零知识证明论文阅读—Blockchain-Assisted Transparent Cross-Domain Authorization and Authentication for Smart City
System Model
系统由五类实体组成：Identity committee members (ICMs), Identity issuers (IIs), Identity holders (IHs), Identity verifiers (IVs), Identity auditor (IA)。详细的介绍可以阅读这篇论文 Blockchain-Assisted Transparent Cross-Domain Authorization and Authentication for Smart City
Service Entity Registration
Identity Issuers Registration
在此阶段, identity issuers, identity verifiers, 和 identity auitor 将会在系统生成私钥，发布公钥
每一个 identity issuers, I I i ∈ { I I 1 , I I 2 , . . . , } II_i \in \{II_1,II_2,...,\} IIi∈{II1,II2,...,}，选取 K i + 3 K_i + 3 Ki+3 个随机数 ( x i , y i 0 , y i 1 , . . . , y i K i , z i ) ∈ Z p K i + 3 (x_i,y_{i0},y_{i1},...,y_{iK_i},z_i) \in Z_p^{K_i+3} (xi,yi0,yi1,...,yiKi,zi)∈ZpKi+3，其中 K i K_i Ki 是身份属性类别的最大值（最多有多少个身份属性类别）。
Identity issuers 生成公私钥对 ( p k i ′ , s k i ′ ) (pk_i',sk_i') (pki′,ski′)，其中
p k i ′ = ( Y i 0 = g 1 y i 0 , Y i 1 = g 1 y i 1 , . . . , Y i K i = g 1 y i K i , Z i = g 1 z i , X i ′ = g 2 x i , Y i 0 ′ = g 2 y i o , Y i 1 ′ = g 2 y i 1 , . . . , Y i K i ′ = g 2 y i K i , Z i ′ = g 2 z i ) pk_i' = (Y_{i0} = g_1^{y_{i0}},Y_{i1} = g_1^{y_{i1}},...,Y_{iK_i} = g_1^{y_{iK_i}},Z_i = g_1^{z_i},X_i' = g_2^{x_i},Y_{i0}'=g_2^{y_{io}},Y_{i1}'=g_2^{y_{i1}},...,Y_{iK_i}'=g_2^{y_{i}K_i},Z_i'=g_2^{z_i}) pki′=(Yi0=g1yi0,Yi1=g1yi1,...,YiKi=g1yiKi,Zi=g1zi,Xi′=g2xi,Yi0′=g2yio,Yi1′=g2yi1,...,YiKi′=g2yiKi,Zi′=g2zi)
User Registration and Credential Authorization
用户注册和凭证授权阶段，identity holder 或者是 user，可以向某个 identity issuers 注册自己的身份凭证。
identity holder 选择一个随机数
t
i
∈
Z
p
∗
t_i \in Z_p^*
ti∈Zp∗，选择一个唯一序列号
u
i
∈
Z
p
∗
u_i \in Z_p^*
ui∈Zp∗，计算承诺
C
o
m
i
=
g
1
t
i
Y
i
0
u
i
∏
j
=
1
K
i
Y
i
j
a
i
j
Com_i = g_1^{t_i} Y_{i0}^{u_i}\prod_{j=1}^{K_i} Y_{ij}^{a_{ij}}
Comi=g1tiYi0uij=1∏KiYijaij
其中，
a
i
j
a_{ij}
aij 是用户的属性值，
j
j
j 是属性类别标号
(
1
,
K
i
)
(1,K_i)
(1,Ki)，
a
t
t
r
s
i
=
(
a
i
1
,
a
i
2
,
.
.
.
