Linear-Time Zero-Knowledge Proofs for Arithmetic Circuit Satisfiability

Abstract

Abstract. We give computationally efficient zero-knowledge proofs of knowledge for arithmetic circuit satisfiability over a large field. For a circuit with N addition and multiplication gates, the prover only uses O(N ) multiplications and the verifier only uses O(N ) additions in the field. If the commitments we use are statistically binding, our zero-knowledge proofs have unconditional soundness, while if the commitments are statistically hiding we get computational soundness. Our zero-knowledge proofs also have sub-linear communication if the commitment scheme is compact. Our construction proceeds in three steps. First, we give a zero-knowledge proof for arithmetic circuit satisfiability in an ideal linear commitment model where the prover may commit to secret vectors of field elements, and the verifier can receive certified linear combinations of those vectors. Second, we show that the ideal linear commitment proof can be instantiated using error-correcting codes and non-interactive commitments. Finally, by choosing efficient instantiations of the primitives we obtain linear-time zero-knowledge proofs.

Sonic

“…Our permutation argument given in Figure 9 is similar to that of Bootle et al [23]. If the prover commits to f (X ) = n i=1 a i X i , then we have for random challenges β, γ ∈ F p that n i=1…”

“…Symmetric primitives such as Reed-Solomon codes have recently been gaining attention for their post-quantum potential, as there are no known quantum attacks on error-correcting codes and protocols that use them do not require expensive and trusted pre-processing phases. Schemes that use these techniques [2,9,23] are typically made non-interactive in the random oracle model, as opposed to the quantum random oracle model, and designing efficient zeroknowledge protocols in the quantum random oracle model [21] remains an open problem. The codes are typically cheap to compute for the prover.…”

“…A large part of its overhead comes from compiling the addition gates, and the authors observed that when there are many repetitions of the same addition gates in the same layer, it is possible to batch the compilation. Bootle et al [23] introduce a model that they call the ideal linear commitment (ILC) model in which a prover can commit to vectors by sending them to a channel, and a verifier can query the channel on linear combinations of the committed vectors. They then compile the ILC programs into proofs using a code by Ishai et al [48] which can be computed in linear time.…”

“…We use the structure of s(X , Y ) in order to prove its correct calculation using a permutation argument, which itself has a grandproduct argument as an underlying component. We take inspiration from our main construction and from the permutation and grandproduct arguments described by Bayer and Groth [5] and by Bootle et al [23]. We restrict ourselves to constraint systems for which s(X , Y ) can be expressed as the sum of M polynomials, where the j-th such polynomial is of the form…”

Efficient Batch Zero-Knowledge Arguments for Low Degree Polynomials

“…Bootle et al [7] construct arguments with logarithmic communication complexity and linear computation costs based on the discrete logarithm assumption. Recent progress [8] yields zero-knowledge arguments with constant overhead for the prover, and square-root communication costs, though the large constants involved in the construction prevent it from being practical. For more specialised languages, such as range proofs, membership arguments, and polynomial evaluation arguments, there are numerous constructions [28,2], including some extremely simple Σ-protocols.…”