Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detailed Action
Claims 1-14 are pending
Priority
This application is a continuation of U.S. application Ser. No. 18/523,646, filed 29 Nov. 2023, which is a continuation of U.S. application Ser. No. 17/040,480, filed 22 Sep. 2020, now U.S. patent Ser. No. 11/995,648, issued 28 May 2024, which is a 371 Nationalization of International Patent Application No. PCT/IB2019/052184, filed 18 Mar. 2019, which claims priority to United Kingdom Patent Application No. 1804740.7, United Kingdom Patent Application No. 1804742.3, and United Kingdom Patent Application No. 1804739.9, all filed 23 Mar. 2018. Therefore, the effective filing date of this application is 03/23/2018.
Drawings
Applicants’ drawings filed on 06/12/2025 has been inspected and it is in compliance with
MPEP 608.02.
Specification
The specification filed on 06/12/2025 is acceptable for examination proceedings.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 12/17/2025. The submission is
in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure
statement has been considered by the examiner.
Claim Objections
Claims 2-11 are objected to because of the following informalities: Claims 2-11 recite of “A computer-implemented method according to claim 1”. However, claims 2-11 depend on claim 1 and claim 1 already recites of a computer-implemented method. Examiner suggests amending this limitation to “The computer-implemented method according to claim 1 …”. Appropriate correction is required.
Claims 1, 4, and 9 recite the limitation “the statement”. However, claim 1 recites “a statement (S)”. Examiner suggests amending “the statement” to “the statement (S)”. Appropriate correction is required.
Claim 4 recites the limitation “verifier receivers”. Examiner suggests amending this “verifier receives”. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 1-14 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1, 3-5, 7, and 8 recite the limitation "the prover". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “a prover”. Appropriate correction is required.
Claims 2-14 depend on claim 1. Therefore, they also inherit the rejection.
Claim 1 recites of the limitation “receiving from the prover: a statement (S)”. However, claim 1 already recites in a previous limitation “enabling verification of a statement (S)”. It is unclear if the statement in this limitation is the same statement recited before. Examiner suggests amending this limitation to “receiving from the prover: the statement (S)” to refer to the same statement that is being verified.
Claims 2-14 depend on claim 1. Therefore, they also inherit the rejection.
Claim 1 recites the limitation " the function circuit input (s)". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “a function circuit input (s)”. Appropriate correction is required.
Claims 2-14 depend on claim 1. Therefore, they also inherit the rejection.
Claim 1 recites the limitation " the corresponding elliptic curve point multiplier (s)". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “a corresponding elliptic curve point multiplier (s)”. Appropriate correction is required.
Claims 2-14 depend on claim 1. Therefore, they also inherit the rejection.
Claim 1 recites the limitation " the circuit". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “the arithmetic circuit”. Appropriate correction is required.
Claims 2-14 depend on claim 1. Therefore, they also inherit the rejection.
Claim 1 recites of the limitation “a function circuit output (h)”. It is unclear if this function circuit output (h) received from the prover is different from the limitation “a given function circuit output (h)”. For the purpose of examination Examiner is interpreting this limitation as “the given function circuit output (h)”. Appropriate correction is required.
Claims 2-14 depend on claim 1. Therefore, they also inherit the rejection.
Claim 5 recites the limitation " the concatenation". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “a concatenation”. Appropriate correction is required.
Claim 5 recites the limitation " the commitments ". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “the individual wire commitments and/or the batched commitment”. Appropriate correction is required.
Claim 6 recites the limitation " the commitment Wi". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “a commitment Wi”. Appropriate correction is required.
Claim 6 recites the limitation " Com is the commitment". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “Com is a commitment”. Appropriate correction is required.
Claim 6 recites the limitation " the wire value". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “a wire value”. Appropriate correction is required.
Claim 6 recites the limitation " the wire denomination". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “a wire denomination”. Appropriate correction is required.
Claim 8 recites the limitation " the receiver". There is insufficient antecedent basis for this limitation in the claim. For the purpose of examination Examiner is interpreting this limitation as “the verifier”. Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 11 is rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim does not fall within at least one of the four categories of patent eligible subject matter because it is directed towards Signal per se. Furthermore, there is no mention of "non-transitory" in the specification.
Claims 13 and 14 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim does not fall within at least one of the four categories of patent eligible subject matter because it is directed towards Software per se.
Claims 1-14 are rejected under 35 U.S.C. 101 because they directed to an abstract idea.
Claim 1 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim recites a judicial exception (an abstract idea) that is not integrated into a practical application.
Step 1: Statutory Category
Claims 1 satisfies the statutory category requirement because it is directed towards a computer-implemented method under 35 U.S.C. 101(a).
Step 2A, Prong 1 – Judicial Exception (Abstract Area)
The claim recites of a computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including: receiving from the prover: a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s); individual wire commitments and/or a batched commitment for wires of the circuit; a function circuit output (h); and a proving key (PrK), which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
The limitation of computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including: receiving from the prover: a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s), as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can be performed in the mind. A user can manually enable verification of a statement while keeping a witness to the statement a secret. Furthermore, a user can receive from a prover a statement represented by an arithmetic circuit. The arithmetic circuit is nothing more than a set of data representing the statement. Even furthermore, a user can manually implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s).
The limitation of individual wire commitments and/or a batched commitment for wires of the circuit, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can be performed in the mind. A user can manually receive from a prover individual wire commitments and/or a batched commitment for wires of the circuit.
The limitation of a function circuit output (h), as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can be performed in the mind. A user can manually receive from a prover a function circuit output (h).
The limitation of a proving key (PrK), which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can be performed in the mind. A user can manually receive from a prover a proving key which enables to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
Step 2A, Prong 2 – Integration into a practical Application
This judicial exception is not integrated into a practical application. The claim recites of receiving from a prover a statement, individual wire commitments and/or a batched commitment for wires, a function circuit output (h), and a proving key (PrK). However, merely receiving set of data for enabling the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim states broadly of receiving set of data. However, simply receiving set of data does not overcome the abstract idea.
Step 2B- “Significantly More” (Inventive concept)
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. In particular, the claim only recites one additional element of “computer-implemented method” recited at a high-level of generality (i.e., as a generic computer implementing the method) such that it amounts no more than mere instructions to apply the exception using a generic computer. Mere instructions to apply an exception using a generic computer cannot provide an inventive concept. The claim is not patent eligible.
Claim 2 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w). Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually receive an individual wire commitment and use Σ protocols to prove knowledge of the witness (w).
Claim 3 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the verifier sends to the prover a challenge value (x). Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually send to the prover a challenge value (x).
Claim 4 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P). Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually receive from the prover a random value (x) and determine that the statement is true and calculate the elliptic curve point (P).
Claim 5 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover. Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually determine a random value (x) by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
Claim 6 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the commitment Wi is: Wi=Com(Wi,ri) wherein Com is the commitment to the function circuit, wi is the wire value, ri is a random number—different for each wire commitment, and i is the wire denomination, such that Com(w,r)=w×G+r×F wherein F and G are elliptic curve points. Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually determine the commitment Wi is: Wi=Com(Wi,ri).
Claim 7 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the verifier receives a batch of wire commitments from the prover. Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually receive a batch of wire commitments from the prover.
Claim 8 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the receiver receives from the prover a fully opened commitment to at least one wire. Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually receive from the prover a fully opened commitment to at least one wire.
Claim 9 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the statement uses only one arithmetic circuit for the function circuit. Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually determine the statement uses only one arithmetic circuit for the function circuit.
Claim 10 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. This claim recites of wherein the function circuit implements a hash function. Therefore, the limitations of this claim, as drafted, is a process that, under its broadest reasonable interpretation, covers steps that can also be performed in the mind. A user can manually implement a hash function.
Claim 11 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim recites a judicial exception (an abstract idea) that is not integrated into a practical application.
Step 1: Statutory Category
Claims 11 does not satisfy the statutory category requirement under 35 U.S.C. 101(a) because claim 11 is directed towards signal per se.
Furthermore, Claim 11 recites the limitation “configure a processor to perform the method of claim 1.”. Therefore, the same Step 2A, Prong 1, Step 2A, Prong 2, and Step 2B analysis as seen in the rejection of claim 1 applies.
Claim 12 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim recites a judicial exception (an abstract idea) that is not integrated into a practical application.
