Privacy-preserving cryptocurrencies Privacy-preserving smart ......2019/04/10 · SHARK NIZK for...

Privacy-preserving cryptocurrencies

Privacy-preserving smart contracts

Proof of regulatory compliance

Blockchain-based sovereign identity

Blockchain-based sovereign identitysee [ZKProof Standardization – Applications Track]

Need zero-knowledge non-interactive arguments of knowledge,

ideally succinct ones: zk-SNARK.

• QAP-based [GGPR13][PGHR13][BCGTV13][DFGK14]

[Groth16][GM17][BG18]…

Fastest verification. Widely used.

Common Reference String (CRS)Require a

Structured Reference String (SRS)Common Reference String (CRS)Require a

Structured Reference String (SRS)Require a

Generating an SRS:

• Trusted setup

Generating an SRS:

• Trusted setup

• MPC + destruction [BCGTV15][BGG17]

• Updatable SRS [GKMMM18, MBKM19]

• Scalable SRS generation (“Powers of Tau”) [BGM18]

Other zk-SNARKs

• PCP-based (e.g., libSTARK)

[Micali94][BCGT13][BCS16][BBCGGHPRSTV17][BBHR18]

Asymptotically succinct but large constants.

Other zk-SNARKs

Non-succinct ZK:

Other zk-SNARKs

Non-succinct ZK:

• Aurora [BCRSVW19]

• Bulletproofs [BCCGP16][BBBPWM17]

• Hyrax [WTSTW17]

• Ligero [AHIV17]

• ZKBoo(++) [GMO16][CDGORRSZ17]

Slow verification and/or large proofs (as statement grows).

Seeing transactions

Including new transactionsin a block

Seeing transactions

Slow verification → miners get a head start by not validating→ double-spends and chain splits [July 2015 Bitcoin fork]

Seeing transactions

Verifying the previous block

zero-knowledge

succinct hybrid argument of knowledge

zero-knowledge

Prudent verificationSlow (comparable to Bulletproofs)

No SRS

zero-knowledge

Optimistic verification

Fast (comparable to QAP-based SNARK)

Relies on SRS

Prudent verificationSlow (comparable to Bulletproofs)

No SRS

Optimistically verify during propagation.

Optimisticallyverify tx for inclusion in block template.

Prudently verify later, during PoW.

Optimisticallyverify incoming blocks.

Optimistic

verification

Prudent verification

Optimistic

verification

Optimistic

verification

• Detection

– Real-timeOptimistic

verification

• Detection

– Real-time

– Revoke SRS

– Such pair of proofs is a fraud proof for compromised SRS!

Optimistic

verification

• Detection

– Real-time

– Revoke SRS

• Recovery

Optimistic

verification

• Detection

– Real-time

– Revoke SRS

• Recovery

– Soundness: prudently verify

Optimistic

verification

• Detection

– Real-time

– Revoke SRS

• Recovery

– Speed: regenerate SRS + refresh the optimistic proofs.

Optimistic

verification

• Detection

– Real-time

– Revoke SRS

• Recovery

Optimistic

verification

• Detection

– Real-time

– Revoke SRS

• Recovery

Optimistic

verification

SHARK requirement: anyone can refresh, without original sender.

Attempt – parallel composition:

Fix a language 𝐿 and construct a NIZK for it:1

𝑃NIZK

Not pictured: 𝐺NIZK

𝑃NIZK

𝑥 ∈ 𝐿

𝑃NIZK 𝑉NIZK

𝑤 𝑥

𝑥 ∈ 𝐿

𝑃NIZK 𝑉NIZK

𝑤 𝑥

𝑥 ∈ 𝐿Call 𝜋 “prudent proof”

𝑃NIZK 𝑉NIZK

Construct a SNARK for the same 𝐿:2

𝑤 𝑥

𝑥 ∈ 𝐿Call 𝜋 “prudent proof”

𝑃NIZK 𝑉NIZK

Not pictured: 𝐺NIZK, 𝐺SNARK

𝑃SNARK 𝑉SNARK𝑥

𝑤 𝑥

𝑥 ∈ 𝐿

Call 𝜋 “prudent proof”

𝑃NIZK 𝑉NIZK

𝑤 𝑥

𝑥Optimistic proofs should be

refreshable without 𝑤

𝑥 ∈ 𝐿

𝑃NIZK 𝑉NIZK

𝑤 𝑥

𝜙 is not a SHARKoptimistic proof

Optimistic proofs should berefreshable without 𝑤

𝑥 ∈ 𝐿

Construction:

𝑃NIZK 𝑉NIZK𝑥

𝑤 𝑥

𝑥 ∈ 𝐿

Construction:

𝑃NIZK 𝑉NIZK Call 𝜋 “prudent proof”𝑥

𝑤 𝑥

𝑥 ∈ 𝐿

Construction:

𝑃NIZK 𝑉NIZK Call 𝜋 “prudent proof”

