Zero Knowledge Proof MOOC

Date:

Reviewed:

Topic / Chapter: SNARKs via Interactive Proofs

❓Questions

Notes

• Interactive Proofs
  • Motivation
    • computation-limited verifier
      • wants data analysis
    • verifier: holds data summary
      • queries to cloud provider w/ data
        • or: “challenges”
      • cloud provider: provides answer
    • interactive proofs (formally)
      • $P$ solves problem, tells $V$ the answer
        • then conversation goes
        • $P$’s goal: convince $V$ the answer is correct
      • requirements
        • completeness: an honest $P$ can convince $V$
        • (statistical) soundness: $V$ will catch $P$’s lie w.h.p.
        • if soundness holds only against “eff” provers: then it is argument not proof
  • Interactive proofs vs. arguments
    • soundness vs. knowledge soundness
      • $C(x,w)\to F$
      • soundness: $V$ accepts → $\exists w$ s.t. $C(x,w)=0$
      • knowledge soundness: $V$ accepts → $P$ “knows” $w$ s.t. $C(x,w)=0$
        • 👨‍🏫stronger!
    • standard soundness: meaningful even when knowledge soundness isn’t
      • as there is no “natural witness”
      • e.g. $P$ claims that output of $V$’s program on $x$ is 42
    • reverse: prover claims he knows secret key for a certain BTC wallet
      • or: preimage of hash that gives 0
      • many “witnesses” exist
    • public verifiability
      • only convincing the party that is choosing random challenges
        • others: can’t trust the proposed verifier
      • if interactive: each run only convinces one party
      • for public coin protocols: Fiat-Shamir is used
        • to make it non-interactive
• SNARKs from Interactive Proofs
  • SNARK example
    • procedure
      • $P$: commits cryptographically to $w$
      • reveals “just enough” info on commitment to allow $V$ to run checks
      • render non-interactive via Fiat-Shamir
• Review of Functional Commitments
  • Functional commitments
    • different types
      • polynomial commitments
        • to univariate $f(X)\in F_p^{\le d}[X]$
      • multilinear commitments
        • to multilinear $f\in F_p^{\le 1}[X_1,\dots X_k]$
      • vector commitments (e.g. Merkle trees)
        • to $\overrightarrow{u}=(u_1,\dots ,u_d)\in F_p^d$
        • open cells: $f_{\overrightarrow{u}}(i)=u_i$
  • Merkle trees: the commitment
    • uses: C.R. hash function
    • opening proof size: $O(\log n)$
    • example: univariate $f(X)\in F_7^{(\le d)}[X]$
      • $m_1=H(f(0),f(1))$
        • … $m_4=H(f(6),\ast )$
      • $h_1=H(m_1,m_2)$
      • $k_1=H(h_1,h_2)$
      • to prove value $f(4)$, must provide
        • $k_1$, $h_1$, $m_4$, $f(4),f(5)$
    • notation
      • $P$ Merkle-commits to all evaluations of $f$
      • upon request of $f(r)$, $P$ reveals all associated leaf along w/ opening info
      • two problems
        • no. of leaves: $|F|$
          • takes at least $|F|$ to compute commitment
          • want time proportional to degree bound $d$
        • $V$ does not know $f$ has at most degree $d$
• Interactive Proof Design: Technical Preliminaries
  • SZDL lemma
    • FACT: let $p\ne q$ be univariate polynomials of degree at most $d$
      • then $P{r}_{r\in F}[p(r)=q(r)]\le \frac{d}{|F|}$
      • $p(r)-q(r)$ has at most $d$ zeros
    • SZDL lemma: multivariate generalization
      • let $p\ne q$ be $l$-variate polynomials of total degree at most $d$
      • then $P{r}_{r\in F^l}[p(r)=q(r)]\le \frac{d}{|F|}$
      • using multivariate to lower the degree and make computation quicker
  • Low-degree and multilinear extensions
    • extension: given $f:\{0,1{\}}^l\to F$, a $l$-variate polynomial $g$ over $F$: extend $f$
      • if $\forall x\in \{0,1{\}}^{l}f(x)=g(x)$
    • multilinear extensions: any function $f:\{0,1{\}}^l\to F$ has unique multilinear extension (MLE) $\tilde{f}$
      • multilinear: polynomial has degree at most 1 in each var
      • e.g. $(1-x_1)(1-x_2)$, but not in $x_1^2{x}_2$
  • Example

    • let $f:\{0,1{\}}^2-F$ s.t.

      1	2
      8	10

    • $\tilde{f}:F^2\to F$ (multilinear extension)

      • $\tilde{f}(x_1,x_2)=(1-x_1)(1-x_2)+2(1-x_1)x_2+8x_1(1-x_2)+10x_1{x}_2$
        • actually: quite similar to SoP approach!

