【作者】 周晓；

【导师】 来学嘉；

【作者基本信息】 上海交通大学 ， 计算机科学与技术， 2018， 硕士

【摘要】 比特币是目前最为成功的一种数字货币,其中最核心的技术就是实现去中心化的区块链技术。由于区块链中所有的交易信息都是透明的,对于许多追求数据隐私性与安全性的用户而言,这种数字货币的形式并不能满足他们的需求,因此,对私密交易的需求也应运而生。利用区块链实现的私密交易与比特币中的交易方式类似,但是不同之处在于,在私密交易中交易金额是被隐藏起来的。私密交易的实现主要采用了具有加法同态的佩德森承诺机制,利用佩德森承诺机制,就可以实现对交易金额的隐藏。但是,在私密交易中由于引入了模运算会导致加密后的密文产生溢出问题,也称范围验证的问题。为了解决范围验证问题,可以使用博罗米环签名来对私密交易中金额的范围做佩德森承诺,使得只有加密后的金额在某个特定的范围之内这个承诺才是有效的。本文还对范围验证算法和博罗米环签名算法进行了时间和存储空间上的优化。本文主要工作包括:通过金额转换成不同进制时,所需的公钥个数和签名个数不同,选择最优的转换进制;通过预计算的方式,使得范围验证中公钥生成算法的效率提升了 37%,同时也使范围验证算法的效率提升了5%;减少私密交易时需要发布的佩德森承诺个数,减少了承诺所需的存储空间;针对金额很小的情况,提出了一种适用于私密交易范围验证的博罗米环签名变体,在牺牲一定金额的隐私性的前提下,减少范围验证所需要的时间和空间。更多还原

【Abstract】 Bitcoin has been the most popular and successful cryptocurrency so far.Blockchain is the most impres-sive technology in bitcoin because of its decentralized property.However,all of the transaction information in blockchain is transparent.For most users who care much about data privacy,bitcoin is not a suitable choice for them.Therefore,confidential transaction is very urgent for these users.Confidential transaction is similar to the transaction in bitcoin,except that all the transaction amounts in confidential transaction are hidden by the transaction users.The core technology in confidential transaction is Pedersen commitment,which is a commitment with addition homomorphic property.Users can hide the transaction amount utilizing Pedersen commitment.However,because of the modular arithmetic in confiden-tial transaction,here comes another problem named "overflow" or rangeproof.In order to solve this problem,we use Borromean ring signature to construct a commitment for the amount’s range.In this way,only if the amount in the specific range,the commitment will be valid.Then,we optimize the rangeproof and Borromean ring signature algorithms on time complexity and memory space.In this paper,our contributions are as follows:according to the base transform,we choose the optimized base for the transaction amount so they can publish the fewest numbers of commitments and signatures;using pre-computation,reduce the time of public key generation algorithm by 37%and rangeproof algorithm by 5%;reduce the number of Pedersen commitments and the size of Pedersen commitments;we propose a Borromean ring signature variant aiming to construct the confidential transaction for very small transaction amounts,which can reduce the number of signatures while a little privacy of transaction amounts will be sacrificed.更多还原