SNARKs with Preprocessing. Eran Tromer

Transcription

1 SNARKs with Preprocessing Eran Tromer BIU Winter School on Verifiable Computation and Special Encryption 4-7 Jan 206

2 G: Someone generates and publishes a common reference string P: Prover picks NP statement exists w such that f(x,w)=y and sends x,y, and a succint proof V: Verifier efficiently checks proof and is convinced that prover knows a witness w.

3 3 zksnark for NP: setting ff ff f(x,w)=y witness w, internal values z Prover PP proof ππ Verifier VV

4 zksnark for NP: setting 4 ff zero knowledge succinct (VV and ππ) noninteractive argument proof of knowledge zksnark f(x,w)=y Prover PP proof ππ Verifier VV

5 Preprocessing zksnark for NP: setting 5 Variants: Dependence on ff Cheap / expensive Secret / public randomness Publicly-verifiable / designated-verifier Prover PP ff Generator GG f(x,w)=y proof ππ $

6 0 Preprocessing SNARKs for NP Proof size (field elements) CRS size Prover runtime [Groth0] 42 OO(ss 2 ) OO(ss 2 ) [Lipmaa2] 39 OO(ss) OO(ss 2 ) QAP-based [GGPR3] Reinterpreted as linear PCPs: [BCIOP3] [SBVBBW3] 7 8 OO(ss) OO(ss) Preprocessing is private-coin and costs OO(s) Improvements: [PGHR3] [BCTV4usenix] [BBFR5] [CFHKKNPX5]... [DFGK4] 4 OO(ss) OO(ss)

7 zksnark construction via QAP and Linear PCPs Computation Algebraic Circuit RCS QAP Linear PCP Linear Interactive Proof zksnark

8 Computation Arithmetic Circuit Efficient computation ff( ). Deterministic ff yy Nondeterministic: ww: ff, ww yy completeness soundness, PoK Arithmetic circuit CC(, ) over FF. : CC, yy accepts with internal values FF nn 2

9 3 Arithmetic Circuit RCS (Rank- Quadratic System) [GGPR3] Arithmetic circuit CC(, ) over FF. : CC, yy accepts with internal values FF nn completeness mm RCS aa jj, bb jj, cc jj vectors in FF kk. jj= FF nn : jj,, mm : yy soundness, PoK ττ ττ ττ aa jj yy bb jj = yy cc jj

10 Expressing gates as constraints: Multiplication gate in CC converted into a constraint: yy ττ ττ yy = yy ττ Addition gate in CC converted into a constraint: yy ττ ττ yy = yy ττ Generally, any bilinear gate. 4

11 RCS (Rank- Quadratic Constraint System) QAP (Quadratic Arithmetic Program) [GGPR3] 5 mm RCS aa jj, bb jj, cc jj vectors in FF kk. jj= FF nn : jj,, mm : yy ττ ττ ττ aa jj yy bb jj = yy cc jj Matrices (AA, BB, CC) in FF kk mm. FF nn : ττ ττ ττ yy AA yy yy BB CC = 0 mm

12 RCS QAP (cont.) Matrices (AA, BB, CC) in FF kk mm. FF mm : 6 yy QAP: AA ii αα, BB ii αα, CC ii αα that vanish on SS. ττ ττ ττ AA yy BB yy interpolate to AA ii (αα) interpolate to BB ii (αα) interpolate to CC ii (αα) Fix SS = αα, αα mm FF. For ii =,, kk and jj =, mm: Let AA ii αα be the degree-(mm ) polynomial such that AA ii αα jj = AA ii,jj. Likewise BB ii αα, CC ii (αα). Let VV αα = mm jj= αα αα jj, vanishing on SS. FF nn : kk ii= and VV polynomials in FF αα. Let PP,yy, αα = AA,yy, αα BB,yy, αα CC,yy, αα VV αα divides PP,yy, (αα) i.e., HH(αα): PP,yy, αα = HH αα VV(αα) ττ AA0 (αα) AA (αα) yy AA kk (αα) Intuition: VV(αα) generates the ideal of all polynomials ττ BB0 (αα) BB (αα) yy BB kk (αα) CC ττ CC0 (αα) CC (αα) yy CC kk (αα) = 0 mm

