Pointproofs: Aggregating Proofs for Multiple Vector Commitments 学习笔记2

1. 引言

在博客 Pointproofs: Aggregating Proofs for Multiple Vector Commitments 学习笔记1中，主要对 Algorand团队Gorbunov等人2020年论文《Pointproofs: Aggregating Proofs for Multiple Vector Commitments》做了一个总体的梳理。该论文在 Libert和Yung 2010年论文《Concise mercurial vector commitments and independent zero-knowledge sets with short proofs》的基础上，做了以下改进：

• 采用了非对称bilinear pairing group，并针对${\mathbb{G}}_1$域内的运算效率>${\mathbb{G}}_2$>${\mathbb{G}}_T$，对Verify算法做了优化（计算$r=({\sum }_{i\in S}{m}_i{t}_i{)}^{-1}modp$，将${\mathbb{G}}_T$域内的运算转移到${\mathbb{G}}_1$域内）：
  
• 采用Random Oracle Model，基于hash函数$H$引入了随机参数$t_i=H(i,C,S,m[S])$来实现same-commitment aggregation；基于hash函数$H$和$H^{\prime }$引入了随机参数$t_{j,i}=H(i,C_j,S_j,m_j[S_j])$和$t_j^{\prime }=H^{\prime }(j,\{C_j,S_j,m_j[S_j]{\}}_{j\in [l]})$来实现cross-commitment aggregation。

本博客将重点关注：

• proof of correctness/binding for same-commitment aggregation
• proof of correctness/binding for cross-commitment aggregation
• same-commitment aggregation from CDH-like assumption
• weak binding and realization
• cross-commitment aggregation from polynomial commitments
• https://github.com/algorand/pointproofs 代码解析

该论文实现的binding属性是基于AGW+ROM model under the $l$-wBDHE assumption：（详细定义参见博客 Pointproofs: Aggregating Proofs for Multiple Vector Commitments 学习笔记1 1.1节内容）

2. proof of correctness/binding for same-commitment aggregation

2.1 same commitment aggregation

具体的实现为：

• Setup($1^{\lambda },1^N$)：取随机值$\alpha \leftarrow {\mathbb{Z}}_p$，输出：【其中$a=(\alpha ,{\alpha }^2,\cdots ,{\alpha }^N)$】
  $g_1^a=(g_1^{\alpha },\cdots ,g_1^{{\alpha }^N})$
  $g_1^{{\alpha }^{N}a[-1]}=(g_1^{{\alpha }^{N+2}},\cdots ,g_1^{{\alpha }^{2N}})$
  $g_2^a=(g_2^{\alpha },\cdots ,g_2^{{\alpha }^N})$
  $g_T^{{\alpha }^{N+1}}=e(g_1^{\alpha },g_2^{{\alpha }^N})$
  Prove key为：$g_1^a，g_1^{{\alpha }^{N}a[-1]}$
  Verify key为：$g_2^a,g_T^{{\alpha }^{N+1}}$
  而$\alpha$为有毒垃圾，trusted setup后应直接丢弃，must never be known to the adversary。

• Commit($m$) for $m\in {\mathbb{Z}}_p^N$：
  $C=g_1^{m^{T}a}=g_1^{{\sum }_{i\in N}{m}_i{\alpha }^i}$

• UpdateCommit($C,S,m[S],m^{\prime }[S]$)：
  $C^{\prime }=C\cdot g_1^{(m^{\prime }[S]-m[S]{)}^{T}a[S]}=C\cdot g_1^{{\sum }_{i\in S}(m_i^{\prime }-m_i){\alpha }^i}$