,
a
i
K
i
)
attrs_i = (a_{i1},a_{i2},...,a_{iK_i})
attrsi=(ai1,ai2,...,aiKi)，如果 identity holder 不持有该属性类别，可以将该属性类别值设置为
0
0
0。后续，holder 发送
(
C
o
m
i
,
a
t
t
r
s
i
,
π
C
o
m
i
)
(Com_i, attrs_i, \pi_{Com_i})
(Comi,attrsi,πComi) 给 identity issuer。
Identity issuer 为用户生成一个唯一的身份标识符 U I D i = H ( p k i ′ ∥ t s ∥ i n d ) UID_i = H(pk_i'\parallel ts \parallel ind) UIDi=H(pki′∥ts∥ind)， t s ts ts 是时间戳， I n d Ind Ind 是注册用户的索引值。选择一个随机数 v i v_i vi ，计算 σ i ′ = ( σ i 1 ′ = g 1 v i , σ i 2 ′ = ( X i ⋅ C o m i ⋅ Z i U I D i ) v i ) \sigma_i' = (\sigma_{i1}' = g_1^{v_i},\sigma_{i2}' = (X_i\cdot Com_i\cdot Z_i^{UID_i})^{v_i}) σi′=(σi1′=g1vi,σi2′=(Xi⋅Comi⋅ZiUIDi)vi)，返回 ( σ i ′ , U I D i ) (\sigma_i',UID_i) (σi′,UIDi) 给 holder。
Identity issuer unblinds
σ
i
=
(
σ
i
1
=
g
1
v
i
,
σ
i
2
=
σ
i
2
′
/
σ
i
1
′
)
\sigma_i = (\sigma_{i1} = g_1^{v_i},\sigma_{i2} = \sigma_{i2}'/\sigma_{i1}')
σi=(σi1=g1vi,σi2=σi2′/σi1′)，验证：
e
(
σ
i
1
,
X
i
′
)
⋅
e
(
σ
i
1
,
Y
i
0
′
)
u
i
⋅
∏
j
=
1
K
i
e
(
σ
i
1
,
Y
i
j
′
a
i
j
)
⋅
e
(
σ
i
1
,
Z
i
′
)
U
I
D
i
=
e
(
σ
i
2
,
g
2
)
e(\sigma_{i1},X_i') \cdot e(\sigma_{i1},Y_{i0}')^{u_i}\cdot \prod_{j=1}^{K_i}e(\sigma_{i1},Y_{ij}'^{a_{ij}})\cdot e(\sigma_{i1},Z_i')^{UID_i}= e(\sigma_{i2},g_2)
e(σi1,Xi′)⋅e(σi1,Yi0′)ui⋅j=1∏Kie(σi1,Yij′aij)⋅e(σi1,Zi′)UIDi=e(σi2,g2)
推导：
σ
i
1
′
=
g
1
v
i
,
σ
i
2
′
=
(
g
1
x
i
⋅
g
1
t
i
g
1
y
i
0
u
i
⋅
∏
j
=
1
K
i
g
1
y
i
j
a
i
j
⋅
g
1
z
i
⋅
U
I
D
i
)
v
i
\sigma_{i1}' = g_1^{v_i}, \sigma_{i2}' = (g_1^{x_i} \cdot g_1^{t_i}g_1^{y_{i0}u_i}\cdot \prod_{j=1}^{K_i}g_1^{y_{ij}a_{ij}}\cdot g_1^{z_i \cdot UID_i})^{v_i}
σi1′=g1vi,σi2′=(g1xi⋅g1tig1yi0ui⋅j=1∏Kig1yijaij⋅g1zi⋅UIDi)vi
解密后的
(
σ
i
1
,
σ
i
2
)
(\sigma_{i1},\sigma_{i2})
(σi1,σi2)：
σ
i
1
=
g
1
v
i
,
σ
i
2
=
σ
i
2
′
σ
i
1
t
i
=
(
g
1
x
i
⋅
g
1
t
i
g
1
y
i
0
u
i
⋅
∏
j
=
1
K
i
g
1
y
i
j
a
i
j
⋅
g
1
z
i
⋅
U
I
D
i
)
v
i
g
1
v
i
t
i
=
(
g
1
x
i
⋅
g
1
y
i
0
u
i
⋅
∏
j
=
1
K
i
g
1
y
i
j
a
i
j
⋅
g
1
z
i
⋅
U
I
D
i
)
v
i