13 QAP Linear PCP 7 QAP: AA ii αα, BB ii αα, CC ii αα kk ii= FF nn : HH(αα): PP,yy, αα = HH αα VV(αα) [GGPR3] [BCIOP3] [BCGTV3] and VV polynomials in FF αα. Let PP,yy, αα = AA,yy, αα BB,yy, αα CC,yy, αα ττ AA0 (αα) AA (αα) yy AA kk (αα) ττ BB0 (αα) BB (αα) yy BB kk (αα) ττ CC0 (αα) CC (αα) yy CC kk (αα) Probabilistic check: Draw ττ RR FF and check PP,yy, ττ =? HH ττ VV(ττ). Soundness: polynomial identity testing with degree <2mm FF Let ππ = (,, yy,, h) where h is the coefficient vector of HH. Then this check can be done by 4 linear queries to ππ, retrieving the monomials. (Plus a 5th for checking, yy via random linear combination.) Any ππ still commits to some low-degree HH(ττ) PP,yy, ττ.

14 QAP Linear PCP: the algorithms 8 Let PP,yy, αα = AA,yy, αα BB,yy, αα CC,yy, αα HH(αα): PP,yy, αα = HH αα VV(αα) ττ AA0 (αα) AA (αα) yy AA kk (αα) yy ττ BB0 (αα) BB (αα) BB kk (αα) ττ CC0 (αα) CC (αα) yy CC kk (αα) Prover: compute HH and its coefficient vector h; Output ππ = (,, yy,, h) where h is the coefficient vector of HH. Complexity: Dominated by computing the mm coefficients of HH. With suitable FFT: ~mm log mm + (#"nonzero entries in " AA, BB, CC) field operations. Query: Verify: draw ττ RR FF, make linear queries to ππ according to ττ. Complexity: ~4mm + 2(#nonzero entries in AA, BB, CC) field operations. Decision: check a simple quadratic equation in the answers. Later: important for public verifiability (will use of pairings).

15 QAP Linear PCP: adding ZK 9 Let PP,yy, αα = AA,yy, αα BB,yy, αα CC,yy, αα δδ, δδ 2, δδ 3 RR FF ττ AA0 (αα) AA (αα) yy AA kk (αα) +δδ VV(αα) ττ BB0 (αα) BB (αα) yy BB kk (αα) +δδ 2 VV(αα) ττ CC0 (αα) CC (αα) yy CC kk (αα) +δδ 3 VV(αα) Honest-Verifier Zero Knowledge: Prover adds random multiple of VV αα to AA, BB, CC(αα). ZK: The queries to AA,yy,, BB,yy,, CC,yy, return random independent FF elements. The query to HH follows from them. The, yy-consistency query is predictable.

16 Linear PCP Linear Interactive Proof [BCIOP3] Linear PCP Prove, yy, ww ππ FF mm qq,, qq kk FF mm aa,, aa kk FF (aa ii = ππ ττ qq ii ) Verify(, yy) An LPCP is not automatically a LIP, because of consistency (different qq ii may see different ππ) 20 Linear Interactive Proof Prove, yy, ww Π FF kk mm qq,, qq mm FF aa,, aa kk FF (aa = Πqq) Verify(, yy)

17 2 Linear PCP Linear Interactive Proof: adding a consistency check Linear PCP Prove, yy, ww ππ FF mm qq,, qq kk FF mm aa,, aa kk FF consistency check kk qq kk+ = ii= αα ii qq ii where αα,, αα kk RR FF [BCIOP3] Verify(, yy) Linear Interactive Proof Prove, yy, ww Verify(, (kk+) kk+ mm Π FF qqq,, qqq (kk+)mm FF aa,, aa kk+ FF yy)

