for the work (correct execution of the circuit) and in doing so, proves that it has possession of (a) the correct verification key and (b) a valid proof-of-correctness. The verification may be performed by another computer system (e.g., a node of the blockchain that is a verifier) or by either/both of the computing entities that are a party to the smart contract.

FIG. 5 shows an illustrative example of a process 500 for generating a two-party common reference string comprising a verification key and evaluation key, in accordance with an embodiment. Some or all of the process 500 (or any other processes described herein, or variations and/or combinations thereof) may be performed under the control of one or more computer systems configured with computer-executable instructions and may be implemented as code (e.g., computer-executable instructions, one or more computer programs, or one or more applications) executing collectively on one or more processors, by hardware, software, or combinations thereof. The code may be stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of computer-readable instructions executable by one or more processors. The computer-readable storage medium may be a non-transitory computer-readable medium. In some embodiments, at least some of the computer-readable instructions usable to perform the process 500 are not stored solely using transitory signals (e.g., a propagating transient electric or electromagnetic transmission). A non-transitory computer-readable medium may include non-transitory data storage circuitry (e.g., buffers, caches, and queues) within transceivers of transitory signals.

In an embodiment, the system performing the process 500 is a computing entity that is a party to a smart contract that performs a process to at least establish information that can be used by the system and another party of the smart contract to calculate an identical common reference string. A common reference string described in connection with the process 500 may be in accordance with those discussed in connection with, for example, FIGS. 1-4. In an embodiment, the common reference string is expressed by means of the polynomials v(x), w(x) evaluated in a secret s of the form:

$v\left(s\right)=a_0+a_{1}s+a_2{s}^2+\dots +a_n{s}^n$ $w\left(s\right)=b_0+b_{1}s+b_2{s}^2+\dots +b_n{s}^n$

In an embodiment, the first computing entity determines 502 a first polynomial to generate a first set of elliptic curve values. In an embodiment, the system generates elliptic curve points of form: v(s)_G=a_0G+a₁s_G+a₂s_2G+ . . . , for some generator G of the associated group (e.g., of elliptic curve points). Unless otherwise noted, the polynomials in this process 500 are defined over a field, _r. Thus, let (_r, +,·) be a field. Then, a polynomial over _r is given by P: →′ and P(x)=Σ_i=0ⁿa_ixⁱ where a_i∈. The set of elliptic curve points may be represented as {p₁^k(x_l)_Gi}_{k∈{1, . . . ,n},l∈{1,2},i=1}.

The first computing entity may make 504 the set of elliptic curve points available to the second computing entity. In an embodiment, the system need not make the entire set of elliptic curve points available to the second computing entity-rather in an embodiment, the system transmits a subset of the elliptic curve points {p₁^k(x₂)_G}_{k∈{1, . . . ,n}}.

For example, in accordance with at least one embodiment, where n=2, the first computing entity computes {p₁(x₁), p₁²(x₁), p₁(x₂), p₁²(x₂)} and shares, with the second computing entity, {p₁(x₂), p₁²(x₂)}. The remaining quantities {p₁(x₁), p₁²(x₁)} may be utilised by the first computing entity to calculate the common reference string. The second computing entity, which is also a party to the smart contract, may separately generate a set of elliptic curve points for the same input points (e.g., generate elliptic curve points {p₂^k(x₁)_G}_{k∈{1, . . . ,n}}) and provide either all or some of the generated points to the first computing entity. The first computing entity may receive 506, from the second computing entity, a second set of elliptic curve points that correspond to some or all of the elliptic curve points generated by the second computing entity, wherein the subset may be determined based on techniques described elsewhere in this disclosure (e.g., in connection with FIGS. 2 and 6).

