Computer-implemented system and method for trustless zero-knowledge contingent payment

A computer-implemented method executed by a computing device associated with a seller or prover for enabling a trustless zero-knowledge contingent payment or exchange of reward data from a buyer or verifier in exchange for access data from the seller or prover, wherein the reward data is data associated with a payment, the method including:

• receiving from the buyer a buyer public key (pkB) derived from multiplying a buyer secret key (skB) with an elliptic curve generator point (G), wherein the elliptic curve generator point (G) is defined on an elliptic curve and is selected from elliptic curves used in blockchain network cryptographic operations;
• generating a seller public key (pks) determined from multiplying a seller secret key (i) with the elliptic curve generator point (G), wherein the seller secret key is the access data or is used to secure the access data required by the buyer;
• generating a zero-knowledge proof statement using a Sigma protocol with batched wire commitments for an arithmetic circuit representing the zero-knowledge proof statement, wherein the zero-knowledge proof statement uses publicly verifiable elliptic curve parameters with a prover-generated proving key computed from random numbers, which for a function circuit output of an arithmetic circuit representing the zero-knowledge proof statement, and an elliptic curve point, an input of the function circuit is equal to the seller secret key (i), wherein said zero-knowledge proof statement enables the buyer to determine that the arithmetic circuit is satisfied and validate the zero-knowledge proof statement through verification of the batched wire commitments, thus determining that the seller holds the required seller secret key that unlocks the access data;
• preparing and sending a data set to the buyer, the data set including the zero-knowledge proof statement and a hash value computed by applying a hash function to the seller secret key (i);
• receiving from the buyer a first transaction Tx1 that contains an output including a hash-locked output script that specifies a hash value computed by applying a hash function to the seller secret key that allocates the reward data to the buyer, which is accessible using the seller secret key (i) as a preimage to the hash value specified in the hash-locked output script;
• responsive to observing the first transaction Tx1 being broadcast on a blockchain, such that the first transaction Tx1 is mined into a block by distributed blockchain nodes, accessing the reward data from the output of the first transaction Tx1;
• and
• generating, signing and broadcasting a second transaction Tx2 that includes a digital signature from the seller or prover and the seller secret key (i) in plaintext form as the preimage to satisfy the hash-locked output script to unlock the reward data, wherein the seller secret key (i) is revealed on the blockchain through publicly recorded inclusion of the plaintext seller secret key in an input script of the second transaction Tx2 that is stored in a subsequent block on the blockchain, thus enabling the buyer to retrieve the seller secret key (i) by reading the input script of the second transaction Tx2 from the blockchain and to obtain the access data offered by the seller by deriving the access data from the retrieved seller secret key (i).