LACT+: Practical Post-Quantum Scalable Confidential Transactions

Abstract

A “confidential monetary value” carries information about the real monetary value but does not disclose it. Post-quantum private blockchains with confidential monetary values—large-sized blockchains with large verification times—have the least scalability because they need to save and verify more information than those with “plain-text monetary values”. High scalability is an essential security requirement for decentralized blockchain payment systems because the more honest peers who can afford to verify the blockchain copies are, the higher the security. We propose a quantum-safe transaction protocol for confidential monetary blockchains, LACT+ (Lattice-based Aggregable Confidential Transactions), which is more scalable than previous post-quantum confidential blockchains, i.e., many input/output transactions with logarithmic sized complexity.

1. Introduction

Blockchain-based cryptocurrencies have become popular due to the security of decentralization, i.e., there is no single point of failure and no single authority in control. However, decentralization has a downside because it requires many honest peers to keep a copy of the blockchain and constantly verify it. Otherwise, malicious peers can alter the cash system for their gain. The number of honest peers mainly depends on the system’s scalability (size and verification time) because peers have to spend their resources like space and computational power to save and verify blockchains. Despite the security and privacy, “quantum-safe” and “confidential” cryptocurrencies have the least scalability because they need special computations and algorithms that require more space and more computational power. This paper introduces a more scalable quantum-safe confidential blockchain transaction method, LACT+, where we only need 5.7 KB to store a confidential monetary value, whereas refs. [1,2] need >30 KB and 9.6 KB, respectively.

Confidential Transactions. Cryptocurrencies are public records accessible by anyone. Even though pseudonyms are commonly used, refs. [3,4,5,6,7,8,9] show that these identities can be linked to real identities. Therefore, maintaining monetary amounts in “plain text” is a major privacy concern. Confidential transactions (CT) solve this problem by keeping monetary values confidential yet providing tools to verify that hidden coin amounts are not negative, stolen, or double spent. However, this enhanced privacy comes at the cost of scalability because these tools generate proofs that should be stored in the blockchain, and verification of these proofs takes more computational power than simply checking plain-text numbers.

Aggregable Transactions. A transaction takes a set of current coins, changes their ownership, and updates the blockchain with that information. Hence, blockchain verifiers need to know “who has coins? Furthermore, are they only spending what they have?”. Hence, they mainly need to know about current coins and who has them, not who had them. As the name implies, aggregable transactions aggregate multiple transactions into a smaller transaction, and this aggregated transaction shows “who has coins after those transactions”. For example, if ${\mathcal{P}}_1$ sends coins to ${\mathcal{P}}_2$ and ${\mathcal{P}}_3$, and ${\mathcal{P}}_2$ sends their coins to ${\mathcal{P}}_4$, the aggregated transaction shows that ${\mathcal{P}}_3$ and ${\mathcal{P}}_4$ have coins, and forgets that ${\mathcal{P}}_1$ and ${\mathcal{P}}_2$ had coins. Hence, an aggregable blockchain is a single aggregated transaction of all previous transactions. This forgotten information reduces the size and verification time and improves scalability significantly. However, previous aggregable blockchains refs. [1,2,10,11,12,13,14] cannot prove that the aggregated blockchain is the aggregated version of the “right” or the consensus accepted blockchain (more theoretically, previous aggregated blockchains are not “immutable”). Hence, despite the high scalability, “peers” have to download and verify the complete blockchain.

Quantum Safety. Recent developments in quantum computing, e.g., IBM’s roadmap ref. [15], show that quantum adversaries can be a real threat even to the current standardized security level in the near future. Post-quantum (we use “post-quantum”, “quantum-safe”, or “quantum-resistant” to describe plausibly quantum-secure protocols) payments started receiving attention because many established decentralized payments are based on the discrete-logarithmic problem (DLP), which is vulnerable to quantum adversaries. Not only transparent payments, but many aggregable confidential transactions refs. [10,11,12,13,14] are also based on DLP and equally vulnerable to quantum adversaries. Ref. [1,2] introduced two quantum-safe aggregable confidential transactions that are based on the short integer solution problem (SIS) and the modular SIS. However, ref. [1] has an inefficient proof system and the transactions of ref. [2] are limited to a maximum two inputs and two outputs.

This paper proposes an immutable aggregable confidential transaction protocol, LACT+ (Lattice-based Aggregable Confidential Transactions), based on approximate modular SIS (approximate SIS), to provide post-quantum security with practical scalability.

1.1. Related Work

Let us explain the key components of decentralized aggregable payments that lead to LACT+. Note that here, we sketch a common protocol that describes refs. [1,2,10,11,12,13,14] generally regardless of their “hardness assumption”, e.g., they can be based on DLP or SIS.

Digital Coins from Cryptographic View. Decentralized payment systems store monetary values as digital coins where each coin represents some amount of the smallest unit (e.g., the number of cents). These digital coins are stored in the public domain, where anyone has access. Therefore, coins need a security mechanism to prevent theft. Let there be a digital signature scheme that signs messages when its key card (secret signing key) is presented and the public key of the key card tells anyone whether it produced the signed message or not. Users attach these public keys to their digital coin(s) and securely keep the key card(s) with them. Wherever they want to spend the coins, they create a signed receipt, and they send the signed receipt to the network. Because the public key verifies the signed receipts without key cards, the whole network can verify that the legitimate owner is spending the coin. However, once the coins are sent, the new owner attaches a new public key to the coins where only he/she has a key card to it. In that way, after sending the coins, previous owners cannot take coins back because they do not have new key cards. The signed receipts are known as digital signatures.

Transparent Digital Coin Transactions. Users create transactions when they want to send digital coins or receive them. A transaction turns a set of current unspent coins (inputs) into spent coins and produces new unspent coins (outputs). However, a transaction should not illegally generate coins—the input coins should be equal to the output coins—or allow coins to be stolen. Therefore, each transaction has a header that proves the total coin amount summation (1. summation proof) and the digital signatures of coins (2. ownership proofs). In transparent coin transactions, the summation proof is simple and only contains the number of supplied coins (e.g., mining reward) and transaction fee because the verifiers can add the numbers and can check that input coins and the supplied coins are equal to the output coins and the transaction fee. However, the ownership proof is linear in the number of unique public keys of inputs, i.e., the ownership proof of the transaction is the set of signatures of all unique input public keys refs. [16,17].

Confidential Digital Coins. Instead of plain-text coins, confidential payment systems keep coins’ value hidden. We call them “confidential coins”. A confidential coin is a commitment for the coin amount and a range proof to prove that the hidden coin amount is in the accepted range, e.g., $[0,2^{64})$. A commitment can be viewed as a safe box that hides coins and is locked with a secret key (a.k.a., blinding key or the masking key). Yet, anyone can verify that the hidden coin amount is in the accepted range using the cryptographic range proof (even though proving the range of physical coins is impossible without opening the safe-box, it is actually possible with digital coin commitments!). These range proofs are called “zero-knowledge proofs” because they do not reveal anything other than the designated knowledge statement. In this case, the proofs only show that values are in the accepted range.

Confidential Transactions (CT). There are two categories of CTs; (1) Ring CTs which obfuscate the senders and receivers with shadow participants refs. [18,19,20,21,22] and (2) Aggregable CTs which allow aggregating multiple transactions into one transaction by removing spent coin records refs. [1,2,10,11,12,13,14]. In general, confidential transactions are similar to the transparent transactions but with the following main differences,

• they transact confidential coins, and
• their headers contain zero-knowledge summation proofs to show that hidden input coins are equal to hidden output coins, along with plain-text supplied coins and fees.

However, Ring CTs and aggregable CTs have different ownership proofs. Ring CTs’ ownership proofs are threshold signatures or one/many-out-of-many proofs that are either linear or logarithmic in the number of unique participants, whereas, aggregable CTs’ reuse their summation proofs as ownership proofs ref. [10]. Due to this reuse and removing spent coin records, aggregable CTs provide better scalability than Ring CTs. From now on, we use CT for aggregable CTs.

Ownership + Summation Proofs. Let there be an additively homomorphic commitment $u=\mathtt{com}(v,k)$ that hides and binds $(v,k)$ when v is the coin amount and k is the secret masking key. Here, “binding” means that it is computationally impossible to find another $(v^{\prime },k^{\prime })$ pair for the same u, and “additively homomorphic” denotes that ${\sum }_{i=0}^{\ast }\mathtt{com}(v_i,k_i)=\mathtt{com}({\sum }_{i=0}^{\ast }{v}_i,{\sum }_{i=0}^{\ast }{k}_i)$. A confidential coin is a commitment and a range proof of that commitment. For example, $C=(u,\pi ={\mathtt{range}}_{2^L}\left(u\right))$, and $\pi$ verifies that u’s hidden coin amount is in $[0,2^L)$.

Assume that a set of participants want to spend confidential coins ${[u_i=\mathtt{com}(v_i,k_i)]}_{i=0}^{\ast }$ and create new confidential coins ${[u_i^{\prime }=\mathtt{com}(v_i^{\prime },k_i^{\prime })]}_{i=0}^{\ast }$ for the supplied coins s and the transaction fee f. Then they compute a public key out of commitments such that

$$pk=\sum _{i=0}^{\ast }{u}_i^{\prime }-\sum _{i=0}^{\ast }{u}_i+\mathtt{com}(f-s,0)=\mathtt{com}(0,\sum _{i=0}^{\ast }{k}_i^{\prime }-\sum _{i=0}^{\ast }{k}_i)$$

because ${\sum }_{i=0}^{\ast }{v}_i^{\prime }-{\sum }_{i=0}^{\ast }{v}_i+f-s=0$ if the owners do not illegally generate coins.

Aggregable CTs’ digital signature schemes use commitments as their public keys. However, a valid signature can be created if and only if the commitments’ value is zero refs. [1,10,11,12,13,14]. In the previous equation, if participants do not generate coins illegally, they can create digital signatures for $pk$ using the aggregated secret key ${\sum }_{i=0}^{\ast }{k}_i^{\prime }-{\sum }_{i=0}^{\ast }{k}_i$. Hence a signature of $pk$ can prove (1) the summation and (2) the ownership because a digital signature can only be created if all the secret keys are known.

Lattice-based Ownership+Summation Proofs. Ref. [1] introduced the first quantum-safe aggregable CT protocol. However, ref. [1] is inefficient leading to $>30$ KB commitments. Ref. [2] proposed the first practical aggregable post-quantum CT protocol, LACT, based on the Module-Ring Short Integer Problem (MSIS). LACT significantly improves efficiency by storing coins in their binary forms such that $u=\mathtt{com}([b_0,\dots ,b_{63}],k)$ instead of the full integer, when $v={\sum }_{i=0}^{63}{2}^i{b}_i$. LACT’s confidential integers are binary commitments and a range proof for all bits, i.e., $C=(u,\pi ={\mathtt{range}}_2\left(u\right))$ when $\pi$ verifies that the bits of u’s hidden coin amount are in $[0,1]$. More concretely, LACT’s commitments are only 9.6 KB long for coins in $[0,2^{64})$.

However, summation does not work anymore because adding two binary commitments does not output a binary commitment due to carries. Therefore, LACT use carry proofs to fix the summation. Each carry proof has a commitment of carries and a range proof to show that each carry is either 0 or 1. Therefore, a LACT header contains supplied coins, transaction fee, a digital signature and a carry proof to prove the ownership and the summation of hidden coins.

Unprovable Immutability. In blockchains refs. [16,17], transaction headers are securely stored with consensus proofs to show that the community has accepted the that version of the blockchain, which is the “right blockchain”. If somebody changes the right blockchain, the consensus proofs will indicate that there was an altercation, i.e., immutability. However, current aggregable CT protocols refs. [2,10,11,12,13,14] do not provide proper immutability proofs for aggregated blockchains, only for complete blockchains. Therefore, despite the aggregation, peers have to keep all coin records for the verification, e.g., Grin ref. [23] and Beam ref. [24]—which use Mimblewimble aggregable transactions refs. [10,11,12,13] keep all transactions to provide immutability. Therefore, aggregable CTs do not reduce the overall blockchain size nor provide trustless verification for aggregable CTs in current settings.

1.2. Our Contribution

We introduce LACT+, a more efficient Lattice-based Aggregable Confidential Transaction protocol with provable immutability. Furthermore, we implement a public LACT+ C library ref. [25] and provide formal security proofs.

Approx-SIS. LACT+ uses the Approximate Module Short Integer Problem (Approx-SIS) ref. [26] which can be tightly reduced to LWE (Learning with Errors ref. [27]) or SIS ref. [28]. Approx-SIS creates shorter proofs by dropping low bits of each polynomial coefficient without affecting security when the dropped bits are smaller than some norm, e.g., each LACT+ commitment drops 14 bits from $256\times 6$ coefficients and reduces the size from 8.4 KB to 5.7 KB.

More than 2 inputs/outputs. LACT’s main constraint was that a maximum of two inputs or outputs could be included in a transaction because the carries must be in [0, 1]. If there are more than two inputs/outputs, they had to be separated into multiple transactions, and each transaction includes an additional carry proof. LACT+ transactions allow having more than two inputs or outputs at a logarithmic cost, i.e., $\mathcal{O}(log(x\left)\right)$ for x number of in/outputs. Hence, LACT+ does not unnecessarily increase the size of the header.

Trustless Immutability. Previous aggregable CTs’ headers are malleable, or the owners of the transactions can use the same header set for different unspent coins. This allows the owners to forge many chains for the same header with different unspent coins or spent coins refs. [10,13]. Hence, preserving headers is not sufficient to provide immutability, and block creators hash the whole transaction and save the transaction hash through the consensus mechanism. Therefore, the peers must download the complete chain (note that we do not consider users who depend on “trusted” peers without verifying the blockchain as peers because they are replicas of the those “trusted” peers). Hence, except for the efficient ownership + summation proofs, the aggregation has no use to the peers who do not blindly trust other peers.

As a solution, LACT+ headers contain aggregable activity proofs ref. [29] to prevent the forging of different blockchains for the consensus accepted headers, i.e., each transaction header contains an activity proof for that transaction, and by giving the same input and output coin records, the activity proof verifies that they existed. More importantly, an aggregated activity proof can verify the activities of an aggregated CT; hence, chains’ unspent coin records cannot be forged. Not only that, activity proofs are constant sizes for any number of inputs and outputs, e.g., 49 bytes in LACT+. Hence, activity proofs do not break transaction aggregation, but at a tiny cost, peers can download a small aggregated chain and verify the existence of coins without blindly trusting other peers.

Table 1 compares LACT+ with other CT protocols.

Table 1. Comparison of Confidential Transactions.

