Practical verified computation with streaming interactive proofs

Abstract

When delegating computation to a service provider, as in the cloud computing paradigm, we seek some reassurance that the output is correct and complete. Yet recomputing the output as a check is inefficient and expensive, and it may not even be feasible to store all the data locally. We are therefore interested in what can be validated by a streaming (sublinear space) user, who cannot store the full input, or perform the full computation herself. Our aim in this work is to advance a recent line of work on "proof systems" in which the service provider proves the correctness of its output to a user. The goal is to minimize the time and space costs of both parties in generating and checking the proof. Only very recently have there been attempts to implement such proof systems, and thus far these have been quite limited in functionality.Here, our approach is two-fold. First, we describe a carefully chosen instantiation of one of the most efficient general-purpose constructions for arbitrary computations (streaming or otherwise), due to Goldwasser, Kalai, and Rothblum [19]. This requires several new insights and enhancements to move the methodology from a theoretical result to a practical possibility. Our main contribution is in achieving a prover that runs in time O(S(n) log S(n)), where S(n) is the size of an arithmetic circuit computing the function of interest; this compares favorably to the poly(S(n)) runtime for the prover promised in [19]. Our experimental results demonstrate that a practical general-purpose protocol for verifiable computation may be significantly closer to reality than previously realized.Second, we describe a set of techniques that achieve genuine scalability for protocols fine-tuned for specific important problems in streaming and database processing. Focusing in particular on noninteractive protocols for problems ranging from matrix-vector multiplication to bipartite perfect matching, we build on prior work [8,15] to achieve a prover that runs in nearly linear-time, while obtaining optimal tradeoffs between communication cost and the user's working memory. Existing techniques required (substantially) superlinear time for the prover. Finally, we develop improved interactive protocols for specific problems based on a linearization technique originally due to Shen [34]. We argue that even if general-purpose methods improve, fine-tuned protocols will remain valuable in real-world settings for key problems, and hence special attention to specific problems is warranted.

Streaming Authenticated Data Structures

“…The research community has introduced streaming verifiable computation, both in the statistical [11,12] and the cryptographic setting [10,42], where a verifier and a prover observe a stream of n elements x 1 , x 2 , . . .…”

“…, x n and the verifier can delegate some computation over the stream to the prover. The protocols in [11,12] are probabilistic and use multiple interactions for verification, which reveal the secret randomness. Thus they support one-shot computation tasks, whereas we allow any number of queries.…”

“…Thus they support one-shot computation tasks, whereas we allow any number of queries. Although most of the existing streaming verifiable protocols [10,11,12] are particularly efficient in terms of verifier complexity (e.g., (poly-)logarithmic in the size of the stream), the main shortcoming of all previous work (except for the work of Schröder and Schröder [42], see next paragraph) is the fact that the prover complexity is linear in the size of the stream, even for sublinear (logarithmic) computations, e.g., membership and range search queries on a stream of elements drawn from an ordered universe. 2 This significantly limits the applicability of these protocols since such an overhead introduces a large amount of latency, making them impractical for real-world deployment.…”

“…The only eligible interaction occurs in the querying phase (which is inherent anyways). Such interaction consists only of one round as opposed to existing schemes in the statistical setting that can have up to a logarithmic number of interactions (e.g., [11,12]). 2.…”

“…The running times of the verifier and the prover (for both updates and queries) as well as the proof size are all logarithmic in n and M , where n is the size of the stream and M is the size of the elements universe. In comparison, existing schemes in this setting (e.g., [10,11,12]) incur a linear proof generation overhead on the server, even for sublinear computations (see Section 1.1). We thus achieve an exponential improvement for many common queries in the prover's running time.…”