Construct a SNARK for “𝑉NIZK accepts”2

𝑤 𝑥

𝑥 ∈ 𝐿

Construction:

𝑃SNARK

𝑤 𝑥

𝑥 ∈ 𝐿

Construction:

𝑃SNARK

𝑤 𝑥

𝑥 ∈ 𝐿

accepts

Construction:

𝑃SNARK 𝑉SNARK

𝑤 𝑥

𝑥 ∈ 𝐿

accepts

Construction:

𝑃SNARK 𝑉SNARK

𝑤 𝑥

𝑥 ∈ 𝐿

accepts

Call 𝜙 “optimistic proof”

Construction:

𝑃SNARK 𝑉SNARK

𝑤 𝑥

𝑥 ∈ 𝐿

accepts

Call 𝜙 “optimistic proof”

Generically combining

state-of-the-art components:

● Bulletproofs NIZK + Groth16 SNARK

𝑂( 𝐶 )-size circuit

𝑂(𝜆 𝐶 ) group

ops in 𝑉NIZK

some speed-up via multiexp

ops in 𝑉NIZK

𝑂(𝜆2 𝐶 ) group

ops in 𝑃SNARK

ops in 𝑉NIZK

ops in 𝑃SNARK

ops in 𝑉NIZK

ops in 𝑃SNARK

NIZK for R1CS

≈ “arithmetic circuits with bilinear gates”

• a new compilation technique for linear PCPs

NIZK for R1CS

• public coin NIZK from LPCPs ⇒ prudent mode

NIZK for R1CS

• an optimized variant of Bulletproofs’inner product argument

NIZK for R1CS

⇒ 𝑉NIZK has an “algebraic heart”

A special-purpose SNARK

NIZK for R1CS

for “encoded polynomial delegation”, a problem we introduce

NIZK for R1CS

for “encoded polynomial delegation”, a problem we introduce

OurSHARK

NIZK for R1CS

[GGPR12][BCIOP13]

1 Design a proof system sound against linear provers

[GGPR12][BCIOP13]

Design a proof system sound against linear provers

Force prover to be linear using a cryptographic encoding

[GGPR12][BCIOP13]

𝑃𝑥

𝑤𝜋

[GGPR12][BCIOP13]

𝑃𝑥

query sampler

[GGPR12][BCIOP13]

𝑃𝑥

Ԧ𝑞(1), … , Ԧ𝑞(𝑘)query sampler

[GGPR12][BCIOP13]

𝑃𝑥

Ԧ𝑞(1), … , Ԧ𝑞(𝑘)

query sampler

[GGPR12][BCIOP13]

𝑃𝑥

Ԧ𝑞(1), … , Ԧ𝑞(𝑘)

𝑎1, … , 𝑎𝑘

𝑎𝑖 = ⟨ Ԧ𝑞 𝑖 , 𝜋⟩

query sampler

[GGPR12][BCIOP13]

𝑃𝑥

Ԧ𝑞(1), … , Ԧ𝑞(𝑘)

𝑎1, … , 𝑎𝑘

𝑎𝑖 = ⟨ Ԧ𝑞 𝑖 , 𝜋⟩

𝑥state

query sampler

decision predicate

[GGPR12][BCIOP13]

𝑃𝑥

Ԧ𝑞(1), … , Ԧ𝑞(𝑘)

𝑎1, … , 𝑎𝑘

𝑎𝑖 = ⟨ Ԧ𝑞 𝑖 , 𝜋⟩

𝑥state

acc/rej

query sampler

decision predicate

[GGPR12][BCIOP13]

𝑃𝑥

Ԧ𝑞(1), … , Ԧ𝑞(𝑘)

𝑎1, … , 𝑎𝑘

𝑎𝑖 = ⟨ Ԧ𝑞 𝑖 , 𝜋⟩

𝑥state

acc/rej

Can define natural notions of completeness, PoK, ZK.

query sampler

decision predicate

𝑃 𝑉

Observe that 𝑃LPCP does not need to know queries a priori.

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

𝐜𝐦𝜋 ≔ Commit(𝜋)

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

𝐜𝐦𝜋 ≔ Commit(𝜋)2 Pick coins for 𝑄LPCP

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

3 Run:

𝑄LPCPstate

Ԧ𝑞(𝑖)

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

3 Run:

𝑄LPCPstate

Ԧ𝑞(𝑖)

Public-coin so can’t encrypt queries or use functional commitments. [BCIOP13] [LRY16]

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

𝑎𝑖 ≔ ⟨Ԧ𝑞 𝑖 , 𝜋⟩

3 Run:

𝑄LPCPstate

Ԧ𝑞(𝑖)

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

3 Run:

4 Run 𝑄LPCP tocompute state.

𝑄LPCPstate

Ԧ𝑞(𝑖)

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

3 Run:

𝑄LPCPstate

Ԧ𝑞(𝑖)

𝐷LPCP

𝑎𝑖

acc/rej

accepts.

