SNARKs for C: Verifying Program Executions Succinctly and in Zero Knowledge

Abstract

Abstract. An argument system for NP is a proof system that allows efficient verification of NP statements, given proofs produced by an untrusted yet computationally-bounded prover. Such a system is non-interactive and publiclyverifiable if, after a trusted party publishes a proving key and a verification key, anyone can use the proving key to generate non-interactive proofs for adaptivelychosen NP statements, and proofs can be verified by anyone by using the verification key.We present an implementation of a publicly-verifiable non-interactive argument system for NP. The system, moreover, is a zero-knowledge proof-ofknowledge. It directly proves correct executions of programs on TinyRAM, a nondeterministic random-access machine tailored for efficient verification. Given a program P and time bound T , the system allows for proving correct execution of P , on any input x, for up to T steps, after a one-time setup requiringÕ(|P |·T ) cryptographic operations. An honest prover requiresÕ(|P |·T ) cryptographic operations to generate such a proof, while proof verification can be performed with only O(|x|) cryptographic operations. This system can be used to prove the correct execution of C programs, using our TinyRAM port of the GCC compiler.This yields a zero-knowledge Succinct Non-interactive ARgument of Knowledge (zk-SNARK) for program executions, in the preprocessing model -a powerful solution for delegating NP computations, with several features not achieved by previously-implemented primitives.Our approach builds on recent theoretical progress in the area. We present efficiency improvements and implementations of two main ingredients: 1. Given a C program, we produce a circuit whose satisfiability encodes the correctness of execution of the program. Leveraging nondeterminism, the generated circuit's size is merely quasilinear in the size of the computation. In particular, we efficiently handle arbitrary and data-dependent loops, control flow, and memory accesses. This is in contrast with existing "circuit generators", which in the general case produce circuits of quadratic size. 2. Given a linear PCP for verifying satisfiability of circuits, we produce a corresponding SNARK. We construct such a linear PCP (which, moreover, is zero-knowledge and very efficient) by building and improving on recent work on quadratic arithmetic programs.

Verifiable Computation in Multiparty Protocols with Honest Majority

“…In [22], Yao's garbled circuits [36] are executed using fully homomorphic encryption. Quadratic span programs for boolean circuits and quadratic arithmetic programs for arithmetic circuits without PCP have first been proposed in [23], later extended to PCP by [6], and further optimized and improved in [5,28,31]. Particular implementations of verifiable computations have been done for example in [5,31,34].…”

“…Similarly to different approaches to verifiable computation [5,6,23,28,31], in our work we let the relation R to correspond to the circuit C executed by the party whose observance of the protocol is being verified. In this correspondence, v is the tuple of all inputs, outputs, and used random values of that party.…”

“…Hence it is unclear how the decision algorithm D can be executed on it. Hence we do not use D as a black box, but build our solution on top of a particular LPCP [5].…”

“…The LPCP algorithms used by Ben-Sasson et al [5] are statistical HVZK. Namely, the values π, q i do not reveal any private information about π, unless the random seed τ ∈ F for Q is chosen in a bad way, which happens with negligible probability for a sufficiently large field.…”

“…3 and its implementation in Sec. 5. Before the latter, we give an overview of the existing building blocks we use in Sec.…”