In an embodiment, the system determines 508 an identical common reference string based on at least a portion of the first and second sets of elliptic curve points. For example, after the exchange of elliptic curve points, a Lagrange interpolation may be utilised to express p in terms of p(x₁) and p(x₂). In an embodiment, both parties of the smart contract can reconstruct powers (pⁿ(x))_G (and in particular, (pⁿ(0)_G=(sⁿ)_G), by means of the exchanged points (p_i(x_j)_G. For powers (pⁿ(x))_G, the multinomial formula as described above may be utilised:

${\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+\dots +p_m\left(x_j\right)\right]}^n\rangle }_G={\langle {\sum }_{k_1+k_2+\dots +k_m=n}\left(\begin{array}{c}n\\ k_1,k_2,\dots ,k_m\end{array}\right){\prod }_{t=1}^m{p}_t^{k_t}\left(x_j\right)\rangle }_G.$

For example, for m=2 this becomes:

${\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+\dots +p_2\left(x_j\right)\right]}^n\rangle }_G={\langle {\sum }_{k_1+k_2=n}\left(\begin{array}{c}n\\ k_1,k_2\end{array}\right){\prod }_{t=1}^2{p}_t^{k_t}\left(x_j\right)\rangle }_G.$

In an embodiment, additional parameters (e.g., scalar values and/or elliptic curve points) are exchanged between the first and second computing entities, such as in the manner described in connection with FIG. 3, and the parameters, in conjunction with a power of the shared secret sⁿ_G are utilised to compute the verification key and/or evaluation key. In an embodiment, the parameters are exchanged without reliance on encryption and/or communications channels that provide cryptographically verifiable assurances of confidentiality.

In an embodiment, the first and second computing entities agree on a transaction and each makes 510 a contribution to a respective transaction input of the smart contract which can be unlocked by a third computing entity (e.g., worker) that correctly executes the smart contract. In an embodiment, either of the computing entities provides a proportionate worker fee. There may or may not be a P2SH type agreement in which both make contributions to the same address (e.g., address for worker). In an embodiment, the P2SH script includes elements of the verification key or hash values of the verification key. A worker (e.g., third computing entity) may unlock (e.g., unlock) the contributions by providing a computationally verifiable attestation that the worker has the correct verification and provides a valid proof of correctness, for example, by using techniques described in connection with U.K. Patent Application No. 1719998.5 and/or U.K. Patent Application No. 1720768.9.

FIG. 6 shows an illustrative example of a process 600 for sharing powers of a shared secret between n parties (e.g., n>2), in accordance with at least one embodiment. Some or all of the process 600 (or any other processes described herein, or variations and/or combinations thereof) may be performed under the control of one or more computer systems configured with computer-executable instructions and may be implemented as code (e.g., computer-executable instructions, one or more computer programs, or one or more applications) executing collectively on one or more processors, by hardware, software, or combinations thereof. The code may be stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of computer-readable instructions executable by one or more processors. The computer-readable storage medium may be a non-transitory computer-readable medium. In some embodiments, at least some of the computer-readable instructions usable to perform the process 600 are not stored solely using transitory signals (e.g., a propagating transient electric or electromagnetic transmission). A non-transitory computer-readable medium may include non-transitory data storage circuitry (e.g., buffers, caches, and queues) within transceivers of transitory signals. In an embodiment, the equivalent of a threshold is given a priori and it is assumed that the necessary number of participants first agree. This differs from various existing techniques, such as those described in Shamir's Secret Sharing Scheme (4S), wherein the sharing of a secret only works under the limitation that a given threshold is reached.

Secret sharing, in accordance with various embodiments, is valid for an arbitrary number of parties. In an embodiment, large parts of the formalism described in this disclosure can be applied to multi-party (n>2) scenarios. In some embodiments, multi-party systems (n>2) are not required to conceal certain other parameters (e.g., some or all of the following non-elliptic curve (e.g., scalar) parameters: r_v, r_w, α_v, α_w, α_y, β, γ). If, however, those parameters are to remain private according to the protocol, different approaches—such as those described in connection with FIG. 3—may be utilised to conceal parameters such as r_y, r_w.