      1	2	3	4	5	6
      8	10	12	14	16	18
      15	18	21	24	27	30
      22	26	30	34	38	52
      29	34	39	44	49	56

      • True as:
        • $\tilde{f}(0,0)=1$
        • $\tilde{f}(0,1)=2$
        • $\tilde{f}(1,0)=8$
        • $\tilde{f}(1,1)=10$

    • non-multilinear extension

      • $f:g(x_1,x_2)=-x_1^2+x_1{x}_2+8x_1+x_2+1$

      1	2	3	4	5	6
      8	10	12	14	16	18
      13	16	19	22	25	28
      16	20	24	28	32	36
      17	22	27	32	37	42

      • True as:
        • $g(0,0)=1$
        • $g(0,1)=2$
        • $g(1,0)=8$
        • $g(1,1)=10$
  • Evaluating multilinear extensions quickly
    • fact: given as input $2^l$ evaluations of a function $f$
      • $\forall r\in {\mathbf{F}}^l\exists O(2^l)$-time algo to evaluate $\tilde{f}(r)$
      • i.e. by listing all its values with manually
    • sketch: using Lagrange interpolation
    • define ${\tilde{\delta }}_w(r)={\prod }_{i=1}^l(r_i{w}_i+(1-r_1)(1-w_i))$
      • i.e. multilinear Lagrange basis polynomial corresponding to $w$
      • or: PoS, but from analog values of $r$
        • ($w$ being digital)
    • fact: $f(r)={\sum }_{w\in \{0,1{\}}^l}f(w)\cdot {\delta }_w(r)$
    • $\forall w\in \{0,1{\}}^l$, ${\tilde{\delta }}_w(r)$ can be computed w/ $O(l)$ field operations
      • yields an $O(l{2}^l)$-time also
      • can reduce to $O(2^l)$ time via DP
• Sum-Check Protocol
  • Sum-check protocol

    • [LFKN90]

    • input: $V$ given oracle access to a $l$-variate polynomial $g$ over field $\mathbf{F}$

      • i.e. access to $g(i)$ where $i\in \mathbf{F}$

    • goal: compute the quantity

      • ${\sum }_{b_1\in \{0,1\}}{\sum }_{b_2\in \{0,1\}}\cdots {\sum }_{b_l\in \{0,1\}}g(b_1,\dots ,b_l)$
      • idea: outsource the computation to prover so that it takes $O(n)$ time instead of $O(2^n)$

    • 👟Start: $P$ sends claimed answer $C_1$

      • protocol checks that:
      • $C_1={\sum }_{b_1\in \{0,1\}}{\sum }_{b_2\in \{0,1\}}\cdots {\sum }_{b_l\in \{0,1\}}g(b_1,\dots ,b_l)$

    • 👟Round 1: $P$ sends univariate polynomial $s_1(X_1)$ claimed to equal

      $H_1(X_1):={\sum }_{b_2\in \{0,1\}}\cdots {\sum }_{b_l\in \{0,1\}}g(X_1,b_2\dots ,b_l)$

      • i.e. output if prover was honest

    • $V$ checks that $C_1=s_1(0)+s_1(1)$

      • or: ${\sum }_{b_1\in \{0,1\}}{s}_1(b_1)$

    • if check passes: safe to believe that $C_1$ is the correct answer

      • if $V$ believes $s_1=H_1$
      • i.e. check $s_1(r_1)=H_1(r_1)$ where $r_1\leftarrow R$
      • $V$ can compute $s_1(r_1)$ directly from $P$’s first message, not $H_1(r_1)$ though

    • 👟Round 2: ($P$ sends $s_2(X_2)$ and) $P$ recursively check that $s_1(r_1)=H_1(r_1)$

      • i.e. that $s_1(r_1)={\sum }_{b_2\in \{0,1\}}\cdots {\sum }_{b_l\in \{0,1\}}g(r_1,b_2,\dots ,b_l)$

    • 👟Round $l$: ($P$ sends $s_l(X_l)$ and) $P$ check that $H_l:=g(r_1,r_2\dots ,X_l)$

      • $V$: checks that $s_{l-1}(r_{l-1})=s_l(0)+s_l(1)$
      • by picking $s_l(r_l)=g(r_1,\dots r_l)$