Implementation	Post Quantum	Security	Aggregable	Immutable Headers
Ring CT  ref. [30]	✗	DLP	✗	-
Maxwell’s CT  ref. [31]	✗	DLP	✗	-
Mimblewimble  ref. [10]	✗	DLP	✓	✗
Ring CT v2  ref. [19]	✗	DLP	✗	-
Fuchsbauer et al.  ref. [13]	✗	DLP	✓	✗
Lattice Ring CT  ref. [21]	✓	SIS	✗	-
MATRiCT  ref. [20]	✓	MSIS	✗	-
Zhang et al.  ref. [1]	✓	SIS	✓	✗
MATRiCT+  ref. [22]	✓	MSIS/LWE	✗	-
LACT  ref. [2]	✓	SIS/MSIS	✓	✗
Ours (LACT+)	✓	Approx-SIS	✓	✓

2. Preliminary

An integer ring is $\mathbb{Z}/q\mathbb{Z}={\mathbb{Z}}_q$ which has integers in $[-\frac{q-1}{2},\frac{q-1}{2}]$ for an odd prime q. A polynomial ring is $\mathbb{Z}\left[X\right]/(X^N+1)=\mathcal{R}$ with $N=2^k$ for some integer $k>0$. A fully splitting ring is ${\mathbb{Z}}_q\left[X\right]/(X^N+1)={\mathcal{R}}_q$ where each polynomial coefficient is in ${\mathbb{Z}}_q$ for a prime $q=1\left(\text{mod}2N\right)$. A polynomial is denoted with an upper arrow, e.g., $\overrightarrow{a}$ that is in $\mathcal{R}$ or ${\mathcal{R}}_q$. We denote vectors of n elements in bold letters ($\mathit{a}={\left[a_i\right]}_{i=0}^n$) and matrices of m vectors in capital bold letters ($\mathit{A}={\left[{\mathit{a}}_i\right]}_{i=0}^m$). Similarly, polynomial vectors are denoted as $\overrightarrow{\mathit{a}}={\left[{\overrightarrow{a}}_i\right]}_{i=0}^n$, and matrices are denoted as $\overrightarrow{\mathit{A}}={\left[{\overrightarrow{\mathit{a}}}_i\right]}_{i=0}^m$. $\overrightarrow{a}\overrightarrow{b}$ denotes the polynomial multiplication of $\overrightarrow{a}$ and $\overrightarrow{b}$. $x\overrightarrow{a}$ is a scalar multiplication where each coefficient is multiplied by scalar x.

Uniform sampling of some set S is denoted as $s\stackrel{\$}{\leftarrow }\mathit{S}$. A negligible function of security parameter $\lambda$ is denoted as $ϵ\left(\lambda \right)=1/o\left({\lambda }^c\right)$ for some natural number c. The security parameter and public parameters are commonly referred as $\lambda$ and $p{p}_{\left(\lambda \right)}$. We only use the following norms: the infinity norm $\parallel \overrightarrow{a}\parallel =\mathtt{max}\left(\right[|a_i{\left|\right]}_{i=0}^{N-1})$ and the level 1 norm $\parallel \overrightarrow{a}{\parallel }_1={\sum }_{i=0}^{N-1}\left|a_i\right|$. $\mathbf{0}$ and $\overrightarrow{\mathbf{0}}$ are a vector of all zero values and a zero polynomial of all zero coefficients, respectively. $\mathtt{binary}\left(v\right)$ either outputs $\mathit{b}$ of L elements or $\overrightarrow{b}\in {\mathcal{R}}_q$ such that $v={\sum }_{i=0}^L{2}^i{b}_i$ according to the context. $\mathtt{rot}(v_i,i)$ outputs polynomial $\overrightarrow{a}$ such that the $i^{\mathrm{th}}$ coefficient of $\overrightarrow{a}$ is $v_i$, and other coefficients are zeros s.t. ${[{\overrightarrow{a}}_j=0]}_{j=0,j\ne i}^N$. ${\mathtt{highbits}}_p\left(v\right)$ and ${\mathtt{lowbits}}_p\left(v\right)$ denote high bits and low bits of $v\in {\mathbb{Z}}_q$ such that ${\mathtt{highbits}}_p\left(v\right)·2^p+{\mathtt{lowbits}}_p\left(v\right)=v$. Furthermore, ${\mathtt{up}}_p\left(v\right)=vs.·2^p$. We use these functions for polynomial vectors in an element-wise manner, e.g., ${\mathtt{highbits}}_p\left(\overrightarrow{\mathit{a}}\right)$ to denote high-bit polynomial vectors. Note that we use polynomial rotations to change the locations of bits. For example,

$$(j,i)\ge 0;j+i<N:\begin{array}{c}\hfill \mathtt{rot}(v,j)\mathtt{rot}(1,i)=\mathtt{rot}(v,j+i)\end{array}\in \mathcal{R}$$

$$\begin{array}{c}\hfill (j,i)\ge 0;j-i>0;i<N:\mathtt{rot}(v,j)\mathtt{rot}(-1,N-i)=\mathtt{rot}(v,j-i)\end{array}$$

2.1. Common Security Properties

First, we start with the common security definitions of confidential coins, carry proofs, and transactions, i.e., the hiding property, zero-knowledge, and knowledge soundness.

Confidential coins and carry proofs should be hiding, i.e., they should not reveal the committed coin value or the carry vector. We define hiding or indistinguishability of a generic protocol $\mathtt{P}$’s outputs below.

Definition 1

(Statistical Hiding). Let ${\mathcal{D}}_1$ be the output distribution of protocol $\mathtt{P}\left(p{p}_{\lambda }\right)$, and ${\mathcal{D}}_0$ be the simulated distribution created by a simulator $\mathcal{S}(p{p}_{\lambda },\mathcal{T})$ with a trapdoor $\mathcal{T}$ of public parameter $p{p}_{\lambda }$. For any $\mathcal{A}$, $\mathtt{P}$’s outputs are hiding if

$$2\left|\frac{1}{2}-Pr\left[b\stackrel{?}{=}{b}^{\prime }|b\stackrel{\$}{\leftarrow }[0,1];\theta \stackrel{\$}{\leftarrow }{D}_b;b^{\prime }\leftarrow \mathcal{A}(p{p}_{\lambda },\theta )\right]\right|\le ϵ\left(\lambda \right).$$

Coin and carry proofs contain range proofs. A range proof should not reveal anything about the committed value other than the range. Similarly, summation proofs of transactions should not disclose anything about the coin values other than that input coins are equal to output coins. We define these requirements for a generic protocol $\mathtt{P}$ and statement(s) $\mathcal{L}$. For example, in range proofs, $\mathtt{range}(L,\mathit{b})$ outputs 1 if all $b_i\in [0,1]$ of $i\in [0,L)$. The statement $\mathcal{L}$ of a range proof is “$\mathtt{range}(L,\mathit{b})$ is 1 for hidden $\mathit{b}$”. Assume the generic protocol $\mathtt{P}$ reveals a statement $\mathcal{L}$ about the outputs but nothing else. Then, $\mathtt{P}$’s outputs are zero-knowledge except for $\mathcal{L}$. We state the zero-knowledge of $\mathtt{P}$ below.

Definition 2

(Zero-Knowledge Argument). Let ${\mathcal{D}}_0$ be the simulated distribution of a simulator $\mathcal{S}(p{p}_{\lambda },\mathcal{L},\mathcal{T})$ with a trapdoor $\mathcal{T}$ of public parameter $p{p}_{\lambda }$ for $\mathcal{L}$, and ${\mathcal{D}}_1$ be the real output distribution of protocol $\mathtt{P}\left(p{p}_{\lambda }\right)$ for statements $\mathcal{L}$. For any p.p.t. $\mathcal{A}$, $\mathtt{P}$’s outputs are zero-knowledge if

$$2\left|\frac{1}{2}-Pr\left[b\stackrel{?}{=}{b}^{\prime }|b\stackrel{\$}{\leftarrow }[0,1];\theta \stackrel{\$}{\leftarrow }{D}_b;b^{\prime }\leftarrow \mathcal{A}(p{p}_{\lambda },\theta ,\mathcal{L})\right]\right|\le ϵ\left(\lambda \right).$$

Even though coins, carry proofs, and transactions are hiding and zero-knowledge, they should be knowledge sound such that no adversary can create valid proofs for invalid hidden coin amounts or invalid carry vectors. We capture this property by using a simulator $\mathcal{K}$ with a trapdoor $\mathcal{T}$ who extracts hidden values from the proofs. This is a stronger version of knowledge soundness, called simulated witness extractability. If a generic protocol is simulated witness extractable, the simulator $\mathcal{K}$ can always extract valid hidden amounts and carries that satisfy the required statement(s). We state the simulated witness extraction of a generic protocol $\mathtt{P}$ for statement(s) $\mathcal{L}$ below.

Definition 3

(Simulated Witness Extractability). Let $\mathtt{P}$ be a generic zero-knowledge protocol for statement $\mathcal{L}$ such that $\mathtt{P}(p{p}_{\lambda },\mathcal{L},\Pi )$ verifies whether hidden values of Π satisfies $\mathcal{L}$ or not. $\mathtt{P}$ is simulated witness extractable if

$$Pr\left[\begin{array}{c}\hfill \mathtt{P}(p{p}_{\lambda },\mathcal{L},\Pi )\stackrel{?}{=}1\wedge \\ \hfill \mathcal{L}(p{p}_{\lambda },\mathit{w})\stackrel{?}{=}1\end{array}|\begin{array}{c}\hfill \Pi \leftarrow \mathcal{A}\left(p{p}_{\lambda }\right)\\ \hfill \mathit{w}\leftarrow \mathcal{K}(p{p}_{\lambda },\mathcal{T},\mathcal{L},\Pi )\end{array}\right]\le ϵ\left(\lambda \right).$$

Technically, these extractors do not exist outside the simulated world because public parameters are securely generated to avoid unintentional trapdoors.

2.2. Hardness Assumption

LACT+ depends on the approximate SIS problem ref. [26].

Definition 4 

(Approximate Inhomogeneous Module Short Integer Solution Problem (Approx-SIS)). The advantage of an algorithm $\mathcal{A}$ solving Approx-SIS of $(n,m,q,\gamma ,{\gamma }^{\prime },N)$ after one execution is given by,

$$Pr\left[\begin{array}{c}\hfill \parallel \overrightarrow{\mathit{s}}\parallel \le \gamma \wedge \\ \hfill \parallel \overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}}-\overrightarrow{\mathit{y}}\parallel \le {\gamma }^{\prime }\end{array}|\begin{array}{c}\hfill \overrightarrow{\mathit{H}}\stackrel{\$}{\leftarrow }{\mathcal{R}}_q^{n\times m};\overrightarrow{\mathit{y}}\stackrel{\$}{\leftarrow }{\mathcal{R}}_q^n\\ \hfill \overrightarrow{\mathit{s}}\leftarrow \mathcal{A}(p{p}_{\lambda },\overrightarrow{\mathit{y}},\overrightarrow{\mathit{H}})\end{array}\right]$$

2.3. Activity Proofs

Let $\mathbb{H}$ be a multiplicative group of prime order $q_2>2^{3\lambda }$ and $\mathtt{H}:{\{0,1\}}^{\ast }\stackrel{}{\to }\mathbb{H}$ be a secure collision-resistant hash function family. Casually, we use $\mathtt{H}$ for one randomly chosen but commonly known member of a collision-resistant hash function family for a given $\lambda$ where the key of $\mathtt{H}$ is random, fixed, and publicly known.

Let there be a non-empty set of data entries $\mathit{s}$ that will be updated into a new set ${\mathit{s}}^{\prime }$. The proof $\delta$ of this activity is,

$$\delta =\mathtt{activity}(\mathit{s},{\mathit{s}}^{\prime }):{\Pi }_{i=0}^{\ast }\mathtt{H}\left(s_i^{\prime }\right)·{\left({\Pi }_{i=0}^{\ast }\mathtt{H}\left(s_i\right)\right)}^{-1}\in \mathbb{H}.$$

Definition 5

(Immutability). An activity proof of $(\mathtt{H},q^{\prime })$ is immutable if the following is less than or equal to $ϵ\left(\lambda \right)$.

$$Pr\left[\begin{array}{c}\hfill ({\mathit{s}}_1,{\mathit{s}}_1^{\prime })\stackrel{?}{\ne }({\mathit{s}}_2,{\mathit{s}}_2^{\prime })\wedge \\ \hfill \mathtt{activity}({\mathit{s}}_1,{\mathit{s}}_1^{\prime })\stackrel{?}{=}\mathtt{activity}({\mathit{s}}_2,{\mathit{s}}_2^{\prime })\end{array}|\left(\begin{array}{c}\hfill {\mathit{s}}_1,{\mathit{s}}_1^{\prime }\\ \hfill {\mathit{s}}_2,{\mathit{s}}_2^{\prime }\end{array}\right)\leftarrow \mathcal{A}(\mathtt{H},q_2)\right]$$

2.4. Hints

We frequently multiply high-bit polynomials with short challenge polynomials and check equality. Because the multiplication creates large errors that may propagate into higher bits, we use “hints”, a $\{-1,0,1\}$ polynomial vector that holds at most $\chi$ recovery bits. The way of creating and using hints is stated below.

$$\begin{array}{ccc}\underline{\mathtt{hints}(\chi ,\overrightarrow{\mathit{a}}\in {\mathcal{R}}_q^n,\overrightarrow{\mathit{b}}\in {\mathcal{R}}_q^n)}:\hfill & & \underline{\mathtt{use}\_\mathtt{hints}(\chi ,\overrightarrow{\mathit{a}}\in {\mathcal{R}}_q^n,\overrightarrow{\mathit{h}}\in {\mathcal{R}}_q^n)}:\hfill \\ \overrightarrow{\mathit{h}}=\overrightarrow{\mathit{a}}-\overrightarrow{\mathit{b}}\in {\mathcal{R}}_q^n\hfill & & \mathrm{if}\parallel \overrightarrow{\mathit{h}}\parallel >1\wedge \parallel \overrightarrow{\mathit{h}}{\parallel }_1>\chi :\hfill \\ \mathbf{if}\parallel \overrightarrow{\mathit{h}}\parallel >1\wedge \parallel \overrightarrow{\mathit{h}}{\parallel }_1>\chi :\mathrm{return}\perp \hfill & & \mathrm{return}\perp \hfill \\ \mathrm{return}\overrightarrow{\mathit{h}}\hfill & & \mathrm{return}\overrightarrow{\mathit{b}}=\overrightarrow{\mathit{a}}-\overrightarrow{\mathit{h}}\in {\mathcal{R}}_q^n\hfill \end{array}$$

2.5. Public Parameters

We use the following public parameters (Algorithm 1) throughout the remainder of the paper.