In an embodiment, all participants agree 602 upon and/or have access to the function f: →′ which maps finite field elements to other finite field elements. The functions, in an embodiment, serve as coefficients/exponents of generators of groups. For illustrative purposes, embodiments described hereinafter focus on polynomials since the functions we are interested in can be expressed in terms of polynomials by means of generalisations of Taylor series. In particular, in various embodiments, the parties involved evaluate the functions in the same value and without passing the value around amongst themselves. For example, in the case of a polynomial of order 1, this amounts to utilising Shamir's Secret Sharing Scheme. For higher orders (n>1), the parties are dealing with expressions of the form:

$f\left(s\right)=a_0+a_{1}s+a_2{s}^2+\dots +a_n{s}^n$

Accordingly, techniques described herein can be utilised to ensure that all participants have the same f(s)_G. For example, in a protocol described in accordance with at least one embodiment, the same EQ_FSG can be shared among two or more participants (i.e., n>1) by publically distributing points in the form (s^r)_G, for arbitrary integer powers r, since f(s))_G=a_0G+a₁s_G+a₂s²_G+ . . . , where G is a generator of the group in question (e.g., of elliptic curve points).

In an embodiment, each participant is able to generate 604 polynomials, which are evaluated in a set of points (x₁, x₂, . . . ) with x_i≠∀i, and the points may be known to all parties. In an embodiment, the sum of the polynomials of each participant makes up the (master) polynomial, of which the intersection with the y-axis is the secret, i.e.,

$p\left(x\right)={\sum }_{j=1}^m{p}_j\left(x\right)$

with p(0)=s, and where m is the number of participants. The intersection with the y-axis as described above may be referred to as an intersection point.

In order to establish s, each participant shares 606 a corresponding polynomial evaluated in the different points (x₁, x₂, . . . ). More specifically, participant i creates/calculates p_i(x_j) for i, j∈{1, . . . , m}, and sends off p_i(x_j)_G to j. Once these quantities are shared, each participant is able to calculate or otherwise determine 608 a power of the shared secret s^r.

Slightly more scrutiny is needed when considering s^r, since it amounts to sharing representations of

$s^r={\left(p\left(0\right)\right)}^r={\left({\sum }_{j=1}^m{p}_j\left(0\right)\right)}^r$

It may not possible to calculate powers of p_i(x_j)_G because powers of the generator are generally not defined. However, since all participants can infer s_G by means of the exchanged p_i(x_j)_G, it is possible to start by examining powers of the Lagrange interpolation polynomial L(x) (as the master polynomial generally can be constructed by means of Lagrange interpolation (Lagrange Polynomial, n.d.)). The Lagrange interpolation can be written as:

$L\left(x\right)=\sum _{j=1}^{m}p\left(x_j\right)l_j\left(x\right)\mathrm{where}$ $l_j\left(x\right)=\underset{k\ne j}{\prod _{1\le k\le m}}\frac{x-x_k}{x_j-x_k}$ $\mathrm{and}\mathrm{thus}:L^r\left(x\right)={\left(\sum _{j=1}^{k}p\left(x_j\right)l_j\left(x\right)\right)}^r=\sum _{k_1+k_2+\dots +k_m=r}\left(\begin{array}{c}r\\ k_1,k_2,\dots ,k_m\end{array}\right)\prod _{t=1}^m{\left(p\left(x_t\right)l_t\left(x\right)\right)}^{k_t}$ $\mathrm{where}\left(\begin{array}{c}r\\ k_1,k_2,\dots ,k_m\end{array}\right)=\frac{r!}{k_1!k_2!\dots k_m!}$

is the multinomial coefficient (Multinomial Theorem, n.d.). Accordingly, the l_j(x) polynomials can be calculated by each participant independently. Next, each participant can calculate:

${\langle L^r\left(x\right)\rangle }_G={\langle {\left(\sum _{j=1}^{m}p\left(x_j\right)l_j\left(x\right)\right)}^r\rangle }_G={\langle \sum _{k_1+k_2+\dots +k_m=r}\left(\begin{array}{c}r\\ k_1,k_2,\dots ,k_m\end{array}\right)\prod _{t=1}^m{\left(p\left(x_t\right)l_t\left(x\right)\right)}^{k_t}\rangle }_G$ $\mathrm{such}\mathrm{that}{\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+\dots +p_k\left(x_j\right)\right]}^n\rangle }_G$

which, in turn, can be rewritten as (using the multinomial expansion):

