onsistency: Prover sends c1,y1,cγ0,yγ0 to the verifier. Prover computes a vector Î as challenge, in which Î = H(C1,R, r0,r1,c1,y1,cγ0,yγ0) for idx ∈ Î do Prover sends C1 [:,idx] and the Merkle tree proof of Rootidx for C2 [:,idx] under R to verifier function PC. VERIFY_EVAL(ΠX,X,y= ϕ (X),R) Proximity: ∀idx ∈ Î, Cγ0 [idx] == <γ0, c1[:,idx]=""> and Ec(yγ0) == Cγ0 Consistency: ∀idx ∈ Î, C1 [idx] == <γ0, c1[:,idx]=""> and Ec(y1) == C1 y==1, y1> ∀idx ∈ Î, Ec ( C1[:,idx]) is consistent with ROOTidx, and ROOTidx’s Merkle tree proof is valid. Output accept if all conditions above holds. Otherwise output reject. 结语 许多的零知识证明算法在设计之初都依赖证明者和验证者双方的交互,但是这种交互式证明协议不适合用在追求高效,网络通讯开销大的应用场景下,比如链上数据隐私保护和 zkRollup 等等。通过 Fiat-Shamir 启发式(Heuristic),可以在不破坏协议安全性的条件下让证明者本地生成随机数“挑战”,并且可以被证明者验证。根据这种方法,FOAKS 同样实现了非交互式的证明,并应用在系统当中。 参考文献 1.Fiat, Amos; Shamir, Adi (1987). "How To Prove Yourself: Practical Solutions to Identification and Signature Problems". Advances in Cryptology — CRYPTO' 86. Lecture Notes in Computer Science. Springer Berlin Heidelberg. 263: 186–194. doi:10.1007/3-540-47721-7_12. ISBN 978-3-540-18047-0. 2.https://www.cnblogs.com/zhuowangy2k/p/12246575.html 撰文:康水跃,Fox Tech CEO;孟铉济,Fox Tech 首席科学家 来源:DeFi之道 来源:金色财经lg...