Check that

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

3 Run:

𝑄LPCPstate

Ԧ𝑞(𝑖)…

𝐷LPCP

𝑎𝑖

acc/rej

accepts.

Check that

𝑃 𝑉1 Run:

𝑃LPCP𝑥

𝑤𝜋

3 Run:

5 Check that 𝑎𝑖’s are consistent with 𝐜𝐦𝜋.

𝑄LPCPstate

Ԧ𝑞(𝑖)…

𝐷LPCP

𝑎𝑖

acc/rej

accepts.

Check that

Verifier knows: , 𝑎’s, and commitment to proof 𝐜𝐦𝜋 ≔ Commit(𝜋)

Goal: for every query Ԧ𝑞 check 𝑎 = ⟨ Ԧ𝑞, 𝜋⟩ for a pre-committed 𝜋

Technique: inner-product arguments [BCCGP16,BBBPWM18]

Technique: inner-product arguments

Input: Two vector Pedersen commitments 𝐜𝐦𝒖, 𝐜𝐦𝒗, and 𝑧 ∈ 𝔽.

[BCCGP16,BBBPWM18]

Prove: The decommitments 𝑢, Ԧ𝑣 ∈ 𝔽𝑛 have the specified inner-product 𝑧 = 𝑢, Ԧ𝑣

So the verifier:

[BCCGP16,BBBPWM18]

So the verifier: ● computes commitments to queries: 𝐜𝐦𝑞 ≔ Commit( Ԧ𝑞)

[BCCGP16,BBBPWM18]

● engages in IP arguments for (𝐜𝐦𝑞 , 𝐜𝐦𝜋, 𝑎)

[BCCGP16,BBBPWM18]

Result: NIZK from linear PCPs!

[BCCGP16,BBBPWM18]

Result: NIZK from linear PCPs! SHARK prudent proofs

𝑉NIZK

𝑉● check that LPCP decision

predicate accepts (cheap)

● compute Pedersen commitmentto each LPCP query Ԧ𝑞 (costly)

● check that each inner productargument verifier accepts (costly)

(Not pictured: Fiat-Shamir transform, …)

● check that LPCP decisionpredicate accepts (cheap)

we will make 𝑃SNARK do both

A new building block:“encoded polynomial delegation”

we will make 𝑃SNARK do both

Goal: compute 𝐜𝐦𝑞 ≔ Commit( Ԧ𝑞)

Goal: compute 𝐜𝐦𝑞 ≔ Commit( Ԧ𝑞) 𝑄Ԧ𝑞

Most efficient linear PCP: quadratic arithmetic programs of [GGPR12]

Each query Ԧ𝑞 has nice algebraic structure:

Each query Ԧ𝑞 has nice algebraic structure: 𝜏 =

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝑝𝑖 𝜏 = 𝑝𝑖,0 + 𝑝𝑖,1𝜏 +⋯+ 𝑝𝑖,𝑑𝜏𝑑

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

= ( 𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

= ( 𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝜏 ⋅ ( 𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1)

= ( 𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝜏 ⋅ ( 𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1) +

𝜏𝑑 ⋅ ( 𝑝1,𝑑 , 𝑝2,𝑑 , … , 𝑝𝑛,𝑑)

= ( 𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝐜𝐦𝑞 = Commit(𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝜏 ⋅ ( 𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1) +

𝜏𝑑 ⋅ ( 𝑝1,𝑑 , 𝑝2,𝑑 , … , 𝑝𝑛,𝑑)

= Commit(𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

= ( 𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝜏 ⋅ ( 𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1) +

𝜏𝑑 ⋅ ( 𝑝1,𝑑 , 𝑝2,𝑑 , … , 𝑝𝑛,𝑑)

𝜏 ⋅ Commit(𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1)

= Commit(𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

= ( 𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝜏 ⋅ ( 𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1) +

𝜏𝑑 ⋅ ( 𝑝1,𝑑 , 𝑝2,𝑑 , … , 𝑝𝑛,𝑑)

𝜏𝑑 ⋅ Commit(𝑝1,𝑑 , 𝑝2,𝑑 , … , 𝑝𝑛,𝑑)

𝜏 ⋅ Commit(𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1)

= Commit(𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

= ( 𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)

Ԧ𝑞 = (𝑝1 𝜏 , 𝑝2 𝜏 , … , 𝑝𝑛 𝜏 )

𝜏 ⋅ ( 𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1) +

𝜏𝑑 ⋅ ( 𝑝1,𝑑 , 𝑝2,𝑑 , … , 𝑝𝑛,𝑑)

𝜏𝑑 ⋅ Com(𝑝1,𝑑 , 𝑝2,𝑑 , … , 𝑝𝑛,𝑑)

𝜏 ⋅ Com(𝑝1,1, 𝑝2,1, … , 𝑝𝑛,1)

= Com(𝑝1,0, 𝑝2,0, … , 𝑝𝑛,0)