Step 1: Statutory Category
Claims 12 satisfies the statutory category requirement because it is directed towards an electronic device under 35 U.S.C. 101(a).
Furthermore, Claim 12 recites the limitation “the one or more processor(s) to perform the method of claim 1.”. Therefore, the same Step 2A, Prong 1, Step 2A, Prong 2, and Step 2B analysis as seen in the rejection of claim 1 applies.
Claim 13 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim recites a judicial exception (an abstract idea) that is not integrated into a practical application.
Step 1: Statutory Category
Claims 13 does not satisfy the statutory category requirement under 35 U.S.C. 101(a) because claim 13 is directed towards software per se.
Furthermore, Claim 13 recites the limitation “the node configured to perform the method of claim 1.”. Therefore, the same Step 2A, Prong 1, Step 2A, Prong 2, and Step 2B analysis as seen in the rejection of claim 1 applies.
Claim 14 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim recites a judicial exception (an abstract idea) that is not integrated into a practical application.
Step 1: Statutory Category
Claims 14 does not satisfy the statutory category requirement under 35 U.S.C. 101(a) because claim 14 is directed towards software per se.
Furthermore, Claim 14 recites the limitation “a node according to claim 13.”. Therefore, the same Step 2A, Prong 1, Step 2A, Prong 2, and Step 2B analysis as seen in the rejection of claim 1 applies.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 3, 5, 6, 8, 9, 12, 16, 18, 19, 20, 21, 22, and 23 of U.S. Patent No. US11797984B2. Although the claims at issue are not identical, they are not patentably distinct from each other because the corresponding claims further recite similar/same limitation of the same subject matter.
Current application 19/235,793
U.S. Patent No. US11797984B2
1. A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including:
receiving from the prover:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
1. A computer-implemented method for enabling zero-knowledge proof or verification of a statement (S) for enabling exchange of data between a prover and a verifier, wherein the prover has access to first data on a first blockchain, and the verifier has access to second data on a second blockchain, the method including:
the prover generating a key-pair for the second blockchain, sending a public key (PA) of said pair to the verifier, and retaining a private key (sA) of said pair;
the prover receiving a verifier's public key (PB) for the first blockchain, said verifier having generated a key-pair for the first blockchain and retaining a private key (sB) of said pair;
the prover sending a data set to the verifier, said data set including a zero-knowledge proof statement (S), one or more commitments, an input (PX) and a function circuit output (h);
the prover creating a first blockchain transaction TxAthat transfers access to the first data to a common public key address (Pc), and broadcasts said transaction on a first blockchain network, said address defined by a sum of the input (PX) and the verifier's public key (PB)
P C =P B +P x
the prover verifying a second blockchain transaction TxB, said transaction created and broadcast on a second blockchain network by the verifier after confirming the inclusion of the first blockchain transaction TxA in the first blockchain, said transaction transferring access to the second data to a prover's public key address (PA) that is accessible by the prover using:
a valid signature (sA)for the prover's public key address (PA), and
a function circuit input value (x) that determines the function circuit output (h);
the prover confirming the second blockchain transaction TxB is included on the second blockchain and accessing the second data by providing their signature (sA) and the value (x) that is the function circuit input of the function circuit output (h);
thus enabling the verifier to observe the value (x) that is the function circuit input that determines the function circuit output (h) and access the first data by providing a signature using a private key corresponding to the common public key address Pc, which is sB+x from the homomorphic properties of elliptic curve point multiplication.
2. A computer-implemented method according to claim 1, wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w).
3. The computer-implemented method according to claim 1, for enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement, thus determining that the prover holds the witness (w) to the statement.
3. A computer-implemented method according to claim 1, wherein the verifier sends to the prover a challenge value (x).
5. The computer-implemented method according to claim 3, wherein the prover
receives from the verifier a challenge value (x) and responds with an opening.
4. A computer-implemented method according to claim 1, wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
6. The computer-implemented method according to claim 3, wherein the prover sends to the verifier a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
5. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
8. The computer-implemented method according to claim 6, wherein the random value (x) is computed by hashing a concatenation of all the commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
Wi=Com(Wi,ri)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
9. The computer-implemented method according to claim 3 wherein
the commitment Wi is:
W i=Com(w i ,r i)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is a wire denomination,
such thatCom(w, r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein the verifier receives a batch of wire commitments from the prover.
12. The computer-implemented method according to claim 3, wherein the prover sends a batch of wire commitments and generates random numbers to compute elliptic curve points for each wire to form the proving key (PrK).
8. A computer-implemented method according to claim 1, wherein the receiver receives from the prover a fully opened commitment to at least one wire.
16. The computer-implemented method according to claim 1, wherein the prover additionally sends a fully opened commitment to at least one wire of the function circuit.
9. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
18. The computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
10. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
19. The computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
11. A computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
20. A non-transitory computer readable storage medium comprising computer-executable instructions that, when executed, configure a processor to perform the method of claim 1.
12. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
21. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; and a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions that, when executed, configure the one or more processor(s) to perform the method of claim 1.
13. A node of a blockchain network, the node configured to perform the method of claim 1.
22. A node of a blockchain network, the node configured to perform the method of claim 1.
14. A blockchain network having a node according to claim 13.
23. A blockchain network having a node according to claim 22.
Claims 1-14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-4, 6, 7, 10, 14, 16, 17, 20, and 22 of U.S. Patent No. US11995648B2. Although the claims at issue are not identical, they are not patentably distinct from each other because the corresponding claims further recite similar/same limitation of the same subject matter.
Current application 19/235,793
U.S. Patent No. US11995648B2
1. A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including:
receiving from the prover:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
1. A computer-implemented method for enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), a function circuit input to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier, wherein the function circuit implements the function of a hash function;
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement, thus determining that the prover holds the witness (w) to the statement;
wherein the method is used by the prover to enable a zero-knowledge contingent transaction for data, such as an encryption key,
and further wherein:
the prover liaises with a verifier to confirm the data to be provided and the data to be received and establishes a communication channel with the verifier,
the prover receives an elliptic curve public key pkB from the verifier, said verifier having generated the elliptic curve public key pkB from a secure random secret key skB, wherein
pkV=skV×G and G is an elliptic curve point,
the prover secures the data to be provided with a locking value i, such that
data=pk V +i×G
and the prover sends, to the verifier, their public key, wherein pkP=i×G, and an output f(i) from the function circuit wherein a function circuit input is the locking value i, wherein the function circuit implements the function of a hash function,
the prover sending the statement (S) proof to the verifier that proves to the verifier that the input to the function circuit is a private key corresponding to pkP,
thus enabling the verifier to verify the proof and confirm that an address corresponding to pk=pkV+pkP matches an agreed pattern, and thus further determine that knowing the locking value i enables derivation of a full private key for the data (skB+i), and that the locking value i is the function circuit input to the function circuit i,
the prover receiving from the verifier a transaction Tx1, which contains an output that contains the data to be received, which can be accessed by a signature from the prover and the function circuit input, i, and
the prover signs and broadcasts the transaction on a blockchain, where it is mined into a block, enabling the prover to access the data from the output of the transaction Tx1 by providing a second transaction Tx2 supplying their signature and the value i to unlock the transaction, which is then revealed on the blockchain,
thus enabling the verifier to identify the locking value i and access the data offered by the prover, wherein
sk=sk B +i,
where pk=sk×G.
2. A computer-implemented method according to claim 1, wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w).
2. A computer-implemented method according to claim 1, wherein the prover sends an individual wire commitment and communicates with the verifier using Σ protocols to prove knowledge of the witness (w).
3. A computer-implemented method according to claim 1, wherein the verifier sends to the prover a challenge value (x).
3. A computer-implemented method according to claim 1, wherein the prover receives from the verifier a challenge value (x) and responds with an opening.
4. A computer-implemented method according to claim 1, wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
4. A computer-implemented method according to claim 1, wherein the prover sends to the verifier a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
5. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing a concatenation of all the commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
Wi=Com(Wi,ri)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
W i=Com(w i ,r i)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is a wire denomination,
such thatCom(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein the verifier receives a batch of wire commitments from the prover.
10. A computer-implemented method according to claim 1, wherein the prover sends a batch of wire commitments and generates random numbers to compute elliptic curve points for each wire to form the proving key (PrK).
8. A computer-implemented method according to claim 1, wherein the receiver receives from the prover a fully opened commitment to at least one wire.