\sigma_{i1} = g_1^{v_i}, \sigma_{i2} = \frac{\sigma_{i2}'}{\sigma_{i1}^{t_i}}= \frac{(g_1^{x_i} \cdot g_1^{t_i}g_1^{y_{i0}u_i}\cdot \prod_{j=1}^{K_i}g_1^{y_{ij}a_{ij}}\cdot g_1^{z_i \cdot UID_i})^{v_i}}{g_1^{v_it_i}}= (g_1^{x_i} \cdot g_1^{y_{i0}u_i}\cdot \prod_{j=1}^{K_i}g_1^{y_{ij}a_{ij}}\cdot g_1^{z_i \cdot UID_i})^{v_i}
σi1=g1vi,σi2=σi1tiσi2′=g1viti(g1xi⋅g1tig1yi0ui⋅∏j=1Kig1yijaij⋅g1zi⋅UIDi)vi=(g1xi⋅g1yi0ui⋅j=1∏Kig1yijaij⋅g1zi⋅UIDi)vi
验证的等式展开：
e
(
g
1
v
i
,
g
2
x
i
)
⋅
e
(
g
1
v
i
,
g
2
y
i
0
)
u
i
⋅
∏
j
=
1
K
i
e
(
g
1
v
i
,
g
2
y
i
j
)
a
i
j
⋅
e
(
g
1
v
i
,
g
2
z
i
)
U
I
D
i
=
e
(
σ
i
2
,
g
2
)
e(g_1^{v_i},g_2^{x_i})\cdot e(g_1^{v_i},g_2^{y_{i0}})^{u_i}\cdot \prod_{j=1}^{K_i} e(g_1^{v_i},g_2^{y_{ij}})^{a_{ij}}\cdot e(g_1^{v_i},g_2^{z_i})^{UID_i} = e(\sigma_{i2},g_2)
e(g1vi,g2xi)⋅e(g1vi,g2yi0)ui⋅j=1∏Kie(g1vi,g2yij)aij⋅e(g1vi,g2zi)UIDi=e(σi2,g2)
那么身份颁发者
I
I
i
II_i
IIi 给用户的颁发的凭证是
C
r
e
d
i
=
(
u
i
,
U
I
D
i
,
a
t
t
r
s
i
,
σ
i
)
Cred_{i} = (u_i,UID_i,attrs_i,\sigma_i)
Credi=(ui,UIDi,attrsi,σi)
Authentication Policy Generation
一个 Identity verifier 可能需要认证不同属性 ( A 11 , A 22 , . . . , ) (A_{11},A_{22},...,) (A11,A22,...,) 满足某个身份策略 P = ( A 11 ∧ A 21 ) ∨ A 31 ∧ . . . ) P = (A_{11} \wedge A_{21}) \vee A_{31} \wedge ...) P=(A11∧A21)∨A31∧...)。此外， ( A 11 , A 21 , . . . , ) (A_{11},A_{21},...,) (A11,A21,...,) 可能属于不同的身份属性 A T T R s = ( Λ 1 , Λ 2 , . . . , ) ATTRs = (\Lambda _1,\Lambda _2,...,) ATTRs=(Λ1,Λ2,...,)，其中 A 11 ∈ Λ 1 ， A 21 ∈ Λ 2 A_{11} \in \Lambda_1，A_{21} \in \Lambda_2 A11∈Λ1，A21∈Λ2。
在我们的框架中，一个认证策略 P P P 被加密成一个认证策略列表，这个策略列表中充满了 ( P 1 , P 2 , . . . , P K ′ ) (P_1,P_2,...,P_{K'}) (P1,P2,...,PK′)，K’ 是策略列表中所有策略的个数（其实是一个认证策略被加密成一个策略列表，然后列表中由 K’ 个策略，属性只要匹配到一个策略就匹认证成功）。对于每一个属性类别，都分配一个假属性 ρ j \rho_j ρj。为了压缩认证策略的存储成本和确保认证策略的机密性，我们使用 Elgamal 加密来聚合和加密创建一个隐藏的认证策略。
Identity verifier 首先为认证策略计算加密基
B
B
B。这个加密基可以被任何 Identity holder 使用根据认证策略生成加密属性。Identity verifier 选择两个随机数
β
∈
Z
p
∗
\beta \in Z_p^*
β∈Zp∗ 和
γ
∈
Z
p
∗
\gamma \in Z_p^*
γ∈Zp∗ 并且计算：
B
=
(
B
0
,
B
1
)
=
(
g
1
β
,
s
p
k
β
⋅
g
1
γ
)
=
(
g
1
β
,
g
1
s
β
+
γ
)
B = (B_0,B_1)= (g_1^\beta,spk^\beta\cdot g_1^\gamma)=(g_1^{\beta},g_1^{s\beta+\gamma})
B=(B0,B1)=(g1β,spkβ⋅g1γ)=(g1β,g1sβ+γ)
之后，为了加密认证策略列表中的一个策略
P
k
=
(
A
11
,
A
21
,
.
