Aurora: Transparent Succinct Arguments for R1CS

Linear-Size Constant-Query IOPs for Delegating Computation

“…In this work we construct IOPs for algebraic computations over large fields that are "almost" ideal; namely, we achieve linear proof length, O(N log N ) (strictly quasilinear) prover arithmetic complexity, constant query and round complexity, and polylogarithmic verifier time. Our new IOP protocols match the state-of-the-art proof length and prover complexity of [BCRSVW19], while at the same time achieving an exponential improvement in verifier time for a rich class of computations. We focus on arithmetic complexity as the natural notion of efficiency for IOPs for algebraic problems.…”

“…Computations over small fields (e.g. F 2 ) can be handled by moving to an extension field, which introduces an additional logarithmic factor in the proof length and prover time (the same is true of [BBHR18a;BCRSVW19]). Even with this additional logarithmic factor, our construction matches the state of the art for prover complexity (but not proof length) for succinct boolean circuit satisfiability, while improving verifier time to polylogarithmic.…”

“…We now consider arithmetic circuit satisfiability defined over fields F that are large (of size Ω(N )). In this regime, [BCRSVW19] obtains IOPs for ASAT with proof length O(N ) and query complexity O(log N ). The arithmetization, following [BS08], is based on the Reed-Solomon code and uses the algebraic structure of large smooth fields.…”

“…Testing is done via FRI [BBHR18b], a recent IOP of proximity for the Reed-Solomon code with linear proof length and logarithmic query complexity. The construction in [BCRSVW19], which we will build upon, falls short of our goal on two fronts: verifier time is linear in the size of the circuit rather than polylogarithmic, and query complexity is logarithmic rather than constant. Comparison with [Ben+17;BBHR18a].…”

“…Two of these constructions are particularly relevant for us: [BCGRS17] achieves IOPs for Boolean circuit satisfiability (CSAT) with linear proof length, unspecified polynomial prover time, and constant query and round complexity, 1 and [BCRSVW19] achieves logarithmic-round IOPs for arithmetic circuit satisfiability withÕ(N log N ) prover time, 2 linear proof length, and logarithmic query complexity.…”