14. A computer-implemented method according to claim 1, wherein the prover additionally sends a fully opened commitment to at least one wire.
9. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
16. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
10. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
17. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
11. A computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
22. An electronic device comprising:
an interface device;
one or more processor(s) coupled to the interface device; and
a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
12. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
22. An electronic device comprising:
an interface device;
one or more processor(s) coupled to the interface device; and
a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
13. A node of a blockchain network, the node configured to perform the method of claim 1.
20. A computer-implemented method according to claim 1, wherein a prover performs a trustless fair-exchange of data with a verifier,
wherein the prover has access to first data on a first blockchain, and the verifier has access to second data residing on a second blockchain, and the prover and verifier agree to exchange said data, the method including:…
14. A blockchain network having a node according to claim 13.
20. A computer-implemented method according to claim 1, wherein a prover performs a trustless fair-exchange of data with a verifier,
wherein the prover has access to first data on a first blockchain, and the verifier has access to second data residing on a second blockchain, and the prover and verifier agree to exchange said data, the method including:..
Claims 1-14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-4, 6, 7, 10, 14, 16, 17, 20, and 22 of U.S. Patent No. US11995648B2. Although the claims at issue are not identical, they are not patentably distinct from each other because the corresponding claims further recite similar/same limitation of the same subject matter.
Current application 19/235,793
U.S. Patent No. US11995648B2
1. A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including:
receiving from the prover:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
1. A computer-implemented method for enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), a function circuit input to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier, wherein the function circuit implements the function of a hash function;
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement, thus determining that the prover holds the witness (w) to the statement;
wherein the method is used by the prover to enable a zero-knowledge contingent transaction for data, such as an encryption key,
and further wherein:
the prover liaises with a verifier to confirm the data to be provided and the data to be received and establishes a communication channel with the verifier,
the prover receives an elliptic curve public key pkB from the verifier, said verifier having generated the elliptic curve public key pkB from a secure random secret key skB, wherein
pkV=skV×G and G is an elliptic curve point,
the prover secures the data to be provided with a locking value i, such that
data=pk V +i×G
and the prover sends, to the verifier, their public key, wherein pkP=i×G, and an output f(i) from the function circuit wherein a function circuit input is the locking value i, wherein the function circuit implements the function of a hash function,
the prover sending the statement (S) proof to the verifier that proves to the verifier that the input to the function circuit is a private key corresponding to pkP,
thus enabling the verifier to verify the proof and confirm that an address corresponding to pk=pkV+pkP matches an agreed pattern, and thus further determine that knowing the locking value i enables derivation of a full private key for the data (skB+i), and that the locking value i is the function circuit input to the function circuit i,
the prover receiving from the verifier a transaction Tx1, which contains an output that contains the data to be received, which can be accessed by a signature from the prover and the function circuit input, i, and
the prover signs and broadcasts the transaction on a blockchain, where it is mined into a block, enabling the prover to access the data from the output of the transaction Tx1 by providing a second transaction Tx2 supplying their signature and the value i to unlock the transaction, which is then revealed on the blockchain,
thus enabling the verifier to identify the locking value i and access the data offered by the prover, wherein
sk=sk B +i,
where pk=sk×G.
2. A computer-implemented method according to claim 1, wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w).
2. A computer-implemented method according to claim 1, wherein the prover sends an individual wire commitment and communicates with the verifier using Σ protocols to prove knowledge of the witness (w).
3. A computer-implemented method according to claim 1, wherein the verifier sends to the prover a challenge value (x).
3. A computer-implemented method according to claim 1, wherein the prover receives from the verifier a challenge value (x) and responds with an opening.
4. A computer-implemented method according to claim 1, wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
4. A computer-implemented method according to claim 1, wherein the prover sends to the verifier a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
5. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing a concatenation of all the commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
Wi=Com(Wi,ri)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
W i=Com(w i ,r i)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is a wire denomination,
such thatCom(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein the verifier receives a batch of wire commitments from the prover.
10. A computer-implemented method according to claim 1, wherein the prover sends a batch of wire commitments and generates random numbers to compute elliptic curve points for each wire to form the proving key (PrK).
8. A computer-implemented method according to claim 1, wherein the receiver receives from the prover a fully opened commitment to at least one wire.
14. A computer-implemented method according to claim 1, wherein the prover additionally sends a fully opened commitment to at least one wire.
9. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
16. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
10. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
17. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
11. A computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
22. An electronic device comprising:
an interface device;
one or more processor(s) coupled to the interface device; and
a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
12. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
22. An electronic device comprising:
an interface device;
one or more processor(s) coupled to the interface device; and
a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
13. A node of a blockchain network, the node configured to perform the method of claim 1.
20. A computer-implemented method according to claim 1, wherein a prover performs a trustless fair-exchange of data with a verifier,
wherein the prover has access to first data on a first blockchain, and the verifier has access to second data residing on a second blockchain, and the prover and verifier agree to exchange said data, the method including: …
14. A blockchain network having a node according to claim 13.
20. A computer-implemented method according to claim 1, wherein a prover performs a trustless fair-exchange of data with a verifier,
wherein the prover has access to first data on a first blockchain, and the verifier has access to second data residing on a second blockchain, and the prover and verifier agree to exchange said data, the method including:
Claims 1, 2, 4-14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 3-5, and 7-13 of U.S. Patent No. US12307447B2. Although the claims at issue are not identical, they are not patentably distinct from each other because the corresponding claims further recite similar/same limitation of the same subject matter.
Current application 19/235,793
U.S. Patent No. US12307447B2
1. A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including:
receiving from the prover:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
1. A computer-implemented method for enabling zero-knowledge proof or verification of a statement (S) for enabling exchange of data between a prover and a verifier, wherein the prover has access to first data on a first blockchain, and the verifier has access to second data on a second blockchain, the method including:
the prover generating a key-pair for the second blockchain, sending a public key (PA) of said pair to the verifier, and retaining a private key (s_A) of said pair;
the prover receiving a verifier's public key (PB) for the first blockchain, said verifier having generated a key-pair for the first blockchain and retaining a private key (sB) of said pair;
the prover computing a function circuit output (h) based at least in part on a secure random number generated by the prover, and an input (Px) corresponding to the secure random number;
the prover sending a data set to the verifier, said data set including a zero-knowledge proof statement (S), one or more commitments, the input (Px) and the function circuit output (h), wherein the data further comprises a vanity address, and wherein the zero-knowledge proof statement (S) comprises data indicative of a pre-image of the function circuit output (h) being equal to a private key used to generate the input (Px), wherein the vanity address is obtained from a third party, wherein the prover sends a batch of wire to form a proving key (PrK);
the prover creating a first blockchain transaction TxA that transfers access to the first data to a common public key address (Pc), and broadcasts said transaction on a first blockchain network, said address defined by a sum of the input (Px) and the verifier's public key (PB)
P C =P B +P x
the prover verifying a second blockchain transaction TxB, said transaction created and broadcast on a second blockchain network by the verifier after confirming inclusion of the first blockchain transaction TxA in the first blockchain, said transaction transferring access to the second data to the prover's public key address (PA) that is accessible by the prover using:
a valid signature (sA) for the prover's public key address (PA), and
a value (x) that is the function circuit input that determines the function circuit output (h), and
the prover confirming the second blockchain transaction TxB is included on the second blockchain and accessing the second data by providing their signature (sA) and the value (x) that is the function circuit input of the function circuit output (h), thus enabling the verifier to observe the value (x) that is the function circuit input that determines the function circuit output (h) and access the first data by providing a signature using the private key for PC, which is sB+x from the homomorphic properties of elliptic curve point multiplication.
3. A computer-implemented method according to claim 1 for enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
the proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement, thus determining that the prover holds the witness (w) to the statement (S).
2. A computer-implemented method according to claim 1, wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w).
3. A computer-implemented method according to claim 1 for enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
….
4. A computer-implemented method according to claim 1, wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
4. A computer-implemented method according to claim 3, wherein the prover sends to the verifier a random value (x) for enabling the verifier to determine that the statement (S) is true and calculate the elliptic curve point (P).
5. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
3. …. a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and …
9. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
6. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
Wi=Com(Wi,ri)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
5. A computer-implemented method according to claim 3, wherein
the commitment Wi is:W i =Com(w i , r i),
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is a wire denomination,
such that
Com(w, r)=w×G+r×F,
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein the verifier receives a batch of wire commitments from the prover.
