Partnered With:

Cryptography principle and application in blockchain privacy computing

Read this article in 66 Minutes

If data rights are the consensus, privacy technologies will be the foundation of all applications at the top.

The principle and Application of cryptography in blockchain Privacy Computing

RealAlitta, DaPangDun, ViewDAO

One, the introduction

Since the research needs to look at various privacy projects, from anonymous currency to independent public chain of programmable privacy, from software-based to solutions combining software and hardware, we can clearly see that relevant technical solutions are constantly iterating with the development of privacy.

(Personal understanding of programmable privacy: Privacy public chain will be used to solve the privacy problems of various algorithms and solutions in a modular form to provide developers, developers can easily call directly)

Found in understanding the process of project, involved in all kinds of algorithm is name, term, complicated relationship, before thinking about joining chain block industry experience in AI algorithms, most of the foreign algorithm also has to understand, after decided to combine block chain and privacy involves the key technology and main program to do a systematic carding of the project, open the black box of privacy technology.

Considering that there are many relevant technical theories, some information cannot be determined from official documents or publicly available resources on the Internet. I have explained and reasoned with this part of the content based on my own understanding. Therefore, it is inevitable that there will be mistakes or omissions.

Second, the directory

This article will mainly be introduced from the technical level, including the following parts:

Why does blockchain need privacy technology?

What are the main issues to be solved with blockchain + privacy?

3. What are the tools currently available in blockchain to address privacy issues?

What tools do major privacy projects use to solve privacy problems?

Iii. Specific content & NBSP;

Why does blockchain need privacy technology?

1.1 Confirmation of personal data in the Web3.0 era

Privacy protection is the core technology for users to determine the ownership of data (user data: Refers to all kinds of data generated by users on the chain). At present, almost all the data of the public chain are completely open to the outside world, and teams with strong technology and capital (such as Nansen and Footprint, etc.) will benefit from analyzing and processing the data on the chain, which is similar to the monopoly mode of giant in the Web2.0 era. The giants get the bulk of the revenue, and the users who generate the data get next to nothing.

Privacy protection adds the switch of whether users need to open their metadata to the outside world, which is controlled by users. Users can choose whether to open their metadata and whether to open data to the outside world and data demanders through charging.

1.2 Make personal data more secure

Privacy protection can better avoid the loss of user data by hacker attack, especially in the current era of continuous development of psychological engineering, the demand for privacy protection is getting higher and higher.

1.3 Prevent information asymmetry from being used

Privacy protections prevent a jump start, such as a sandwich trade, from knowing who is trading and what is being traded.

2. What are the main issues of blockchain + privacy that need to be solved?

The blockchain containing privacy function is the combination of blockchain technology and privacy technology, so we need to first understand where the blockchain needs to use privacy.

2.1 block chain

Blockchain is a decentralized, distributed ledger that records transactions, and a transaction has two parts:

1 two identities (both sides of the transaction) : we need to confirm the identity, specifically, to confirm whether a user (address) has access to some coins in the account book;

2. A set of amounts: We need to confirm whether the balance of the account is enough to cover the current transaction (for checking whether the amount of coins spent is less than or equal to the amount of coins in the account); At the same time, we also need to check whether the same coin is used twice, that is, whether there is a double spending problem (the same coin is transferred to different people, and then the transaction information is sent to different nodes for verification).

2.2 Major privacy issues

Privacy issues, therefore, can be subdivided into four categories:

1. Sender privacy;

2. privacy of receiver;

3. Account balance privacy;

4 Privacy of transaction content.

3. What are the tools currently available in blockchain to solve privacy problems?

The tools used to address privacy in the blockchain space fall into two broad categories:

Pure software approach: a series of cryptographic algorithms based on mathematical puzzles

2. The combination of soft and hard: the combination of cryptography algorithm and TEE(Trusted Execution Environment) Environment

Software level

Mainly the category of cryptography, which can be divided into:

1. Cryptographic prototype

2 Cryptanalysis

3 Symmetric encryption

4 Asymmetric encryption

5 Password Protocol

Classification of common cryptography

3.1 Password Analysis

Cryptanalysis is to crack encrypted information. The decomposition of large prime numbers and discrete logarithm in the prototype of cryptography are the number theory basis of symmetric encryption, asymmetric encryption and cryptographic protocols. The following three categories of specific applications of cryptography are mainly introduced: symmetric encryption, asymmetric encryption and cryptographic protocols.

