Arya: Nearly Linear-Time Zero-Knowledge Proofs for Correct Program - PowerPoint PPT Presentation

Arya: Nearly Linear-Time Zero-Knowledge Proofs for Correct Program Execution Jonathan Bootle, Andrea Cerulli, Jens Groth, Sune Jakobsen, Mary Maller

Zero-Knowledge Proofs for Statement Correct Program Execution Witness Prover Verifier

Zero-Knowledge Proofs for Statement Correct Program Execution Witness Prover Verifier

Zero-Knowledge Proofs for Statement Correct Program Execution Completeness: An honest prover Prover Verifier convinces the verifier.

Zero-Knowledge Proofs for Statement Correct Program Execution Soundness: A dishonest prover never convinces the verifier. Completeness: An honest prover Prover Verifier Computational guarantee convinces the verifier. -> argument

Zero-Knowledge Proofs for Statement Correct Program Execution Witness Soundness: A dishonest prover never convinces the verifier. Completeness: An honest prover Prover Verifier Computational guarantee convinces the verifier. Zero-knowledge: -> argument Nothing but the truth of the statement is revealed.

Zero-Knowledge Proofs for Statement Correct Program Execution Interaction Prover Verifier Communication Computation Computation Prover Verifier Cryptographic Assumption

Zero-Knowledge Proofs for Correct Program Execution Registers Memory pc r1 r2 r3 … … … … … flag Primary Input instruction1 Random instruction2 Input Tapes Access Instruction3 Auxiliary Input … TinyRAM Program … … TinyRAM Instructions include ADD, MULT, XOR, AND,…

Zero-Knowledge Proofs for Correct Program Execution Registers Memory pc r1 r2 r3 … … … … … flag Primary Input instruction1 Random instruction2 Input Tapes Access Instruction3 Auxiliary Input … TinyRAM Program … … TinyRAM Public Values <-> Statement

Zero-Knowledge Proofs for Correct Program Execution Registers Memory pc r1 r2 r3 … … … … … flag Primary Input instruction1 Random instruction2 Input Tapes Access Instruction3 Auxiliary Input … TinyRAM Program … … TinyRAM Private Values <-> Prover’s Witness

Zero-Knowledge Proofs for Correct Program Execution Goal: Why TinyRAM? Zero-knowledge proof for • Closer to real world statements • Compilers from restricted C to correct TinyRAM execution TinyRAM with low prover overhead

List of Memory Execution Trace Memory Changes Extra Time Information 0 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 1 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 2 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 3 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 … … instruction1 instruction2 T pc r1 r2 r3 … … … … … flag pc r1 r2 r3 Instruction3 TinyRAM … Primary Input Program … Input Tapes Auxiliary Input …

List of Memory Checks Memory Changes Extra Time Information 0 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 1 pc r1 r2 r3 … … … … flag pc r1 r2 r3 2 pc r1 r2 r3 … … … … flag pc r1 r2 r3 3 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 … … instruction1 Memory instruction2 T pc r1 r2 r3 … … … … flag pc r1 r2 r3 Instruction3 TinyRAM Consistency … Primary Input Program … Input Tapes Auxiliary Input …

List of Memory Checks Memory Changes Extra Time Information 0 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 Correct 1 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 2 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 Instruction 3 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 Execution … … instruction1 instruction2 T pc r1 r2 r3 … … … … … flag pc r1 r2 r3 Instruction3 TinyRAM … Primary Input Program … Input Tapes Auxiliary Input …

List of Memory Checks Memory Changes Extra Time Information 0 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 1 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 2 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 3 pc r1 r2 r3 … … … … … flag pc r1 r2 r3 … … instruction1 Word instruction2 T pc r1 r2 r3 … … … … … flag pc r1 r2 r3 Instruction3 TinyRAM … Primary Input Program Decompositions … Input Tapes Auxiliary Input …

Proving Correct Program Execution Sources of Overhead Our Solutions • Large fields and large cyclic • Use hash-based proof system groups over any field • Permutation networks for • Alternative approach to checking checking memory permutations • Large circuits for bitwise • Word decomposition technique operations gives constant-size circuits

� � Results Work Prover Verifier Communication Rounds Assumption Complexity Complexity BCTV14 Ω(𝑈 log 𝑈 ' ) 𝜕(𝑀 + 𝑤 ) 𝜕(1) 1 KoE This LT-CRHF 𝑃(𝛽𝑈) 𝑃(log log 𝑈) 𝑞𝑝𝑚𝑧(𝜇) 𝑈 + 𝑀 + 𝑤 𝑞𝑝𝑚𝑧(𝜇) 𝑈 + 𝑀 Work But what is 𝛽 ? Security 2 78 9:; < Program Length 𝑀 Runtime Bound 𝑈 Public Input 𝑊

Arithmetising TinyRAM Overview TinyRAM Execution Trace Algebraic Constraints Main Polynomials Contributions Prior work: Linear-Time Ideal Protocols Zero-Knowledge Look-Up Zero-Knowledge Proofs Arguments and More Standard Protocols 18

Ideal Linear Commitment Protocols Commit to vectors P V 𝑦 ← C Commit to vectors Send random challenges 𝑧 ← C … … Check linear 𝑨 ← C combinations against Compute linear combinations Linear combinations commitments

