Sublinear Zero-Knowledge Arguments for RAM Programs Payman Mike - PowerPoint PPT Presentation

Sublinear Zero-Knowledge Arguments for RAM Programs Payman Mike Alessandra Mohassel Scafuro Rosulek OSU NCState V I S Oregon State University A

Problem C Data S

Problem C Data S R 1

Problem C Data S R 1 y 1

Problem C Data S R 1 y 1 R 2

Problem C Data S R 1 y 1 R 2 y 2

Problem C Data S R 1 y 1 R 2 y 2 . . . .

Problem C Data S R 1 proof 𝜌 1 y 1 correct computation on same data R 2 y 2 𝜌 2 . . . .

Problem C Data S R 1 Zero-Knowledge proof 𝜌 1 y 1 correct computation on same data R 2 y 2 𝜌 2 . . . .

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties Efficiency: work depends only on running time T

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties Efficiency: work depends only on running time T Security: Composability

Problem Data S C R 1 Zero-knowledge y 1 𝜌 1 proof Properties Efficiency: work depends only on running time T Security: Composability [constant-round]

Sub-linear Zero Knowledge

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks Problem P’s work depends on size of the input

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks Problem P’s work depends on size of the input Circuit-based approaches

Sub-linear Zero Knowledge [Kil92,Mic94,Gro10a,Lip12, GGPR13,….] P V pcp / Goal: proof as short as possible snarks Problem P’s work depends on size of the input ORAM Circuit-based approaches [GO96…]

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase GC GC GC GC T garbled circuits

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase GC GC GC GC T garbled circuits Problem Setup Phase : O(N) for both !

Sub-linear amortized Zero-Knowledge [HMR15] P V Setup phase proof phase Special cases ZK Sets [MRK03] and generalizations [ORS07,..] GC GC GC GC T garbled circuits Problem Setup Phase : O(N) for both !

Our Result

Sulinear Zero-Knowledge for RAM programs Setup Phase V P Proof Phase T = running time work depends only on running time T UC-Secure [based on efficient primitives (GC, Zkboo[GMO16])]

UC-Secure Ideal functionality F zkRAM F zkRAM V P

UC-Secure Ideal functionality F zkRAM F zkRAM Init: M V P

UC-Secure Ideal functionality F zkRAM M F zkRAM Init: M V P

UC-Secure Ideal functionality F zkRAM M F zkRAM Init: M V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM M’,y ← R i ( M , w i ) M F zkRAM Init: M V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM M’,y ← R i ( M , w i ) M ’ M F zkRAM Init: M V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM M’,y ← R i ( M , w i ) M ’ M F zkRAM Init: M R i , y V P Prove: R i , w i

UC-Secure Ideal functionality F zkRAM Challenge: extract M from M’,y ← R i ( M , w i ) M ’ M transcript F zkRAM Init: M R i , y V P Prove: R i , w i

Our technique

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling R i

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling access pattern (i 1, i 2, i 3,.. ) R i

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling access pattern (i 1, i 2, i 3,.. ) R i prepares T garbled circuits

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - Garbling access pattern (i 1, i 2, i 3,.. ) R i prepares T garbled circuits GC GC GC [JOK13]

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i i 1 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i i 2 i 1 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i i 2 i 1 i 3 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y replace used encoding

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data Garbling values - ORAM - “Garbling” access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y replace used encoding soundness: V fully controls encoding of the dataset

Sub-linear amortized Zero-Knowledge [HMR15] Setup phase P V Data V should do nothing. Garbling values - ORAM - “Garbling” Soundness….? access pattern (i 1, i 2, i 3,.. ) R i 0/1 i 2 i 1 i 3 GC GC GC y replace used encoding soundness: V fully controls encoding of the dataset

P V Setup phase access pattern (i 1, i 2, i 3,.. ) GC GC GC

P V Setup phase access pattern (i 1, i 2, i 3,.. ) initial data GC GC GC

P V Setup phase access pattern (i 1, i 2, i 3,.. ) ORAM initial data GC GC GC

P V Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM initial data GC GC GC

P V Merkle Tree Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM initial data GC GC GC

P V Merkle Tree Setup phase encode access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC

P V Merkle Tree Setup phase encode ? access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC 1. Consistency with committed input? (black-box)

P V Merkle Tree Setup phase encode ? access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC 1. Consistency with committed input? (black-box) 2. Extraction committed input?