Large prime decomposition and discrete logarithm pairs satisfy the following description: a simple understanding is that there is a function y=f(x). It is easy to find y from x, but difficult to find x from y. Y can be understood as a public key and X as a private key

3.2 Symmetric encryption algorithm

In simple terms, Encryption and decryption use the same secret key. The main algorithm is Data Encryption Standard (DES), which is a block algorithm that uses the secret key to encrypt. The main process of DES is to complete the encryption process through the iterative bit operation. The details are not expanded.

3.3 Asymmetric Encryption Algorithms

The user has a key pair that contains a private key and a public key. The public key is used for encryption and the private key is used for decryption. The encryption and decryption keys are different so they are called asymmetric encryption algorithms.

Asymmetric encryption algorithms can generate a key pair based on either of the two types of mathematical problems in cryptography archetypes. RSA is an asymmetric encryption algorithm based on the decomposition of large prime numbers, and ECDSA is an asymmetric encryption algorithm based on the discrete logarithm problem.

Asymmetric encryption algorithm is the core of the process is based on digital signature, the following will first introduce the digital signature and its classification, then explain the general verification process of asymmetric encryption signature then is introduced based on ECC to generate a public key, private key algorithm ECDSA signature verification process, finally is introduced in order to protect the signer privacy and use of ring signature technology.

A digital signature

This is a method of identifying digital information that functions like ordinary signatures written on paper, but uses a technique from the field of public key encryption. A set of digital signatures typically defines two complementary operations, one for signing and one for validation. Depending on the number of signatures can be divided into two categories: single signature, multi-signature.

Type of digital signature

A common digital signature, also known as a digital signature, uses a single signature to identify digital information.

Blind signatures, in which the content of a message is not visible to the signer until it is signed (blindness). The resulting blind signature can be publicly verified against the original, non-blind message as a regular digital signature. Blind signatures, where signers and message writers are different, can be used effectively to protect privacy in scenarios including electronic elections and digital cash.

Group signatures, in which a user signs a message on behalf of a Group and remains anonymous within the Group. That is, someone who sees the signature can verify with the public key that the message was sent by a member of the group, but doesn't know which one. Can be used for voting in large organizations.

Ring signatures, a type of signature derived from group signatures, are described in more detail later.

The signing and verification process in asymmetric encryption

Suppose that little B has 10 BTCS and now sends four BTCS to little V. The private key of little B is SK and the public key is PK

1 The sender generates information

1) Hash the message "little B sends four BTCS to little V" to generate an information summary

2. B uses his private key SK to encrypt the message digest to generate a password (also known as a digital signature)

3. Little B sends "little B sends four BTC to Little V", its public key PK and password to the verifier

2 Verifier verification

1) The verifier hashes the received information to generate an information digest 1

2) Decrypt the password with the public key of little B to generate information summary 2

3) If message digest 1 equals message digest 2, the verifier can determine that the message was sent by little B

The above process can complete the authentication for the following reasons:

1) Identification of sender. The password can be decrypted by small B's public key PK to prove that small B has the corresponding private key SK and PK, because the password is encrypted by the private key SK;

2) Confirmation of content sent by sender. The password decrypted by B's public key PK is the hash value of the message sent by B. If it is the same as the hash value of the broadcast message sent by B, the sent message has not been tampered with.