Ideal Linear Commitment Protocols Commit to execution trace P V 𝑦 ← C Commit to vectors Send random challenges 𝑧 ← C … … Coefficients of linear 𝑨 ← C combinations embed Compute linear combinations Linear combinations useful conditions

Committing Encode 2 6 6 2 0 2 3 7 2 5 7 3 1 7 4 3 7 2 8 4 8 4 5 7 4 6 8 9 3 5 4 2 8 4 6 7 2 3 4 6 2 1 5 6 3 3 7 4 3 9 8 4 7 2 4 5 2 5 3 9 Prover Hash computes linear combination 5 9 3 2 4

Checking Commitments Encode 2 6 6 2 0 2 3 7 2 5 7 3 1 7 4 3 7 2 8 4 8 4 5 7 4 6 8 9 3 5 4 2 8 4 6 7 2 3 4 6 2 1 5 6 3 3 7 4 3 9 8 4 7 2 4 5 2 5 3 9 Prover Hash computes linear combination Encode 5 9 3 2 4 2 3 7 2 5 7 3 1 7 4 Verifier encodes and spot-checks columns High minimum distance catches cheating

Correct Instruction Execution pc r1 r2 r3 pc r1 r2 r3 … … … … … flag Covers all Transition Circuit TinyRAM Check consistency of instructions values across each pc r1 r2 … … … … flag pc r2 r3 time step Transition Circuit Constant size circuit pc r1 r2 r3 … … … … flag pc r1 r2 r3 Give batch argument that each copy of circuit is satisfied

Word Decomposition Avoid binary circuits when checking bitwise operations on non-binary field elements! 𝑏, 𝑐 ∈ 0,1 𝑏 + 𝑐 = 2 𝑏 ∧ 𝑐 + (𝑏 ⊕ 𝑐)

Word Decomposition Register value Binary Decomposition 𝑏 𝒃 𝟏 𝒃 𝟐 𝒃 𝟑 𝒃 𝟒 … … … … 𝒃 𝑿7𝟑 𝒃 𝑿7𝟐 𝑏 P Odd bits 𝒃 𝟐 𝟏 𝒃 𝟒 𝟏 … … … … 𝒃 𝑿7𝟐 𝟏 𝑏 Q Even bits 𝒃 𝟏 𝟏 𝒃 𝟑 𝟏 … … … … 𝒃 𝑿7𝟑 𝟏 𝑏 = 2𝑏 P + 𝑏 Q

Word Decomposition 𝑏 𝑐 𝒃 𝟏 𝒃 𝟐 𝒃 𝟑 𝒃 𝟒 … … … … 𝒃 𝑿7𝟑 𝒃 𝑿7𝟐 𝒃 𝟏 𝒃 𝟐 𝒃 𝟑 𝒃 𝟒 … … … … 𝒃 𝑿7𝟑 𝒃 𝑿7𝟐 𝑏 P 𝑐 P 𝒃 𝟐 𝟏 𝒃 𝟒 𝟏 … … … … 𝒃 𝑿7𝟐 𝟏 𝒃 𝟐 𝟏 𝒃 𝟒 𝟏 … … … … 𝒃 𝑿7𝟐 𝟏 𝑏 Q 𝑐 Q 𝒃 𝟏 𝟏 𝒃 𝟑 𝟏 … … … … 𝒃 𝑿7𝟑 𝟏 𝒃 𝟏 𝟏 𝒃 𝟑 𝟏 … … … … 𝒃 𝑿7𝟑 𝟏 𝑏 = 2𝑏 P + 𝑏 Q 𝑐 = 2𝑐 P + 𝑐 Q XORs in even bits ANDs in odd bits 𝒃 𝟏 ⊕ 𝒄 𝟏 𝒃 𝟏 ∧ 𝒄 𝟏 𝒃 𝟑 ⊕ 𝒄 𝟑 𝒃 𝟑 ∧ 𝒄 𝟑 … … … … 𝒃 𝑿7𝟑 ⊕ 𝒄 𝑿7𝟑 𝒃 𝑿7𝟑 ∧ 𝒄 𝑿7𝟑 𝑏 Q + 𝑐 Q

Look-up Argument Register Even Odd Decomposition Look-Up Table Value Bits Bits Register Values Even Bits Odd Bits All possible register Use zero-knowledge look-up values argument to show all decompositions correct

Look-up Argument Approach: Values 𝑏 T , 𝑏 ' , … , 𝑏 V lie in table Look-Up Table 𝒄 𝟐 𝑐 T , 𝑐 ' , … , 𝑐 Y already public ó 𝒄 𝟑 1. Commit to 𝑏 T , 𝑏 ' , … , 𝑏 V , 𝑓 T , 𝑓 ' , … , 𝑓 Y 𝒄 𝟒 𝑏 T , 𝑏 ' , … , 𝑏 V ⊂ {𝑐 T , 𝑐 ' , … , 𝑐 Y } … … … 2. Prove in zero-knowledge that ó Verify a ‘square and multiply’ … algorithm in zero-knowledge a b 𝒄 𝒐 V Y a b ∏ = ∏ (𝑦 − 𝑏 ^ ) 𝑦 − 𝑐 for random 𝑦 V Y ∏ = ∏ (𝑌 − 𝑏 ^ ) 𝑌 − 𝑐 ` ` ^_T `_T ^_T `_T for some 𝑓 ` ≥ 0 Think of 𝑛 ≫ 𝑜