3. A computer-implemented method according to claim 1 for enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
….
8. A computer-implemented method according to claim 1, wherein the receiver receives from the prover a fully opened commitment to at least one wire.
7. A computer-implemented method according to claim 1, wherein the prover additionally sends a fully opened commitment to at least one wire of the function circuit.
9. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
8. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
10. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
9. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
11. A computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
10. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by a processor of a computer system, cause the computer system to at least perform the computer-implemented method according to claim 1.
12. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
11. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
13. A node of a blockchain network, the node configured to perform the method of claim 1.
12. A node of a blockchain network, the node configured to perform the method of claim 1.
14. A blockchain network having a node according to claim 13.
13. A blockchain network having a node according to claim 12.
Claims 1-14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-4, 6, 7, 10, 14, and 16-20 of U.S. Patent No. US12367490B2. Although the claims at issue are not identical, they are not patentably distinct from each other because the corresponding claims further recite similar/same limitation of the same subject matter.
Current application 19/235,793
U.S. Patent No. US12367490B2
1. A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including:
receiving from the prover:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
1. A computer-implemented method for enabling zero-knowledge proof or verification of a statement(S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
data comprising the statement(S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether, for a given function circuit output (h) and an elliptic curve point (P), a function circuit input(s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier(s), wherein the function circuit is a circuit that implements a hash function;
individual wire commitments and/or a batched commitment for wires of the function circuit;
the given function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the function circuit is satisfied, calculate the elliptic curve point (P), and validate the statement, thus determining that the prover holds the witness (w) to the statement, wherein each commitment is encrypted.
2. A computer-implemented method according to claim 1, wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w).
2. The computer-implemented method according to claim 1, wherein the prover sends an individual wire commitment and communicates with the verifier using Sigma (Σ) protocols to prove knowledge of the witness (w).
3. A computer-implemented method according to claim 1, wherein the verifier sends to the prover a challenge value (x).
3. The computer-implemented method according to claim 1, wherein the prover receives from the verifier a challenge value (x) and responds with an opening.
4. A computer-implemented method according to claim 1, wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
4. The computer-implemented method according to claim 1, wherein the prover sends to the verifier a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
5. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
6. The computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing a concatenation of all the individual wire commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
Wi=Com(Wi,ri)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. The computer-implemented method according to claim 1, wherein a commitment Wi is:
W i=Com(w i ,r i)
wherein
Com is a commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is a wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein the verifier receives a batch of wire commitments from the prover.
10. The computer-implemented method according to claim 1, wherein the prover sends a batch of wire commitments and generates random numbers to compute elliptic curve points for each wire to form the proving key (PrK).
8. A computer-implemented method according to claim 1, wherein the receiver receives from the prover a fully opened commitment to at least one wire.
14. The computer-implemented method according to claim 1, wherein the prover additionally sends a fully opened commitment to at least one wire.
9. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
16. The computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
10. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
17. The computer-implemented method according to claim 1, wherein the function circuit implements an SHA-256 hash function.
11. A computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
18. A non-transitory computer-readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
12. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
19. An electronic device comprising:
an interface device;
one or more processor(s) coupled to the interface device; and
a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
13. A node of a blockchain network, the node configured to perform the method of claim 1.
20. An electronic device as claimed in claim 19, wherein the electronic device is a node of a blockchain network.
14. A blockchain network having a node according to claim 13.
20. An electronic device as claimed in claim 19, wherein the electronic device is a node of a blockchain network.
Claims 1-14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 3, 7-10, 12, 13, 16, 20, and 22-26 of U.S. Patent No. US12014364B2. Although the claims at issue are not identical, they are not patentably distinct from each other because the corresponding claims further recite similar/same limitation of the same subject matter.
Current application 19/235,793
U.S. Patent No. US12014364B2
1. A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including:
receiving from the prover:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
3. A computer-implemented method for enabling a trustless zero-knowledge contingent payment or exchange of reward data from a buyer or verifier in exchange for access data from a seller or prover, the method including:
sending a seller a buyer public key (pkB) derived from multiplying a buyer secret key (skB) with an elliptic curve generator point (G);
receiving from the seller a data set, said data set including a zero-knowledge proof statement, which for a given function circuit output of an arithmetic circuit representing the zero-knowledge proof statement, and an elliptic curve point, a function circuit input is equal to a seller secret key (i), wherein a seller's public key (pks) is derived from multiplying the seller secret key (i) with the elliptic curve generator point (G), wherein the seller secret key is the access data or is used to secure the access data;
verifying the zero-knowledge proof statement;
sending the buyer a first transaction Tx1 that contains an output that allocates the reward data to the buyer in exchange for obtaining the access data, that is accessible using the seller secret key (i);
confirming, on a blockchain, that the seller has signed and broadcast the first transaction such that it is mined into a block, thus enabling the seller to access the reward data from the output of the first transaction Tx1 by providing a second transaction Tx2 supplying their signature and the seller secret key (i) to unlock the reward data; and
obtaining the access data offered by the seller, further including sending an elliptic curve public key pkB to the seller, said buyer having generated said elliptic curve public key from a secure random secret key skB, wherein:
pkB=skB×G, and G is the elliptic curve point, and
the seller secures the access data to be provided with a locking value i, such that
access data=pk B +i×G
and receiving from the seller, with the data set, seller public key, wherein pks=i×G, and an output f(i) from the given function circuit of the arithmetic circuit, wherein the function circuit input is the locking value i.
7. The computer-implemented method according to claim 3 for enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including:
the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the arithmetic circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the arithmetic circuit is satisfied and calculate the elliptic curve point (P) and validate the statement, thus determining that the prover holds the witness (w) to the statement.
2. A computer-implemented method according to claim 1, wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w).
8. The computer-implemented method according to claim 7, wherein the prover sends an individual wire commitment and communicates with the verifier using Σ protocols to prove knowledge of the witness (W).
3. A computer-implemented method according to claim 1, wherein the verifier sends to the prover a challenge value (x).
9. The computer-implemented method according to claim 7, wherein the prover receives from the verifier a challenge value (x) and responds with an opening.
4. A computer-implemented method according to claim 1, wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
10. The computer-implemented method according to claim 7, wherein the prover sends to the verifier a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
5. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
12. The computer-implemented method according to claim 10, wherein the random value (x) is computed by hashing a concatenation of all the individual wire commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
Wi=Com(Wi,ri)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
13. The computer-implemented method according to claim 7, wherein:
a commitment Wi is:
W i =Com(w i ,r i)
wherein
Com is the commitment to the function circuit,
wi is a wire value,
ri is a random number—different for each wire commitment, and
i is a wire denomination,
such thatCom(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein the verifier receives a batch of wire commitments from the prover.
16. The computer-implemented method according to claim 7, wherein the prover sends a batch of wire commitments and generates random numbers to compute elliptic curve points for each wire to form the proving key (PrK).
8. A computer-implemented method according to claim 1, wherein the receiver receives from the prover a fully opened commitment to at least one wire.
20. The computer-implemented method according to claim 3, wherein the prover additionally sends a fully opened commitment as an input to at least one wire of the function circuit of the arithmetic circuit.
9. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
22. The computer-implemented method according to claim 3, wherein the zero-knowledge proof statement uses only one arithmetic circuit for the function circuit.
10. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
23. The computer-implemented method according to claim 3, wherein the function circuit of the arithmetic circuit implements a hash function.
11. A computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
24. An electronic device comprising:
an interface device;
one or more processor(s) coupled to the interface device; and
a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
12. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
24. An electronic device comprising:
an interface device;
one or more processor(s) coupled to the interface device; and
a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
13. A node of a blockchain network, the node configured to perform the method of claim 1.
25. A node of a blockchain network, the node configured to perform the method of claim 1.
14. A blockchain network having a node according to claim 13.
26. A blockchain network having a node according to claim 25.
Claims 1-14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 4-9, 12, and 16-21 of Application 18603863. Although the claims at issue are not identical, they are not patentably distinct from each other because the corresponding claims further recite similar/same limitation of the same subject matter.
A Notice of Allowance has been issued for application 18603863. However, a patent number has not yet been issued.