• Prove($i,m$)：open第$i$个位置。
  ${\pi }_i=g_1^{{\alpha }^{N+1-i}m[-i{]}^{T}a[-i]}=g_1^{{\sum }_{j\in [N]-\{i\}}{m}_j{\alpha }^{N+1-i+j}}$
  其中$g_1^{{\alpha }^{N+1-i}a[-i]}$均已包含在了Prove key中了。
  若$m_j$ at index $j\ne i$ changes to $m_j^{\prime }$，则${\pi }_i^{\prime }=\pi \cdot g_1^{(m_j^{\prime }-m_j){\alpha }^{N+1-i+j}}$，若$m_i$ changes to $m_i^{\prime }$，则proof 不变${\pi }_i^{\prime }={\pi }_i$。但是两种情况下，commitment $C$均需要更新为$C^{\prime }$。

• Aggregate($C,S,m[S],\{{\pi }_i:i\in S\}$)：
  $\hat{\pi }={\prod }_{i\in S}{\pi }_i^{t_i}$
  其中 $t_i=H(i,C,S,m[S])$

• Verify($C,S,m[S],\hat{\pi }$)：
  验证$e(C,g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}$ 是否成立。
  其中 $t_i=H(i,C,S,m[S])$

2.2 proof of correctness for same-commitment aggregation

对于任意的$i\in [N],{\pi }_i=Prove(i,m)=g_1^{{\alpha }^{N+1-i}m[-i{]}^{T}a[-i]}$，对Commit/Prove/Aggregate/Verify整个流程，可分两步证明：

• 1）证明$e(C,g_2^{{\alpha }^{N+1-i}})=e({\pi }_i,g_2)\cdot g_T^{{\alpha }^{N+1}{m}_i}$
• 2）证明$e(C,g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}$

具体为：
1）有 $m^{T}a=m[-i{]}^{T}a[-i]+{\alpha }^i{m}_i$
等式左右两边同时乘以${\alpha }^{N+1-i}$，有：
$(m^{T}a){\alpha }^{N+1-i}={\alpha }^{N+1-i}m[-i{]}^{T}a[-i]+{\alpha }^{N+1}{m}_i$
转换为pairing计算，有：
$e(g_1^{m^{T}a},g_2^{{\alpha }^{N+1-i}})=e(g_1^{{\alpha }^{N+1-i}m[-i{]}^{T}a[-i]},g_2)\cdot g_T^{{\alpha }^{N+1}{m}_i}$
从而证明了$e(C,g_2^{{\alpha }^{N+1-i}})=e({\pi }_i,g_2)\cdot g_T^{{\alpha }^{N+1}{m}_i}$ 成立。

2）在$e(C,g_2^{{\alpha }^{N+1-i}})=e({\pi }_i,g_2)\cdot g_T^{{\alpha }^{N+1}{m}_i}$的基础上，等式左右两侧均进行$t_i$次幂乘，则有：
$e(C,g_2^{{\alpha }^{N+1-i}{t}_i})=e({\pi }_i^{t_i},g_2)\cdot g_T^{{\alpha }^{N+1}{m}_i{t}_i}$
将要open的$S$集合内的所有公式均乘一块，有（for all $i\in S$）：
$e(C,g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e({\prod }_{i\in S}{\pi }_i^{t_i},g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}$ 成立。

证明UpdateCommit算法正确性的思路为：
$m^{\prime T}a=(m^{\prime }[S]-m[S]{)}^{T}a[S]+m^{T}a$ 等式恒成立。

2.3 proof of binding for same-commitment aggregation

采用归谬法来证明，假设adversary 可计算$C=g_1^{z^{T}a}$，并为$(S,m[S])$提供proof $\hat{\pi }$【其中$m[S]\ne z[S]$】，使得$\hat{\pi }$可被Verify通过。
$e(g_1^{z^{T}a},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{z}_i{t}_i}=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}$

注意adversary也不知道$g_1^{{\alpha }^{N+1}}$，即${\log }_{g_1}\hat{\pi }$ 中 ${\alpha }^{N+1}$ 项的系数应为 $0$。
比较上述等式中$g_T^{{\alpha }^{N+1}}$的系数应满足：
${\sum }_{i\in S}{m}_i{t}_i{\equiv }_p{\sum }_{i\in S}{z}_i{t}_i$
用向量表示，应满足：
$z[S{]}^{T}t{\equiv }_{p}m[S{]}^{T}t$
其中$t=(H(i,C,S,m[S]),i\in S)$

