ADSNARK: Nearly Practical and Privacy-Preserving Proofs on Authenticated Data

Abstract

We study the problem of privacy-preserving proofs on authenticated data, where a party receives data from a trusted source and is requested to prove computations over the data to third parties in a correct and private way, i.e., the third party learns no information on the data but is still assured that the claimed proof is valid. Our work particularly focuses on the challenging requirement that the third party should be able to verify the validity with respect to the specific data authenticated by the source-even without having access to that source. This problem is motivated by various scenarios emerging from several application areas such as wearable computing, smart metering, or general business-to-business interactions. Furthermore, these applications also demand any meaningful solution to satisfy additional properties related to usability and scalability. In this paper, we formalize the above three-party model, discuss concrete application scenarios, and then we design, build, and evaluate ADSNARK, a nearly practical system for proving arbitrary computations over authenticated data in a privacy-preserving manner. ADSNARK improves significantly over state-of-the-art solutions for this model. For instance, compared to corresponding solutions based on Pinocchio (Oakland'13), ADSNARK achieves up to 25× improvement in proof-computation time and a 20× reduction in prover storage space.

Full Accounting for Verifiable Outsourcing

“…Another line of work uses argument protocols, both interactive [73][74][75] and non-interactive [14,21,26,47,56,66] ("SNARK" refers to the latter). However, these protocols seem incompatible with hardware implementation (as discussed in prior work [82, §9]) and impose cryptographic assumptions (strong ones in the non-interactive setting).…”

“…There are a few exceptions. In the zkSNARK setting, the cost assessment depends on the premium that one is willing to pay for otherwise unachievable functionality [14,18,39]. Also, two works in the verifiable outsourcing setting do not require precomputation.…”

Geppetto: Versatile Verifiable Computation

“…RESULT verify_job(DATA b0, QUERY b1) { commitment cs [4]; cs[0] = b0->c; // reuse commitment produced by save_DATA cs[1] = b1->c; // reuse commitment produced by save_QUERY RESULT b2 = load_recommit_RESULT(); cs[2] = b2->c; load_verify_commit(&STATE.vk, &cs [3], C_job_LOCALS); cProof pi; load_cProof("job", &pi, outsource_id, RUN_TIME); verify_proof(&STATE.vk, &pi, 4, cs); return b2; } Just like job, verify_job takes two buses and returns a bus. The input buses propagate trusted commitments from the caller; in particular, the bigdata commitment is shared across all calls.…”

“…Currently, the best performing, fully general-purpose verifiable computation protocols [51,55] are based on Quadratic Arithmetic Programs (QAPs) [33]. To provide non-interactive, publicly verifiable computation, as well as zero-knowledge proofs (i.e., computations in which some or all of the worker's inputs are private) recent systems [4,8,10,11,18,27,43,61] have converged on the Pinocchio protocol [51] as a cryptographic back end. Pinocchio, in turn, depends on QAPs.…”

Hash First, Argue Later

“…The approach based on leveled homomorphic signatures [29] is more expressive but still very expensive in practice, as the size of the proof (i.e., evaluated signature) is polynomial in the depth of the computation's circuit. AD-SNARKs [3] provide a functionality similar to homomorphic authenticators, working efficiently for arbitrary computations, but even in their case the set of computations has to be fixed a priori. As a further restriction, the model of both homomorphic authenticators and AD-SNARKs requires a secret key for data outsourcing, and it only supports append-only data uploading (i.e., it does not support changing the uploaded data).…”