Sonic

Abstract

Ever since their introduction, zero-knowledge proofs have become an important tool for addressing privacy and scalability concerns in a variety of applications. In many systems each client downloads and verifies every new proof, and so proofs must be small and cheap to verify. The most practical schemes require either a trusted setup, as in (pre-processing) zk-SNARKs, or verification complexity that scales linearly with the complexity of the relation, as in Bulletproofs. The structured reference strings required by most zk-SNARK schemes can be constructed with multi-party computation protocols, but the resulting parameters are specific to an individual relation. Groth et al. discovered a zk-SNARK protocol with a universal structured reference string that is also updatable, but the string scales quadratically in the size of the supported relations.Here we describe a zero-knowledge SNARK, Sonic, which supports a universal and continually updatable structured reference string that scales linearly in size. We also describe a generally useful technique in which untrusted "helpers" can compute advice that allows batches of proofs to be verified more efficiently. Sonic proofs are constant size, and in the "helped" batch verification context the marginal cost of verification is comparable with the most efficient SNARKs in the literature.

Updateable Inner Product Argument with Logarithmic Verifier and Applications

“…However, the aforementioned schemes have a better communication complexity (O λ (1)) and, while asymptotically the verifier has the same complexity (O λ (log |C|)), in their case it works mainly on the field while ours works in the group, which is less efficient. Also, while the prover complexity in [32,20,15] is quasi-linear in |C| and ours is linear, theirs works mainly in the field. We report some concrete numbers in Table 1 for the overhead of each scheme (we do not include concrete numbers for other schemes in communication and verification since they are constant while ours are logarithmic in |C|).…”

“…As far as we know, all recently proposed efficient and fully-succinct updateable schemes [32,20,15] rely on the Algebraic Group Model [18] or other Knowledge Type assumptions apart from the Random Oracle Model, while in our case the Random Oracle Model and a standard assumption is enough. However, the aforementioned schemes have a better communication complexity (O λ (1)) and, while asymptotically the verifier has the same complexity (O λ (log |C|)), in their case it works mainly on the field while ours works in the group, which is less efficient.…”

“…The authors also presented a scheme which is updateable, but it has a universal common reference string of size quadratic in the maximal size of all supported circuits (although from the global setup a linear, circuit-specific string can be derived). Maller et al presented Sonic [32], which improved this to a linear CRS by exploiting the reduction of [10]. Several works [20,15,19] have tried to improve the efficiency of Sonic concretely.…”

“…To overcome this, we delegate this computation to the prover who gives a succinct proof for the correct computation of [β]. To achieve that, we assume a specific structure for the circuit (basically that the gates have bounded fan-in and fan-out) and apply techniques similar to [32] adapted to our setting. These conditions can be imposed by pre-processing the circuit appropriately without asymptotically increasing the circuit size.…”

Non-Interactive Zero-Knowledge for Blockchain: A Survey

“…The resulting scheme satisfies perfect completeness and zero-knowledge with computational soundness. 5) Sonic [120] is a zero-knowledge scheme based on the updatable CRS model of Groth [117] using a polynomial commitment scheme, pairings and arithmetic circuits. Trusted setup for the CRS is needed and can be implemented, for example, with secure multiparty computation.…”