Algorithm 1 Public Parameter Generation

Assign ${\mathcal{C}}_{\beta }^N,L^{\prime },p_1,p_2,\chi ,\alpha ,\tau ,{\tau }_1,{\tau }_2,{\tau }_3\in \mathbb{N}$ such that     $L^{\prime }L\le N$⊳ Maximum number of inputs/outputs is $2^{L^{\prime }}$ because we only used one polynomial for carry commitments. When using l number of polynomials, this constraint should be $L^{\prime }L\le Nl$.     ⊳ for negligible soundness error    ${log}_2\left(\genfrac{}{}{0pt}{}{N}{\beta }\right)+\beta \ge 2\lambda$,       ⊳ for smaller errors targeting different summations     $p_1·2^{16}<2^{{\gamma }^{\prime }}$ and $p_2·2^8<2^{{\gamma }^{\prime }}$     ⊳ Norm 1 limit for hint polynomials is heuristically chosen according to $p_1$ and $p_2$ aiming to create hints within a reasonable time     $\chi \leftarrow \mathtt{heuristic}(p_1,p_2)$ s.t. $\parallel \mathtt{hint}(·)\in {\mathcal{R}}_q^n{\parallel }_1\le \chi$     ⊳ for rejection sampling in range proofs     $0<2\ll \alpha$, $0<{\beta }^2\tau +\beta {\tau }_1\ll {\tau }_2\le \gamma$,     ⊳ for rejection sampling in aggregate signatures     $0<(2^{L^{\prime }}+1)\beta \tau \ll {\tau }_3$ and $2^{L^{\prime }}{\tau }_3\le \gamma$,     ⊳ for computational hiding of coin amounts     $(m-3)N{log}_2\left(2\tau \right)\ge 6\lambda$,     $L\alpha \ll \gamma$ Get $\overrightarrow{\mathit{H}}\stackrel{\$}{\leftarrow }{\mathcal{R}}_q^{n\times m}$ s.t. $\mathtt{Approx}-{\mathtt{SIS}}_{n,m,q,N,\gamma ,{\gamma }^{\prime }}$ is hard. ${\mathcal{C}}_{\beta }^N=[x\in {\mathcal{R}}_q\mathrm{s}.\mathrm{t}.\parallel x\parallel ={1,\parallel x\parallel }_1=\beta ]$ return $p{p}_{(\lambda ,L)}=(n,m,q,N,{\mathcal{C}}_{\beta }^N,L^{\prime },p_1,p_2,\chi ,\alpha ,$$\tau ,{\tau }_1,$         ${\tau }_2,{\tau }_3,\gamma ,{\gamma }^{\prime },\overrightarrow{\mathit{H}})$

2.6. Fiat–Shamir Signatures

We define a digital signature scheme based on Fiat–Shamir challenges similar to refs. [32,33,34,35,36] in Algorithm 2. This signature scheme is the Approx-SIS version of ref. [36] with (1) a varying key space to allow aggregate keys and (2) beginning zero polynomials to align with commitments.

$\mathtt{SIG}$ provides completeness and strong EUF-CMA (Existential Unforgeability under Chosen Message Attack) due to the security of ref. [36] and the hardness of Approx-SIS.

We define the security properties below.

Definition 6.

$\mathsf{SIG}$ is complete and strong EUF-CMA if

$$Pr\left[\begin{array}{c}\hfill \mathsf{SIG}.\mathsf{ver}(p{p}_{\lambda },pk,m,\mathtt{sig},c)\stackrel{?}{=}1\end{array}|\begin{array}{c}\hfill (k,pk)=\mathsf{SIG}.\mathsf{kgen}(p{p}_{\lambda },c)\\ \hfill \mathtt{sig}=\mathsf{SIG}.\mathsf{sign}(p{p}_{\lambda },k,m,c)\end{array}\right]\ge 1-ϵ\left(\lambda \right)$$

$${\mathsf{Adv}}_{\mathsf{SIG},p{p}_{\lambda }}^{\mathsf{EUF},\mathcal{A}}:=Pr\left[{\mathsf{Game}}_{\mathsf{SIG},p{p}_{\lambda }}^{\mathsf{EUF},\mathcal{A}}\left(\right)\right]\le ϵ\left(\lambda \right).$$

• $\underline{{\mathsf{Game}}_{\mathsf{SIG},p{p}_{\lambda }}^{\mathsf{EUF},\mathcal{A}}:}$
• $c\leftarrow {\mathcal{A}}_{step1}\left(p{p}_{\lambda }\right)$; if $c>2^{L^{\prime }}$: return ⊥
• $(k,pk)=\mathsf{SIG}.\mathsf{kgen}(p{p}_{\lambda },c)$; $(m^{\prime },{\mathtt{sig}}^{\prime })\leftarrow {\mathcal{A}}_{step2}^{{\mathtt{sign}}_k}(p{p}_{\lambda },pk)$
• return $(m^{\prime },{\mathtt{sig}}^{\prime })\notin \mathbf{Q}\wedge \mathsf{SIG}.\mathsf{ver}(p{p}_{\lambda },pk,m^{\prime },{\mathtt{sig}}^{\prime },c)$
•  
• $\underline{{\mathsf{Oracle}\mathtt{sign}}_k(m,c):}$$\mathtt{sig}=\mathsf{SIG}.\mathsf{sign}(p{p}_{\lambda },k,m,c)$ 
• $\mathbf{Q}=\mathbf{Q}\cup \left\{\right(m,\mathtt{sig}\left)\right\}$; return $\mathtt{sig}$

Theorem 1.

$\mathtt{SIG}$ is complete and EUF-CMA when ref. [36] is complete and EUF-CMA, and solving Approx-SIS of $(n,m-3,q,\gamma ,{\gamma }^{\prime },N)$ is hard.

Algorithm 2 Digital Signatures

1: ⊳ Here, the key spaces change according to $c\le 2^{L^{\prime }}$   2: ⊳ Recall that ${\tau }_2\gg (2^{L^{\prime }}+1)\tau \beta$ and $\gamma \le 2^{L^{\prime }}{\tau }_3$   3: $\underline{\mathsf{SIG}.\mathsf{kgen}(p{p}_{\lambda },c):}$ ⊳$\overrightarrow{\mathit{k}}$ is the secret signing key   4: $\overrightarrow{\mathit{k}}\stackrel{\$}{\leftarrow }{[-c\tau ,c\tau ]}^{(m-3)\times N}$;$\overrightarrow{\mathit{pk}}={\mathtt{highbits}}_{p_1}(\overrightarrow{\mathit{H}}[{\mathit{0}}^3,\overrightarrow{\mathit{r}}])\in {\mathcal{R}}_q^n$   5: return $(\overrightarrow{\mathit{k}},\overrightarrow{\mathit{pk}})$         6: $\underline{\mathsf{SIG}.\mathsf{sign}(p{p}_{\lambda },\overrightarrow{\mathit{k}},m,c):}$ if $c>2^{L^{\prime }}$: return ⊥   7: $\overrightarrow{\mathit{pk}}={\mathtt{highbits}}_{p_1}(\overrightarrow{\mathit{H}}[{\mathit{0}}^3,\overrightarrow{\mathit{r}}])\in {\mathcal{R}}_q^n$   8: ${\overrightarrow{\mathit{r}}}_0\stackrel{\$}{\leftarrow }{[-c{\tau }_3,c{\tau }_3]}^{(m-3)\times N}$   9: $\overrightarrow{\mathit{y}}={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{pk}})\in {\mathcal{R}}_q^n$ 10: $\overrightarrow{x}=\mathtt{hash}(\overrightarrow{\mathit{pk}},\overrightarrow{\mathit{y}},m)\in {\mathcal{C}}_{\beta }^N$ 11: $\overrightarrow{\mathit{\sigma }}={\overrightarrow{\mathit{r}}}_0+\overrightarrow{x}\overrightarrow{\mathit{k}}\in {\mathcal{R}}^{m-3}$ 12: if $\parallel \overrightarrow{\mathit{\sigma }}\parallel >(c{\tau }_3-c\beta \tau )$: go to Step 8 13: ${\overrightarrow{\mathit{y}}}^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}[{\mathit{0}}^3,\overrightarrow{\mathit{\sigma }}]-\overrightarrow{x}{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{pk}}))\in {\mathcal{R}}_q^n$ 14: $\overrightarrow{\mathit{h}}=\mathtt{hints}(\chi ,{\overrightarrow{\mathit{y}}}^{\prime },\overrightarrow{\mathit{y}})$; if $\overrightarrow{\mathit{h}}=\perp$: go to Step 8 15: return $(\overrightarrow{\mathit{\sigma }},\overrightarrow{\mathit{h}},\overrightarrow{x})$      16: $\underline{\mathsf{SIG}.\mathsf{ver}(p{p}_{\lambda },\overrightarrow{\mathit{pk}},m,\overrightarrow{\mathit{\sigma }},\overrightarrow{x},c):}$ 17: if $c>2^{L^{\prime }}$: return 0 18: ${\overrightarrow{\mathit{y}}}^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}[{\mathit{0}}^3,\overrightarrow{\mathit{\sigma }}]-\overrightarrow{x}{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{pk}}))\in {\mathcal{R}}_q^n$ 19: $\overrightarrow{\mathit{y}}=\mathtt{hints}(\chi ,{\overrightarrow{\mathit{y}}}^{\prime },\overrightarrow{\mathit{h}})$; if $\overrightarrow{\mathit{y}}=\perp$: return 0 20: return $\parallel \overrightarrow{\mathit{\sigma }}\parallel <\gamma \wedge \overrightarrow{x}\stackrel{?}{=}\mathtt{hash}(\overrightarrow{\mathit{pk}},\overrightarrow{\mathit{y}},m)$

3. LACT+ Protocol

A LACT+ transaction has input confidential coins, output confidential coins, and a header (signature, carry proof, and activity proof), as shown in Figure 1. The input confidential coins are in the blockchain’s set of unspent coins. During the aggregation, they will be removed from the unspent coin set, and output confidential coins will be added to the unspent coin set (see Figure 2) where $\mathtt{coin}\left(\mathtt{s}\right)$ was removed). Therefore, an aggregated blockchain can be seen as a big transaction that contains all unspent coins. In this section, we explain confidential coins, carry proofs of the headers, and finally the complete aggregable transactions.

Figure 1. LACT+ transaction structure.

Figure 2. Transaction aggregation.

3.1. Confidential Coins

We begin by building confidential coin records where we can hide coin values but can also verify that the hidden coin amounts are in some range $[0,2^L)$.

Let there be a confidential coin scheme $\mathtt{COIN}$ that supports the following functionalities.

• $\mathtt{COIN}.\mathtt{gen}(p{p}_{(\lambda ,L)},v):$ returns $(k,\mathtt{coin})$ if v is in $[0,2^L-1]$; otherwise returns ⊥. Here, k is a secret key, a.k.a., blinding key, and L is defined in $p{p}_{(\lambda ,L)}$.
• $\mathtt{COIN}.\mathtt{open}(p{p}_{(\lambda ,L)},v,k,\mathtt{coin}):$ returns 1 if $\mathtt{coin}$ is generated for $(v\in [0,2^L),k)$; otherwise, returns 0.
• $\mathtt{COIN}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{coin}):$ returns 1 if the hidden coin amount is in $[0,2^L)$ otherwise, returns 0.

Protocol Sketch

First, we sketch an interactive version of a 1-bit range proof. Let there be a value b which should be either 0 or 1. For some mask $a\in [-\alpha ,\alpha ]$ and random challenge $x\in [-1,0,1]$, take $z=bx+a$ if $z\in [-\alpha +1,\alpha -1]$. Otherwise, the process is repeated until a valid z is found. Then $z(z-x)=xa(2b-1)+a^2$ because $x^{2}b(b-1)$ should be zero. We use this method to prove the range of a bit.

Let $\mathcal{P}$ be a prover and $\mathcal{V}$ be a verifier. $\mathcal{V}$ has a commitment $u=\mathtt{com}(b,0,k)$, and $\mathcal{P}$ who knows $k\in [-\tau ,\tau ]$ wants to show that the bit b is either 1 or 0 without revealing it. The prover uses commitments to prove the range of b. First, $\mathcal{P}$ creates commitment $t_1=\mathtt{com}(b,a(2b-1),r_1)$ and sends it to $\mathcal{V}$. After receiving a challenge $x_1$ from $\mathcal{V}$, $\mathcal{P}$ replies with $t_2=\mathtt{com}(xa,a^2,r_2)$. Then, $\mathcal{V}$ sends the second challenge $x_2$. After that, $\mathcal{P}$ computes $z=(bx+a)$ and $r=x_2(x_{1}k+r_1)+r_2$. If z is in $[-\alpha +1,\alpha -1]$ and r is in $[-\tau +{\tau }_1+{\tau }_2,\tau -{\tau }_1-{\tau }_2]$, they statistically hide $b,a,k,r_1$, and $r_2$. Hence, $\mathcal{P}$ sends z and r to $\mathcal{V}$. If z and r are not in the secure ranges, $\mathcal{P}$ rejects them and restarts the protocol. Finally, the verifier $\mathcal{V}$ checks that $\mathtt{com}(x_{1}z,z(z-x_2),r)\stackrel{?}{=}{x}_2{x}_{1}u+x_2{t}_1+t_2$. $\mathcal{V}$ accepts that b is either 0 or 1 if they are equal.

We use this technique to prove the range of the coin by repeating it for all bits. Furthermore, we increase the range of challenges into $2^{2\lambda }$ so that $\mathcal{P}$ cannot cheat. The complete non-interactive protocol $\mathtt{COIN}$ is given in Algorithm 3, and a graphical overview is provided in Figure 3. Note that all LACT+ commitments have the form of $\mathtt{com}(\ast ,\ast ,\ast ,\ast )$, not $\mathtt{com}(\ast ,\ast ,\ast )$. Hence, the verifier will check $\mathtt{com}(x_{1}z,z(z-x_2),0,r)\stackrel{?}{=}{x}_2{x}_{1}u+x_2{t}_1+t_2$ with a fixed 0 value. This extra value space is used for carry proofs which will be explained in the next section.

Figure 3. A graphical overview of confidential coins (Algorithm 3).