Current application 19/235,793
Application 18603863
1. A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including:
receiving from the prover:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the circuit is satisfied and calculate the elliptic curve point (P) and validate the statement.
1. A computer-implemented method executed by a computing
device associated with a seller or prover for enabling a trustless zero-knowledge contingent
payment or exchange of reward data from a buyer or verifier in exchange for access data from
the seller or prover, wherein the reward data is data associated with a payment, the method
including: receiving from the buyer a buyer public key (pkB) derived from multiplying a buyer
secret key (skB) with an elliptic curve generator point (G), wherein the elliptic curve generator
point (G) is defined on an elliptic curve and is selected from elliptic curves used in blockchain
network cryptographic operations; generating a seller public key (pks) determined from multiplying a seller secret key (i)
with the elliptic curve generator point (G), wherein the seller secret key is the access data or is used to secure the access data required by the buyer; generating a zero-knowledge proof statement using a Sigma protocol with batched wire commitments for an arithmetic circuit representing the zero-knowledge proof statement, wherein the zero-knowledge proof statement uses publicly verifiable elliptic curve parameters with a prover-generated proving key computed from random numbers, which for a function circuit output of an arithmetic circuit representing the zero-knowledge proof statement, and an elliptic curve point, an input of the function circuit is equal to the seller secret key (i), wherein said zero-knowledge proof statement enables the buyer to determine that the arithmetic circuit is satisfied and validate the zero-knowledge proof statement through verification of the batched wire commitments, thus determining that the seller holds the required seller secret key that unlocks
the access data; preparing and sending a data set to the buyer, the data set including the zero-knowledge proof statement and a hash value computed by applying a hash function to the seller secret key (i); receiving from the buyer a first transaction Tx₁ that contains an output including a hash-locked output script that specifies a hash value computed by applying a hash function to the seller secret key that allocates the reward data to the buyer, which is accessible using the seller secret key (i) as a preimage to the hash value specified in the hash-locked output script; responsive to observing the first transaction Tx₁ being broadcast on a blockchain, such that the first transaction Tx₁ is mined into a block by distributed blockchain nodes, accessing the reward data from the output of the first transaction Tx₁; and generating, signing and broadcasting a second transaction Tx₂ that includes a digital
signature from the seller or prover and the seller secret key (i) in plaintext form as the preimage
to satisfy the hash-locked output script to unlock the reward data, wherein the seller secret key (i)
is revealed on the blockchain through publicly recorded inclusion of the plaintext seller secret
key in an input script of the second transaction Tx2 that is stored in a subsequent block on the
blockchain, thus enabling the buyer to retrieve the seller secret key (i) by reading the input script
of the second transaction Tx2 from the blockchain and to obtain the access data offered by the seller by deriving the access data from the retrieved seller secret key (i).
4. (Previously Presented) The computer-implemented method according to claim 1, for
enabling zero-knowledge proof or verification of a statement (S) in which a prover proves to a
verifier that a statement is true while keeping a witness (w) to the statement a secret, the method including: the prover sending to the verifier:
a statement (S) represented by an arithmetic circuit with m gates and n wires configured
to implement a function circuit and determine whether for a given function circuit output (h) and an elliptic curve point (P), the function circuit input (s) to a wire of the function circuit is equal to the corresponding elliptic curve point multiplier (s);
individual wire commitments and/or a batched commitment for wires of the arithmetic
circuit;
a function circuit output (h); and
a proving key (PrK),
which enables the verifier to determine that the arithmetic circuit is satisfied and calculate
the elliptic curve point (P) and validate the statement, thus determining that the prover holds the
witness (w) to the statement.
2. A computer-implemented method according to claim 1, wherein the verifier receives an individual wire commitment and Σ protocols are used to prove knowledge of the witness (w).
5. The computer-implemented method according to claim 4, wherein the prover sends an individual wire commitment and communicates with the verifier using Σ protocols to prove knowledge of the witness (W).
3. A computer-implemented method according to claim 1, wherein the verifier sends to the prover a challenge value (x).
6. (Previously Presented) The computer-implemented method according to claim 4,
wherein the prover receives from the verifier a challenge value (x) and responds with an opening.
4. A computer-implemented method according to claim 1, wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true and calculate the elliptic curve point (P).
7. (Previously Presented) The computer-implemented method according to claim 4,
wherein the prover sends to the verifier a random value (x) for enabling the verifier to determine
that the statement is true and calculate the elliptic curve point (P).
5. A computer-implemented method according to claim 4, wherein the random value (x) is computed by hashing the concatenation of all the commitments generated and sent to the verifier by the prover.
8. (Previously Presented) The computer-implemented method according to claim 7,
wherein the random value (x) is computed by hashing the concatenation of all the individual wire
commitments generated and sent to the verifier by the prover.
6. A computer-implemented method according to claim 1, wherein
the commitment Wi is:
Wi=Com(Wi,ri)
wherein
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein
F and G are elliptic curve points.
9. The computer-implemented method according to any of claim 4, wherein the commitment Wi is:
Wi=Com(wi,ri)
wherein:
Com is the commitment to the function circuit,
wi is the wire value,
ri is a random number—different for each wire commitment, and
i is the wire denomination,
such that
Com(w,r)=w×G+r×F
wherein:
F and G are elliptic curve points.
7. A computer-implemented method according to claim 1, wherein the verifier receives a batch of wire commitments from the prover.
12. The computer-implemented method according to claim 4, wherein the prover sends a batch of wire commitments and generates random numbers to compute elliptic curve points for each wire to form the proving key (PrK).
8. A computer-implemented method according to claim 1, wherein the receiver receives from the prover a fully opened commitment to at least one wire.
16. (Previously Presented) The computer-implemented method according to claim 1,
wherein the prover additionally sends a fully opened commitment as an input to at least one wire of the function circuit of the arithmetic circuit.
9. A computer-implemented method according to claim 1, wherein the statement uses only one arithmetic circuit for the function circuit.
16. (Previously Presented) The computer-implemented method according to claim 1,
wherein the prover additionally sends a fully opened commitment as an input to at least one wire of the function circuit of the arithmetic circuit.
10. A computer-implemented method according to claim 1, wherein the function circuit implements a hash function.
17. (Previously Presented) The computer-implemented method according to claim 1,
wherein the function circuit implements a hash function and, preferably, an SHA-256 hash
function.
11. A computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1.
18. (Previously Presented) A non-transitory computer-readable storage medium comprising
computer-executable instructions that, when executed, configure a processor to perform the method of claim 1.
12. An electronic device comprising: an interface device; one or more processor(s) coupled to the interface device; a memory coupled to the one or more processor(s), the memory having stored thereon computer executable instructions which, when executed, configure the one or more processor(s) to perform the method of claim 1.
19. (Previously Presented) An electronic device comprising:
an interface device; one or more processor(s) coupled to the interface device; and a memory coupled to the one or more processor(s), the memory having stored thereon
computer executable instructions that, when executed, configure the one or more processor(s) to perform the method of claim 1.
13. A node of a blockchain network, the node configured to perform the method of claim 1.
20. (Previously Presented) A node of a blockchain network, a node configured to perform
the method of claim 1.
14. A blockchain network having a node according to claim 13.
21. (Previously Presented) A blockchain network having the node according to claim 20.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4 and 6-14 are rejected under 35 U.S.C. 103 as being unpatentable over BOOTLE ("Efficient zero-knowledge proof systems") in view of MOHASSEL (US-20200219099-A1), as evidenced by applicant’s admitted prior art (AAPA), hereinafter BOOTLE-MOHASSEL-AAPA.
