Arya: Nearly Linear-Time Zero-Knowledge Proofs for Correct Program Execution

Abstract

There have been tremendous advances in reducing interaction, communication and verification time in zero-knowledge proofs but it remains an important challenge to make the prover efficient. We construct the first zero-knowledge proof of knowledge for the correct execution of a program on public and private inputs where the prover computation is nearly linear time. This saves a polylogarithmic factor in asymptotic performance compared to current state of the art proof systems. We use the TinyRAM model to capture general purpose processor computation. An instance consists of a TinyRAM program and public inputs. The witness consists of additional private inputs to the program. The prover can use our proof system to convince the verifier that the program terminates with the intended answer within given time and memory bounds. Our proof system has perfect completeness, statistical special honest verifier zero-knowledge, and computational knowledge soundness assuming linear-time computable collision-resistant hash functions exist. The main advantage of our new proof system is asymptotically efficient prover computation. The prover's running time is only a superconstant factor larger than the program's running time in an apples-to-apples comparison where the prover uses the same TinyRAM model. Our proof system is also efficient on the other performance parameters; the verifier's running time time and the communication are sublinear in the execution time of the program and we only use a log-logarithmic number of rounds.

Efficient Proofs of Software Exploitability for Real-world Processors

“…The routing network has asymptotic complexity O(t log(t)), where t is the trace length, and large constants. A more efficient permutation proof, first explored by [15,41], shows that two secret lists…”

“…We implement the unknown permutation proof using the circuit defined in Figure 2 over a large ring, based on techniques first introduced by Bootle et al [15], and first explored by Neff [41]. This stand-alone circuit receives two secret shared lists and a public randomly selected challenge x.…”

ZK-SecreC: a Domain-Specific Language for Zero Knowledge Proofs

“…In ZK S C, lists (which play the role of arrays) have rather restrictive typing rules associated with them, making sure that computations with them can be converted into circuit operations. Having the keys in $post and in an arbitrary domain requires the use of Oblivious RAM (ORAM) [11], which has had a number of solutions proposed in the context of ZK proofs [5,20,28]. A general method for ORAM in ZKP context [28] performs no correctness checks while the load and store operations are executed.…”

Sonic

“…In the decades since their introduction, zero-knowledge proofs have been used to support a wide variety of potential applications, ranging from verifiable outsourced computation [11,16,24,59] to anonymous credentials [6,27,28,32,39], with a multitude of other settings that also require a balance between privacy and integrity [17,19,29,31,36]. In recent years, cryptocurrencies have been one increasingly popular real-world application [10,44,52,57], with general zero-knowledge protocols now deployed in both Zcash and Ethereum.…”