Based on elliptic curve (ECC) signature algorithm

ECDSA is a signature algorithm commonly used in asymmetric encryption. The verification process is as follows:

1 Generating signatures:

2 Verifying signatures:

3 The principle is as follows:

Ring signature

Ring Signature, a type of digital Signature, can protect the privacy of the signer and allow the authentication node to verify the correctness of the Signature.

The flow of ring signature (image from network)

1 Signature process (refer to the figure above for understanding)

2 Verifying signatures:

3.4 Password Protocol

A new protocol is derived from the fusion of symmetric and asymmetric encryption technologies according to service scenarios.

DH protocol/algorithm

Diffie-hellman is a method of ensuring the security of shared information (secret keys) over insecure networks. It is also known as secret key consistency protocol and can be used as a method of sharing keys for symmetric encryption algorithms.

The specific process is as follows:

Digital envelope

Digital envelope is a kind of technology which combines the advantages of symmetric encryption and asymmetric encryption to secure information transmission. In simple terms, a digital envelope allows two people to share a piece of information that no one else can see.

The communication process is as follows:

1 Sender:

1. The sender generates a symmetric encryption key

2. Encrypt the sent information with symmetric keys to generate ciphertext

3. Encrypt the symmetric encryption key with the public key of the receiver to generate the key ciphertext

4. The combination of ciphertext and key ciphertext is called a digital envelope, and the digital envelope is sent to the recipient

2 Receiver:

1. After receiving the digital envelope, the receiver decrypts the ciphertext with the private key to obtain the symmetric encryption key

2. Use the symmetric encryption key to decrypt the ciphertext to obtain the information

3. The sender and receiver share a piece of information that is not visible to others

Conclusion: 3

It can be found that the key to information sharing between sender and receiver is to have a symmetric encryption key. Generally, information may be leaked after the receiver decrypts the symmetric encryption key in this way, so that the privacy of communication disappears. However, TEE environment provides enough secure environment for decryption key, so the combination of digital envelope and TEE provides a feasible scheme for communication between users and verifier in privacy computing.

Cryptography commitment

Cryptography commitment is a two-stage interactive protocol involving two parties, the promising party and the receiving party respectively.

1 Two stages:

The first stage is the commitment-level stage, in which the committer selects a message and sends it to the receiver in ciphertext.

The second stage is the verification stage, in which the promiser discloses the relevant parameters of the message and the ciphertext generation, and the receiver generates a new ciphertext in the same way as the sender. If the two ciphertexts are consistent, the promise is reliable; otherwise, the promise is unreliable. It should be noted that commitment can be understood as only encryption process without decryption process. In the verification stage, it can be directly verified by several parameters of plaintext or completed by constructing zero-knowledge proof method without disclosing plaintext.

2 Two properties:

The promise of cryptography has two properties: concealment and binding. Concealment refers to the promise that the value (ciphertext) will not reveal anything about the "message"; Binding means that the promiser cannot open the promise (ciphertext) into other messages than the original "message" and verify it.

3 Three categories

There are three main categories: hash commitment, Pederson commitment and quantum commitment.

[Hash commitment] : It is mainly used in scenarios with low privacy requirements. For example, when downloading a movie, the movie website first computes a hash value of the movie to be downloaded to the user, and the user calculates a new hash value of the movie locally after finishing the movie. If the two are equal, the downloaded movie is proved to be complete.

[Pederson promises] : Blockchain is widely used in the field of privacy, which will be described in detail later.

[Quantum promise] : it is a new promise scheme to deal with the risk that quantum computing may bring to the promise of classical cryptography. It is currently in the early stage of research.

Perdeson commitment

Pederson commitment is currently commonly used in the field of encryption, most of which are based on elliptic curve (EC). The calculation process is described below.

The practical application process is as follows:

Suppose that little B has 10 coins from two UTXO records, namely 3 and 7, 8 coins need to be transferred to little V and marked as T, and the remaining 2 coins need to be marked as change, in order to simply ignore the miner's cost.