Regarding claim 1, BOOTLE teaches “A computer-implemented method for enabling verification of a statement (S) which a verifier verifies is true while a witness (w) to the statement is kept as a secret, the method including: ([BOOTLE, abstract] “A proof system can be used by a prover to demonstrate to one or more verifiers that a statement is true. Proof systems can be interactive where the prover and verifier exchange many messages, or non-interactive where the prover sends a single convincing proof to the verifier. Proof systems are widely used in cryptographic protocols to verify that a party is following a protocol correctly and is not cheating. A particular type of proof systems are zero-knowledge proof systems, where the prover convinces the verifier that the statement is true but does not leak any other information. Zero knowledge proofs are useful when the prover has private data that should not be leaked but needs to demonstrate a certain fact about this data. The prover may for instance want to show it is following a protocol correctly but not want to reveal its own input.”) ([BOOTLE, Page 9] “The definition of zero-knowledge follows the simulation paradigm, which says that if it is possible to simulate an accepting transcript without knowing a witness, then the protocol is not leaking information about the witness.”) ([BOOTLE, Page 2] “The prover knows the witness w, and wants to convince the verifier that u ∈ LR without revealing anything else. In particular, the prover does not want to reveal the witness w.”) receiving from the prover: a statement (S) represented by an arithmetic circuit with m gates and n wires configured to implement a function circuit and determine whether for a given function circuit output (h) … ([BOOTLE, Section 2.6, Fig. 7] “To illustrate the capabilities of Σ-protocols, we show how to build a protocol for a more general relation combining several simpler protocols. For example, using many parallel executions of the zero and product Σ-protocols in Section 2.4 we can provide Σ-protocols for the satisfiability of arithmetic circuits. To prove satisfiability of an arithmetic circuit the prover has to commit to all the Wi corresponding to wire assignments and then prove consistency of inputs and outputs of addition gates using Σzero and multiplication gates using Σprod. Consider for instance a very simple arithmetic circuit over Zp consisting of fan-in-2 addition and multiplication gates, as the one pictured in Fig. 7. The prover computes commitments Wi = COMck(wi, ri) for random ri and then shows that both commitments W1 · W2 ·
W
3
-
1
and W4 · W5 ·
W
7
-
1
open to 0 and that W3 and W8 open to w1 · w2 and w6 · w7, respectively ……. For an arithmetic circuits with N addition and multiplication gates we need to combine N parallel executions of Σzero and Σprod. The resulting communication amounts to O(N) commitments and field elements.”) ([BOOTLE, Section 2.2] “Consider two group elements s, t ∈ G, such that they share the same discrete logarithm with respect to two different generators g, h ∈ G …. The prover starts by picking a random field element r from Zp and then computes two blinding elements a = g^r, b = h^r and sends them to the verifier. The verifier picks a uniformly random challenge x ← Zp and sends it back to the prover. The prover computes the field element z = wx + r and sends it to the verifier. The verifier checks if both of the following verification equations hold g^z = s^x * a, h^z = t^x * b, in which case accept the proof and otherwise rejects it. The argument is summarized in Fig. 2.”) … individual wire commitments and/or a batched commitment for wires of the circuit; ([BOOTLE, Section 2.7] “Another way to batch arguments together is to commit to many values at once. We can build commitments to vectors rather than single elements and extend the previous techniques to vector commitments. We can for instance extend Pedersen commitments to allow openings in Znp, as described in Fig. 9. This extension preserves the same properties of the standard Pedersen commitment scheme but committing to n elements only requires sending a single group element.”) a function circuit output (h); ([BOOTLE, Section 2.6] “To prove satisfiability of an arithmetic circuit the prover has to commit to all the wi corresponding to wire assignments and then prove consistency of inputs and outputs of addition gates using Σzero and multiplication gates using Σprod.”) ([BOOTLE, Fig. 7] “w8”) and a proving key (PrK), which enables the verifier to determine that the circuit is satisfied and calculate … and validate the statement. ([BOOTLE, Section 2.4] “Σprod. For this protocol we focus on the case of Pedersen commitments and refer to [CD98] for the more general case. Let A, B, C be commitments opening to a, b and ab, respectively. Consider a commitment key ck = (G, p, g, h). The main idea is for the prover to prove knowledge of opening of A and B and showing that C opens to the same value of A when replacing g with B in the commitment key. Let ck0 = (G, p, B, h) be the modified key, thus …. The full description of the protocol is in Fig. 6. The protocol, Σprod achieves perfect completeness, perfect SHVZK and computational special soundness. ”) ([BOOTLE, Section 2.2] “Consider two group elements s, t ∈ G, such that they share the same discrete logarithm with respect to two different generators g, h ∈ G. We now give a simple Σ-protocol for the equality of discrete logarithms of s and t. More precisely we describe a Σ-protocol for the following relation where G is a group of prime order p with |p| = λ. The prover starts by picking a random field element r from Zp and then computes two blinding elements a = g^r, b = h^r and sends them to the verifier. The verifier picks a uniformly random challenge x ← Zp and sends it back to the prover. The prover computes the field element z = wx + r and sends it to the verifier. The verifier checks if both of the following verification equations hold g^z = s^x * a, h^z = t^x * b, in which case accept the proof and otherwise rejects it. The argument is summarized in Fig. 2.”) ([BOOTLE, Section 2.1] “A Σ-protocol is zero-knowledge if it does not leak information about the witness beyond the membership of u in the language LR. The definition of zero knowledge follows the simulation paradigm, which says that if it is possible to simulate an accepting transcript without knowing a witness, then the protocol is not leaking information about the witness.”)
However, BOOTLE does not teach “an elliptic curve point (P) …. elliptic curve point multiplier … calculate the elliptic curve point (P)”.
In analogous teaching, MOHASSEL teaches of “an elliptic curve point (P) …. elliptic curve point multiplier … calculate the elliptic curve point (P)” ([MOHASSEL, para. 0021], “the commitment to the message comprises a point along an elliptic curve. In non-limiting embodiments, the method includes verifying, by at least one processor of the verifying system, the digital signature based on the commitment and the zero-knowledge algorithm.”) ([MOHASSEL, para. 0090] “Non-limiting embodiments provide for the proving system to establish that the input/output used in a Sigma protocol for an algebraic statement is the same as input/output committed to by an algebraic commitment scheme, such as “Com.” This enables using the output of an algebraic statement as an intermediate output in a composite statement. For instance, the proving system can show that it has access to h, x1, x2 such that h=g1 x 1 g2 x2 2 given g1, g2, Com(h), Com(x1), Com (x2). To do so, the proving system generates a commitment to a point P on an elliptic curve E(Ft) by committing to its coordinates, i.e. Com(P)=(Comq(Px), Comq(Py)) where P=(Px, Py) and q>t.”) ([MOHASSEL, para. 0091] “For example, the proving system generates a commitment to a group element gx where g is a generator for an elliptic curve group and proves access to x such that Com(gx)=y given a public y. Such methods are not limited to RSA groups, which would not apply to Bitcoin because the Bitcoin protocol utilizes elliptic curve groups. Non-limiting embodiments of the proving system prove equality of committed values over different elliptic curve groups such that the system can prove access to x such that Comp(x)=y and Comq(x)=z for public values y, z where Comp denotes an algebraic commitment over an elliptic curve group of size p (similarly, Comq). This method enables the proving system efficiently shift from proof systems in one group to another group by committing to the shared values in both groups and invoking a proof, thereby avoiding processing-intensive exponentiation operations.”).
Thus, given the teaching of MOHASSEL, it would have been obvious to one of ordinary skill in the art before the effective filling date of the claimed invention to combine the teaching of elliptic curve point by MOHASSEL into the teaching of a method for enabling zero-knowledge proof by BOOTLE. One of ordinary skill in the art would have been motivated to do so because MOHASSEL recognizes the need for zero-knowledge proofs ([MOHASSEL, para. 0006] “A ZKP of solvency would allow a cryptocurrency exchange to verify to its users that it controls sufficient funds without revealing the amount or distribution of said funds and liabilities. Without cryptographic proofs of solvency, exchanges may be relegated to soliciting third-party auditors to verify funds, which requires users to trust the third-party auditor, and the auditor to maintain the privacy of the data. Therefore, there is a need in the art for efficient ZKPs of statements of solvency.”).
However, BOOTLE-MOHASSEL does not explicitly teach “the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve multiplier (s);”.
However, as presented above, BOOTLE Section 2.7 teaches Pedersen commitments and as evidenced by Applicant’s admitted prior art the Pedersen commitment scheme teaches of “the function circuit input (s) to a wire of the function circuit is equal to a corresponding elliptic curve multiplier (s);”. ([AAPA, Specification, para. 0012] “A Pedersen commitment scheme involves two elliptic curve generator points: G and F in the group G of prime order p, known to all parties. The committer generates a secure random number r in the field of prime integers Zp, and then computes the commitment (via elliptic curve addition/multiplication) to the secret value s: Com(s, r) = s X G + r X F, wherein X denotes elliptic curve point multiplication”).
Thus, as evidenced by applicant’s admitted prior art, BOOTLE implicitly teaches this feature.
