Updateable Inner Product Argument with Logarithmic Verifier and Applications

Abstract

We propose an improvement for the inner product argument of Bootle et al. (EUROCRYPT'16). The new argument replaces the unstructured common reference string (the commitment key) by a structured one. We give two instantiations of this argument, for two different distributions of the CRS. In the designated verifier setting, this structure can be used to reduce verification from linear to logarithmic in the circuit size. The argument can be compiled to the publicly verifiable setting in asymmetric bilinear groups. The new common reference string can easily be updateable. The argument can be directly used to improve verification of Bulletproofs range proofs (IEEE SP'18). On the other hand, to use the improved argument to prove circuit satisfiability with logarithmic verification, we adapt recent techniques from Sonic (ACM CCS'19) to work with the new common reference string. The resulting argument is secure under standard assumptions (in the Random Oracle Model), in contrast with Sonic and recent works that improve its efficiency (Plonk, Marlin, AuroraLight), which, apart from the Random Oracle Model, need either the Algebraic Group Model or Knowledge Type assumptions.

Efficient inner product arguments and their applications in range proofs

“…In this paper, we optimise the IPA tvc and range proof of Daza et al [3] and the IPA ovc of Bünz et al [1]. Table 1 and Table 2 show the concrete complexity comparisons of inner product arguments and range proofs, respectively.…”

“…Nevertheless, our protocol relies on bilinear groups and requires trusted but universally updatable setup while theirs relies on standard groups and requires transparent setup, and our protocol's concrete communication and prover complexities are increased. Compared with Daza et al [3], the two protocols have the same asymptotic complexity, and it is therefore essential to compare the concrete complexity. Specifically, the concrete communication and verifier complexities are reduced by 2 log 2 n field elements and 2 log 2 n field multiplications, respectively.…”

“…Kim et al [8] improved the IPA ovc of Bünz et al [1] with bilinear map, achieving asymptotically sublinear verifier complexity. Daza et al [3] improved the IPA tvc of Bootle et al [4] with structured commitment keys, achieving asymptotically logarithmic verifier complexity. Bünz et al [7] improved Lai et al's argument for pairing-based language, achieving asymptotically logarithmic verifier complexity.…”

“…The other approach is n-ary decomposition that is used in the latest state of the art protocols [1,3,16]. To prove that a secret value v lies in range [0, n ℓ − 1] (we call ℓ the bit length of range), it is sufficient to prove that each component of the n-ary decomposition of v belongs to [0, n − 1], which can be achieved using some brute-force method since n is very small (usually takes 2).…”

“…Chung et al [16] reduced the concrete communication complexity of Bulletproofs by three elements, based on zero-knowledge weighted inner product argument. Daza et al [3] proposed a range proof that has both O(log m) communication and verifier complexities, but the concrete prover and communication complexities are greatly increased.…”