One-bit Range Proof Sketch (Interactive)
$\mathcal{P}$		${\mathcal{V}}_2$
$a\stackrel{\$}{\leftarrow }[-\alpha ,\alpha ];r_1\stackrel{\$}{\leftarrow }[-{\tau }_1,{\tau }_1]$
$t_1=\mathtt{com}(b,a(2b-1),r_1)$	$\underrightarrow{t_1}$
$r_2\stackrel{\$}{\leftarrow }[-{\tau }_2,{\tau }_2]$	$\underleftarrow{x_1}$	$x_1\stackrel{\$}{\leftarrow }[-1,1]$
$t_2=\mathtt{com}(xa,a^2,r_2)$	$\underrightarrow{t_2}$
$z=(bx+a)\in [-\alpha +1,\alpha -1]$	$\underleftarrow{x_2}$	$x_2\stackrel{\$}{\leftarrow }[-1,1]$
$r=x_2(x_{1}k+r_1)+r_{2}s.t.$
$r\in [-\tau +{\tau }_1+{\tau }_2,\tau -{\tau }_1-{\tau }_2]$	$\underrightarrow{z,r}$	$\mathtt{com}(x_{1}z,z(z-x_2),r)\stackrel{?}{=}$
		$x_2{x}_{1}u+x_2{t}_1+t_2$

Algorithm 3 New Confidential Coins

1: ⊳ Creates coin records for v coins   2: $\underline{\mathtt{COIN}.\mathtt{gen}(p{p}_{(\lambda ,L)},v)}$:   3: ⊳ Short vector for the commitment   4: $\overrightarrow{b}=\mathtt{binary}(L,v)$ s.t. $v={\sum }_{i=0}^{L-1}{2}^i{b}_i$   5: $\overrightarrow{\mathit{k}}\stackrel{\$}{\leftarrow }{[-\tau ,\tau ]}^{(m-3)\times N}$   6: $\overrightarrow{\mathit{s}}=[\overrightarrow{b},\overrightarrow{0},\overrightarrow{0},\overrightarrow{\mathit{k}}]\in {\mathcal{R}}_q^m$   7: $\overrightarrow{\mathit{u}}={\mathtt{highbits}}_{p_1}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}})\in {\mathcal{R}}_q^n$ ⊳ Commitment   8: ⊳ Get masking values for bits from Lazy Sampling   9: ${[{\overrightarrow{\mathit{a}}}_i\stackrel{\$}{\leftarrow }{[-(\alpha -(1-b_i)),(\alpha -(1-b_i))]}^N]}_{i=0}^L$ 10: ⊳ Short key vectors for range proof commitments 11: ${\overrightarrow{\mathit{r}}}_1\stackrel{\$}{\leftarrow }{[-{\tau }_1,{\tau }_1]}^{(m-3)\times N}$; ${\overrightarrow{\mathit{r}}}_2\stackrel{\$}{\leftarrow }{[-{\tau }_2,{\tau }_2]}^{(m-3)\times N}$ 12: ${\overrightarrow{\mathit{s}}}_1=[\overrightarrow{0},{\sum }_{i=0}^L{\overrightarrow{\mathit{a}}}_i\mathtt{rot}(2b_i-1,i),\overrightarrow{0},{\overrightarrow{\mathit{r}}}_1]\in {\mathcal{R}}^m$ 13: ${\overrightarrow{\mathit{t}}}_1={\mathtt{highbits}}_{p_2}(\overrightarrow{\mathit{H}}{\overrightarrow{\mathit{s}}}_1)\in {\mathcal{R}}_q^n$ 14: ${\overrightarrow{x}}_1=\mathtt{hash}(\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1)\in {\mathcal{C}}_{\beta }^N$ 15: ${\overrightarrow{\mathit{s}}}_2=[{\overrightarrow{x}}_1{\sum }_{i=0}^L{\overrightarrow{\mathit{a}}}_i,{\sum }_{i=0}^L{\overrightarrow{\mathit{a}}}_i{\overrightarrow{\mathit{a}}}_i,\overrightarrow{0},{\overrightarrow{\mathit{r}}}_2]\in {\mathcal{R}}^m$ 16: ${\overrightarrow{\mathit{t}}}_2={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}{\overrightarrow{\mathit{s}}}_2)\in {\mathcal{R}}_q^n$ 17: ${\overrightarrow{x}}_2=\mathtt{hash}(\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,{\overrightarrow{\mathit{t}}}_2)\in {\mathcal{C}}_{\beta }^N$ 18: ${[{\overrightarrow{\mathit{z}}}_i={\overrightarrow{x}}_2\mathtt{rot}(b_i,i)+{\overrightarrow{\mathit{a}}}_i]}_{i=0}^L\in {\mathcal{R}}^L$ 19: $\overrightarrow{\mathit{r}}={\overrightarrow{x}}_2({\overrightarrow{x}}_1\overrightarrow{\mathit{k}}+{\overrightarrow{\mathit{r}}}_1)+{\overrightarrow{\mathit{r}}}_2\in {\mathcal{R}}^{m-3}$ 20: if $\parallel \overrightarrow{\mathit{z}}\parallel >(\alpha -1)\vee \parallel \overrightarrow{\mathit{r}}\parallel >({\tau }_2-{\beta }^2\tau -\beta {\tau }_1)$: 21:    go to Step 5 22: ⊳ Check norms 23: $\widehat{\overrightarrow{z}}={\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_i({\overrightarrow{\mathit{z}}}_i-{\overrightarrow{x}}_2\mathtt{rot}(1,i))\in \mathcal{R}$ 24: if $\parallel \widehat{\overrightarrow{z}}\parallel >\gamma$: go to Step 5 25: ⊳ Create hints for ${\overrightarrow{\mathit{t}}}_2$ 26: $\overrightarrow{\mathit{s}}=[{\overrightarrow{x}}_1{\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_i,\widehat{\overrightarrow{z}},\overrightarrow{0},\overrightarrow{\mathit{r}}]\in {\mathcal{R}}^m$ 27: ${\overrightarrow{\mathit{t}}}_2^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}}-{\overrightarrow{x}}_2({\overrightarrow{x}}_1{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{u}})+{\mathtt{up}}_{p_2}({\overrightarrow{\mathit{t}}}_1)))\in {\mathcal{R}}_q^n$ 28: $\overrightarrow{\mathit{h}}=\mathtt{hints}(\chi ,{\overrightarrow{\mathit{t}}}_2^{\prime },{\overrightarrow{\mathit{t}}}_2)$ 29: if $\overrightarrow{\mathit{h}}=\perp$: go to Step 5 30: return $\overrightarrow{\mathit{k}}$ and $\mathtt{coin}=(\overrightarrow{\mathit{z}},\overrightarrow{\mathit{r}},\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,\overrightarrow{\mathit{h}},{\overrightarrow{x}}_2)$      31: ⊳ Open coin records of v coins and key $\overrightarrow{\mathit{k}}$ 32: $\underline{\mathtt{COIN}.\mathtt{open}(p{p}_{(\lambda ,L)},v,\overrightarrow{\mathit{k}},\mathtt{coin}):}$ 33: $(\overrightarrow{\mathit{z}},\overrightarrow{\mathit{r}},\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,\overrightarrow{\mathit{h}},{\overrightarrow{x}}_2)=\mathtt{coin}$ 34: $\overrightarrow{\mathit{s}}=[\mathtt{binary}(v),\overrightarrow{0},\overrightarrow{0},\overrightarrow{\mathit{k}}]\in {\mathcal{R}}^m$ 35: return $\parallel \overrightarrow{\mathit{s}}\parallel \stackrel{?}{\le }\alpha \wedge \overrightarrow{\mathit{u}}\stackrel{?}{=}{\mathtt{highbits}}_{p_1}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}})\in {\mathcal{R}}_q^n$      36: ⊳ Verify coin records 37: $\underline{\mathtt{COIN}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{coin}):}$ 38: $(\overrightarrow{\mathit{z}},\overrightarrow{\mathit{r}},\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,\overrightarrow{\mathit{h}},{\overrightarrow{x}}_2)=\mathtt{coin}$ 39: ${\overrightarrow{x}}_1=\mathtt{hash}(\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1)$ 40: $\widehat{\overrightarrow{z}}={\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_i({\overrightarrow{\mathit{z}}}_i-{\overrightarrow{x}}_2\mathtt{rot}(1,i))\in \mathcal{R}$ 41: $\overrightarrow{\mathit{s}}=[{\overrightarrow{x}}_1{\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_i,\widehat{\overrightarrow{z}},\overrightarrow{0},\overrightarrow{\mathit{r}}]\in {\mathcal{R}}^m$ 42: ⊳ Use hints to recompute ${\overrightarrow{\mathit{t}}}_2$ 43: ${\overrightarrow{\mathit{t}}}_2^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}}-{\overrightarrow{x}}_2({\overrightarrow{x}}_1{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{u}})+{\mathtt{up}}_{p_2}({\overrightarrow{\mathit{t}}}_1)))\in {\mathcal{R}}_q^n$ 44: ${\overrightarrow{\mathit{t}}}_2=\mathtt{use}\_\mathtt{hints}(\chi ,{\overrightarrow{\mathit{t}}}_2^{\prime },\overrightarrow{\mathit{h}})$ 45: if ${\overrightarrow{\mathit{t}}}_2=\perp$: return 0 46: return ${\overrightarrow{x}}_2\stackrel{?}{=}\mathtt{hash}(\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,{\overrightarrow{\mathit{t}}}_2)\wedge \parallel \overrightarrow{\mathit{s}}\parallel \le \gamma$

We want $\mathtt{COIN}$ to be complete, hiding, binding, zero-knowledge, and knowledge sound. Here, we state the undefined security properties of $\mathtt{COIN}$; completeness and binding. Other properties, namely, hiding, zero-knowledge, and knowledge soundness, defined in Section 2.1 are valid for $\mathtt{COIN}$ as well when the statement $\mathcal{L}$ is

$$“\text{all }\mathit{L}\text{ bits of }\mathit{b}=\mathtt{binary}(\mathit{L},\mathit{v})\text{ are either 0 or 1}”.$$

Definition 7

(Completeness). $\mathtt{COIN}$ is complete if honestly generated proofs can be verified for the correct range, or the following is greater than or equal to $1-ϵ\left(\lambda \right)$.

$$Pr\left[\begin{array}{c}\hfill \mathtt{COIN}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{coin})\end{array}|\begin{array}{c}\hfill vs.\in [0,2^L-1]\\ \hfill (k,\mathtt{coin})=\mathtt{COIN}.\mathtt{gen}(p{p}_{(\lambda ,L)},v)\end{array}\right]$$

Once a coin record has been published, no one, including the creator who knows the secret key, should be able to claim another coin value for the same coin record. Otherwise, after sending a transaction, owners can illegally generate coins. We capture this security property below.

Definition 8

(Binding). $\mathtt{COIN}$ is binding if

$$Pr\left[\begin{array}{c}\hfill (v,k)\stackrel{?}{\ne }(v^{\prime },k^{\prime })\wedge \\ \hfill \mathtt{COIN}.\mathtt{open}(p{p}_{(\lambda ,L)},v,k,\mathtt{coin})\wedge \\ \hfill \mathtt{COIN}.\mathtt{open}(p{p}_{(\lambda ,L)},v^{\prime },k^{\prime },\mathtt{coin})\end{array}|\left(\begin{array}{c}\hfill \mathtt{coin}\\ \hfill v,k\\ \hfill v^{\prime },k^{\prime }\end{array}\right)\leftarrow \mathcal{A}\left(p{p}_{(\lambda ,L)}\right)\right]\le ϵ\left(\lambda \right)$$

Theorem 2.

$\mathtt{COIN}$ is complete, computationally binding, and computational knowledge sound, and zero-knowledge if approx-SIS of $(n,m,q,\gamma ,{\gamma }^{\prime },N)$ is hard (see the security proof in Appendix A).

3.2. Logarithmic-Sized Carry Proofs

Binary commitments are smaller than full integer commitments. However, we cannot directly check summations of transactions’ in/outputs and chains’ total unspent coin amount when they are in binary forms. Therefore, LACT  ref. [2] uses static carries with maximum two inputs and two outputs and a static supply.

Unlike traditional blockchains, LACT maintains an unspent coin record (with a zero key) for the coinbase (coin supplier) where the coinbase holds future supply, and those coins do not belong to anyone until they are awarded. The idea is to maintain a constant coin amount on the blockchain all the time. For instance, the coinbase holds the maximum $v_{\mathtt{base}}=S$ at the beginning and keeps reducing the amount $v_{\mathtt{base}}=v_{\mathtt{base}}-s^{\left(t\right)}$ with each rewarded coin $s^{\left(t\right)}$ of transaction t. Therefore, the blockchain always has S coins. When the coin amount is constant, the following equations can be used to check the summation of individual transactions and the blockchain.

Let the maximum coin amount be in $[0,2^L)$. For transaction t, let the inputs be $\mathit{c}$ with coins ${\left[v_i\right]}_{i=0}^{\ast }$ such that $\mathtt{binary}\left(v_i\right)={\left[b_{i,j}\right]}_{j=0}^L$ and outputs be ${\mathit{c}}^{\prime }$ with coins ${\left[v_i^{\prime }\right]}_{i=0}^{\ast }$ such that $\mathtt{binary}\left(v_i^{\prime }\right)$$={[b_{i,j}^{\prime }]}_{j=0}^L$. Then, the input carries ${\left[c_j\right]}_{j=0}^{L+1}$ are computed as

$${\left[0,\left({\sum }_{i=1}^{\left|\mathit{c}\right|}{b}_{i,0}+c_0\right)÷\mathtt{2},\dots ,\left({\sum }_{i=1}^{\left|\mathit{c}\right|}{b}_{i,L-2}+c_{L-2}\right)÷\mathtt{2},0\right]}_{j=0}^{L+1}$$

where $c_0$ and $c_L$ are zeros, and other $c_j$s are either 0 or 1. Similarly, the output carries ${[c_j^{\prime }]}_{j=0}^{L+1}$ are

$${\left[0,\left({\sum }_{i=1}^{|{\mathit{c}}^{\prime }|}{b}_{i,0}^{\prime }+c_0^{\prime }\right)÷\mathtt{2},\dots ,\left({\sum }_{i=1}^{|{\mathit{c}}^{\prime }|}{b}_{i,L-2}^{\prime }+c_{L-2}^{\prime }\right)÷\mathtt{2},0\right]}_{j=0}^{L+1}$$

such that $c_0^{\prime }$ and $c_L^{\prime }$ are zeros, and $c_j^{\prime }$s are 0 or 1. Note that ÷ is the integer division and $|·|$ is the size of a set/vector.

Then, these binary vectors satisfy Equation (1) if inputs coins are equal to output coins.

$${\left[\sum _{i=1}^{|{\mathit{c}}^{\prime }|}{b}_{i,j}^{\prime }-\sum _{i=1}^{\left|\mathit{c}\right|}{b}_{i,j}+(c_j^{\prime \left(t\right)}-2c_{j+1}^{\prime \left(t\right)}-c_j^{\left(t\right)}+2c_{j+1}^{\left(t\right)})\stackrel{?}{=}0\right]}_{j=0}^L$$

(1)

Furthermore, due to the constant coin amount, Equation (2) can be used to verify that unspent coins ($\mathtt{ucoins}$) are equal to the total supply S of headers ($\mathtt{headers}$) $\mathtt{binary}\left(S\right)={\left[S_j\right]}_{j=0}^L$.

$${\left[\sum _{i=1}^{\left|\mathtt{ucoins}\right|}{b}_{i,j}+\sum _{t=1}^{\left|\mathtt{headers}\right|}\left(c_j^{\prime \left(t\right)}-2c_{j+1}^{\prime \left(t\right)}-c_j^{\left(t\right)}+2c_{j+1}^{\left(t\right)}\right)\stackrel{?}{=}{S}_j\right]}_{j=0}^L$$

(2)

Therefore, LACT headers contain carry

$$\mathtt{com}({[c_j^{\prime \left(t\right)}-2c_{j+1}^{\prime \left(t\right)}-c_j^{\left(t\right)}+2c_{j+1}^{\left(t\right)}]}_{j=0}^{L-1},\ast )$$

and range proofs of in/output carries (we call them carry proofs) when in/output size is 2. Note that when there is only one in/output, the carries are always zero, in which case no carry proofs are needed. These carries’ range proofs are similar to coins’ carry proofs even though a functional output of the carries is committed. However, a normal transaction has to be separated into multiple LACT transactions if there are more than two inputs or outputs. For example, a transaction of $(2\Rightarrow 3)$ can be separated into two transactions; $(2\Rightarrow 2)$ and $(1\Rightarrow 2)$ with two carry proofs.