1 Commitment generation:

2 Verification of commitment

3 The verifier promises to verify

3.4 Proof of zero knowledge

It is a type of cryptography protocol, which simply means that the verifier does not need to know the information held by the verifier to confirm that the verifier does have this information. This paper does not expand the proof of zero knowledge.

Combination of soft and hard layers

3.5 the TEE

The Trusted Execution Environment is an area of the CPU that is almost impenetrable. TEE accepts ciphertext input, performs plaintext calculation internally, and encrypts output after calculation in a communication Environment where private calculations are ciphertext. TEE is a plaintext calculation, which can protect privacy on the premise of ensuring computational efficiency. The input is ciphertext, so TEE and the other party of communication (user/node, etc.) are required to use the key sharing described above to complete data decryption. The privacy protection of TEE requires the support of cryptography algorithm at the software level.

The following is an example to illustrate a communication process combined with TEE in blockchain:

1 Sender:

1. The sender generates the DES key and encrypts the transaction information

2. Encrypt the DES key using the public key published by TEE (which also has a public key and a private key)

3. Transaction information signature

4. The digital envelope formed by the transaction ciphertext, DES key ciphertext and digital signature is sent to the TEE node

2 TEE node:

TEE uses the private key to decrypt the DES key of encrypted information

2. DES key decrypts information

3. The transaction information is verified, calculated and encrypted and output to update the ledger

Only the TEE node can reveal the information encrypted by the public key of the TEE node. Therefore, when conducting privacy transactions, users only need to encrypt privacy information through the TEE public key and exchange information with the TEE node through the digital envelope.

4. What tools do main privacy projects use to solve privacy problems?

From the perspective of the underlying logic of the ledger, almost all projects related to privacy adopt UTXO model. Although the account model is more programmatic than UTXO model, its compatibility with privacy is much worse.

In terms of the technical scheme to realize privacy, according to their own understanding, some project teams use software-based cryptography algorithm, while others use software and hardware combined cryptography scheme to complete the construction of privacy project.

The following four aspects of anonymous coin, Layer2 privacy scheme, privacy public chain and other related privacy projects are introduced to select their implementation technology scheme and how the scheme achieves privacy protection.

4.1 the anonymous money

The main function of anonymous currency is to complete the privacy of the transaction function itself, which does not have programmability. DASH, Monero and Zcash are mainly introduced.

DASH

The main technology used is Coinjoin, and the specific process is as follows:

1. Mixed currency node collects transfer applications from users who need to transfer money within a period of time

2. Split the amount of all the sender according to the standard value, the base is 0.001, 0.001, 0.01, 0.01, etc

3. Send standardized coins to the recipient in the amount agreed by the sender

It can be seen that the privacy of sender and receiver is realized in the whole process (the mixed-currency node is not anonymous), but the privacy of amount and account is not. Authentication, amount confirmation, and double spending problems, as well as cryptographic algorithms used in ethereum without privacy, are similarly unexpanded.

Monero

1 basic Information:

Using a BTC-like UTXO ledger model, these two "tables" (actually two Merkle trees) are maintained in the ledger, one containing past input and output changes, and the other containing the secret key image of the UTXO that has been spent. Monero each user has two key pairs, one is called Secret Spend key, which is mainly used to unlock their own unspent UTXOs, and the other is called Secret View key, which is used by the sender to generate one-time public keys and addresses.

2 Transfer process:

3 Effect:

Sender privacy, identity authentication, transaction content privacy (transaction amount privacy), amount confirmation;

The sender carries out ring signature through one-time private key and submits transfer information through Pederson promise. The verifier can complete identity authentication through asymmetric encryption and complete transaction validity authentication through homomorphic additivity + zero knowledge range proof of Pederson promise.

4 Double flower problem:

The key image needs to be submitted to the ledger when each input is spent, and only part of the legitimate transfer will be accepted when the same input is spent more than once during the consensus phase.