.
.
,
)
P_k = (A_{11},A_{21},...,)
Pk=(A11,A21,...,)，
k
=
1
,
2
,
.
.
,
K
′
k = 1,2,..,K'
k=1,2,..,K′，Identity Verifier 聚合身份策略为：
Ξ
k
=
∑
A
∈
P
k
A
=
A
11
+
A
21
+
\Xi_k = \sum_{A\in P_k} A=A_{11}+A_{21}+
Ξk=∑A∈PkA=A11+A21+，选择一个随机数
η
k
∈
Z
p
∗
\eta_k \in Z_p^*
ηk∈Zp∗ ，并且加密这个认证策略：
C
k
=
E
n
c
(
P
k
)
=
E
n
c
(
Ξ
k
)
=
(
C
k
0
,
C
k
1
)
=
(
B
0
Ξ
k
⋅
g
1
η
k
,
B
1
Ξ
k
⋅
s
p
k
η
k
)
=
(
g
1
α
k
,
s
p
k
α
k
⋅
g
1
γ
Ξ
k
)
C_k = Enc(P_k)=Enc(\Xi_k)=(C_{k0},C_{k1})=(B_0^{\Xi_k}\cdot g_1^{\eta_k}, B_1^{\Xi_k}\cdot spk^{\eta_k}) = (g_1^{\alpha_k},spk^{\alpha_k}\cdot g_1^{\gamma\Xi_k})
Ck=Enc(Pk)=Enc(Ξk)=(Ck0,Ck1)=(B0Ξk⋅g1ηk,B1Ξk⋅spkηk)=(g1αk,spkαk⋅g1γΞk)
展开：
C
k
0
=
g
1
β
Ξ
k
+
η
k
=
g
1
α
k
,
C
k
1
=
g
1
(
s
β
+
γ
)
Ξ
k
+
s
η
k
=
g
1
s
β
Ξ
k
+
γ
Ξ
k
+
s
η
k
=
g
1
s
(
β
Ξ
K
+
η
k
)
+
γ
Ξ
k
=
s
p
k
α
k
⋅
g
1
γ
Ξ
k
C_{k0} = g_1^{\beta\Xi_k+\eta_k}=g_1^{\alpha_k},C_{k_1}=g_1^{(s\beta+\gamma)\Xi_k+s\eta_k}=g_1^{s\beta\Xi_k+\gamma\Xi_k+s\eta_k}=g_1^{s(\beta\Xi_K+\eta_k)+\gamma\Xi_k}=spk^{\alpha_k}\cdot g_1^{\gamma\Xi_k}
Ck0=g1βΞk+ηk=g1αk,Ck1=g1(sβ+γ)Ξk+sηk=g1sβΞk+γΞk+sηk=g1s(βΞK+ηk)+γΞk=spkαk⋅g1γΞk
Identity verifier 使用加密基
B
B
B，对每个认证策略
P
k
=
(
A
11
,
A
21
,
.
