Delegation with Updatable Unambiguous Proofs and PPAD-Hardness - PowerPoint PPT Presentation

Delegation with Updatable Unambiguous Proofs and PPAD-Hardness Lisa Yang MIT Based on joint work with Yael Tauman Kalai and Omer Paneth

time 𝑈 computation 𝑁 𝑦 = ? Delegation 𝑁(𝑦) = y Proof Π 𝑊 checks Π in time ≪ 𝑈 Can verifying be faster than computing?

Publicly Verifiable Delegation 𝐷𝑆𝑇 𝑁(𝑦) = y Proof Π

Prior Work: Publicly Verifiable Delegation Strong assumptions • Random Oracle Model [Micali94] • Knowledge assumptions [Groth10, Lipma12, Gennaro-Gentry-Parno-Raykova12, Bitansky- Canetti-Chiesa-Tromer12, Bitansky-Chiesa-Ishai-Ostrovsky- Paneth13…] • Indistinguishability Obfuscation [Bitansky-Sanjam-Lin-Pass-Telang14,Canetti-Holmgren-Jain- Vaikuntanathan14,Koppula-Lewko-Waters14, Canetti- Holmgren16, Chen-Chow-Chung-Lai16] • Multilinear maps [Paneth-Rothblum17] Delegation for bounded-depth circuits via Fiat-Shamir • Optimal security of LWE [Canetti-Chen-Holmgren-Lombardi-Rothblum-Rothblum-Wichs19] • Sub-exponential LWE [Kalai-Zhang20] Delegation for polynomial-time computations • Bilinear groups [Kalai-Paneth-Y19]

𝐷 𝑈 Updatable Proofs [Valiant08] Consider a long computation 𝐷 0 → 𝐷 𝑈 carried out over 𝐶 iterations 𝐷 𝑀 𝑗+1 … Updatable Proofs: update Π 𝑗 into Π 𝑗+1 𝐷 𝑀 𝑗 ~ computation performed Π 𝑗+1 Want the proof update to take time Π 𝑗 Want proofs to remain succinct 𝐷 0 [Bitansky-Canetti-Chiesa-Tromer13] using SNARKs (based on strong assumptions)

Unambiguous Proofs 𝐷𝑆𝑇 𝑁(𝑦) = y Proofs Π ≠ Π′ Unambiguous Proofs: 𝑄 ∗ (𝐷𝑆𝑇) cannot output Π ≠ Π′ for the same statement 𝑁 𝑦 = 𝑧 (except with negligible probability over 𝐷𝑆𝑇 ) [Reingold-Rothblum-Rothblum]

Our Results: Delegation Delegation with updatable and unambiguous proofs based on the decisional bilinear group assumption: For a bilinear group 𝐻 of order 𝑞 = 2 Θ(𝜆) and 𝛽 = 𝑃(log 𝜆) given [Kalai-Paneth-Y19] for random 𝑕 ∈ 𝐻 and 𝑡 ∈ ℤ 𝑞 it is hard to distinguish whether 𝑢 = 𝑡 2𝛽+1 or 𝑢 is an independent random element in ℤ 𝑞 .

Our Results: PPAD-Hardness [ Choudhuri-Hubacek-Kamath-Pietrzak-Rosen-Rothblum 19] PPAD-Hardness based on: 2. Any hard language 𝑀 decidable in super-polynomial time (and 1. The quasi-polynomial hardness of KPY’s bilinear group assumption polynomial space) • For example, the hardness of SAT for sub-exponential size circuits (non-uniform ETH) suffices

Related Work: PPAD-Hardness Strong assumptions • Indistinguishability Obfuscation [Abbot-Kane-Valiant04, Bitanski-Paneth-Rosen15, Hubacek-Yogev17] • Functional Encryption assumptions [Garg-Pandey-Srinivasan16, Komargodski-Segev17] Fiat-Shamir interactive protocol for a particular language • Security of Fiat-Shamir/Optimal security of LWE [Choudhuri-Hubacek-Kamath-Pietrzak-Rosen- Rothblum19, Ephraim-Freitag-Komargodski-Pass19] • Sub-exponential LWE [Lombardi-Vaikuntanathan20, Kalai-Zhang20, Jawale-Khurana20] Polynomial Local Search (PLS) Hardness [Bitansky-Gerichter20]

1. Delegation with Updatable Proofs • Use recursive proof composition • Without strong assumptions! Local extraction [Kalai-Paneth-Y19]