We generalize this concept of static carry proofs for more than two input and output transactions at a logarithmic cost to reduce the size impact of carry proofs in LACT+.

Let there be a carry proof protocol, $\mathtt{CARRY}$ that commits and provides range proofs for maximum $2^{L^{\prime }}$ number of inputs or outputs.

• $\mathtt{CARRY}.\mathtt{gen}(p{p}_{(\lambda ,L)},{[v_i]}_{i=0}^{\left|\mathtt{in}\right|},{[v_i]}_{i=0}^{\left|\mathtt{out}\right|}):$ returns $(k,\mathtt{carry})$ if all $\mathit{v}$ and $\mathit{v}$ are in $[0,2^L-1]$; otherwise returns ⊥. Here, k is the secret key of carry commitment, $\left|\mathtt{in}\right|\le 2^{L^{\prime }}$ and $\left|\mathtt{out}\right|\le 2^{L^{\prime }}$. At this point, we do not check $\sum \mathit{v}=\sum {\mathit{v}}^{\prime }$, which will be performed in transaction creation. Here, $\left|\mathtt{in}\right|$ and $\left|\mathtt{out}\right|$ are the input and output sizes.
• $\mathtt{CARRY}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{carry}):$ returns one if the hidden carries are in $[0,2^{L^{\prime }})$ and the carries are committed according to Equation (1); otherwise, it returns zero.

Protocol Sketch

Carry proofs contain a commitment and a range proof to show that each carry is in a proper range, which is $[0,2^{L^{\prime }})$ for maximum $2^{L^{\prime }}\ge 2$ inputs and outputs. Let there be $2^{L_{\mathtt{in}}}$ number of inputs and $2^{L_{\mathtt{out}}}$ number of outputs. A LACT+ carry commitment is $\mathtt{com}(c_j^{\prime (t)}-2c_{j+1}^{\prime (t)}-c_j^{(t)}+2c_{j+1}^{(t)},0,0,k)$ when $\mathit{c}$ and ${\mathit{c}}^{\prime }$ are input and output carries. Here, except for the 0^th and ${(L-1)}^{\mathrm{th}}$ carries, the output carries ${[c_j^{\prime }]}_{j=1}^{L-2}$ are in $[0,2^{L_{\mathtt{out}}})$, and other input carries ${[c_j]}_{j=1}^{L-2}$ are in $[0,2^{L_{\mathtt{in}}})$. Hence, LACT+ creates range proofs for the following vectors

$$\begin{gathered} [\mathtt{binary}(L_{\mathtt{in}},c_1),\dots ,\mathtt{binary}(L_{\mathtt{in}},c_{L-2})]\in \mathcal{R}\mathrm{and} \\ [\mathtt{binary}(L_{\mathtt{out}},c_1^{\prime }),\dots ,\mathtt{binary}(L_{\mathtt{out}},c_{L-2}^{\prime })]\in \mathcal{R}. \end{gathered}$$

We define the new carry proof protocol in Algorithm 4. Furthermore, we provide a graphical view of the carry proofs in Figure 4 using the same notation as Algorithm 4.

Algorithm 4 New Confidential Carry Proofs

1: ⊳$\left|\mathtt{in}\right|,\left|\mathtt{out}\right|$ $(\le 2^{L^{\prime }})$ are the number of in/outputs, including supplied coins and transaction fee.   2: $\underline{\mathtt{CARRY}.\mathtt{gen}(p{p}_{(\lambda ,L)},{\left[v_i\right]}_{i=0}^{\left|\mathtt{in}\right|},{\left[v_i\right]}_{i=0}^{\left|\mathtt{out}\right|}):}$   3: if $\left|\mathtt{in}\right|>2^{L^{\prime }}\wedge \left|\mathtt{out}\right|>2^{L^{\prime }}$:   4:         return ⊥   5: $L_{\mathtt{in}}=\lceil {log}_2(\lfloor (2\left|\mathtt{in}\right|-1)\rfloor )\rceil$   6: $L_{\mathtt{out}}=\lceil {log}_2(\lfloor (2\left|\mathtt{out}\right|-1)\rfloor )\rceil$   7: ${[b_i=\mathtt{binary}\left(v^{\left(i\right)}\right)]}_{i=1}^{\left|\mathtt{in}\right|}$, ${[b_i^{\prime }=\mathtt{binary}\left(v^{\prime \left(i\right)}\right)]}_{i=1}^{\left|\mathtt{out}\right|}$   8: ⊳ Carries when ÷ is the integer division   9: ${\mathit{c}}_0=\left[0,{[c_{0,j+1}=\left({\sum }_{i=1}^{\left|\mathtt{in}\right|}{b}_{i,j}+c_{0,j}\right)÷2]}_{j=0}^{L-1},0\right]$  10: ${\mathit{c}}_1=\left[0,{[c_{1,j+1}=\left({\sum }_{i=1}^{\left|\mathtt{out}\right|}{b}_{i,j}^{\prime }+c_{1,j}\right)÷2]}_{j=0}^{L-1},0\right]$ 11: ⊳ Bits of input carries 12: ${\mathit{c}}_0^{\prime }={\left[{\mathtt{binary}}_{L_{\mathtt{in}}}\left(c_{0,j}\right)\right]}_{j=0}^{L+1}\in {\mathcal{R}}^{(L+1)\times L^{\prime }}$ 13: ⊳ Bits of output carries 14: ${\mathit{c}}_1^{\prime }={\left[{\mathtt{binary}}_{L_{\mathtt{out}}}\left(c_{1,j}\right)\right]}_{j=0}^{L+1}\in {\mathcal{R}}^{(L+1)\times L^{\prime }}$ 15: ⊳ Compute random masks for carries 16: ⊳ Lazy Sampling 17: ${[{[{\overrightarrow{\mathit{d}}}_{0,i,l}\stackrel{\$}{\leftarrow }{[-(\alpha -(1-c_{0,i,l}^{\prime })),(\alpha -(1-c_{0,i,l}^{\prime }))]}^N]}_{i=1}^L]}_{l=0}^{L_{\mathtt{in}}}$ 18: Set ${\overrightarrow{\mathit{d}}}_{0,0}=\overrightarrow{\mathit{0}}$ and ${\overrightarrow{\mathit{d}}}_{0,L}=\overrightarrow{\mathit{0}}$ 19: $[{[{\overrightarrow{\mathit{d}}}_{1,i,l}\stackrel{\$}{\leftarrow }{[-(\alpha -(1-c_{1,i,l}^{\prime })),{(\alpha -(1-c_{1,i,l}^{\prime }))}^N]}_{i=1}^L]}_{l=0}^{L_{\mathtt{out}}}$ 20: Set ${\overrightarrow{\mathit{d}}}_{1,0}=\overrightarrow{\mathit{0}}$ and ${\overrightarrow{\mathit{d}}}_{1,L}=\overrightarrow{\mathit{0}}$ 21: ${\widehat{\overrightarrow{c}}}_0={\sum }_{l=0}^{L_{\mathtt{in}}}{\sum }_{j=0}^L{\overrightarrow{\mathit{d}}}_{0,j,l}\mathtt{rot}(2c_{0,j,l}^{\prime }-1,j{L}_{\mathtt{in}}+l)\in \mathcal{R}$ 22: ${\widehat{\overrightarrow{c}}}_1={\sum }_{l=0}^{L_{\mathtt{out}}}{\sum }_{j=0}^L{\overrightarrow{\mathit{d}}}_{1,j}\mathtt{rot}(2c_{1,j,l}^{\prime }-1,j{L}_{\mathtt{out}}+l)\in \mathcal{R}$ 23: ${\widehat{\overrightarrow{c}}}^{\prime }={[(c_{1,j}-c_{0,j})-2(c_{1,j+1}-c_{0,j+1})]}_{j=0}^L,{\mathit{0}}^{N-L}]\in \mathcal{R}$ 24: $t_{\mathtt{in}}=N-j·(L_{\mathtt{in}}-1)-l$ 25: $t_{\mathtt{in}}^{\prime }=N-(j+1)·(L_{\mathtt{in}}-1)-l-1$ 26: ${\widehat{\overrightarrow{d}}}_0^{\prime }={\sum }_{l=0}^{L_{\mathtt{in}}}{\sum }_{j=0}^L({\overrightarrow{\mathit{d}}}_{0,j,l}\mathtt{rot}(-2^l,t_{\mathtt{in}})-2{\overrightarrow{\mathit{d}}}_{0,j+1,l}\mathtt{rot}(-2^l,t_{\mathtt{in}}^{\prime }))$ 27: $t_{\mathtt{out}}=N-j·(L_{\mathtt{out}}-1)-l$ 28: $t_{\mathtt{out}}^{\prime }=N-(j+1)·(L_{\mathtt{out}}-1)-l-1$ 29: ${\widehat{\overrightarrow{d}}}_1^{\prime }={\sum }_{l=0}^{L_{\mathtt{out}}}{\sum }_{j=0}^L({\overrightarrow{\mathit{d}}}_{1,j,l}\mathtt{rot}(-2^l,t_{\mathtt{out}})-2{\overrightarrow{\mathit{d}}}_{1,j+1,l}\mathtt{rot}(-2^l,t_{\mathtt{out}}^{\prime }))$ 30: ⊳ Pick random masks 31: $\overrightarrow{\mathit{k}}\stackrel{\$}{\leftarrow }{[-\tau ,\tau ]}^{(m-3)\times N}$ 32: ${\overrightarrow{\mathit{r}}}_1\stackrel{\$}{\leftarrow }{[-{\tau }_1,{\tau }_1]}^{(m-3)\times N}$; ${\overrightarrow{\mathit{r}}}_2\stackrel{\$}{\leftarrow }{[-{\tau }_2,{\tau }_2]}^{(m-3)\times N}$ 33: ⊳ Carry commitment 34: $\overrightarrow{\mathit{u}}={\mathtt{highbits}}_{p_1}(\overrightarrow{\mathit{H}}[{\widehat{\overrightarrow{c}}}^{\prime },\overrightarrow{0},\overrightarrow{0},\overrightarrow{\mathit{k}}])\in {\mathcal{R}}_q^n$ 35: ${\overrightarrow{\mathit{t}}}_1={\mathtt{highbits}}_{p_2}(\overrightarrow{\mathit{H}}[\overrightarrow{0},{\widehat{\overrightarrow{c}}}_1,{\widehat{\overrightarrow{c}}}_0,{\overrightarrow{\mathit{r}}}_1])\in {\mathcal{R}}_q^n$ 36: ${\overrightarrow{x}}_1=\mathtt{hash}(\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1)\in {\mathcal{C}}_{\beta }^N$ 37: ${\overrightarrow{\mathit{s}}}_2=[{\overrightarrow{x}}_1({\widehat{\overrightarrow{d}}}_1^{\prime }-{\widehat{\overrightarrow{d}}}_0^{\prime }),{\sum }_{l=0}^{L_{\mathtt{out}}}{\sum }_{j=0}^L{\overrightarrow{\mathit{d}}}_{1,j,l}^2,{\sum }_{l=0}^{L_{\mathtt{in}}}{\sum }_{j=0}^L{\overrightarrow{\mathit{d}}}_{0,j,l}^2,{\overrightarrow{\mathit{r}}}_2]$   38: ${\overrightarrow{\mathit{t}}}_2={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}{\overrightarrow{\mathit{s}}}_2)\in {\mathcal{R}}_q^n$ 39: ${\overrightarrow{x}}_2=\mathtt{hash}(\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,{\overrightarrow{\mathit{t}}}_2)\in {\mathcal{C}}_{\beta }^N$