假设当$(S,z[S],m[S])$确定后，$t\leftarrow {\mathbb{Z}}_p^{|S|}$为chosen uniformly at random 时，则有：
${\mathrm{Pr}}_t[z[S]/{\equiv }_{p}m[S]andz[S{]}^{T}t{\equiv }_{p}m[S{]}^{T}t]=1/p$
即相应的概率可忽略。

因此问题的关键在于：ensure the uniform choice of $t$ for any fixed $(S,z[S],m[S])$。
注意有：

• $C$ determines $z$ in AGM；
• $C,S,m[S]$为random oracle $H(i,\cdot ,\cdot ,\cdot )$ 的input，输出为 $t_i$。

若adversary可以找到相应的$m_i\ne z_i$值，使得：
${\sum }_{i\in S}{z}_i{t}_i{\equiv }_p{\sum }_{i\in S}{m}_i{t}_i$
成立，则binding属性不成立。

2.3.1 为何需要将$C,S,m[S]$作为$H$的input？

$t_i=H(i,\cdot ,\cdot ,\cdot )$，为什么需要将$C,S,m[S]$作为$H$的input？

• 若$t_i$与$m_i$无关，则adversary可指定$|S|-1$个$m_i$的值，并根据${\sum }_{i\in S}{z}_i{t}_i{\equiv }_p{\sum }_{i\in S}{m}_i{t}_i$等式计算最后一个$m_i$的值。从而破坏了binding属性。
• 若$t_i=H(i,C)$，Wanger’s attack可产生a $2^{\sqrt{\log p}}$ algorithm that given $\{z_i{t}_i,m_i{t}_i{\}}_{i\in [N]}$，从而计算a set $S$ of size $2^{\sqrt{\log p}}$ 使得 ${\sum }_{i\in S}{z}_i{t}_i{\equiv }_p{\sum }_{i\in S}{m}_i{t}_i$ 等式成立。对于128-bit security level for the curve(如 $\log p\approx 256$)，$2^{\sqrt{\log p}}\approx 2^{16}$，which makes for a very pratical attack。
• 若$t_i=H(i,C,S)$，可能存在与$t_i=H(i,C)$类似的攻击。【It seems plausible that the attack also extends to the setting of $t_i=H(i,C,S)$: it would suffice to extend Wagner’s algorithm to finding values that sum to a given constant, because the values of the elements of S are not committed, and thus, although ${\sum }_{i\in S}{z}_i{t}_i$ is fixed, the attacker can choose from a list of random $m_i$ for each $i\in S$.】

2.3.2 binding for same-commitment aggregation 分析

分为两步来分析：
1）bounding “lucky” queries。
相当于对于固定$C,S,m[S]$，寻找符合要求的$z和y$，满足$C=g_1^{z^{T}a+{\alpha }^N{y}^{T}a[-1]}$，同时满足$m[S]/{\equiv }_{p}z[S]且(m[S]-z[S]{)}^{T}t{\equiv }_{p}0$。若能找到相应的$z和y$，则称为“H-lucky”。

正常open为$\{z_i{\}}_{i\in [S]}$的话，则$e(C,g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(g_1^{z^{T}a},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{z}_i{t}_i}$ 等式是恒成立的。若想作弊open为$\{m_i{\}}_{i\in [S]}，其中m[S]\ne z[S]$的话，则在等式两边都乘以$e(g_1^{{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})$的话，则有：

• 等式左边为：$e(g_1^{z^{T}a},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})\cdot e(g_1^{{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i+{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(C^{\prime },g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})$