${\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+\dots +p_k\left(x_j\right)\right]}^n\rangle }_G={\langle \sum _{k_1+k_2+\dots +k_m=n}\left(\begin{array}{c}n\\ k_1,k_2,\dots ,k_m\end{array}\right)\prod _{t=1}^m(p_t^{k_t}\left(x_j\right)\rangle }_G$

This means that participant i (who is the owner/creator of polynomial p_i) can provide participant j with powers of p_i(x_j)_G, i.e., with the set:

{p_i^k(x_j)_G}_{j∈{1, . . . ,m}}

This allows participant j to calculate p_j^l(x_j)p_i^k(x_j)·G (and similarly p_j^l(x_i)p_i^k(x_i)·G) etc. In an embodiment, a participant calculates expressions on the form:

${\langle L^r\left(x\right)\rangle }_G={\langle {\left(\sum _{j=1}^{m}p\left(x_j\right)l_j\left(x\right)\right)}^r\rangle }_G={\langle \sum _{k_1+k_2+\dots +k_m=r}\left(\begin{array}{c}r\\ k_1,k_2,\dots ,k_m\end{array}\right)\prod _{t=1}^m{\left(l_t\left(x\right)\right)}^{k_t}\left(\sum _{k_1^{\prime }+k_2^{\prime }+\dots +k_m^{\prime }=k_t}\left(\begin{array}{c}{k}_t\\ k_1^{\prime }+k_2^{\prime },\dots ,k_m^{\prime }\end{array}\right)\prod _{t\prime =1}^m{p}_{t\prime }^{k_{{\prime }_{t^{\prime }}}}\left(x_j\right)\right)\rangle }_G$

Consider an example, in accordance with at least one embodiment, in which participants use an elliptic curve and where G is a generator in the corresponding (multiplicative) representation. In the case of two participants, A and B: A sends p₁(x_2G to B, and receives p₂(x_1G in return. Accordingly, participant A can calculate

${\langle p\left(x_1\right)\rangle }_G={\langle p_1\left(x_1\right)+p_2\left(x_1\right)\rangle }_G$

and similarly, participant B can calculate:

${\langle p\left(x_2\right)\rangle }_G={\langle p_1\left(x_2\right)+p_2\left(x_2\right)\rangle }_G$

Using Lagrange interpolation it is possible to express p in terms of p(x₁) and p(x₂):

$p\left(x\right)=p\left(x_1\right)\frac{x-x_2}{x_1-x_2}+p\left(x_2\right)\frac{x-x_1}{x_2-x_1}=\frac{p\left(x_1\right)-p\left(x_2\right)}{x_1-x_2}x+\frac{-p\left(x_1\right)x_2+p\left(x_2\right)x_1}{x_1-x_2}$

Each participant can reconstruct p(x)_G (and in particular p(0)_G), by means of the exchanged points p_i(x_j)_G. For higher powers of pⁿ(x)_G, the multinomial formula from the previous section may be utilised:

${\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+\dots +p_m\left(x_j\right)\right]}^n\rangle }_G={\langle \sum _{k_1+k_2+\dots +k_m=n}\left(\begin{array}{c}n\\ k_1,k_2,\dots ,k_m\end{array}\right)\prod _{t=1}^m{p}_t^{k_t}\left(x_j\right)\rangle }_G$

For m=2 this becomes:

${\langle p^n\left(x_j\right)\rangle }_G={\langle {\left[p_1\left(x_j\right)+p_2\left(x_j\right)\right]}^n\rangle }_G={\langle \sum _{k_1+k_2=n}\left(\begin{array}{c}n\\ k_1,k_2\end{array}\right)\prod _{t=1}^2{p}_t^{k_t}\left(x_j\right)\rangle }_G$

After this exchange (following certain, pre-arranged conventions) both parties can calculate pⁿ(x_j)_G and, in particular, pⁿ(0)_G=sⁿ_G.