18 26 Linear Interactive Proof designated-verifier SNARK [BCIOP3] Input-Oblivious Linear Interactive Proof Prove, yy, ww Π FF kk mm qq,, qq mm FF aa,, aa kk FF Verify(, yy) QQ uu DD,yy $ Designated-verifier SNARK (GG, PP, VV)

19 Linear Interactive Proof designated-verifier SNARK: construction GG: pk EE, sk EE Gen EE ( kk ) proving key cc cc mm Enc pk EE Enc pk EE qq pk = (pk EE, cc,, cc mm ) qq mm QQ uu $ verification key vk = (sk EE, uu) PP pk,, yy, ww : Prove, yy, ww Π FF kk mm HomEval pk EE(Π, cc) cc cc kk VV vk,, yy, ππ : aa Dec sk EE Dec aa sk EE kk DD,yy (, uu) 27

20 Linear Interactive Proof designated-verifier SNARK: assumption 28 Linear-Only Homomorphism ( [BSW]) encryption scheme that ONLY allows FF -linear homomorphic operations (e.g., knowledge variant of Paillier) non-falsifiable assumption Can add ZK and PoK with a bit more work.

21 Bonus: ultrasuccinct designated-verifier SNARK [BCIOP3] PCP randomized subset-sum -query Linear LCP 29 trivially -query Linear Interactive Proof Paillier + knowledge Designated-verifier SNARK where the proof is a single Paillier ciphertext Efficiency caveat: prover computes a full-blown query-efficient PCP.

22 30 Linear Interactive Proof (publicly-verifiable) SNARK [BCIOP3] Input-Oblivious Linear Interactive Proof Prove, yy, ww Π FF kk mm qq,, qq mm FF aa,, aa kk FF Verify(, yy) QQ uu DD,yy $ (Publicly-verifiable) SNARK (GG, PP, VV)

23 3 Linear Interactive Proof (publicly-verifiable) SNARK: approach [BCIOP3] Enc pk EE( ) satisfies - semantic security - linear-only homomorphism Being able to test properties of the prover s answers implies that we must give up semantic security. Need: Enc pk ( ) with - quadratic predicate test - linear-only homomorphism - Δ-power one-wayness Bilinear maps Dominates VV runtime Knowledge of Exponent Unfalsfiable. Also need the LIP, hence, underlying Linear PCP, to have low-degree QQ and DD algorithms. QAP works!

24 zksnark construction via QAP and Linear PCPs Computation Algebraic Circuit RCS QAP Linear PCP Linear Interactive Proof zksnark Frank Gehry No Longer Allowed To Make Sandwiches For Grandkids 38

25 Full [PGHR3] protocol ([BCTV4USENIX] variant) 39

26 [PGHR3] assumptions qq-power Diffie-Hellman qq-strong Diffie-Hellman qq-power Knowledge of Exponent 40

27 zksnark backend implementations Pinocchio/Geppetto [PGHR3] [CFHKKNPZ5] libsnark github.com/scipr-lab/libsnark [BCGTV3a] [BCTV4crypto] [BCTV4usenix] snarklib github.com/jancarlsson/snarklib (clone of libsnark with different C++ style by Jan Carlsson ) Numerous frontends (some included in the above), to be discussed tomorrow. 4

28 Example: libsnark backends [PGHR3] backend with [BCTV4USENIX] improvements speedof verifier by merging parts of the pairing computation reduced verification key size to ~/3 (when #inputs #gates) Square Span Programs [DFGK4] backend ADSNARK backend, [BBFR5] backend Tailored libraries for finite fields, ECC, pairings M arithmetic gates, 000-bit input, desktop PC 80-bit security 28-bit security Generator 97 s 7 s Prover 5 s 47 s Verifier 4.9 ms ( ms ) 5. ms ( ms ) Proof size 230 B 288 B Full code, MIT license github.com/scipr-lab/libsnark 42

29 Extensions/variants ADSNARK [BBFR5] a preprocessing SNARKs for proving statements on authenticated data [DFGK4] A preprocessing SNARK for the language Square Span Programs, more efficient for Boolean circuits 43