• 等式右边为：$e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{z}_i{t}_i}\cdot e(g_1^{{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{z}_i{t}_i}\cdot e(g_1,g_2{)}^{{\alpha }^{N+1}{\sum }_{j\in [N-1]}{y}_j{\alpha }^j\cdot {\sum }_{i\in [S]}{\alpha }^{N+1-i}{t}_i}$
  其中${\sum }_{j\in [N-1]}{y}_j{\alpha }^j\cdot {\sum }_{i\in [S]}{\alpha }^{N+1-i}{t}_i={\sum }_{i\in [S]}(t_i\cdot {\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1-i+j})={\sum }_{i\in [S]}{t}_i{x}_i$，$x_i={\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1-i+j}$。

这样就有$e(C^{\prime },g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{z}_i{t}_i}\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in [S]}{t}_i{x}_i}=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}(z_i+x_i)t_i}=e(\hat{\pi },g_2)\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}$
其中：
$m_i=z_i+x_i=z_i+{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1-i+j}$
$C^{\prime }=g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i+{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}}$
$C=g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i}$

也就是说，若adversary可找到相应的$C^{\prime }$，使得$H(i,C,S,m[S])=H(i,C^{\prime },S,m[S])$成立且$C^{\prime }=g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i+{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}}且C=g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i}$，则可作弊成功。即：
$e(C,g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})=(e(\hat{\pi },g_2)/e(g_1^{{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i}))\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}=e(g_1,{\hat{\pi }}^{\ast })\cdot g_T^{{\alpha }^{N+1}{\sum }_{i\in S}{m}_i{t}_i}$
其中$e(g_1^{{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}},g_2^{{\sum }_{i\in S}{\alpha }^{N+1-i}{t}_i})$ 可根据现有的public parameter计算出来。 【这段话理解有问题，不应在于Hash碰撞，而在于，应该是对于固定$C,S,m[S]$，寻找符合要求的$z和y$，满足$C=g_1^{z^{T}a+{\alpha }^N{y}^{T}a[-1]}$，同时满足$m[S]/{\equiv }_{p}z[S]且(m[S]-z[S]{)}^{T}t{\equiv }_{p}0$。若能找到相应的$z和y$，则称为“H-lucky”。】
从而，对于$C$，adversary可通过提供proof ${\hat{\pi }}^{\ast }$ 作弊成功——将本应为$z[S]$ open 为了 $m[S]$。

由于${\mathrm{Pr}}_t[z[S]/{\equiv }_{p}m[S]andz[S{]}^{T}t{\equiv }_{p}m[S{]}^{T}t]=1/p，其中t=(H(i,C,S,m[S]):i\in S)$，也就是说，对于固定的$(S,m[S],z[S])$，找到相应的$C^{\prime }$使得$H(i,C,S,m[S])=H(i,C^{\prime },S,m[S])$成立，且存在$z\in {\mathbb{Z}}_p^N,y\in {\mathbb{Z}}_p^{N-1}$使得$C^{\prime }=g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i+{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}}，C=g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i}$的概率不高于$1/p$。

By the union bound, the probability that an adversary makes an H-lucky query is at most $q_H/p$, where $q_H$ is the number of queries to $H$. Below, we assume this never happens。

2）若可extracting $g_1^{{\alpha }^{N+1}}$，则可破坏本论文$l$-wBDHE security assumption。

若对于$C=g_1^{z^{T}a+{\alpha }^N{y}^{T}a[-1]}=g_1^{{\sum }_{i\in [N]}{z}_i{\alpha }^i+{\sum }_{j\in [N-1]}{y}_j{\alpha }^{N+1+j}}$，存在$(S^{\ast },m^{\ast },{\hat{\pi }}^{\ast })$ 使得：
$m^{\ast }[S^{\ast }]\ne z[S^{\ast }]且Verify(C,S^{\ast },m^{\ast }[S^{\ast }],{\hat{\pi }}^{\ast })$ 成立。

即有$e(C,g_2^{{\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i})=e({\hat{\pi }}^{\ast },g_2)\cdot g_T^{{\alpha }^{N+1}{m}^{\ast }[S^{\ast }{]}^{T}t}$成立，其中$t_i=H(i,C,S^{\ast },m^{\ast }[S^{\ast }])$。

于是有：$C^{{\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i}={\hat{\pi }}^{\ast }\cdot g_1^{{\alpha }^{N+1}{m}^{\ast }[S^{\ast }{]}^{T}t}$ 成立。

上述等式左侧展开为含$g_1^{{\alpha }^{N+1}}$的项和不含$g_1^{{\alpha }^{N+1}}$的项表示：
$C^{{\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i}=g_1^{(z^{T}a+{\alpha }^N{y}^{T}a[-1])\cdot {\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i}$

The smallest $i$ value is $1$.