    • general idea: checking $s_i$ only on first occurrence, trusting it there after

• Analysis of Sum-Check Protocol
  • Completeness
    • holds by design
    • if $P$ sends the prescribed messages: all tests will pass
  • Soundness
    • if some other message was sent: $V$ rejects w/ probability of at least $1-\frac{l\cdot d}{|\mathbf{F}|}$
    • e.g. $|\mathbf{F}|\approx 2^{128}$, $d=3$, $l=60$
      • then soundness error $\le 3\cdot 60/2^{128}=2^{-120}$
    • proof: by induction on no. of var $l$
      • base case: $l=1$; $P$ sends $s_1(X_1)$ claims to equal $g(X_1)$
        • $V$ picks $r_1$ at random, checks that $s_1(r_1)=g(r_1)$
        • if $s_1\ne g$, then $P{r}_{r_1\in \mathbf{F}}[s_1(r_1)=g(r_1)]\le \frac{d}{|\mathbf{F}|}$
      • inductive case $l>1$
        • recall: $P$’s first message $s_1(X_1)$ claimed to equal $H_1(X_1):={\sum }_{b_2\in \{0,1\}}\cdots {\sum }_{b_l\in \{0,1\}}g(X_1,b_2,\dots ,b_l)$
        • $V$ picks $r_1$ at random, (recursively) checks that $s_1(r_1)=H_1(r_1)$
        • if $s_1\ne H_1$, then $P{r}_{r_1\in \mathbf{F}}[s_1(r_1)=H(r_1)]\le \frac{d}{|\mathbf{F}|}$
        • if $s_1(r_1)\ne H(r_1)$, $P$ is left to prove a false claim in rec. call
          • applies sum-check to $l-1$ variate
          • by induction: $P$ convinces $V$ w/ probability at most $\frac{d(l-1)}{|\mathbf{F}|}$
    • summary: if $s_1\ne H_1$, $V$ accepts at most
      • $$\begin{gathered} P{r}_{r_1\in \mathbf{F}}[s_1(r_1)=H(r_1)] \\ =P{r}_{r_2,\dots r_l\in \mathbf{F}}[\text{V accepts}|s_1(r_1)\ne H(r_1)] \\ \le \frac{d}{|\mathbf{F}|}+\frac{d(l-1)}{|\mathbf{F}|}\le \frac{dl}{|\mathbf{F}|} \end{gathered}$$
  • Cost of the protocol
    • total communication: $O(dl)$ field elements
      • $P$ sends $l$ messages, each at univariate degree $d$
      • $V$ sends $l-1$ messages, each w/ 1 field element
    • $V$’s runtime: $O(dl+[\text{time(g)}])$
    • $P$’s runtime (at most)
      • $O(d\cdot 2^l\cdot [\text{time(g)}])$
• Sum-Check Protocol Application
  • Counting triangles
    • input: $A\in \{0,1{\}}^{n\times n}$
      • representing adjacency matrix of a graph
    • desired output: ${\sum }_{(i,j,k)\in [n{]}^3}{A}_{ij}{A}_{jk}{A}_{ik}$
    • fastest known algorithm: runs in matrix-multiplication time
      • i.e. ~= $n^{2.37}$ (super linear time)
    • IP: let verifier run in $O(n^2)$ time (minimum possible)
  • Protocol

    • protocol: view $A:\{0,1{\}}^{\log n}\times \{0,1{\}}^{\log n}\to F$

      

    • $\tilde{A}$: multilinear extension of $A$

    • define polynomial $g(X,Y,Z)=A(X,Y)A(Y,Z)\tilde{A}(X,Z)$

    • apply the sum-check protocol to compute

      • ${\sum }_{(a,b,c)\in \{0,1{\}}^{3\log n}}g(a,b,c)$
  • Costs
    • total communication: $O(\log n)$
    • $V$ runtime: $O(n^2)$
    • $P$ runtime: $O(n^3)$
    • $V$ runtime: dominated by evaluating
      • $g(r_1,r_2,r_3)=A(r_1,r_2)A(r_2,r_3)\tilde{A}(r_1,r_3)$
• SNARK for Circuit-Satisfiability

  • SNARK for circuit-satisfiability

    • $P,V$: agreed on circuit $C$ over $\mathbf{F}$ size $S$ and output $y$
      • $P$ claims to know $w$ s.t. $C(x,w)=y$
      • let $x$ be empty for simplicity
    • transcript $T$ for $C$: assignment of a value to every gate
      • is correct if it assigns gate values upon evaluating $C$ on a valid $w$

    

  • Transcript as a function

    • with domain $\{0,1{\}}^{\log S}$
    • assign each gate in $C$ a ($\log S$)-bit label and view $T$ as a function
      • mapping gate labels to $\mathbf{F}$

    

    • and final output: always $T(1,\dots ,1)$ (last gate to be computed)
• Polynomial IOP Underlying the SNARK

  • Polynomial IOP

    • $P$’s first message is a ($\log S$)-variate polynomial $h$ claimed to extend a correct transcript $T$
      • i.e. $h(x)=T(x)\forall x\in \{0,1{\}}^{\log s}$
    • $V$: needs to check this, but only able to learn few evaluation of $h$ (not $S$)