Regarding claim 2, BOOTLE-MOHASSEL-AAPA teaches all limitations of claim 1. BOOTLE further teaches “wherein the verifier receives an individual wire commitment and ∑ protocols are used to prove knowledge of the witness (w). ([BOOTLE, section 2.4] “Commitment schemes and Σ-protocols are closely related. It is possible in fact to construct commitment schemes out of Σ-protocols for hard relations as described in [Dam90]. It is also convenient to rethink the interaction of Σ-protocols in terms of committing and opening. A general way to build Σ-protocols is to let the prover commit to some values in the first move, and to open some commitments depending on the challenge in the last move. We try to illustrate this general approach by showing two examples of Σ-protocols. The first one is a protocol for showing that a commitment opens to 0. The second protocol is for proving that a commitment opens to the product of the openings of two other commitments”) ([BOOTLE, section 2.6] “To prove satisfiability of an arithmetic circuit the prover has to commit to all the wi corresponding to wire assignments and then prove consistency”) ([BOOTLE, section 1] “The prover knows the witness w, and wants to convince the verifier that u ∈ LR without revealing anything else. In particular, the prover does not want to reveal the witness w.”) ([BOOTLE, section 2.1] “A Σ-protocol is a form of proof of knowledge, in the sense that a prover should be able to answer random challenges only if she knows a witness for a statement u. This is formalized via special soundness which says that given two accepting transcripts corresponding to two distinct challenges and the same initial message it is possible to extract a witness for the statement.”)
Regarding claim 3, BOOTLE-MOHASSEL-AAPA teaches all limitations of claim 1. BOOTLE further teaches “wherein the verifier sends to the prover a challenge value (x).” ([BOOTLE, section 2] “In the example the verifier picks a random challenge in {0, 1} and the prover has probability ½ of convincing the verifier of a false statement. The protocol needs to be iterated many times in order to reduce this probability and achieve good soundness. In this section we describe 3-move interactive proof systems in which the verifier picks a uniformly random challenge from a much larger space. This means a cheating prover has small probability of guessing the verifier’s challenge in advance. The size of the challenge space is made big enough so that a single execution of the protocol suffices to convince the verifier. This kind of interactive proof systems often goes under the name of Σ-protocols.”) ([BOOTLE, section 2.1] “The prover sends an initial message a to the verifier, the verifier replies with a random challenge x, and the prover answers with a final response z. The verifier finally checks the transcript (a, x, z) and decides whether to accept or reject the statement.”)
Regarding claim 4, BOOTLE-MOHASSEL-AAPA teaches all limitations of claim 1. BOOTLE further teaches “wherein the verifier receivers from the prover a random value (x) for enabling the verifier to determine that the statement is true ([BOOTLE, section 2.4] “Σzero. Consider a commitment A opening to 0 to be part of the statement. The prover computes a random commitment B = COMck(0; s) and sends it to the verifier, which answer with a random challenge x. The prover then sends opening information z to the verifier, which checks the commitment AxB opens to 0 using randomness z. The full description of the protocol is in Fig. 5 …… This protocol could be used also to prove equality of openings of commitments. Given two commitments A1 and A2 it suffices to use Σzero to show that A1 * A2^-1 opens to zero. In the protocol we only require the commitment scheme to be homomorphic, therefore it can be instantiated with both Pedersen and ElGamal commitments. In both cases we get perfect completeness, perfect soundness and perfect special honest verifier zero-knowledge.”).
However, BOOTLE does not teach “and calculate the elliptic curve point (P)”.
In analogous teaching MOHASSEL teaches “and calculate the elliptic curve point (P)”. ([MOHASSEL, para. 0090] “Non-limiting embodiments provide for the proving system to establish that the input/output used in a Sigma protocol for an algebraic statement is the same as input/output committed to by an algebraic commitment scheme, such as “Com.” This enables using the output of an algebraic statement as an intermediate output in a composite statement. For instance, the proving system can show that it has access to h, x1, x2 such that h=g1 x 1 g2 x2 2 given g1, g2, Com(h), Com(x1), Com (x2). To do so, the proving system generates a commitment to a point P on an elliptic curve E(Ft) by committing to its coordinates, i.e. COM(P)=(COMq(Px), COMq(Py)) where P=(Px, Py) and q>t.”).
The same motivation to modify MOHASSEL with BOOTLE as in the rejection of claim 1, applies.
Regarding claim 6, BOOTLE-MOHASSEL-AAPA teaches all limitations of claim 1. BOOTLE further teaches “wherein the commitment Wi is: Wi=COM(wi ,ri) wherein COM is the commitment to the function circuit, wi is the wire value, ri is a random number—different for each wire commitment, and i is a wire denomination”. ([BOOTLE, section 2.6] “To illustrate the capabilities of Σ-protocols, we show how to build a protocol for a more general relation combining several simpler protocols. For example using many parallel executions of the zero and product Σ-protocols in Section 2.4 we can provide Σ-protocols for the satisfiability of arithmetic circuits. To prove satisfiability of an arithmetic circuit the prover has to commit to all the wi corresponding to wire assignments and then prove consistency of inputs and outputs of addition gates using Σzero and multiplication gates using Σprod. Consider for instance a very simple arithmetic circuit over Zp consisting of fan-in-2 addition and multiplication gates, as the one pictured in Fig. 7. The prover computes commitments Wi = COMck(wi , ri) for random ri and then shows that both commitments W1 · W2 · W3^-1 and W4 · W5 · W7^-1 open to 0 and that W3 and W8 open to w1 · w2 and w6 · w7, respectively.”) ([BOOTLE, section 2.3] “Pedersen Commitments. Consider a group G of prime order p and let g, h be random generators of the group. Message and randomnesses are in Zp and the commitment space is the group G. The sender commits to an element m ∈ Zp by picking a uniformly random r from Zp and computing c = g^m * h^r. The scheme is perfectly hiding and computationally binding, assuming that the discrete logarithm assumption holds.”)
However, BOOTLE does not explicitly teach “such that COM(w,r)=w×G+r×F wherein F and G are elliptic curve points”.
However, as presented in claim 1, BOOTLE Section 2.7 teaches Pedersen commitments and as evidenced by Applicant’s admitted prior art the Pedersen commitment scheme teaches of “COM(w,r)=w×G+r×F wherein F and G are elliptic curve points”. ([AAPA, page 3 lines 25-31] “A Pedersen commitment scheme involves two elliptic curve generator points: G and F in the group G of prime order p, known to all parties. The committer generates a secure random number r in the field of prime integers Zp, and then computes the commitment (via elliptic curve addition/multiplication) to the secret value s: Com(s, r) = s X G + r X F, wherein X denotes elliptic curve point multiplication”)
Thus, as evidenced by applicant’s admitted prior art, BOOTLE implicitly teaches this feature.
Regarding claim 7, BOOTLE-MOHASSEL-AAPA teaches all limitations of claim 1. BOOTLE further teaches “wherein the verifier receives a batch of wire commitments from the prover.” ([BOOTLE, Section 2.7, Fig. 8] “Batch Σ-protocol for opening of many commitments to 0. …. GROTH [Gro09] used batching techniques and vector commitments together to give zero-knowledge arguments for linear algebra relations over vectors. These techniques make it possible to give arguments for the satisfiability of arithmetic circuits with an overall communication of O(√N) group and field elements. So arithmetic circuit satisfiability and many other relevant relations can be proved with sublinear communication”) ([BOOTLE, section 2.6] “The prover computes commitments Wi = COMck(wi, ri) for random ri”) ([BOOTLE, Section 2.7, Fig. 8] “Vbatch (ck, A1, …. , An)”) [Examiner’s note: Figure 8 of BOOTLE shows a verifier batch received from a prover batch.]
Regarding claim 8, Applicant’s admitted prior art teaches of “wherein the receiver receives from the prover a fully opened commitment to at least one wire. ([AAPA, specification, para. 0025] “If the prover wants to show that, in addition to satisfying the circuit, a particular wire has a particular value, they can fully open the commitments to the relevant wires.”) ([AAPA, specification, para. 0012] “Central to many interactive zero-knowledge protocols are commitment schemes, which are used to for arithmetic circuit satisfiability. A commitment enables a prover to commit to a secret value in advance, and then later verifiably reveal (open) the secret value. A commitment scheme has two main properties. Firstly, it is hiding - the commitment keeps the value secret. Secondly, it is binding - the commitment can only be opened to the originally committed value”) ([AAPA, specification, para. 0013] “The committer can at a later stage fully open the commitment (i.e. it can be verified), by providing the values”).