.
.
,
)
P_k = (A_{11},A_{21},...,)
Pk=(A11,A21,...,)加密，对
P
k
P_k
Pk 加密得到
C
k
，
k
=
1
,
.
.
.
,
K
′
C_k，k = 1,...,K'
Ck，k=1,...,K′，最终得到
C
=
(
C
1
,
C
2
,
.
.
.
,
C
k
′
)
C=(C_1,C_2,...,C_k')
C=(C1,C2,...,Ck′)
On-Chain Authentication
Request Generation
Identity holders 使用身份凭证 C r e d i Cred_i Credi 和身份属性 a t t r i attr_i attri，生成链上认证请求。
加密身份属性
a
t
t
r
i
=
(
a
i
1
,
a
i
2
,
.
.
.
,
a
i
K
i
)
→
a
t
t
r
i
′
=
(
U
i
1
,
U
i
2
,
.
.
.
,
U
i
K
i
)
attr_i = (a_{i1},a_{i2},...,a_{iK_i}) \rightarrow attr_i' = (U_{i1},U_{i2},...,U_{iK_i})
attri=(ai1,ai2,...,aiKi)→attri′=(Ui1,Ui2,...,UiKi)
加密过程为使用随机数
ϵ
\epsilon
ϵ 和基元
B
B
B 加密，得到：
U
i
j
=
(
U
i
j
0
,
U
i
j
1
)
=
(
B
0
ϵ
a
i
j
⋅
g
1
r
j
,
B
1
ϵ
a
i
j
⋅
s
p
k
r
j
)
=
(
g
1
β
ϵ
a
i
j
+
r
j
,
g
1
(
s
β
+
γ
)
ϵ
a
i
j
⋅
g
1
s
r
j
)
=
(
g
1
β
ϵ
a
i
j
+
r
j
,
g
1
s
β
ϵ
a
i
j
+
γ
ϵ
a
i
j
+
s
r
j
)
=
(
g
1
β
ϵ
a
i
j
+
r
j
,
g
1
γ
ϵ
a
i
j
s
p
k
β
ϵ
a
i
j
+
r
j
)
U_{ij} = (U_{ij0},U_{ij1})=(B_{0}^{\epsilon a_{ij}}\cdot g_1^{r_j},B_{1}^{\epsilon a_{ij}}\cdot spk^{r_j})=(g_1^{\beta \epsilon a_{ij}+r_j},g_1^{(s\beta+\gamma)\epsilon a_{ij}}\cdot g_1^{sr_{j}})=(g_1^{\beta \epsilon a_{ij}+r_j},g_1^{s\beta\epsilon a_{ij}+\gamma\epsilon a_{ij}+sr_{j}})=(g_1^{\beta \epsilon a_{ij}+r_j},g_1^{\gamma\epsilon a_{ij}}spk^{\beta\epsilon a_{ij}+r_{j}})
Uij=(Uij0,Uij1)=(B0ϵaij⋅g1rj,B1ϵaij⋅spkrj)=(g1βϵaij+rj,g1(sβ+γ)ϵaij⋅g1srj)=(g1βϵaij+rj,g1sβϵaij+γϵaij+srj)=(g1βϵaij+rj,g1γϵaijspkβϵaij+rj)
聚合加密属性
U
i
j
U_{ij}
Uij 得到
W
i
W_{i}
Wi，
j
=
1
,
.
.
.