40: ${\overrightarrow{\mathit{z}}}_0={[{[{\overrightarrow{x}}_2\mathtt{rot}(c_{0,j,l},j{L}_{\mathtt{in}}+l)+{\overrightarrow{\mathit{d}}}_{0,j,l}]}_{j=1}^L]}_{l=0}^{L_{\mathtt{in}}}\in {\mathcal{R}}^{L_{\mathtt{in}}\times L}$ 41: ${\overrightarrow{\mathit{z}}}_1={[{[{\overrightarrow{x}}_2\mathtt{rot}(c_{1,j,l},j{L}_{\mathtt{out}}+l)+{\overrightarrow{\mathit{d}}}_{1,j,l}]}_{j=1}^L]}_{l=0}^{L_{\mathtt{in}}}\in {\mathcal{R}}^{L_{\mathtt{out}}\times L}$ 42: if $\parallel {\overrightarrow{\mathit{z}}}_0\parallel >(\alpha -1)\vee \parallel {\overrightarrow{\mathit{z}}}_1\parallel >(\alpha -1)$: 43:      go to Step 15 44: $\overrightarrow{\mathit{r}}={\overrightarrow{x}}_2({\overrightarrow{x}}_1\overrightarrow{\mathit{k}}+{\overrightarrow{\mathit{r}}}_1)+{\overrightarrow{\mathit{r}}}_2\in {\mathcal{R}}^{m-3}$ 45: if  $\parallel \overrightarrow{\mathit{r}}\parallel >({\tau }_2-{\beta }^2\tau -\beta {\tau }_1):$ 46:          go to Step 15 47: ${\widehat{\overrightarrow{z}}}_0^{\prime }={\overrightarrow{x}}_1{\sum }_{l=0}^{L_{\mathtt{in}}}{\sum }_{j=0}^L({\overrightarrow{\mathit{z}}}_{0,j,l}\mathtt{rot}(-2^l,t_{\mathtt{in}})$ 48:               $-2{\overrightarrow{\mathit{z}}}_{0,j+1,l}\mathtt{rot}(-2^l,t_{\mathtt{in}}^{\prime }))\in \mathcal{R}$ 49: ${\widehat{\overrightarrow{z}}}_1^{\prime }={\overrightarrow{x}}_1{\sum }_{l=0}^{L_{\mathtt{out}}}{\sum }_{j=0}^L({\overrightarrow{\mathit{z}}}_{1,j,l}\mathtt{rot}(-2^l,t_{\mathtt{out}})$ 50:               $-2{\overrightarrow{\mathit{z}}}_{1,j+1,l}\mathtt{rot}(-2^l,t_{\mathtt{out}}^{\prime }))\in \mathcal{R}$ 51: ${\widehat{\overrightarrow{z}}}_0={\sum }_{l=0}^{L_{\mathtt{in}}}{\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_{0,i}({\overrightarrow{\mathit{z}}}_{0,i}-{\overrightarrow{x}}_2\mathtt{rot}(1,i{L}_{\mathtt{in}}+l))\in \mathcal{R}$ 52: ${\widehat{\overrightarrow{z}}}_1={\sum }_{l=0}^{L_{\mathtt{out}}}{\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_{1,i}({\overrightarrow{\mathit{z}}}_{1,i}-{\overrightarrow{x}}_2\mathtt{rot}(1,i{L}_{\mathtt{out}}+l))\in \mathcal{R}$   53: $\overrightarrow{\mathit{s}}=[{\widehat{\overrightarrow{z}}}_1^{\prime }-{\widehat{\overrightarrow{z}}}_0^{\prime },{\widehat{\overrightarrow{z}}}_1,{\widehat{\overrightarrow{z}}}_0,\overrightarrow{\mathit{r}}]\in {\mathcal{R}}^m$ 54: if $\parallel \overrightarrow{\mathit{s}}\parallel >\gamma$: go to Step 15 55: ⊳ Compute hints for ${\overrightarrow{\mathit{t}}}_2$ 56: ${\overrightarrow{\mathit{t}}}_2^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}}-{\overrightarrow{x}}_2({\overrightarrow{x}}_1{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{u}})+{\mathtt{up}}_{p_2}({\overrightarrow{\mathit{t}}}_1)))\in {\mathcal{R}}_q^n$ 57: $\overrightarrow{\mathit{h}}=\mathtt{hints}(\chi ,{\overrightarrow{\mathit{t}}}_2^{\prime },{\overrightarrow{\mathit{t}}}_2)$ 58: if $\overrightarrow{\mathit{h}}=\perp$: go to Step 15 59: return $\mathtt{carry}=({\overrightarrow{\mathit{z}}}_0,{\overrightarrow{\mathit{z}}}_1,\overrightarrow{\mathit{r}},\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,\overrightarrow{\mathit{h}},{\overrightarrow{x}}_2)$       60: $\underline{\mathtt{CARRY}.\mathtt{ver}(p{p}_{(\lambda ,L)},|\mathtt{in}|,|\mathtt{out}|,\mathtt{carry}):}$ 61: ⊳$(\ast )$ denotes variables that can be empty 62: $({\overrightarrow{\mathit{z}}}_0^{(\ast )},{\overrightarrow{\mathit{z}}}_1^{(\ast )},{\overrightarrow{\mathit{r}}}^{(\ast )},{\overrightarrow{\mathit{u}}}^{(\ast )},{\overrightarrow{\mathit{t}}}_1^{(\ast )},{\overrightarrow{\mathit{h}}}^{(\ast )},{\overrightarrow{x}}_2^{(\ast )}):=\mathtt{carry}$ 63: if $\left|\mathtt{in}\right|>2^{L^{\prime }}\wedge \left|\mathtt{out}\right|>2^{L^{\prime }}$: 64:         return ⊥ 65: $L_{\mathtt{in}}=\lceil {log}_2(\lfloor (2\left|\mathtt{in}\right|-1)\rfloor )\rceil$ 66: $L_{\mathtt{out}}=\lceil {log}_2(\lfloor (2\left|\mathtt{out}\right|-1)\rfloor )\rceil$ 67: $t_{\mathtt{in}}=N-j·(L_{\mathtt{in}}-1)-l$ 68: $t_{\mathtt{in}}^{\prime }=N-(j+1)·(L_{\mathtt{in}}-1)-l-1$ 69: $t_{\mathtt{out}}=N-j·(L_{\mathtt{out}}-1)-l$ 70: $t_{\mathtt{out}}^{\prime }=N-(j+1)·(L_{\mathtt{out}}-1)-l-1$ 71: if $\parallel {\overrightarrow{\mathit{z}}}_0\parallel >\alpha \vee \parallel {\overrightarrow{\mathit{z}}}_1\parallel >\alpha$: 72:      return 0 73: ${\widehat{\overrightarrow{z}}}_0^{\prime }={\overrightarrow{x}}_1{\sum }_{l=0}^{L_{\mathtt{in}}}{\sum }_{j=0}^L({\overrightarrow{\mathit{z}}}_{0,j,l}\mathtt{rot}(-2^l,t_{\mathtt{in}})$ 74:               $-2{\overrightarrow{\mathit{z}}}_{0,j+1,l}\mathtt{rot}(-2^l,t_{\mathtt{in}}^{\prime }))\in \mathcal{R}$ 75: ${\widehat{\overrightarrow{z}}}_1^{\prime }={\overrightarrow{x}}_1{\sum }_{l=0}^{L_{\mathtt{out}}}{\sum }_{j=0}^L({\overrightarrow{\mathit{z}}}_{1,j,l}\mathtt{rot}(-2^l,t_{\mathtt{out}})$ 76:               $-2{\overrightarrow{\mathit{z}}}_{1,j+1,l}\mathtt{rot}(-2^l,t_{\mathtt{out}}^{\prime }))\in \mathcal{R}$ 77: ${\widehat{\overrightarrow{z}}}_0={\sum }_{l=0}^{L_{\mathtt{in}}}{\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_{0,i}({\overrightarrow{\mathit{z}}}_{0,i}-{\overrightarrow{x}}_2\mathtt{rot}(1,i{L}_{\mathtt{in}}+l))\in \mathcal{R}$ 78: ${\widehat{\overrightarrow{z}}}_1={\sum }_{l=0}^{L_{\mathtt{out}}}{\sum }_{i=0}^L{\overrightarrow{\mathit{z}}}_{1,i}({\overrightarrow{\mathit{z}}}_{1,i}-{\overrightarrow{x}}_2\mathtt{rot}(1,i{L}_{\mathtt{out}}+l))\in \mathcal{R}$   79: $\overrightarrow{\mathit{s}}=[{\widehat{\overrightarrow{z}}}_1^{\prime }-{\widehat{\overrightarrow{z}}}_0^{\prime },{\widehat{\overrightarrow{z}}}_1,{\widehat{\overrightarrow{z}}}_0,\overrightarrow{\mathit{r}}]\in {\mathcal{R}}^m$ 80: if $\parallel \overrightarrow{\mathit{s}}\parallel >\gamma$: return 0 81: ⊳ Recompute ${\overrightarrow{\mathit{t}}}_2$ from hints 82: ${\overrightarrow{\mathit{t}}}_2^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}}-{\overrightarrow{x}}_2({\overrightarrow{x}}_1{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{u}})+{\mathtt{up}}_{p_2}({\overrightarrow{\mathit{t}}}_1)))\in {\mathcal{R}}_q^n$ 83: ${\overrightarrow{\mathit{t}}}_2=\mathtt{use}\_\mathtt{hints}(\chi ,{\overrightarrow{\mathit{t}}}_2^{\prime },\overrightarrow{\mathit{h}})$ 84: if ${\overrightarrow{\mathit{t}}}_2=\perp$: return 0 85: return ${\overrightarrow{x}}_2\stackrel{?}{=}\mathtt{hash}(\overrightarrow{\mathit{u}},{\overrightarrow{\mathit{t}}}_1,{\overrightarrow{\mathit{t}}}_2)$

Figure 4. Graphical overview of carry proofs (Algorithm 4).

New carry proofs provide the following properties; completeness, knowledge soundness, and zero-knowledge argument. Zero-knowledge and knowledge soundness are defined for a statement $\mathcal{L}$,

$$“\text{all input and output carries are in }[0,2^{L_{\mathtt{in}}})\mathrm{and}[0,2^{L_{\mathtt{out}}})”$$

according to Definitions 2 and 3.

Definition 9

(Completeness). $\mathtt{CARRY}$ is complete if honestly generated proofs are always valid such that the following is greater than or equal to $1-ϵ\left(\lambda \right)$.

$$Pr\left[\begin{array}{c}\hfill \mathtt{CARRY}.\mathtt{ver}(p{p}_{(\lambda ,L)},\\ \hfill \left|\mathtt{in}\right|,\left|\mathtt{out}\right|,\mathtt{c})\end{array}|\begin{array}{c}\hfill \mathit{v},{\mathit{v}}^{\prime }\in [0,2^L-1]s.t.|\mathit{v}|,|{\mathit{v}}^{\prime }|\parallel \le 2^{L^{\prime }}\\ \hfill (k,\mathtt{c})=\mathtt{CARRY}.\mathtt{gen}(p{p}_{(\lambda ,L)},\mathit{v},{\mathit{v}}^{\prime })\end{array}\right]$$

Theorem 3.

$\mathtt{CARRY}$ is complete, zero-knowledge, and witness extractable if Approx-SIS of $(n,m,q,\gamma ,$${\gamma }^{\prime },N)$ is hard (see the security proof in Appendix B).

3.3. Aggregable Confidential Transactions with Activity Proofs

In this section, we describe LACT+ transactions, $\mathtt{TX}$, with new confidential coins, carry proofs, and activity proofs.

A transaction converts a set of existing coin records (inputs) into new coins (outputs). First, users agree on the inputs and outputs. Then they create a carry proof to show the summation. Finally, they create the transaction by computing a signature to prove the ownership. Let ${\left[\mathit{b}\right]}_{i=0}^{\ast }$, ${\left[{\mathit{b}}^{\prime }\right]}_{i=0}^{\ast }$, ${\mathit{c}}_0$, and ${\mathit{c}}_1$ be the binary inputs, binary outputs, input carries, and output carries accordingly. If the input coins are equal to output coins, they satisfy Equation (1) and a zero-coefficient vector is output. Therefore, the summed commitment $pk$ is,

$$\mathtt{com}\left(\begin{array}{c}\hfill \sum _{i=0}^{\ast }{\mathit{b}}^{\prime }-\sum _{i=0}^{\ast }\mathit{b}\\ \hfill +(c_j^{\prime \left(t\right)}-2c_{j+1}^{\prime \left(t\right)}\\ \hfill -c_j^{\left(t\right)}+2c_{j+1}^{\left(t\right)})\end{array},0,0,\underset{r}{\underbrace{\begin{array}{c}\hfill \sum _{i=0}^{\ast }{k}_i^{\prime }\\ \hfill -\sum _{i=0}^{\ast }{k}_i+k\end{array}}}\right)=\mathtt{com}\left(0,0,0,r\right)=pk$$

when $k,{\left[k\right]}_{i=0}^{\ast }$, and ${\left[k^{\prime }\right]}_{i=0}^{\ast }$ are the keys of the carry commitment, input coin commitments, and output coin commitments. Therefore, $\mathtt{TX}$ asks the users to use $(r,pk)$ as the secret–public key pair and create a signature. First, the users picks a random $r^{\prime }$ and computes $y=\mathtt{com}(0,0,0,r^{\prime })$. Then, users’ computers receive the challenge $x=\mathtt{hash}(u,y)$ by hashing $pk$ and y, and compute $\sigma =r^{\prime }-xr$. The signature is $(\sigma ,x)$. If the input coins are equals to output coins, verifiers can recompute $y^{\prime }:=\mathtt{com}(0,0,0,\sigma )-x\times pk$ and check $x\stackrel{?}{=}\mathtt{hash}(pk,y^{\prime })$. When the challenge is large enough, users cannot cheat and create valid signatures if they illegally generate coins or steal coins.

LACT+ transactions contain activity proofs to enable complete aggregation. Activity proofs are immutable, or it is computationally impossible to find two different input and output sets for the same activity proof. Hence, preserving activity proofs is sufficient to provide immutability to the whole blockchain, including the removed spent coins.

The transaction generation is a multi-party protocol where each sender or receiver keeps their secret keys without sharing and computes a secure partial signature. At the end, those partial signatures are aggregated into a single signature used as the transaction’s signature. Therefore, the senders do not learn the secret keys of other inputs and outputs, and cannot take back the sent coins. We use “green color” to denote the secret computations of each individual.

Before aggregating a transaction into the chain, verifiers check whether the inputs are in the chain or not. If they are in the chain, verifiers check the summation, ownership, and activity of the transaction. When the transaction has valid proofs, the verifiers remove the inputs from the chain, add outputs into the unspent coin set, and preserve the header. The complete protocol of $\mathtt{TX}$ is stated in Algorithm 5 and an example of transaction aggregation is stated in Figure 2.

