Non-Malleable Clause Samples

Non-Malleable. Compact, Multi-Party Range Proofs from Bulletproofs‌ We propose a Logarithmic-sized, Non-Malleable, Non-Interactive, Multi-Party Bulletproof Range Proof scheme with an updated version of improved inner product argument. The improved inner product argument [38, 50] can securely convince a verifer given (h, g, P = hl · gr, πIP) that the prover knows (l, r). The fascinating property of IP is it compresses 2|l| elements of (l, r) to πIP which only has two Zp components and 2 log2 |l| G components (prefer [72] for additional details). The proposed Non-Malleable MBP only uses strong Fiat Shamir challenges derived from a hash function giving the commitment as an input. The strong Fiat Shamir challenges guarantee non-malleability of RP and IP, making unique challenges for the particular commitment. Here, ki is the partial key belong the ith party and v is the coin amount of asset Cv,Σ k. MBP allows n parties to generate range proofs for coin amounts in range [0, 2l − 1] without sharing their partial keys with the combiner (prefer [50] for notations. However, we interchange variable symbols g with h and h with g). RP.Set(λ): return pp = (G, g, h, g, h, u, p) // when a group G = ⟨g⟩, ⟨h⟩, ⟨u⟩ of prime order p ∈ {0, 1}λ and g, h, and u are DL problem hard (NUMS points). g and h are generator vectors of G where |g| = |h| = l and Vpp = [0, 2l − 1]. RP.Prv(pp, C = Cv,Σ k, v, k, n): if n = empty : n := |k| // The combiner (the dealer) starts the function. aL ∈ {0, 1}l : ⟨aL, 2l⟩ = v, aR := aL − 1l $ $ sL, sR ←− Zl , (α, ρ) ←− Zp, A ← gαhaL gaR , S ← gρhsL gsR y ← H(C, A, S), z ← H(C, A, S, y) L(X) := (aL − z · 1l) + sL · X, R(X) := yl · (aR + z · 1l + sR · X) + z2 · 2l t(X) := ⟨L(X), R(X)⟩ = t0 + t1 · X + t2 · X2 gt1 = {}, gt2 = {} for i ∈ [1, n] do // The combiner requests gτ1,i, gτ2,i from each co-prover i. τ1,i , τ2,i ←− Z2 // Each co-prover i shares gτ1,i, gτ2,i with the combiner j. $