,
K
i
j = 1,...,K_i
j=1,...,Ki
W
i
=
(
W
i
0
,
W
i
1
)
=
(
∏
j
=
1
K
i
U
i
j
0
,
∏
j
=
1
K
i
U
i
j
1
)
=
(
g
1
∑
j
=
1
K
i
(
β
ϵ
a
i
j
+
r
j
)
,
g
1
s
β
ϵ
a
i
j
+
γ
ϵ
a
i
j
+
s
r
j
)
=
(
g
1
β
ϵ
a
i
j
+
r
j
,
g
1
γ
ϵ
∑
j
=
1
K
i
a
i
j
s
p
k
∑
j
=
1
K
i
(
β
ϵ
a
i
j
+
r
j
)
)
W_i = (W_{i0},W_{i1})=(\prod_{j=1}^{K_i}U_{ij0},\prod_{j=1}^{K_i}U_{ij1})=(g_1^{\sum_{j=1}^{K_i}(\beta\epsilon a_{ij}+r_j)},g_1^{s\beta\epsilon a_{ij}+\gamma\epsilon a_{ij}+sr_{j}})=(g_1^{\beta \epsilon a_{ij}+r_j},g_1^{\gamma\epsilon \sum_{j=1}^{K_i}a_{ij}}spk^{\sum_{j=1}^{K_i}(\beta\epsilon a_{ij}+r_{j})})
Wi=(Wi0,Wi1)=(j=1∏KiUij0,j=1∏KiUij1)=(g1∑j=1Ki(βϵaij+rj),g1sβϵaij+γϵaij+srj)=(g1βϵaij+rj,g1γϵ∑j=1Kiaijspk∑j=1Ki(βϵaij+rj))
C
′
C'
C′ 是被随机化和加密后的认证策略，同样也是由随机数
ϵ
\epsilon
ϵ 随机化，其中：
C
k
′
=
(
C
k
0
′
,
C
k
1
′
)
=
(
C
k
0
−
ϵ
,
C
k
1
−
ϵ
)
=
(
g
1
−
ϵ
α
k
,
s
p
k
−
ϵ
α
k
⋅
g
1
−
ϵ
γ
Ξ
k
)
C_k' = (C_{k0}',C_{k1}')=(C_{k0}^{-\epsilon},C_{k1}^{-\epsilon})=(g_1^{-\epsilon \alpha_k},spk^{-\epsilon\alpha_k}\cdot g_1^{-\epsilon \gamma \Xi_k})
Ck′=(Ck0′,Ck1′)=(Ck0−ϵ,Ck1−ϵ)=(g1−ϵαk,spk−ϵαk⋅g1−ϵγΞk)
加密身份属性和认证策略，得到
V
V
V，可以在不需要解密
V
V
V 的情况下匹配结果：
V
k
=
(
V
k
0
,
V
k
1
)
=
(
W
i
0
⋅
C
k
0
′
,
W
i
1
⋅
C
k
1
′
)
V_k =(V_{k0},V_{k1})=(W_{i0}\cdot C_{k0}',W_{i1}\cdot C_{k1}')
Vk=(Vk0,Vk1)=(Wi0⋅Ck0′,Wi1⋅Ck1′)
V
k
0
=
g
1
∑
j
=
1
K
i
(
β
ϵ
a
i
j
+
r
j
)
−
ϵ
α
k
;
V
k
1
=
g
1
γ
ϵ
∑
j
=
1
K
i
a
i
j
−
ϵ
γ
Ξ
k
s
p
k
∑
j
=
1
K
i
(
β
ϵ
a
i
j
+
r
j
−
ϵ
α
k
)
)
V_{k0} = g_1^{\sum_{j=1}^{K_i}(\beta\epsilon a_{ij}+r_j)-\epsilon \alpha_k};V_{k1}=g_1^{\gamma\epsilon \sum_{j=1}^{K_i}a_{ij}-\epsilon\gamma\Xi_k}spk^{\sum_{j=1}^{K_i}(\beta\epsilon a_{ij}+r_{j}-\epsilon \alpha_k)})
Vk0=g1∑j=1Ki(βϵaij+rj)−ϵαk;Vk1=g1γϵ∑j=1Kiaij−ϵγΞkspk∑j=1Ki(βϵaij+rj−ϵαk))
总共有 K’ 个匹配结果。如果 holder 身份属性匹配到了身份策略，那么至少会有 1 个对应的匹配结果，例如，明文状态下是
γ
ϵ
∑
j
=
1
K
i
a
i
j
−
ϵ
γ
Ξ
k
=
0
\gamma\epsilon \sum_{j=1}^{K_i}a_{ij}-\epsilon\gamma\Xi_k = 0