Algorithm 5 LACT+ Transactions and Chains

1: ⊳$\left|\mathtt{in}\right|,\left|\mathtt{out}\right|$ $(\le 2^{L^{\prime }})$ are the number of in/outputs.   2: ⊳ owners do not share secret keys of inputs or outputs.   3: $\underline{\mathtt{TX}.\mathtt{gen}(p{p}_{(\lambda ,L)},\mathit{k},\mathtt{carry},{[{\mathit{k}}_i,v_i,{\mathtt{coin}}_i]}_{i=1}^{\left|\mathtt{in}\right|},{[{\mathit{k}}_i^{\prime },v_i^{\prime },{\mathtt{coin}}_i^{\prime }]}_{i=1}^{\left|\mathtt{out}\right|})}$:     4: if $\sum \mathit{v}\ne \sum {\mathit{v}}^{\prime }$: return ⊥   5: ⊳ Commitments cannot be repeated   6: if  $\bigcup \mathtt{coin}.\overrightarrow{\mathit{u}}\ne \mathtt{coin}.\overrightarrow{\mathit{u}}\vee \bigcup {\mathtt{coin}}^{\prime }.\overrightarrow{\mathit{u}}\ne {\mathtt{coin}}^{\prime }.\overrightarrow{\mathit{u}}$   7:       $\vee \mathtt{coin}\bigcap {\mathtt{coin}}^{\prime }\ne \varphi$: return 0   8: $\Delta \ne \mathtt{activity}({[{\mathtt{coin}}_i^{\prime }.\overrightarrow{\mathit{u}}]}_{i=1}^{\left|\mathtt{out}\right|},{[{\mathtt{coin}}_i.\overrightarrow{\mathit{u}}]}_{i=1}^{\left|\mathtt{in}\right|})\in \mathbb{H}$   9: Each sender ${\displaystyle i\in [1,|\mathtt{in}|]}$secretly computes: 10:     ▹${\overrightarrow{\mathit{r}}}_{3,i}\stackrel{\$}{\leftarrow }{[-{\tau }_3,{\tau }_3]}^{(m-3)\times N}$ 11:     ▹${\overrightarrow{\mathit{y}}}_i=\overrightarrow{\mathit{H}}[\overrightarrow{0},\overrightarrow{0},\overrightarrow{0},{\overrightarrow{\mathit{r}}}_{3,i}]\in {\mathcal{R}}_q^n$ and share ${\overrightarrow{\mathit{y}}}_i$ 12: Each receiver ${\displaystyle i\in [1,|\mathtt{out}|]}$ secretly computes: 13:     ▹${\overrightarrow{\mathit{r}}}_{3,i}^{\prime }\stackrel{\$}{\leftarrow }{[-{\tau }_3,{\tau }_3]}^{(m-3)\times N}$ 14:     ▹${\overrightarrow{\mathit{y}}}_i^{\prime }=\overrightarrow{\mathit{H}}[\overrightarrow{0},\overrightarrow{0},\overrightarrow{0},{\overrightarrow{\mathit{r}}}_{3,i}^{\prime }]\in {\mathcal{R}}_q^n$ and share ${\overrightarrow{\mathit{y}}}_i^{\prime }$ 15: ⊳ All receivers compute public key $\overrightarrow{\mathit{pk}}\in {\mathcal{R}}_q^n$. 16: $\overrightarrow{\mathit{pk}}={\mathtt{highbits}}_{p_1}(\mathtt{carry}.\overrightarrow{\mathit{u}}+{\sum }_{i=1}^{\left|\mathtt{out}\right|}{\mathtt{coin}}_i^{\prime }.\overrightarrow{\mathit{u}}-{\sum }_{i=1}^{\left|\mathtt{in}\right|}{\mathtt{coin}}_i.\overrightarrow{\mathit{u}})$   17: $\overrightarrow{\mathit{y}}={\mathtt{highbits}}_{{\gamma }^{\prime }}({\sum }_{i=1}^{\left|\mathtt{out}\right|}{\overrightarrow{\mathit{y}}}_i^{\prime }-{\sum }_{i=1}^{\left|\mathtt{in}\right|}{\overrightarrow{\mathit{y}}}_i)\in {\mathcal{R}}_q^n$ 18: ${\overrightarrow{x}}_0=\mathtt{hash}(\overrightarrow{\mathit{pk}},\overrightarrow{\mathit{y}},\Delta )\in {\mathcal{C}}_{\beta }^N$ ⊳ Signature challenge 19: Each sender ${\displaystyle i\in [1,|\mathtt{in}|]}$ secretly computes: 20:     ▹ ${\overrightarrow{\mathit{\sigma }}}_i={\overrightarrow{\mathit{r}}}_{3,i}+{\overrightarrow{x}}_0{\overrightarrow{\mathit{k}}}_i\in {\mathcal{R}}^{(m-3)}$ 21:     ▹if $\parallel {\overrightarrow{\mathit{\sigma }}}_i\parallel >({\tau }_3-\beta \tau )$: go to Step 9 22: Each receiver ${\displaystyle i\in [1,|\mathtt{out}|]}$ secretly computes: 23:     ▹${\overrightarrow{\mathit{\sigma }}}_i^{\prime }={\overrightarrow{\mathit{r}}}_{3,i}^{\prime }+{\overrightarrow{x}}_0{\overrightarrow{\mathit{k}}}_i^{\prime }\in {\mathcal{R}}^{(m-3)}$ 24:     ▹if $\parallel {\overrightarrow{\mathit{\sigma }}}_i^{\prime }\parallel >({\tau }_3-\beta \tau )$: go to Step 9 25: ⊳ All receivers compute the signature 26: $\overrightarrow{\mathit{\sigma }}={\overrightarrow{x}}_0(\overrightarrow{\mathit{k}}+{\sum }_{i=1}^{\left|\mathtt{out}\right|}{\overrightarrow{\mathit{\sigma }}}_i^{\prime }-{\sum }_{i=1}^{\left|\mathtt{in}\right|}{\overrightarrow{\mathit{\sigma }}}_i)\in {\mathcal{R}}^{(m-3)}$ 27: if $\parallel \overrightarrow{\mathit{\sigma }}\parallel >((\left|\mathtt{out}\right|+\left|\mathtt{in}\right|){\tau }_3-(|\mathtt{out}|+\left|\mathtt{in}\right|+1)\beta \tau )$: 28:       go to Step 9 29: ${\overrightarrow{\mathit{y}}}^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{\sigma }}-{\overrightarrow{x}}_0{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{pk}}))\in {\mathcal{R}}_q^n$ 30: $\overrightarrow{\mathit{h}}=\mathtt{hints}(\chi ,{\overrightarrow{\mathit{y}}}^{\prime },\overrightarrow{\mathit{y}})$ ⊳ Hints for $\overrightarrow{\mathit{y}}$ 31: if $\overrightarrow{\mathit{h}}=\perp$: go to Step 9 32: $\mathtt{header}=(\overrightarrow{\mathit{pk}},\overrightarrow{\mathit{h}},\overrightarrow{\mathit{\sigma }},{\overrightarrow{x}}_0,\mathtt{carry},\Delta )$ 33: return $\mathtt{tx}=(\mathtt{header},{[{\mathtt{coin}}_i]}_{i=1}^{\left|\mathtt{in}\right|},{[{\mathtt{coin}}_i^{\prime }]}_{i=1}^{\left|\mathtt{out}\right|})$       34: ⊳ A chain is an aggregated CT with multiple headers 35: $\underline{\mathtt{TX}.\mathtt{aggregate}(p{p}_{(\lambda ,L)},\mathtt{chain},\mathtt{tx}):}$ 36: $(\mathtt{header},\mathtt{in},\mathtt{out})):=\mathtt{tx}$ 37: $(\mathtt{headers},S,\mathtt{ucoins}):=\mathtt{chain}$ 38: if $\neg \mathtt{TX}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{tx}):$ return ⊥ 39: ⊳ Spending coins should be in the chain 40: if $\mathtt{tx}.\mathtt{in}\notin \mathtt{ucoins}:$ return ⊥ 41: ⊳ Remove spending coins from the chain 42: $\mathtt{ucoins}=(\mathtt{ucoins}\setminus \mathtt{tx}.\mathtt{in})\uplus \mathtt{tx}.\mathtt{out}$ 43: ⊳ Add proofs to the transaction table

44: $\mathtt{headers}=\mathtt{headers}\uplus (|\mathtt{tx}.\mathtt{in}|,|\mathtt{tx}.\mathtt{out}|,\mathtt{tx}.\mathtt{header})$ 45: ⊳ Commitments cannot be repeated 46: if $\bigcup \mathtt{ucoins}.\overrightarrow{\mathit{u}}\ne \mathtt{ucoins}.\overrightarrow{\mathit{u}}$: return ⊥ 47: return $\mathtt{chain}=(\mathtt{headers},S,\mathtt{ucoins}))$       48: $\underline{\mathtt{TX}.\mathtt{header}\_\mathtt{ver}(p{p}_{(\lambda ,L)},|\mathtt{in}|,|\mathtt{out}|,\mathtt{header})}$: 49: $(\overrightarrow{\mathit{pk}},\overrightarrow{\mathit{h}},\overrightarrow{\mathit{\sigma }},{\overrightarrow{x}}_0,\mathtt{carry},\Delta ):=\mathtt{header}$ 50: ⊳ Recompute $\overrightarrow{\mathit{y}}$ from hints 51: ${\overrightarrow{\mathit{y}}}^{\prime }={\mathtt{highbits}}_{{\gamma }^{\prime }}(\overrightarrow{\mathit{H}}\overrightarrow{\mathit{\sigma }}-{\overrightarrow{x}}_0{\mathtt{up}}_{p_1}(\overrightarrow{\mathit{pk}}))\in {\mathcal{R}}_q^n$ 52: $\overrightarrow{\mathit{y}}=\mathtt{use}\_\mathtt{hints}(\chi ,{\overrightarrow{\mathit{y}}}^{\prime },\overrightarrow{\mathit{h}})$ 53: if $\overrightarrow{\mathit{y}}=\perp$: return 0 54: return ${\overrightarrow{x}}_0\stackrel{?}{=}\mathtt{hash}(\overrightarrow{\mathit{pk}},\overrightarrow{\mathit{y}},\Delta )\wedge$ 55:           $\mathtt{CARRY}.\mathtt{ver}(p{p}_{(\lambda ,L)},|\mathtt{in}|,|\mathtt{out}|,\mathtt{carry})$       56: $\underline{\mathtt{TX}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{tx}):}$ 57: $(\mathtt{header},{[{\mathtt{coin}}_i]}_{i=1}^{\left|\mathtt{in}\right|},{[{\mathtt{coin}}_i^{\prime }]}_{i=1}^{\left|\mathtt{out}\right|})):=\mathtt{tx}$ 58: $(\overrightarrow{\mathit{pk}},\overrightarrow{\mathit{h}},\overrightarrow{\mathit{\sigma }},{\overrightarrow{x}}_0,\mathtt{carry},\Delta ):=\mathtt{header}$ 59: ⊳ Commitments cannot be repeated 60: if $\bigcup \mathtt{coin}.\overrightarrow{\mathit{u}}\ne \mathtt{coin}.\overrightarrow{\mathit{u}}\vee \bigcup {\mathtt{coin}}^{\prime }.\overrightarrow{\mathit{u}}\ne {\mathtt{coin}}^{\prime }.\overrightarrow{\mathit{u}}$: 61:       $\vee \mathtt{coin}\bigcap {\mathtt{coin}}^{\prime }\ne \varphi$: return 0 62: ⊳ Check activity 63: if $\Delta =\mathtt{activity}({[{\mathtt{coin}}_i^{\prime }.\overrightarrow{\mathit{u}}]}_{i=1}^{\left|\mathtt{out}\right|},{[{\mathtt{coin}}_i.\overrightarrow{\mathit{u}}]}_{i=1}^{\left|\mathtt{in}\right|})\in \mathbb{H}$: return 0   64: if ${[\neg \mathtt{COIN}.\mathtt{ver}(p{p}_{(\lambda ,L)},{\mathtt{coin}}_i)]}_{i=1}^{\left|\mathtt{in}\right|}$: return 0 65: if ${[\neg \mathtt{COIN}.\mathtt{ver}(p{p}_{(\lambda ,L)},{\mathtt{coin}}_i^{\prime })]}_{i=1}^{\left|\mathtt{out}\right|}$: return 0 66: if $\neg \mathtt{TX}.\mathtt{header}\_\mathtt{ver}(p{p}_{(\lambda ,L)},|\mathtt{in}|,|\mathtt{out}|,\mathtt{header})$: 67:           return 0 68: return ${\mathtt{highbits}}_{{\gamma }^{\prime }-p1}(\overrightarrow{\mathit{pk}})={\mathtt{highbits}}_{{\gamma }^{\prime }}(\mathtt{carry}.\overrightarrow{\mathit{u}}$ 69:              $+{\sum }_{i=1}^{\left|\mathtt{out}\right|}{\mathtt{coin}}_i^{\prime }.\overrightarrow{\mathit{u}}-{\sum }_{i=1}^{\left|\mathtt{in}\right|}{\mathtt{coin}}_i.\overrightarrow{\mathit{u}})\in {\mathcal{R}}_q^n$       70: $\underline{\mathtt{TX}.\mathtt{chain}\_\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{chain}):}$ 71: $(\mathtt{headers},S,\mathtt{ucoins}):=\mathtt{chain}$ 72: $\overrightarrow{\mathit{pk}}=\overrightarrow{\mathit{u}}={\overrightarrow{\mathit{0}}}^n\in {\mathcal{R}}_q^n$; $\overrightarrow{\mathit{s}}=[\mathtt{bin}(S),{\overrightarrow{0}}^{(m-1)}]\in {\mathcal{R}}_q^m$ 73: ⊳ Commitments cannot be repeated 74: if $\bigcup \mathtt{ucoins}.\overrightarrow{\mathit{u}}\ne \mathtt{ucoins}.\overrightarrow{\mathit{u}}$: return 0 75: for all$({\mathtt{coin}}_i)\in \mathtt{ucoins}$: 76:      if $\neg \mathtt{COIN}.\mathtt{ver}(p{p}_{(\lambda ,L)},{\mathtt{coin}}_i)$: return 0 77:      $\overrightarrow{\mathit{u}}=\overrightarrow{\mathit{u}}+{\mathtt{coin}}_i.\overrightarrow{\mathit{u}}\in {\mathcal{R}}_q^n$ 78: for all $(|\mathtt{in}|,|\mathtt{out}|,{\mathtt{h}}_i)\in \mathtt{headers}$: 79:      if $\neg \mathtt{TX}.\mathtt{header}\_\mathtt{ver}(p{p}_{(\lambda ,L)},|\mathtt{in}|,|\mathtt{out}|,\mathtt{h})$: d return 0 80:      $\overrightarrow{\mathit{pk}}=\overrightarrow{\mathit{pk}}+\mathtt{h}.{\mathtt{carry}}_i.\overrightarrow{\mathit{pk}}\in {\mathcal{R}}_q^n$ 81:      $\overrightarrow{\mathit{u}}=\overrightarrow{\mathit{u}}+\mathtt{h}.{\mathtt{carry}}_i.\overrightarrow{\mathit{u}}\in {\mathcal{R}}_q^n$ 82: return ${\mathtt{highbits}}_{{\gamma }^{\prime }-p1}(\overrightarrow{\mathit{pk}})\stackrel{?}{=}{\mathtt{highbits}}_{{\gamma }^{\prime }-p1}(\overrightarrow{\mathit{u}}-\overrightarrow{\mathit{H}}\overrightarrow{\mathit{s}})$ 83: $\wedge {\Pi }_{\Delta \in \mathtt{headers}}\Delta \stackrel{?}{=}{\Pi }_{\mathtt{c}\in \mathtt{ucoins}}{\mathtt{hash}}_0(\mathtt{c}.\overrightarrow{\mathit{u}})\in \mathbb{H}$

$\mathtt{TX}$ is expected to have the following security properties: completeness, zero-knowledge, knowledge soundness, theft resistance, and immutability. We reuse zero-knowledge and knowledge soundness from Definitions 2 and 3 when the statements of $\mathcal{L}$ are:

$$\begin{gathered} “\text{all coins are in }[0,2^L)”\mathrm{and} \\ “\text{total unspent coins are equal to total supplied coins}” \end{gathered}$$

Definition 10

(Completeness). $\mathtt{TX}$ is complete if the honestly generated transactions are always valid, and aggregating a valid transaction into a valid chain always produces a correct chain with the unspent coins of that transaction. Let $\mathcal{G}$ be an arbitrary chain generator.

$$Pr\left[\mathtt{arbitrary}\_\mathtt{tx}\left(\right)\wedge \mathtt{arbitrary}\_\mathtt{chain}\left(\right)\right]\ge 1-ϵ\left(\lambda \right).$$