1. Delegation with Updatable Proofs 𝑁𝑓𝑠𝑕𝑓 𝐷 𝑀 𝑗−1 , Π 𝑗 , 𝐷 𝑀 𝑗 𝑗∈[𝐶] 𝐷 𝑀 𝐶 Π : 𝐷 0 → 𝐷 𝑀 Π 𝐶 replaces this with 𝐷 0 , Π′, 𝐷 𝑀 𝐶 Update Π : 𝐷 𝑀 𝐶 Verify Π 𝐶 𝐷 𝑀 2 A ppend proof for … … … computation Π 2 𝐷 𝑀 2 performed Π ′ Verify Π 2 𝐷 𝑀 1 Proof grows!! 𝐷 𝑀 1 Π contains 𝐶 proofs Π 1 Verify Π 1 Π ′ ≪ Π 1 + ⋯+ |Π 𝐶 | Π 𝑗 :𝐷 𝑀 𝑗−1 → 𝐷 𝑀 𝑗 𝐷 0 𝐷 0 Local extraction nondeterministic suffices!

KPY Delegation 𝐷𝑆𝑇 Homomorphic 𝑟 1 𝑟 𝑙 encryption 𝑁 𝑦 = 𝑧 𝑊 checks Π 𝑧 Π = ? 𝑏 1 𝑏 𝑙 𝑈 using Zero-Test [Paneth-Rothblum17] 𝑏 = 𝐺(𝑟) 𝑦 encoded computation tableau

2. Delegation with Unambiguous Proofs • Unambiguity of Ciphertexts: any 𝑄 ∗ (𝐷𝑆𝑇) cannot generate two • Observation: need to use encryption with unambiguity property 𝑆 𝑡 = 𝑛 different ciphertexts that encrypt the same message • 𝑡𝑙 = 𝑡 ← 𝔾 • KPY Encryption: • 𝑑 = 𝑕 𝑆 ∈ 𝔾[𝑦] • 𝑄 ∗ ↛ 𝑑 = 𝑕 𝑆 ,𝑑 ′ = 𝑕 𝑆 ′ such that 𝑆 𝑡 = 𝑆 ′ 𝑡 = 𝑛 • Unambiguous Proofs: suffices to ensure unambiguity of answers

𝑧 2. Unambiguity of Answers 𝑈 • [Kalai-Raz-Rothblum14] for 𝑟 ∈ 0,1 ℓ answers are unambiguous 𝑦 • Need unambiguous answers for 𝑟 ∈ 𝔾 ℓ 𝑏 = 𝐺(𝑟) • Observation: If 𝑄 evaluates a multilinear polynomial then can show unambiguity of answers for every 𝑟 ∈ 𝔾 ℓ • Idea: Ask 𝑄 to send a “ proof of multilinearity ” for his evaluated ciphertexts Notion of local multilinearity!

Proof of Local Multilinearity • 𝑄 homomorphically evaluates 𝐺(𝑟 1 … 𝑟 ℓ ) • First attempt: ask 𝑄 for the restriction of 𝐺 in each coordinate Evaluate encryptions of (𝐵 𝑗 , 𝐶 𝑗 ) such that 𝐺 Ԧ 𝑟 = 𝐵 𝑗 ⋅ 𝑟 𝑗 + 𝐶 𝑗 𝑊 checks consistency using the Zero-Test • Problem: 𝑄 ∗ can compute (𝐵 𝑗 , 𝐶 𝑗 ) using 𝐹𝑜𝑑(𝑟 𝑗 ) 𝑄 evaluated same • Idea: encrypt Ԧ 𝑟 again without 𝑗 'th coordinate “Proof of E quality” Ask 𝑄 for 𝐵 𝑗 ′ ,𝐶 𝑗 ′ • Test that 𝐵 𝑗 , 𝐶 𝑗 = 𝐵 𝑗 ′ ,𝐶 𝑗 function on both ′ encryptions

Delegation with Updatable Unambiguous Proofs Not done yet … To show unambiguity of entire proof: • Unambiguity of other ciphertexts in KPY proof • Unambiguity of ciphertexts we added ☺ Equality and Multilinearity proofs • Show unambiguity preserved in recursive proof composition Updatable proofs

Summary • Our Results: • Delegation with updatable and unambiguous proofs based on the KPY bilinear group assumption • PPAD-Hardness based on the quasi-polynomial hardness of the KPY bilinear group assumption (and any hard language) Standard • Power of local proofs: assumptions! • recursive proof composition (updatable proofs) • proof of multilinearity (unambiguous proofs)

Thank you! lisayang@mit.edu