γϵ∑j=1Kiaij−ϵγΞk=0，密文情况是
g
1
0
=
1
G
1
g_1^{0}=1^{G_1}
g10=1G1。此外，为了保证更高的安全性，我们使用随机因子
θ
k
\theta_k
θk 来洗牌加密
V
V
V。
V
k
=
(
V
k
0
,
V
k
1
)
=
(
Ψ
(
V
k
0
⋅
g
1
θ
k
)
,
Ψ
(
V
k
1
⋅
s
p
k
θ
k
)
)
V_k =(V_{k0},V_{k1})=(\Psi(V_{k0}\cdot g_1^{\theta_k}),\Psi(V_{k1}\cdot spk^{\theta_k}))
Vk=(Vk0,Vk1)=(Ψ(Vk0⋅g1θk),Ψ(Vk1⋅spkθk))
之后生成一个零知识证明，该证明声明了五个属性：
- Identity holder 拥有一个有效的身份凭证 C r e d i Cred_i Credi，属性 a t t r i attr_i attri，并且是由一个有效的 Identity issuers 颁发;
- 身份凭证没有被有效的 issuers 撤销;
- 属性被加密成 Elgamal 密文 a t t r i ′ attr_i' attri′;
- 匹配算法通过 Identity verifier 的认证策略正确匹配了 holder 的属性， C ′ , V ′ C',V' C′,V′ 这些中间结果也是被正确生成的;
- 真实身份可以被 auditor 正确追踪审计;
Request Verification
系统初始化过程中，有 N N N 个 Identity committee members { I C M 1 , I C M 2 , . . . , I C M N } \{ICM_1,ICM_2,...,ICM_N\} {ICM1,ICM2,...,ICMN}，每个委员共享私钥 s k i ∈ Z p ∗ sk_i \in Z_p^* ski∈Zp∗，生成公钥 s p k = g 1 s spk = g_1^s spk=g1s，多项式为 s k i = f ( i ) = s + ∑ j = 1 T − 1 c o f f j ⋅ ( i ) j sk_i = f(i) = s + \sum_{j=1}^{T-1} coff_j \cdot (i)^j ski=f(i)=s+∑j=1T−1coffj⋅(i)j mod p。并且每个委员生成 auxiliary 信息， a u x i = g s k i aux_i = g^{sk_i} auxi=gski。文章来源：https://www.toymoban.com/news/detail-792990.html
Identity committee members 验证 holder 产生的证明，如果验证通过，则计算（对验证结果的一个背书）：
T
i
k
=
e
(
V
k
0
′
,
H
2
(
s
p
k
∣
∣
t
s
)
)
s
k
i
T_{ik} = e(V_{k0}',H_2(spk||ts))^{sk_i}
Tik=e(Vk0′,H2(spk∣∣ts))ski
其中，
i
i
i 是第几个委员，
i
∈
1
,
.
.
.
,
N
i \in 1,...,N
i∈1,...,N，
k
∈
1
,
.
.
.
,
K
′
k \in 1,...,K'
k∈1,...,K′。后续，Identity committee members 进行投票，如果通过，合约会为其生成一个临时链上访问令牌
Δ
\Delta
Δ。文章来源地址https://www.toymoban.com/news/detail-792990.html
到了这里，关于零知识证明论文阅读---Blockchain-Assisted Transparent Cross-Domain Authorization and Authentication for Smart的文章就介绍完了。如果您还想了解更多内容，请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章，希望大家以后多多支持TOY模板网！
![[论文阅读]CWD——基于稠密预测的通道式知识蒸馏](https://imgs.yssmx.com/Uploads/2024/02/793482-1.png)