• $\underline{\mathtt{arbitrary}\_\mathtt{tx}():}$
• For any ${[v_i]}_{i=1}^{\left|\mathtt{in}\right|}\in [0,2^L-1]$ and ${[v_i^{\prime }]}_{i=1}^{\left|\mathtt{out}\right|}\in [0,2^L-1]$
•      such that ${\sum }_{i=1}^{\left|\mathtt{in}\right|}[v_i]={\sum }_{i=1}^{\left|\mathtt{out}\right|}[v_i^{\prime }]\in [0,2^L-1]$:
•       ${[(k_i,{\mathtt{coin}}_i)=\mathtt{COIN}.\mathtt{gen}(p{p}_{(\lambda ,L)},v_i)]}_{i=1}^{\left|\mathtt{in}\right|}$
•       ${[(k_i^{\prime },{\mathtt{coin}}_i^{\prime })=\mathtt{COIN}.\mathtt{gen}(p{p}_{(\lambda ,L)},v_i^{\prime })]}_{i=1}^{\left|\mathtt{out}\right|}$
• $\mathtt{tx}=\mathtt{TX}.\mathtt{gen}(p{p}_{(\lambda ,L)},{[k_i,{\mathtt{coin}}_i]}_{i=1}^{\left|\mathtt{in}\right|},{[k_i^{\prime },{\mathtt{coin}}_i^{\prime }]}_{i=1}^{\left|\mathtt{out}\right|})$
• return $\mathtt{tx}.\mathtt{in}\stackrel{?}{=}{[\mathtt{coin}]}_{i=1}^{\left|\mathtt{in}\right|}\wedge \mathtt{tx}.\mathtt{out}\stackrel{?}{=}{[{\mathtt{coin}}^{\prime }]}_{i=1}^{\left|\mathtt{out}\right|}\wedge$
•         $\mathtt{TX}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{tx})$
• $\underline{\mathtt{arbitrary}\_\mathtt{chain}():}$
• Get any $\mathtt{chain}$ such that
•      $\mathtt{TX}.\mathtt{chain}\_\mathtt{ver}(p{p}_{(\lambda ,L)}.\mathtt{chain})=1$ and $\mathtt{T}=\left|\mathtt{headers}\right|$
• for $i\in [0,\mathtt{t}]$:
•      ${\mathtt{tx}}_i\stackrel{\$}{\leftarrow }\mathcal{G}(p{p}_{(\lambda ,L)})$ s.t. $\mathtt{CTx}.\mathtt{ver}(p{p}_{(\lambda ,L)},{\mathtt{tx}}_i)=1$
•       $\mathtt{chain}=\mathtt{TX}.\mathtt{aggregate}(p{p}_{(\lambda ,L)},\mathtt{chain},\mathtt{tx})$
•      if $\mathtt{chain}=\perp$: continue
•      if  ${\mathtt{headers}}_{\mathtt{T}+i}\ne \mathtt{tx}.\mathtt{carry}$
•           $\vee {\mathtt{tx}}_{\mathtt{i}}.\mathtt{out}\not\subset {\mathtt{chain}}^{\prime }.\mathtt{ucoins}$: return 0
• return $\mathtt{TX}.\mathtt{chain}\_\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{chain})\wedge \left|\mathtt{headers}\right|\stackrel{?}{=}\mathtt{T}+\mathtt{t}$

Even after aggregation, $\mathtt{TX}$ ensures that unspent coins cannot be spent without their secret keys. We consider strong theft resistance where the adversary has control over everything except an honest user’s secret key. Here, the adversarial algorithm generates a chain (an aggregated CT). In the first step, the algorithm sends some coins to the honest user, where the user locks those coins with a new key. Then, the algorithm tries to spend those coins without obtaining the new secret key. In other words, the network is set to have only one honest user, simulating a real-world decentralized network where everyone can be malicious except the honest user.

Definition 11

(Theft Resistance). $\mathtt{TX}$ is theft resistant if

$${\mathtt{Adv}}_{\mathtt{TX},p{p}_{(\lambda ,L)}}^{\mathtt{TR},\mathcal{A}}=Pr\left[{\mathtt{Game}}_{\mathtt{TX},p{p}_{(\lambda ,L)}}^{\mathtt{TR},\mathcal{A}}\stackrel{?}{=}1\right]\le ϵ\left(\lambda \right).$$

• $\underline{{\mathtt{Game}}_{\mathtt{TX},p{p}_{(\lambda ,L)}}^{\mathtt{TR},\mathcal{A}}:}$ $\mathtt{chain}\leftarrow {\mathcal{A}}_{step1}(p{p}_{(\lambda ,L)})$
• if $\mathtt{TX}.\mathtt{chain}\_\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{chain})$: return ⊥
• $\mathtt{T}=|\mathtt{chain}.\mathtt{headers}|$
• ⊳ Receive ${\mathtt{coin}}^{\prime }\in \mathtt{tx}$ from $\mathcal{A}$ s.t. $\mathcal{A}$ does not know the key of ${\mathtt{coin}}^{\prime }$.
• $\mathtt{chain}=\mathtt{TX}.\mathtt{aggregate}(p{p}_{(\lambda ,L)},\mathtt{chain},\mathtt{tx})$
• ${\mathtt{chain}}^{\prime }\leftarrow {\mathcal{A}}_{step2}(p{p}_{(\lambda ,L)},\mathtt{chain})$
• ⊳ Check whether the coin has been spent or not
• return $\mathtt{TX}.\mathtt{chain}\_\mathtt{ver}(p{p}_{(\lambda ,L)},{\mathtt{chain}}^{\prime })$
•      $\wedge {\mathtt{coin}}^{\prime }\not\subset {\mathtt{chain}}^{\prime }.\mathtt{ucoins}$
•      $\wedge {[\mathtt{chain}.{\mathtt{headers}}_{\mathtt{i}}]}_{i=0}^{\mathtt{T}+1}\stackrel{?}{=}{[{\mathtt{chain}}^{\prime }.\mathtt{headers}]}_{i=0}^{\mathtt{T}+1}$

Informally, blockchains’ immutability states that generating two different input and output sets for the same consensus data should be computationally infeasible. Because we build $\mathtt{TX}$ for a generic consensus mechanism, we capture the immutability such that finding two different input and output sets for the same header(s) is computationally difficult. Therefore, preserving headers is sufficient to provide immutability to the whole blockchain, including removed spent coin records.

Definition 12

(Immutability). $\mathtt{TX}$ ensures immutability if

$${\mathtt{Adv}}_{\mathtt{TX},p{p}_{(\lambda ,L)}}^{\mathtt{IM},\mathcal{A}}=Pr\left[{\mathtt{Game}}_{\mathtt{TX},p{p}_{(\lambda ,L)}}^{\mathtt{IM},\mathcal{A}}\stackrel{?}{=}1\right]\le ϵ\left(\lambda \right).$$

• $\underline{{\mathtt{Game}}_{\mathtt{TX},p{p}_{(\lambda ,L)}}^{\mathtt{IM},\mathcal{A}}:}$ $(\mathtt{tx},{\mathtt{tx}}^{\prime })\leftarrow \mathcal{A}(p{p}_{(\lambda ,L)})$
• return $\mathtt{TX}.\mathtt{ver}(p{p}_{(\lambda ,L)},\mathtt{tx})\wedge \mathtt{TX}.\mathtt{ver}(p{p}_{(\lambda ,L)},{\mathtt{tx}}^{\prime })$
• $(\mathtt{tx}.\mathtt{in}.\mathtt{com},\mathtt{tx}.\mathtt{out}.\mathtt{com})$$\stackrel{?}{\ne }({\mathtt{tx}}^{\prime }.\mathtt{in}.\mathtt{com},{\mathtt{tx}}^{\prime }.\mathtt{out}.\mathtt{com})$
•           $\wedge \mathtt{tx}.\mathtt{header}.\Delta \stackrel{?}{=}{\mathtt{tx}}^{\prime }.\mathtt{header}.\Delta$

Theorem 4.

$\mathtt{TX}$ is complete, computationally theft-resistant, zero-knowledge, and immutable if Approx-SISs of $(n,m,q,\gamma ,{\gamma }^{\prime },N)$ and $(n,m-3,q,\gamma ,{\gamma }^{\prime },N)$ are hard (see the security proofs in Appendix C).

4. Implementation

We implement a C library ref. [25] for LACT+ aiming to achieve 128-bit security. Therefore, a root-Hermite factor $\delta =1.004$ was used for lattices implementations allowing a gap for future attacks ref. [37]. A prime-order multiplicative group $\mathbb{H}$ with at least multiplicative $2^{384}$ elements was used for membership proofs. The prime order of $\mathbb{H}$ is $q_2$ such that $(q_2-1)/2>2^{3\lambda }$ is also prime ($q_2=$ 3a2c6ad1f4ef4084fbf76e7c6201b32850c57c408a6e0c4a6cda6c290c61e6dadd4e6b7312dd3aa6bd610a917c1d42f03). The concrete parameters used for tests are defined in Table 2. According to the parameters, a coin record is 29.9 KB (a commitment and a range proof), and a public key is 5760 Bytes.

Table 2. Concrete Parameters and Variables.

Parameter	Value	Description
$(n,m)$	(6, 4)	Approx-SIS hard
N	256	Polynomial Size
q	$2^{44}-2^{14}+1$	$q=1(mod2N)$
$L,2^{L^{\prime }}$	64, 15	Ranges
$\gamma$	$2^{36}$	Short-Vector Norm
${\gamma }^{\prime }$	$2^{36}$	Error Norm
$\beta$	60	${log}_2\left(\genfrac{}{}{0pt}{}{N}{\beta }\right)+\beta \ge 256$
$log\left(p_1\right)$, $log\left(p_2\right)$	17, 29	$<log\left({\gamma }^{\prime }\right)$, $<log\left({\gamma }^{\prime }\right)$
$\alpha (+\lceil {log}_2\left(\right|L^{\prime }|/2)\rceil )$	$2^9$ to $2^{11}$	maximum 16 in/outputs
$\tau ,{\tau }_1,{\tau }_2$	$2^4-1$, $2^7-1$, $2^{28}-1$	$<\gamma$
${\tau }_3$	$2^{16}$	$<2^{L^{\prime }}\gamma$
$\chi$	60	${\parallel ·\parallel }_1$ Norm of Hints
$|\overrightarrow{x}|$	48 bytes	SHAKE256 ref. [38]
$|\Delta |$	49 bytes	Activity Proofs
${\mathtt{highbits}}_{p_1}(·)$	5.7 KB	Packed High-bits
${\mathtt{highbits}}_{p_2}(·)$	3.1 KB	Packed High-bits

We use two multiplications: number theoretic transform (NTT) for regular polynomials and an easy multiplication when one of the polynomials is a $\mathtt{rot}(\ast ,\ast )$ (see below). The C library uses 64-bit integers except for the NTT, which uses 128-bit integers. In NTT multiplication, we convert polynomials to NTT space using Cooley–Tukey butterflies ref. [39], point-wise multiply them using Montgomery point-wise multiplications ref. [40], and then convert them back using inverse-transform from Gentleman–Sande butterflies ref. [41].

Recall that $\mathtt{rot}(v_i,i)$ is a polynomial where coefficient i is $v_i$, and all other coefficients are zero. Therefore, a multiplication of $\overrightarrow{a}\mathtt{rot}(v_i,i)$ is computed as follows: convert coefficients in $[N-i,N)$ into their negative values, rotate all coefficients by i, and multiply all coefficients by $v_i$. Because this is faster than NTT multiplication, we use this easy multiplication whenever possible, e.g., most of the short-norm vectors in $\mathtt{CARRY}$.

We chose bits’ masking keys from $[-\alpha ,\alpha ]$ such that some functional polynomials like Step 29 in $\mathtt{COIN}$ and Step 53 in $\mathtt{CARRY}$ can be larger than $\gamma$. However, there is a high probability that they will be in the accepted range due to centrally reduced numbers. Therefore, we perform norm checks during the generation of $\mathtt{COIN}$ and $\mathtt{CARRY}$ to ensure completeness.

All the benchmarks were configured as follows: The maximum coin amount and the initial coinbase value are $2^{64}-1$. Here, we use “aggregated size” to denote the database size, which is slightly larger than theoretical sizes due to indexing and identifiers. “Deleted size” means the exact size of deleted coin records as explained in Section 3.1. Therefore, “unaggregated size” is computed as the summation of the aggregated and deleted sizes. The verification times are measured on an i7-1065G7 CPU at 1.30GHz. Furthermore, $[x:y]$ denotes that the number of inputs and outputs are randomly chosen from $[1,x]$ and $[1,y]$.

Efficiency of New Carry Proofs. First, we run benchmarks to get the sizes of new carry proofs and LACT carry proofs. Recall that LACT creates multiple LACT transactions if the numbers of input coins and out coins are larger than two. Therefore, the size impact of carry proofs to the total blockchain is proportional to the number of transactions, whereas in LACT+, this impact is now logarithmic. We simulate carry proof benchmarks to see this size and verification time impact for normal transactions where the input size can be larger than two. Figure 5 and Figure 6 show the accumulated sizes and total verification times for carry proof(s) of LACT and LACT+. From the graphs, we conclude that new LACT+ carry proofs are more efficient than LACT carry proofs. Therefore, the whole system is more efficient than prior post-quantum CT schemes, from unaggregated ones to aggregated ones like LACT, in spite of its other added benefits such as fully trustless verifiable immutability.

Figure 5. Carry proof sizes.

Figure 6. Carry proof verification times.

Impact of Aggregation. The main efficiency mechanism of LACT+ is transaction aggregation. The impact of the transaction aggregation changes according to input/output rates because more unspent outputs lead to larger blockchains. We ran benchmarks for different input/output rates, and we show the results in Figure 7. From the graph, we see that even if the output rate is higher than the input rate, aggregation achieves significant reductions in size. Verification times for these benchmarks are shown in Figure 8.

Figure 7. Aggregated sizes and unaggregated sizes vs. transactions.

Figure 8. Verification times vs. transactions for different input and output rates.

A Theoretical Comparison with MatRiCT+ Esgin et al. proposed ref. [22], an efficient lattice-based Ring CT protocol that uses the Chinese Remainder Theorem (CRT) packing, e.g., packing all L number of $\overrightarrow{\mathit{z}}$ into a single polynomial. Even without CRT packing, LACT+ is more efficient than MatRiCT+ as illustrated in Figure 9.

Figure 9. LACT+ and MatRiCT+: For MatRiCT, Coins $\left(\mathtt{cn}\right)$ are 4.48 KB, public keys are 3.4 KB, and ($2\to 2$) proofs are 47 KB at 1/11 anonymity.

5. Conclusions

Aggregable confidential transactions are more private and scalable than typical transactions. However, the scalability of previous aggregable transactions does not provide trustless verification at the consensus level because real-world transactions should be immutable. LACT+ post-quantum aggregable confidential transactions solve this problem by adding aggregable activity proofs. Equally importantly, LACT+ is more efficient and faster than existing post-quantum aggregable transactions due to our use of approximate SIS and logarithmic carry proofs. LACT+ is the first practical post-quantum aggregable confidential transaction protocol that provides consensus-level aggregation and fully trustless verification.