(1)
$z^{T}a{\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i={\sum }_{i\in S^{\ast }}{z}^{T}a{\alpha }^{N+1-i}{t}_i={\sum }_{i\in S^{\ast }}(z_i{\alpha }^i+z[-i]a[-i]){\alpha }^{N+1-i}{t}_i={\alpha }^{N+1}{\sum }_{i\in S^{\ast }}{z}_i{t}_i+{\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}z[-i]a[-i]t_i$

其中${\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}z[-i]a[-i]t_i$ depends on $g_1^{\alpha },g_1^{{\alpha }^2},\cdots ,g_1^{{\alpha }^N},g_1^{{\alpha }^{N+2}},\cdots ,g_1^{{\alpha }^{2N}}$。

(2)
${\alpha }^N{y}^{T}a[-1])\cdot {\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i$ depends on $g_1^{{\alpha }^{N+3}},\cdots ,g_1^{{\alpha }^{3N}}$.

For :
$C^{{\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i}={\hat{\pi }}^{\ast }\cdot g_1^{{\alpha }^{N+1}{m}^{\ast }[S^{\ast }{]}^{T}t}$

Then:
$(g_1^{{\sum }_{i\in S^{\ast },j\in S^{\ast },i\ne j}{z}_j{t}_i{\alpha }^{N+1-i+j}})\cdot (g_1^{z[-S^{\ast }{]}^{T}a[-S^{\ast }]\cdot {\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i})\cdot (g_1^{{\alpha }^N{y}^{T}a[-1])\cdot {\sum }_{i\in S^{\ast }}{\alpha }^{N+1-i}{t}_i})\cdot ({\hat{\pi }}^{\ast }{)}^{-1}=g_1^{{\alpha }^{N+1}{\sum }_{i\in S^{\ast }}(m_i-z_i)t_i}$ …<1>

当不存在H-lucky queries，且adversary可成功将$z[S^{\ast }]$ open 为不同的$m[S^{\ast }]$，则该adversary亦可根据上述公式成功计算等式右侧的$g_1^{{\alpha }^{N+1}}$值。
因为：
$z[S^{\ast }]\ne m[S^{\ast }]$
所以：
${\sum }_{i\in S^{\ast }}(m_i-z_i)t_i/{\equiv }_{p}0$
令：
$r=1/({\sum }_{i\in S^{\ast }}(m_i-z_i)t_i)\mathrm{m}\mathrm{o}\mathrm{d}p$
公式<1>左右两侧同时进行$r$幂乘即可求得$g_1^{{\alpha }^{N+1}}$值。

$\Rightarrow$ The winning algebraic adversary can be used to compute $g_1^{{\alpha }^{N+1}}$, CONTRADICTING $l$-wBDHE.

3. proof of correctness/binding for cross-commitment aggregation

3.1 cross commitment aggregation

Aggregation of proofs across $l$ commitments，在2.1 same commitment aggregation算法的基础上，增加了AggregateAcross和VerifyAcross算法，具体的实现为：

• AggregateAcross($\{C_j,S_j,m_j[S_j],{\hat{\pi }}_j{\}}_{j\in [l]}$)：
  $\pi ={\prod }_{j=1}^l{\hat{\pi }}_j^{t_j^{\prime }}$
  其中：
  $t_j’=H’(j,\{C_j,S_j,m_j[S_j]{\}}_{j\in [l]})$

• VerifyAcross($\{C_j,S_j,m_j$