Zcash

1 Accounting structure:

Zcash adopts utXO-type ledger structure. Each input and output record in the ledger is called a note, and a note contains the following variables:

The public key of the holder is a_PK, and the quantity is V, which represents the token value of the note. The random number is R1 and R2, which are the unique identification of each note.

When a note is consumed, this value is placed in the Nullifier table to indicate that the note has been consumed. A note can be expressed as: note = < a_pk , v , r1 , r2> , the vector representation of each note is shown in the following table:

2 Merkle tree:

There are also two "tables" in Zcash's ledger: Commitment and Nullifier. In the first column, Hashed Notes is Commitment; Nullifier set in the second column is Nullifier. Commitment stores hash values for all notes, Nullifier stores hash values for notes that have been consumed. Suppose the following table is all active records on the current chain:

Nullifier Set records the hash value of R22, indicating that Note2 has been consumed and cannot be used any more. Note1, note3, note4, note5 can still be used.

3 Zcash Key System:

Zcash has two key systems: Sprout and Sapling. Sapling is more complex and has better privacy protection, but to understand the main process, we will use the Sprout key system as an example.

Source: Zcash White paper

Curve25519 in the figure above is an elliptic curve (ECC) that can be used to implement ECDH. ECDH is an implementation of the key sharing protocol DH introduced earlier. Therefore, we can ignore the details of the specific encryption algorithm in the figure above and focus on the architecture, where:

The figure above explains that after the sender generates a new note, the user sends the permission to the recipient via the chain. The specific process is as follows:

The following takes the privacy transfer process between Z-Addresses in Zcash as an example to illustrate how Zcash realizes privacy protection:

After completion of the transaction, the contents of Table 1 are updated as follows:

In the above process, Zcash realizes the privacy of sender, receiver and account by generating one-time addresses, realizes identity authentication through asymmetric encryption, and realizes amount privacy and amount confirmation through Pederson promise and zero-knowledge proof (please refer to the introduction section of Pederson Promise for details). The Nullifier table stored in the ledger is combined with the consensus process to solve the double flower problem, and the use permission of the newly generated note is shared with the recipient through the improved DH protocol.

4.2 Privacy Public chain

Secret network

1 basic Information:

1. There are two kinds of non-private transactions and private transactions in the network. Non-private transactions are similar to today's public chain transactions; Privacy transactions are performed in the TEE environment.

2. The transaction information and account information of privacy currency sToken are stored in the chain in the form of encryption. It seems to be the information encrypted with the public key of TEE environment (this part of information not found belongs to inferred information).

3. Users who have not generated sToken have only one key pair for non-private transactions. After the generation, in order to check the sToken balance and communicate with the TEE environment to complete private transactions, the local wallet will generate a new private key called the viewing key for the user.

2 Transaction process:

1. The user communicates with TEE(verification node) through digital envelope technology (refer to the tools section). The communication content is sender, currency, quantity and receiver address

2. TEE verifies the sender's identity through asymmetric encryption technology, and completes balance confirmation by calling encrypted ledger information

3. Ledger consensus

4. The ledger information to be updated after consensus is encrypted with TEE public key and stored in the encrypted ledger

5. After the transfer is completed, the recipient can view the balance information of his own account through the viewing key

3 Conclusion:

During the whole transfer process, the sender's identity is confirmed by asymmetric encryption technology. TEE completes balance confirmation by calling encrypted ledger information; Consensus process to solve double flower problem; It is only known to the outside world that the sender interacts with a sToken, but it is not clear what the specific purpose is, so the privacy of the sender, receiver and transaction amount is guaranteed. The balance in the user's private account is encrypted and not visible to the public, so the account privacy is guaranteed.

The etheric fang layer2 - Aztec

This is a privacy-supporting Ethereum Lyer2 solution based on ZK-SnARK, which supports programmatic privacy. The ledger structure is UTXO. The ledger contains two "tables", one is the collection of all notes, the other is the collection of spent notes, and the programming language is Nior.