A protocol according to the process 600 is described hereinbelow. Since each participant needs to be able to obtain expressions of the form

${\langle \left(\begin{array}{c}n\\ k_1,k_2,\dots ,k_m\end{array}\right){\prod }_{t=1}^m{p}_t^{k_t}\left(x_j\right)\rangle }_G$

an ordering may necessary, when exchanging the points. Here we illustrate one such solution.

Without loss of generality, it can be assumed, in accordance with at least one embodiment, that participant 1 is the one submitting the first elliptic curve points. The protocol, in an embodiment, follows the steps:

• • 1. Participant 1 distributes p₁^k1(x_j)_G to all i≠1 participants, where k₁=1, . . . , n and j=1, . . . , m, and where m here is the number of participants;
  • 2. Participant 2 distributes p₁^k1(x_j)p₂^k2(x_j)_G for k₁=0, . . . , n−1, k₂=1, . . . , n and j=1, . . . , m to all i≠2 participants;
  • 3. Participant 3 distributes p₁^k1(x_j)p₂^k2(x_j)p₃^k3(x_j)_G for k₁=0, . . . , n=1, k₂=0, . . . , n−1, k₃=1, . . . , n and j=1, . . . , m to all i≠3 participants; and
  • 4. . . . (and so on, for each participant).

The lth participant in the sequence distributes p₁^k1(x_j) . . . p_l^kl(x_j)_G for k_i=0, . . . , n−1 for i∈{1, . . . , l−1}, k_l=1, . . . , n and j=1, . . . , m to all i≠l. When the last participant, m, distributes his/her points, all the participants have the necessary components to calculate sⁿ_G=pⁿ(0)_G.

In an embodiment, the process 600 comprises a plurality of m participants (e.g., more than 2 participants) that exchange sets of point of the form {p₁^k1(x_j) . . . p_m^km(x_j)_G} wherein the points are used by each participant to calculate p^k(x_j)_G. The participants may then use the p^k(x_j)_G, together with Lagrange interpolation, to obtain p^k(x)_G and, in particular, s^k_G=p^k(0)_G. In an embodiment, the points are elliptic curve points wherein x_j≠0∀j.

FIG. 7 illustrates a simplified block diagram of a computing device 700 that can be used to practice at least one embodiment of the present disclosure.

The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense. However, it will be evident that various modifications and changes may be made thereunto without departing from the scope of the invention as set forth in the claims. Likewise, other variations are within the scope of the present disclosure. Thus, while the disclosed techniques are susceptible to various modifications and alternative constructions, certain illustrated embodiments thereof are shown in the drawings and have been described above in detail. It should be understood, however, that there is no intention to limit the invention to the specific form or forms disclosed but, on the contrary, the intention is to cover all modifications, alternative constructions and equivalents falling within the scope of the invention, as defined in the appended claims.

The use of the term “set” (e.g., “a set of items”) or “subset”, unless otherwise noted or contradicted by context, is to be construed as a nonempty collection comprising one or more members. Further, unless otherwise noted or contradicted by context, the term “subset” of a corresponding set does not necessarily denote a proper subset of the corresponding set, but the subset and the corresponding set may be equal.

Conjunctive language, such as phrases of the form “at least one of A, B, and C”, or “at least one of A, B and C”, unless specifically stated otherwise or otherwise clearly contradicted by context, is otherwise understood with the context as used in general to present that an item, term, etc., could be either A or B or C, or any nonempty subset of the set of A and B and C. For instance, in the illustrative example of a set having three members, the conjunctive phrases “at least one of A, B, and C” and “at least one of A, B and C” refer to any of the following sets: {A}, {B}, {C}, {A, B}, {A, C}, {B, C}, {A, B, C}. Thus, such conjunctive language is not generally intended to imply that certain embodiments require at least one of A, at least one of B and at least one of C each to be present. Further, unless stated otherwise or otherwise clear from context, the phrase “based on” means “based at least in part on” and not “based solely on.”