P V Merkle Tree Setup phase encode ? access pattern (i 1, i 2, i 3,.. ) ORAM OT initial data GC GC GC 1. Consistency with committed input? (black-box) 2. Extraction committed input? 3. “Malicious" ORAM?

1. Black box proof of consistency V P y GC GC [GO S V14, IW14]

1. Black box proof of consistency V P y GC GC encode Reed- Solomon [GO S V14, IW14]

1. Black box proof of consistency V P commit y GC GC encode Reed- Solomon [GO S V14, IW14]

1. Black box proof of consistency V P Merkle Tree commit y GC GC encode Reed- Solomon [GO S V14, IW14]

1. Black box proof of consistency V P Merkle Tree commit codeword y GC GC encode Reed- Solomon i 1 [GO S V14, IW14]

Sublinear Zero-Knowledge Arguments for RAM Programs Payman Mike - PowerPoint PPT Presentation

Sublinear Zero-Knowledge Arguments for RAM Programs Payman Mike Alessandra Mohassel Scafuro Rosulek OSU NCState V I S Oregon State University A Problem C Data S Problem C Data S R 1 Problem C Data S R 1 y 1 Problem C

Zero-knowledge Arguments Proving circuit satisfaibility in zero-knowledge Zero-knowledge In

Zero Knowledge Succinct Noninteractive ARguments of Knowledge Saravanan Vijayakumaran

Sublinear Algorithms for Big Data Qin Zhang 1-1 Part 3: Sublinear in Time 2-1 Sublinear in

Sublinear Algorithms for Big Data Qin Zhang 1-1 Part 2: Sublinear in Communication 2-1

Zero-Knowledge Arguments for Arithmetic Circuits Carsten Baum, Jonathan Bootle, Andrea Cerulli,

Lattice-Based Zero-Knowledge Arguments for Integer Relations t Libert 1 San Ling 2 Khoa Nguyen 2

On Diophantine Complexity and Statistical Zero-Knowledge Arguments Helger Lipmaa Helsinki

Scalable Transparent ARguments-of-Knowledge Michael Riabzev Department of Computer Science,

Transferring knowledge from discourse to arguments: A case study with scientific abstracts Pablo

B669 Sublinear Algorithms for Big Data Qin Zhang 1-1 Part 1: Sublinear in Space 2-1 The model

B669 Sublinear Algorithms for Big Data Qin Zhang 1-1 Part 1: Sublinear in Space 2-1 The model

Classical arguments that for us is a PP complement of easy The following arguments are the

Zero-Knowledge Arguments for Lattice-Based Accumulators: Logarithmic-Size Ring Signatures and

Zero-Knowledge Arguments for Matrix-Vector Relations and Lattice-Based Group Encryption t Libert

Random Local Exploration Techniques for Sublinear-Time Algorithms Krzysztof Onak IBM Research

L ECTURE 2 Last time Introduction Basic models for sublinear-time computation Simple

On Diophantine Complexity and Statistical Zero-Knowledge Arguments Helger Lipmaa Helsinki

Secure Database Commitments and Universal Arguments of Quasi Knowledge Melissa Chase (Microsoft

Focused search for arguments from propositional knowledge Vasiliki Efstathiou and Anthony Hunter

Adding Plural Arguments to Curry Programs Michael Hanus Christian-Albrechts-University of Kiel

Sublinear Algorithms for ( + 1) Vertex Coloring Sepehr Assadi University of Pennsylvania

Sublinear Algorithms Lecture 1 Sofya Raskhodnikova Boston University 1 Organizational Course

3.5 Executing programs n Functional programs are traditionally interpreted, i.e. reductions are

Sublinear Algorithms Lectures 1 and 2 Sofya Raskhodnikova Penn State University 1 Tentative