  • Intuition on $h$

    • $h$: distance-amplified encoding of $T$
    • domain of $T$: $\{0,1{\}}^{\log S}$
      • but domain of $h$: much larger (${\mathbf{F}}^{\log S}$)
      • 👨‍🏫small difference in $T$ → vast difference (almost all) in extension
        • due to distance-amplifying nature
        • by Schwartz-Zippel

    

  • Two-step plan

    • step 1: given any ($\log S$)-variate polynomial $h$, identify a related ($3\log S$)-variate polynomial $g_h$ s.t.
      • $h$ extends a correct transcript $T$ ↔ $g_h(a,b,c)=0\forall (a,b,c)\in \{0,1{\}}^{3\log S}$
        • or: “vanishing” over Boolean hypercube
        • i.e. if $h$ is not a correct transcript: $\exists a,b,c\text{ s.t. }{g}_h(a,b,c)\ne 0$
        • ~= abstraction of messy structure?
      • also: to evaluate $g_h(r)$ at any input: evaluating $h$ at 3 inputs are enough
    • step 2: design an IP to check
      • $g_h(a,b,c)=0\forall (a,b,c)\in \{0,1{\}}^{3\log S}$
      • in which $V$ only needs to evaluate $g_h(r)$ at one point $r$

  • Sketch

    • step 1 sketch: define $g_h(a,b,c)$ via:
      • $\widetilde{add}(a,b,c)\cdot (h(a)-(h(b)+h(c)))+\widetilde{mult}(a,b,c)\cdot (h(a)-(h(b)\cdot h(c)))$
      • $\widetilde{add}(a,b,c)$: gets 3 Boolean vectors in input
        • returns 1 iff $a$ is addition gate and 2 $n$ neighbors are $b,c$
        • else 0
      • $\widetilde{mult}(a,b,c)$: gets 3 Boolean vectors in input
        • returns 1 iff $a$ is multiplication gate and 2 $n$ neighbors are $b,c$
        • else 0
    • properties
      • $g_h(a,b,c)=h(a)-(h(b)+h(c))$
        • if $a$ is label computing sum of $b,c$
      • $g_h(a,b,c)=h(a)-(h(b)\cdot h(c))$
        • if $a$ is label computing multiplication of $b,c$
      • $g_h(a,b,c)=0$ otherwise
      • $g_h$ computation: can be outsourced to $P$ as it only depends on wiring structure, and thus being able to be committed
    • step 2: how to check $g_h(a,b,c)=0\forall (a,b,c)\in \{0,1{\}}^{3\log S}$
      • by evaluating $g_h$ at a single point?
    • if $g_h$ were a univariate polynomial $g_h(X)$
      • and we need to check that $g_h$ vanishes over some set $H\subseteq \mathbf{F}$, not $\{0,1{\}}^{3\log S}$
    • fact: $g_h(x)=0\forall x\in H$ ↔ $g_h$ is divisible by $Z_H(x):={\prod }_{a\in H}(x-a)$
      • $Z_H$: vanishing polynomial for $H$
      • 🧑‍🎓kind of trivial
    • polynomial IOP
      • $P$ sends a polynomial $q$ s.t. $g_h(X)=q(X)\cdot Z_H(X)$
      • $V$ checks this by picking a random $r\in \mathbf{F}$ and checking $g_h(r)=q(r)\cdot Z_H(r)$

  • Actual protocol

    • above: not works as $g_h$ is not univariate
    • computing (finding $q$) is expensive
      • in final SNARK: it would be applying poly-commit to additional polynomials
      • Marlin, PlonK, Groth16 does this, though
    • solution: use the sum-check protocol
      • handles multivariate polynomials
      • doesn’t require $P$ to send additional large polynomials
• Polynomial IOP for Circuit-Satisfiability
  • Recall sum-check
    • goal: compute the quantity (all sum)
    • proof length: roughly total degree of $g$
    • no. of round: $l$
    • $V$ time: ~= time to evaluate $g(r)$
      • not necessarily revealing info on $g$ as long as it knows $g(r)$ for random $r$
  • General idea
    • (works over integers, for ease of explanation)
      • $V$: checks ${\sum }_{a,b,c\in \{0,1{\}}^{\log S}}{g}_h(a,b,c{)}^2$
      • if all terms are 0: sum is 0
        • any non-zero term: cause it to change
    • at the end of protocol: $V$ evaluates $g_h(r_1,r_2,r_3)$
      • suffices to evaluate $h(r_1),h(r_2),h(r_3)$
        • 👨‍🏫in practice, this dominates the runtime
      • outside of these: $V$ runs in time $O(\log S)$
        • no. of variables
      • $P$ performs $O(S)$ field operations given $w$
        • even if there was no proof of correctness: same time