Operations of processes described can be performed in any suitable order unless otherwise indicated or otherwise clearly contradicted by context. Processes described (or variations and/or combinations thereof) can be performed under the control of one or more computer systems configured with executable instructions and can be implemented as code (e.g., executable instructions, one or more computer programs or one or more applications) executing collectively on one or more processors, by hardware or combinations thereof. In some embodiments, the code can be stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors. In some embodiments, the computer-readable storage medium is non-transitory.

The use of any and all examples, or exemplary language (e.g., “such as”) provided, is intended merely to better illuminate embodiments of the invention and does not pose a limitation on the scope of the invention unless otherwise claimed. No language in the specification should be construed as indicating any non-claimed element as essential to the practice of the invention.

Embodiments of this disclosure are described, including the best mode known to the inventors for carrying out the invention. Variations of those embodiments will become apparent to those of ordinary skill in the art upon reading the foregoing description. The inventors expect skilled artisans to employ such variations as appropriate and the inventors intend for embodiments of the present disclosure to be practiced otherwise than as specifically described. Accordingly, the scope of the present disclosure includes all modifications and equivalents of the subject matter recited in the claims appended hereto as permitted by applicable law. Moreover, any combination of the above-described elements in all possible variations thereof is encompassed by the scope of the present disclosure unless otherwise indicated or otherwise clearly contradicted by context.

All references, including publications, patent applications, and patents, cited are hereby incorporated by reference to the same extent as if each reference were individually and specifically indicated to be incorporated by reference and were set forth in its entirety.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be capable of designing many alternative embodiments without departing from the scope of the invention as defined by the appended claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

1. A computer-implemented method comprising: at each of a plurality of participants, determining a respective polynomial;collectively agreeing, among the plurality of participants, upon a set of points;at each of the plurality of participants, evaluating its respective polynomial in the set of points to obtain a respective plurality of values;at each of the plurality of participants, distributing powers of its respective plurality of values to the other participants, and receiving corresponding powers of values from the other participants;at each of the plurality of participants, using the powers of the values to determine a power of a sum of the respective polynomials of the participants, wherein the power of the sum corresponds to a power of a secret; andcollectively generating, among the plurality of participants and based on the power of the secret, a blockchain transaction.

2. The computer-implemented method according to claim 1, wherein the set of points are a set of elliptic curve points.

3. The computer-implemented method according to claim 1, wherein determining the power of the sum of polynomials is based on a Lagrange interpolation.

4. The computer-implemented method according to claim 1, further comprising determining, based at least in part on the power of the secret, a common reference string that is determinable by the plurality of participants.

5. (canceled)

6. The computer-implemented method according to claim 1, wherein off-chain communications are utilised in the distribution of the powers of the values of the polynomials to the participants.

7. (canceled)

8. The computer-implemented method according to claim 1, wherein the plurality of participants is exactly two participants.

9. The computer-implemented method according to claim 1, wherein the secret is determined based on the power of the sum of polynomials evaluated at a particular point.

10. The computer-implemented method according to claim 9, wherein the particular point is an intersection point.

11. The computer-implemented method according to claim 1, wherein the set of points excludes an intersection point.

12. The computer-implemented method according to claim 1, wherein the polynomials evaluated in the set of points are of at least order 2.

13. The computer-implemented method according to claim 1, wherein each point of the set of points is a different point.

14. A system, comprising: a processor; andmemory including executable instructions that, as a result of execution by the processor, causes the system to perform the computer-implemented method according to claim 1.

15. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by a processor of a computer system, cause the computer system to at least perform the computer-implemented method according to claim 1.

16. A system, comprising: a processor; andmemory including executable instructions that, as a result of execution by the processor, causes the system to perform the computer-implemented method according to claim 4.

17. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by a processor of a computer system, cause the computer system to at least perform the computer-implemented method according to claim 4.