Here's how Aztec achieves transfer privacy.

Scenario: Little B has 10 Dai on Ethereum and needs to transfer 8 dai to Little V himself and the remaining 2 dai. After the transfer, both parties withdraw their assets and return to Ethereum. The process is as follows:

1. V transfers 10 Dai from Ethereum to Aztec to form zDai. This part is public.

2. Similar to Secret network, a new public key and private key pair are generated with a meeting account

3, the little V generates Pederson promises and submits the hash it wants to spend on the note and the hash of the newly generated note

4. The verifier confirms the balance through the homomorphic additive property and zero-knowledge proof promised by Pederson

5. Update the two "tables" in the books and complete the note ownership transfer record

6. Aztec converts the confidential amount into the open amount and exits the asset via a cross-chain bridge

4.3 & have spent Other Hidden Items

The previous article was more about "account-level privacy", where it is possible to monitor the originating IP of a transaction even with the protection of various privacy technologies described above. IP level within the market of the privacy + block chain project has also been gradually mature, the most representative is Nym, technology implementation can be as simple as is dark net (onion) network architecture to join the block chain incentives, incentive mechanism based on the block chain confuse dark net for IP anonymous network node more and more robust.

As can be seen from the figure above, Nym is equivalent to two networks, one Nym Mix Node network for IP anonymity, and Nym Blockchain is responsible for motivation. The main technology of IP anonymity is obfuscation network, and the specific process of obfuscation network is as follows:

Suppose there are n nodes in the network, and the public key of each node is public

1. The information sender randomly selects K nodes in the network as the encryption path, and the public keys of the K nodes are respectively the sender's public key and the receiver's public key

2. The sender uses k public keys to encrypt the message M sent by the key one by one. Each encrypted message must contain the next decryption node

3. The sender sends the message, and the message is transmitted through the previously defined path. When node I, I decrypts the message with the private key

4. If I is the recipient of the information, I can directly decrypt the information and complete the message transmission; if not, the next node is determined from the decrypted message, and then the message is sent to the next node learned from the decrypted information

The whole transmission process is like a package wrapped in K layer being gradually opened. The intermediate node can only know its previous node and its next node, but it cannot determine whether the upper node is the starting point and the next node is the end point, so the purpose of IP protection is achieved. It should be noted that the whole network is much more complex than the above, and the process also involves information standardization, fragmentation and other operations to confuse information, so this paper will not expand.

4.4 summarize

Sorted as follows:

Four,

The grandest narrative about privacy in blockchain is the privacy rights of personal data in Web3.0. If data rights become common sense, privacy protection technology will be the foundation of all applications at the top. However, this is not easy, and it requires average users to realize the importance of data privacy. I believe that data rights can only become a consensus after some projects can realize the value discovery of personal data.

In view of the above industry narrative needs and the actual demand for anonymous transactions, privacy protection in the blockchain field has emerged in the anonymous coin, privacy public chain, IP privacy and other projects.

In order to better integrate blockchain and privacy through technology, different project teams chose. The technology has developed from a simple cryptography algorithm to the combination of cryptography algorithm and hardware. Cryptography algorithm mainly applies symmetric encryption algorithm, asymmetric encryption algorithm, password sharing algorithm, cryptography promise and hybrid technology derived from these basic cryptography technology. The hardware is mainly the application of TEE environment.

It should be noted that this paper selects representative projects from anonymous coin, Layer2 and privacy public chain for explanation. There are still many anonymous coin projects and privacy networks in the market, such as OASIS, Phala and Manta, which have determined their implementation schemes according to their project positioning. But the key technologies involved have basically been introduced above.

Reference links:

1, https://link.zhihu.com/?target=https%3A//arstechnica.com/security/2013/10/a-relatively-easy-to-understand-primer-on-el liptic-curve-cryptography/3/