Thus, as evidenced by applicant’s admitted prior art, BOOTLE implicitly teaches this feature because BOOTLE teaches of Pedersen Commitments.
Regarding claim 9, BOOTLE-MOHASSEL-AAPA teaches all limitations of claim 1. BOOTLE further teaches “wherein the statement uses only one arithmetic circuit for the function circuit.” ([BOOTLE, Section 2.6, Fig. 7] “To illustrate the capabilities of Σ-protocols, we show how to build a protocol for a more general relation combining several simpler protocols. For example using many parallel executions of the zero and product Σ-protocols in Section 2.4 we can provide Σ-protocols for the satisfiability of arithmetic circuits. To prove satisfiability of an arithmetic circuit the prover has to commit to all the wi corresponding to wire assignments and then prove consistency of inputs and outputs of addition gates using Σzero and multiplication gates using Σprod. Consider for instance a very simple arithmetic circuit over Zp consisting of fan-in-2 addition and multiplication gates, as the one pictured in Fig. 7. The prover computes commitments Wi = COMck(wi, ri) for random ri”).
Regarding claim 10, BOOTLE-MOHASSEL-APPA teaches all limitations of claim 1. BOOTLE does teach of a “function circuit” ([BOOTLE, section 2.6] “Consider for instance a very simple arithmetic circuit over Zp consisting of fan-in-2 addition and multiplication gates, as the one pictured in Fig. 7.”).
However, BOOTLE-MOHASSEL does not explicitly teach “wherein the function circuit implements a hash function.”.
Applicant’s admitted prior art teaches of “wherein the function circuit implements a hash function.”. ([APPA, page 6 line 24-27] “The example in Figure lb is a trivial circuit. In practice, useful circuits consist of many more gates. Of particular interest is an arithmetic circuit for the SHA-256 hash function – this circuit enables a prover to demonstrate that they know the pre-image (input) to a SHA-256 function that hashes to a particular (output) value, without revealing the pre-image.”).
Thus, as evidenced by applicant’s admitted prior art, BOOTLE implicitly teaches this feature.
Regarding claim 11, this claim recites of a computer readable storage medium comprising computer-executable instructions which, when executed, configure a processor to perform the method of claim 1. Therefore, claim 11 is rejected in a similar manner as in the rejection of claim 1.
Regarding claim 12, this claim recites an electronic device having a processor and memory with instruction which once executed perform the steps of claim 1. Therefore, claim 12 is rejected in a similar manner as in the rejection of claim 1. Furthermore, MOHASSEL teaches of device having processor ([MOHASSEL, para. 0086] “Non-limiting embodiments of the invention may be implemented on one or more computing devices including at least one processor, such as but not limited to one or more servers, computers, mobile devices, and/or the like. As used herein, the terms “proving system” and “proving computer” refer to one or more computing devices operated by a user or entity seeking to prove that it has access to a secret key or secret information. The terms “verifying system” and “verifying computer” refer to one or more computing devices operated by a user or entity seeking to verify that the proving system has the secret key or secret information without itself having access to it. It will be appreciated that various other implementations are possible.”).
The same motivation to modify BOOTLE with MOHASSEL as in the rejection of claim 1, applies.
Regarding claim 13, this claim teaches of a node of a blockchain network configured to perform the method of claim 1. Therefore, claim 13 is rejected in a similar manner as in the rejection of claim 1. MOHASSEL further teaches of Blockchain nodes ([MOHASSEL, para. 0093] “The system 2000 also includes a plurality of distributed nodes 214, 216 each hosting the distributed ledger 208. It will be appreciated that, in some embodiments, numerous nodes 214, 216 may host the distributed ledger 208 and that the exchange system 202 may not host the distributed ledger 208. In the example shown in FIG. 2, the exchange system 202 and nodes 214, 216 are nodes of a blockchain network. In the example of the Bitcoin blockchain or other public blockchains, there may be a vast number of nodes.”)
The same motivation to modify BOOTLE with MOHASSEL as in the rejection of claim 1, applies.
Regarding claim 14, this claim recites features similar to those of claim 13, therefore, claim 14 is rejected in a similar manner as in the rejection of claim 13.
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over BOOTLE-MOHASSEL-AAPA in view of MAXWELL (US-20160358165-A1).
Regarding claim 5, BOOTLE-MOHASSEL-AAPA teach all limitations of claim 4. However, BOOTLE-MOHASSEL-AAPA does not teach “wherein the random value (x) is computed by hashing a concatenation of all the commitments generated and sent to the verifier by the prover.”
In analogous teaching, MAXWELL teaches “wherein the random value (x) is computed by hashing a concatenation of all the commitments generated and sent to the verifier by the prover.” ([MAXWELL, para. 0026] “For example, in a case where a sender wishes to generate a rangeproof showing that commitment C is in the value range [0, 32]. The sender may send the recipient a collection of commitments and OR proofs for each of them. Each commitment may be associated with a digit of the input value. For example, the following commitments may be included in a rangeproof: C1is 0 or 1 C2 is 0 or 2 C3 is 0 or 4 C4 is 0 or 8 C5 is 0 or 16. If the sender selects the blinding factors for C1-5 correctly then C1+C2+C3+C4+C5==C. Effectively the input value has been built in binary, and the resulting 5-bit number can only be in the range [0,32].”) ([MAXWELL, para. 0025] “If an ECC signature is constructed so that the ‘message’ is a hash of the pubkey, the signature may prove that the signer knew the private key, which is a discrete log of the pubkey with respect to some generator (like G or H discussed above). For a ‘pubkey’ like P=xG+aH”) ([MAXWELL, para. 0021] “Given the two generators G and H, an exemplary commitment scheme to encrypt the input value may be defined as commitment=xG+aH”).
Thus, given the teaching of MAXWELL, it would have been obvious to one of ordinary skill in the art before the effective filling date of the claimed invention to combine the teaching of concatenation of commitments by MAXWELL into the teaching of a method for enabling zero-knowledge proof by BOOTLE-MOHASSEL-AAPA. One of ordinary skill in the art would have been motivated to do so because MAXWELL recognizes the need to improve privacy in crypto-systems ([MAXWELL, para. 0016] “There are existing deployed techniques that further improve privacy in Bitcoin (such as CoinJoin, which merges the transaction history of users by making joint payments), but the utility of these techniques is reduced by the fact that it's possible to track amounts. There have been proposed cryptographic techniques to improve privacy in Bitcoin-like systems, but so far all of them may result in breaking “pruning” and result in participants needing a perpetually growing database to verify new transactions”) ([MAXWELL, para. 0017] “The systems and methods described herein improve the situation by making the transaction amounts private, while preserving the ability of the public network to verify that the ledger entries still add up. This may be done without adding any new basic cryptographic assumptions to the Bitcoin system, and with a manageable level of overhead. As a side-effect of its design, the additional exchange of private “memo” data (such as invoice numbers or refund addresses) may be allowed by the described encryption methods, without any further increase in transaction size, by reclaiming most of the overhead of the cryptographic proofs used to make the transaction amounts private.”)
Pertinent Art
The prior art made of record and not relied upon is considered pertinent to Applicant’s
disclosure.
BROWN (US-20180270065-A1): This prior art teaches of an approach for an improved method, system, and computer program product that performs zero-knowledge proof of knowledge of user identification and/or authentication for a decentralized, trustless storage and management of user identification and/or authentication using one or more distributed ledger systems.
HIWATARI (US-9979549-B2): This prior art teaches of an information processing apparatus including a key selection section configured to select one out of a plurality of different secret keys, in a public key authentication scheme or a digital signature scheme in which each of the plurality of secret keys exists for one public key registered in a verifier, and a process execution section configured to execute, by using the secret key selected by the key selection section, an authentication process with the verifier by the public key authentication scheme or a digital signature generation process to the verifier by the digital signature scheme.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AFAQ ALI whose telephone number is (571)272-1571. The examiner can normally be reached Mon - Fri 7:30am - 5:30pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ALI SHAYANFAR can be reached at (571) 270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.A./
08/06/2026
/AFAQ ALI/Examiner, Art Unit 2434
/NOURA ZOUBAIR/Primary Examiner, Art Unit 2434
Prosecution Insights