Geppetto: Versatile Verifiable Computation

Abstract

Cloud computing sparked interest in Verifiable Computation protocols, which allow a weak client to securely outsource computations to remote parties. Recent work has dramatically reduced the client's cost to verify the correctness of results, but the overhead to produce proofs largely remains impractical. Geppetto introduces complementary techniques for reducing prover overhead and increasing prover flexibility. With Multi-QAPs, Geppetto reduces the cost of sharing state between computations (e.g., for MapReduce) or within a single computation by up to two orders of magnitude. Via a careful instantiation of cryptographic primitives, Geppetto also brings down the cost of verifying outsourced cryptographic computations (e.g., verifiably computing on signed data); together with Geppetto's notion of bounded proof bootstrapping, Geppetto improves on prior bootstrapped systems by five orders of magnitude, albeit at some cost in universality. Geppetto also supports qualitatively new properties like verifying the correct execution of proprietary (i.e., secret) algorithms. Finally, Geppetto's use of energysaving circuits brings the prover's costs more in line with the program's actual (rather than worst-case) execution time. Geppetto is implemented in a full-fledged, scalable compiler that consumes LLVM code generated from a variety of apps, as well as a large cryptographic library.

A Hybrid Approach to Secure Function Evaluation using SGX

“…We do not implement a hybrid version, but not due to its incompatibility with hybrid computation. 19 In Section 5, we provided intuition for extending the hybrid versions of Database and Dijkstra into further rounds. That discussion was meant primarily to demonstrate that SFE could be achieved for functions requiring more than two rounds.…”

“…Hohenberger and Lysyanskaya introduced the untrusted but much more computationally powerful worker [24]. Follow-on works founded the idea of a verifiable, outsourceable computation scheme [22] and further improved on this idea [19,46,54]. Tramèr et al [60] previously modeled the enclave as a black-box, albeit in a weaker sense, by keeping only critical functionalities secret from the host.…”

Efficient Authenticated Multi-Pattern Matching

“…General-purpose techniques for verifiable computation [19,9,10,20,11,15] and their implementations [30,29] are potential solutions to the problem. To use these systems, the computation of the multi-pattern matching is either modeled as a circuit [28,16] or as a RAM program [14,31,6,7,15]. In circuit-based VC, the whole pattern set must be hardcoded into the circuit, which makes the computation on the server side inefficient (quasi-linear in the circuit size).…”

Certificates for Triangular Equivalence and Rank Profiles

“…We do not use generic approaches to verified computation (where protocols check circuits with polylogarithmic depth [12] or use amortized models and homomorphic encryption [2]). Rather, we use dedicated certificates as those designed for dense [11,14] or sparse [4,5] exact linear algebra.…”